The press release went out on Wednesday 17 January 2007 and reached the Securities and Exchange Commission as an exhibit to a Form 8-K. The TJX Companies, Inc. Victimized by Computer Systems Intrusion; Provides Information to Help Protect Customers, it was headed. An unauthorised intruder had been inside the systems that handled card, debit, cheque and merchandise return transactions for T.J. Maxx, Marshalls, HomeGoods and A.J. Wright in the United States and Puerto Rico, and for Winners and HomeSense in Canada. The company said it was concerned about T.K. Maxx in Britain and Ireland but had not confirmed an intrusion there, and that Bob's Stores was a possibility. "The full extent of the theft and affected customers is not yet known," the release said.
TJX said it had discovered the intrusion in mid-December 2006, had notified law enforcement immediately — the Department of Justice, the Secret Service and, in Canada, the Royal Canadian Mounted Police — and had kept the matter confidential at their request. Its annual report set the sequence out more precisely: suspicious software was noticed on 18 December 2006; police were brought in on 22 December, at a meeting in Boston attended by the Justice Department, the Secret Service and the United States Attorney's office; and the announcement waited because agents warned that disclosure could damage the criminal investigation. Banks and card processors had been told in late December, with law enforcement's agreement. "Immediately" described the call to the police. Four weeks separated it from the notice to customers.
What customers got that day was a telephone number — 866-484-6978 in the United States, 866-903-1408 in Canada, 0800 77 90 15 in Britain and Ireland — fraud-prevention material on the company's website, and a recommendation to read their statements and report anything unexplained to the bank that issued the card. A relatively small number of names had turned up with driver's licence numbers attached, and those people were being contacted directly. Ben Cammarata, the chairman and acting chief executive, said the company was "deeply concerned about this event and the difficulties it may cause our customers." On scale the release said only that card sales information from 2003, and from mid-May through December 2006, might have been reached.
The absence of a number did not hold. On Wednesday 24 January the Massachusetts Bankers Association said data taken from TJX had already been used for fraudulent debit and credit purchases in Florida, Georgia and Louisiana, and in Hong Kong and Sweden; nearly sixty banks had been contacted by the card companies, out of fewer than half its 205 members reporting. "We expect that this is going to continue and the fraud may widen," its spokesman, Bruce Spitzer, said. A Visa alert dated 15 January, reported by InformationWeek on 29 January, had found TJX storing cardholder data against the card industry's own standard. Its own figure, 45.7 million, came in a filing that March; the banks' count of more than 94 million came in October.
A Subject Line From the News
The windstorm known as Kyrill reached Ireland and Britain on the evening of 17 January 2007 and came ashore on the German and Dutch coasts the following afternoon. At 19:30 that evening Deutsche Bahn halted almost all German train services, trains stopping where they stood; at least forty-four people across Europe were killed. On Friday 19 January the Finnish firm F-Secure began catching mail with the subject line "230 dead as storm batters Europe" — a toll higher than any then reported. Mikko Hyppönen, the company's head of research, put the count at a minimum of 10,000 machines worldwide and said the timing was "particularly clever". The attachment installed a service called wincom32 and joined the computer to a peer-to-peer network with no central controller, each node holding only part of the membership list. Six more waves followed over the weekend. No two vendors agreed on a name — Small.dam and Zhelatin, Peacomm, Nuwar, Dorf, CME-711 — and the trade settled on the storm's. Its summer campaigns, and the quarrel over how large the network really was, belong to July.
A Bug a Day for Apple
Announced on 19 December 2006 through Brian Krebs's Security Fix blog at the Washington Post, the Month of Apple Bugs promised one undisclosed flaw a day through January in Apple's operating system or in software running on it. It was run by a researcher using the name LMH and by the independent researcher Kevin Finisterre, after their Month of Kernel Bugs in November 2006. Apple, press coverage reported, would get no advance notice. LMH said the reaction to David Maynor and Jon Ellch's wireless-driver claims the previous August had played a part: "I was shocked with the reaction of some so-called Apple fans." Apple said it always welcomed feedback on improving security on the Mac. Day one was a buffer overflow in QuickTime 7.1.3's handling of rtsp:// addresses; Apple shipped a fix on 23 January. Landon Fuller, a Darwin developer formerly of Apple's BSD group, ran a counter-project issuing unofficial runtime patches, and LMH offered his group advance notice of each disclosure — measured, he said, in hours rather than days. iTWire counted thirty disclosures on 2 February: twenty-two in Apple software, one officially fixed, a dozen more patched or worked around by the two projects. The last entry was an audio clip.
One Word in Committee Room C
The Standing Committee on Information Technology sat on Monday 29 January 2007 from 1100 to 1300 hours in Committee Room 'C' of Parliament House Annexe, New Delhi. Seven members attended with the chairman, Nikhil Kumar; eleven officials of the Department of Information Technology appeared, led by the secretary, Jainder Singh, with the director general of the National Informatics Centre among them. They gave a slide presentation on the Information Technology (Amendment) Bill, 2006 — introduced in the Lok Sabha on 15 December 2006 and referred to the committee — and took questions; a verbatim record was kept. The Bill came out of an expert committee set up in January 2005; the government had chosen to amend the Act of 2000 rather than write new law because, the report later noted, that required the least effort. The reference, made by the Speaker on 19 December, had allowed three months; the work would run instead to the monsoon session, and the witnesses would include Pavan Duggal, a senior advocate of the Supreme Court.
The argument that ran out of that sitting was about one word. Clause 31 proposed to delete "hacking" from Section 66. Industry witnesses and a retired secretary of the Research and Analysis Wing said deletion would damage enforcement; the department answered that "hacking" was "more a colloquial word" that would "change over a period of time", its substance covered elsewhere. The committee found "no justification in such arguments" and said the word should be kept — a recommendation in the report it presented in September. It lost. Section 66 is now headed "Computer related offences", and the data-protection duties the Bill only gestured at arrived two decades later in the statute our India desk sets out.
The twentieth IJCAI meets in Hyderabad
From 6 to 12 January 2007 the Twentieth International Joint Conference on Artificial Intelligence sat in Hyderabad, the first IJCAI in India in a series that began in Washington in 1969, under the theme "Artificial Intelligence and Its Benefits to Society"; Ramon Lopez de Mantaras chaired it. Alan Bundy of the University of Edinburgh, who works on automated reasoning, took the Award for Research Excellence; the Computers and Thought Award, reserved for researchers under thirty-five, went to Peter Stone of the University of Texas at Austin, for machine learning and multiagent systems. The January issue of Scientific American carried an essay by Bill Gates arguing that robotics resembled the computer business of the mid-1970s and wanted the one thing it lacked, a common software platform; his candidate was Microsoft Robotics Studio, released the previous month. Willow Garage was started that same month, and the platform the field settled on was its Robot Operating System. Microsoft's robotics group was shut down in 2014.
Symantec buys Altiris, Sophos buys Endforce
On Monday 29 January 2007 Symantec said it had agreed to buy Altiris, which sold IT management software for network endpoints — mobile devices, laptops, desktops, servers and storage assets — for $33 a share in cash, about $830 million net of cash acquired, with completion expected in the second calendar quarter subject to regulatory and shareholder approval. "The most secure endpoint is a well-managed endpoint," John W. Thompson, Symantec's chairman and chief executive, said in the announcement; Greg Butterfield, Altiris's president and chief executive, was to head a new Symantec business unit. Eighteen days earlier, on 11 January, Sophos had bought Endforce of Columbus, Ohio, a maker of network access control software, for an undisclosed sum, keeping the Columbus operation and continuing the product under its own brand. Neither purchase added a scanning engine. Both treated the endpoint as a thing to be inventoried and brought into compliance, which is the shape the suites took.
⏳ Time capsule — January 2007
- On 9 January, at Macworld in San Francisco, Steve Jobs unveiled the iPhone. The same day the company dropped "Computer" from its name and became Apple Inc.
- On 10 January, at 03:53 UTC, a PSLV left Sriharikota carrying four satellites: Cartosat-2, the Space Capsule Recovery Experiment, Indonesia's LAPAN-TUBsat and Argentina's Pehuensat-1. The capsule, a test of a reusable thermal protection system and of a deceleration and flotation system, came down in the Bay of Bengal at 04:16 UTC on 22 January after twelve days in orbit and was recovered.
- On 17 January the Bulletin of the Atomic Scientists moved the minute hand of its Doomsday Clock to five minutes to midnight.
- Windows Vista went on sale to consumers on 30 January, after a launch event at the Nokia Theatre in New York the evening before. The first retail sale was in Auckland, a minute after midnight local time.
What a First Announcement Is For
Nineteen years on, the January release reads as the template for a genre. It named the chains, drew a line between what was confirmed and what was suspected, explained the delay by pointing at investigators, offered a helpline, and declined to count. Every element of that is now standard, and so is the sequence it exposed: an attack, a discovery, a notification to police, and — weeks later — a notice to the public, with "immediately" attaching only to the middle step. The figures came afterwards, 45.7 million in March and more than 94 million in October, and criminal charges in August 2008. The method outlasted the count: card data read while it moved rather than lifted from where it sat, which is the shape of January 2009.
The month's other two stories hardened into habits of the trade. Storm established that a botnet with no controller to seize is a different problem from one with a central server, and the year spent arguing about its size without settling anything — the argument itself is July's. The Month of Apple Bugs, the third such month since July 2006, made the disclosure calendar a habit: publish on a schedule, let the vendor read it with everyone else, and measure the response in days. Imitators followed within weeks, and by April the pressure had moved from a mailing list to a stage with a laptop as the prize. Behind this edition the archive runs back through December 2006 to January 2006.