Alistair Darling rose in the Commons on the afternoon of Tuesday 20 November 2007 to say that two discs were missing from HM Revenue and Customs. They held the whole child benefit database: 7.25 million claimant families and, on the BBC's breakdown of the department's figures, 15.5 million children, 2.25 million alternative payees, 12,500 agents and 3,000 appointees — about 25 million people, close to half the United Kingdom. On the discs were the names and addresses of parents and children, the children's dates of birth, the parents' National Insurance numbers and, where the department held them, bank or building society details. "The package was not recorded or registered," the Chancellor said. Paul Gray, HMRC's chairman, had resigned that day, citing a substantial operational failure in the department.
The National Audit Office had taken a copy of the same scan in March, having asked first that the sensitive fields be stripped out; that request was refused, the work being judged too costly, and so when the auditors telephoned again on 2 October they asked simply for the full scan, for continuity with March. The two discs they were sent had been burned by the department's IT contractor EDS on 4 October for a routine compliance scan; a junior official at HMRC's Waterview Park offices in Washington, Tyne and Wear, after a colleague failed to produce fresh copies, put that original set into the department's internal post on 18 October, run by the courier TNT, unrecorded and unregistered. On 24 October the auditors said nothing had arrived; a further set went by internal recorded delivery and reached them the next day. The first set was still missing on 5 November. A security incident was raised on 8 November, Darling was told on 10 November, and the Metropolitan Police were called in on 14 November.
What the Metropolitan Police were looking for was two CDs in cases, inside a jiffy bag, inside a yellow envelope marked "TCO" and addressed to the National Audit Office on Buckingham Palace Road in London. Searching began on 18 November, two days before the statement, with 47 detectives; the number later fell to 32, and computers were examined forensically to check what witnesses had said. Letters went to claimants on 26 November over the signature of Dave Hartnett, the acting chairman: "The copy of the data is still likely to be on Government property." On 5 December the department offered £20,000 for information leading to recovery, aimed mainly at its own staff, who were told that handing the discs to a line manager or union representative would not be an offence.
Nothing was recovered, and the investigation cost £473,544, a figure the Treasury later gave the Commons. Kieran Poynter, chairman of PricewaterhouseCoopers, reported on 25 June 2008 that HMRC's security policies had lacked detail and force, that its rules on removable media and encryption were inadequate, that data had been transferred "with insufficient regard to risk and security", and that there was a "lack of awareness amongst staff of the existence of security policies". He made 45 recommendations, all accepted, and set out ten principles, among them that computers be encrypted so that data "cannot be accessed" if lost or stolen. The Independent Police Complaints Commission, reporting the same day after seven months, found no evidence of misconduct or criminality but called the Washington office's data handling "woefully inadequate" and blamed no individual. Darling apologised "unreservedly".
A Million Machines Counted
On Thursday 29 November 2007 the FBI announced the second phase of Operation Bot Roast, begun that June. Its two headline numbers were floors rather than counts: more than one million victim computers identified, more than $20 million in economic losses. Eight people had by then been charged, had pleaded guilty or been sentenced. Adam Sweaney, 27, of Tacoma, pleaded guilty on 24 September to leasing out control of hundreds of thousands of compromised machines; Jason Michael Downey, 24, of Dry Ridge, Kentucky, was sentenced on 23 October to twelve months; Ryan Brett Goldstein, 21, of Ambler, Pennsylvania, was indicted on 1 November over a denial-of-service attack on a Philadelphia university. John Schiefer, 26, of Los Angeles, had agreed on 8 November to plead guilty to four felony counts; on 4 March 2009 Judge A. Howard Matz gave him forty-eight months, a $2,500 fine and about $20,000 in restitution — the first American guilty plea to wiretapping charges in a botnet case. Robert Matthew Bentley, indicted on 27 November, drew forty-one months and $65,000 in restitution in June 2008 for spreading DollarRevenue's adware from a botnet inside Newell Rubbermaid's European network.
One Password, One List
In the first week of November 2007 Salesforce.com wrote to its customers to tell them a contact list had been stolen. The letter came from Parker Harris, the executive vice-president of technology: an employee had been tricked by a phishing message into giving up a company password, and that password had opened the list — customers' first and last names, company names, email addresses and telephone numbers. No weakness in the application or the database had been exploited, Harris emphasised. The company had begun to suspect something a couple of months earlier, when phishing aimed at its customers rose. What came next was precise. A small number of customers received messages shaped like Salesforce invoices; users at a very small number of them gave up passwords; a later wave carried attachments — viruses, keystroke loggers — to a broader group. Brian Krebs's Security Fix blog at the Washington Post had already tied targeted phishing to a stolen database in late October, before the company said anything; Bruce Schneier, writing on 8 November, connected the stolen addresses to a round of fake emails purporting to come from the Federal Trade Commission. Asked by ZDNet on 7 November whether British customers were affected, or any employee disciplined, the company would not say.
A Licence for the Plumbing
On Monday 26 November 2007 the Lok Sabha passed the Payment and Settlement Systems Bill, introduced on 25 July 2006 and reported on by the Standing Committee on Finance, under Major General B. C. Khanduri, on 16 May 2007. The Rajya Sabha passed it on 3 December, the President assented on 20 December, and it came into force on 12 August 2008. It made the Reserve Bank of India the authority over payment systems. Nobody could operate one without the Bank's authorisation; a refusal had to be in writing, with reasons; the Bank could prescribe message formats, timings and membership criteria, issue directions, call for information, inspect and audit; and netting and settlement finality acquired a statutory footing.
Section 18, the power to issue written directions in the public interest, became the instrument of payment security in India. The Bank's circular of 18 February 2009 — RBI/2008-2009/387, issued under that section, and warning that non-adherence would attract penalties under the Act — required banks to add authentication based on information not visible on the card to every online card-not-present transaction, and online alerts on such transactions of ₹5,000 and above, from 1 August 2009; transactions placed through interactive voice response were left out, pending separate instructions. The National Payments Corporation of India, incorporated on 19 December 2008 under the same Act and promoted by the Bank and the Indian Banks' Association, went on to run the shared ATM switch and to build IMPS, RuPay and UPI, which carried 24.07 billion transactions worth ₹29.37 lakh crore in September 2026, about 802 million a day. The fraud our India desk now writes about works on the person holding the phone, not on the card.
Boss wins the Urban Challenge
On Saturday 3 November 2007 eleven driverless vehicles entered mock suburban traffic at the former George Air Force Base in Victorville, California, for the final of DARPA's Urban Challenge. Unlike the desert runs of 2005, this course required merging, queueing at four-way stops, parking and obedience to California's traffic code, each mission scored on elapsed time adjusted for delay, rule violations and dangerous behaviour, with six hours the limit for an official finish. Six finished, and the order was settled overnight on the judges' scorecards. Carnegie Mellon's Tartan Racing, run with General Motors, took the $2 million first prize with Boss, a modified Chevrolet Tahoe that averaged about fourteen miles an hour; Stanford's Junior, a Volkswagen Passat, took $1 million and Virginia Tech's Odin, a Ford Escape, $500,000 — ten days before Netflix gave its 2007 progress prize to the team entering as KorBell. The Challenge's lasting yield was its alumni: Tartan Racing's technical director, Chris Urmson, went to Google's self-driving car project, took it over from Stanford's Sebastian Thrun in 2013 and left in 2016, the year it became Waymo.
Symantec borrows to buy Vontu
Symantec said on 5 November 2007 that it would buy Vontu, whose software found confidential records where they should not have been and stopped them leaving by mail, web or instant message, and the deal closed on 30 November. Symantec's quarterly filing is the plainest account: an aggregate purchase price of approximately $316 million, of which about $298 million was cash net of the cash Vontu held and some $13 million assumed equity awards, with $259 million booked as goodwill — and, the day before completion, a $200 million draw on its billion-dollar revolving credit facility. The promise that Vontu would go on as a self-governing unit drew scepticism from analysts with long memories of Symantec's earlier purchases. It was the second of the autumn's big purchases of something other than a scanner, after McAfee's move into encryption the month before. Data loss prevention is now a line in every endpoint suite rather than a company anyone buys.
⏳ Time capsule — November 2007
- On 5 November Google and the Open Handset Alliance announced Android, a joint effort in handheld computing by a group of handset makers, chipmakers and network operators.
- On 19 November Amazon began selling the Kindle, a wireless reading device that did much to make electronic books ordinary.
- On 24 November Australia's federal election produced a swing of more than five per cent to Labor and Kevin Rudd as prime minister; John Howard conceded by telephone and looked likely to lose his own seat as well.
- From 22 to 26 November, in the first Test against Pakistan at the Feroz Shah Kotla in Delhi, India won by six wickets after Pakistan made 231 and 247; Anil Kumble was player of the match, and Sohail Tanvir made his Test debut. The series ended 1–0.
What the Discs Changed
The Information Commissioner had almost no teeth in November 2007. He could take formal enforcement action, and he did, against HMRC and the Ministry of Defence over what he called "deplorable failures at both", requiring published progress reports at twelve, twenty-four and thirty-six months; but he could not fine. Section 55A of the Data Protection Act 1998, inserted by the Criminal Justice and Immigration Act 2008, gave him the power to serve a monetary penalty notice from 6 April 2010, capped by regulations at £500,000; under the legislation that replaced it the ceiling runs into the tens of millions. Encrypting removable media stopped being a policy and became a default. The Ministry of Defence laptop is January 2008; the review of data handling across government is June 2008.
Bot Roast's lasting contribution was arithmetic — a federal agency counting infected machines and telling their owners, a habit that outlived the cases and shaped the takedowns of November 2008 and January 2009. Schiefer's wiretap count, once a novelty, is now unremarkable: intercepting a victim's traffic is what this software is for. And Salesforce's letter described, in 2007, the attack that has since become the common one against a software service — not a flaw in the code but a password taken from a person, and then the tenant's own data used to make the next message convincing. The discs, meanwhile, have not turned up.