The Sidekick was sold on a promise about where things lived. Danger, the company that designed it — its screen swung round on a hinge to uncover a thumb keyboard — kept each owner's contacts, calendar, notes and photos on its own servers, and the handset held a working copy: lose the phone, sign in on a new one, and everything came back. T-Mobile sold it in the United States, and Microsoft had bought Danger in 2008. On Friday 2 October 2009 the service failed. Calls and text messages still went through; email and the web, which needed Danger's servers, were out for more than a week. T-Mobile's instruction to customers put two words in capitals: "DO NOT remove your battery, reset your Sidekick, or allow it to lose power."
The bad news came on Saturday 10 October. Citing Microsoft and Danger's latest recovery assessment, T-Mobile told customers that personal information "that is no longer on your Sidekick almost certainly has been lost as a result of a server failure at Microsoft/Danger". The qualifier mattered: whatever survived in a handset's memory was now the only copy. By the Monday T-Mobile had stopped selling Sidekicks online and in some shops; to a month of free data service it added a $100 card for anyone with a significant and permanent loss. Unconfirmed reports said the failure had come during work on Danger's storage network contracted to Hitachi Data Systems, without a backup; anonymous insiders told AppleInsider of possible sabotage. Hitachi said the cause had not been identified.
Then the story turned. On 15 October Roz Ho, Microsoft's corporate vice-president for premium mobile experiences, wrote that the company had "recovered most, if not all, customer data for those Sidekick customers whose data was affected", and that they were a minority of users — how many, neither company said, out of a customer base press reports put at nearly 800,000. The outage, she wrote, had been caused by "a system failure that created data loss in the core database and the back-up"; engineers had rebuilt the system "component by component, recovering data along the way", and begun a more resilient backup process. She mentioned neither Hitachi nor sabotage. Steve Ballmer, the chief executive, called the episode "not good", and said it was "not clear there was data loss".
Lawsuits filed from 14 October argued that the companies had promised to back up customers' data automatically and had failed to; in February 2011 plaintiffs asked for final approval of a settlement with T-Mobile. By mid-November Microsoft had restored most of what was missing, and on 17 November T-Mobile put the Sidekick back on sale. The service did not last. Microsoft's successors to the Danger phones, the Kin, were announced in April 2010 and dropped within months; in March 2011 T-Mobile said that Danger's servers would stop on 31 May, a joint decision with Microsoft, and offered owners a tool to export their data. The Sidekick name returned that spring on a Samsung handset running Android, which Andy Rubin, one of Danger's founders, had gone on to build.
A Hundred Defendants
On 7 October 2009 federal prosecutors and the FBI in Los Angeles announced Operation Phish Phry: a 51-count indictment naming 53 people in the United States, 33 of them already arrested, and charges against 47 more in Egypt. Prosecutors said hackers in Egypt had emailed customers of Bank of America and Wells Fargo in the banks' guise, collected account numbers and passwords through counterfeit sites, and moved money into accounts opened by American recruits, who drew it out and wired a share back — at least $1.5 million, by that week's reports. The inquiry, begun in 2007, was the two countries' first joint cyber investigation. The FBI's Keith Bolcar said the defendants' sophistication represented "an evolving and troubling paradigm in the way identity theft is now committed". Its record was headcount: by the Justice Department's count, the most defendants ever charged in a cybercrime case. In June 2011 the lead defendant, Kenneth Joseph Lucas II, was sentenced to eleven years for the fraud, thirteen with a separate drug case, and 47 people had been convicted in federal court. The American releases do not say how the Egyptian cases ended.
Ten Thousand on Pastebin
Neowin, a technology site, first reported that usernames and passwords for Hotmail, Live.com and MSN accounts had been posted on Pastebin, a public text-sharing site. On 5 October 2009 The Register counted 10,028 pairs, every address beginning with A or B, on pages at least one of which had gone up on 1 October; a cached copy was nearly a week older. Microsoft asked for them to be taken down and said it had "determined that this was not a breach of internal Microsoft data": several thousand customers' credentials had been exposed through a likely phishing scheme, and it did not store passwords in plain text. The next day the BBC reported a second list of more than 20,000 on the same site, taking in Gmail, Yahoo, AOL, Comcast and EarthLink; some entries were old or fake, many genuine. Google spoke of "an industry-wide phishing scheme" and forced password resets; Yahoo said "a limited number of Yahoo! IDs" had been made public. Whether the lists shared a source was unclear. Acunetix, going through the Hotmail list, found 123456 sixty-four times, and 42 per cent of passwords in lower-case letters alone.
The Amendment Takes Effect
The Information Technology (Amendment) Act, 2008 came into force on 27 October 2009, ten months after Parliament passed it — the Lok Sabha without debate — and nearly nine after President Pratibha Patil signed it. Rules for its surveillance powers were notified the same day. Section 69 was rewritten: the power to order interception passed from the Controller of Certifying Authorities to the Central and state governments and widened to monitoring and decryption, with up to seven years for a subscriber or intermediary who refused to help. The rules gave it to the Union Home Secretary, or a state's, rather than a judge; on 18 January 2010 CERT-In's director general, Gulshan Rai, was writing to tell Orissa's home department that the Act was in force. It was the power behind the 2010 demands on encrypted services and the ten-agency order of 2018.
Section 66A made it an offence, punishable by up to three years and a fine, to send by computer or phone anything "grossly offensive" or of "menacing character", or known to be false and sent to cause annoyance or inconvenience. A third clause covered email meant to mislead a recipient about where it came from — the month's phishing, in statutory form. This archive follows the first two through arrests in April and November 2012 to the Supreme Court in March 2015. Section 43A made a company handling sensitive personal data liable to compensate anyone harmed by its negligent security. What that data was waited for rules issued in April 2011, passwords first on the list; the Digital Personal Data Protection Act of 2023 removes the section from May 2027, and what replaces it is set out on our India desk.
Flu Trends adds sixteen countries
On 8 October 2009 Google took Flu Trends, which estimated influenza from flu-related searches, beyond the United States, Mexico, Australia and New Zealand to sixteen more countries, among them Canada, Japan, Russia and much of Europe, and into 37 languages. Its engineers, Matt Mohebbi and Dan Vanderkam, left out terms such as swine flu, which people typed to follow the headlines rather than because they were ill. The American model had been rebuilt on 24 September, after the original underestimated the H1N1 pandemic's first wave. On 27 October Similar Images, which found pictures resembling a chosen one, became the first major feature to graduate from Google Labs since its April overhaul; Wolfram|Alpha's iPhone app went on sale that month at $49.99, cut to $1.99 the next April. Flu Trends did not last. In February 2013 Nature reported it estimating more than double the share of doctor visits for flu-like illness recorded by the Centers for Disease Control and Prevention, and in August 2015 Google stopped publishing the estimates.
Eleven of twenty-six fall to Virut
On 9 October 2009 Virus Bulletin reported that eleven of twenty-six products had failed its October VB100 test on Windows Server 2008, every failure owing at least in part to two variants of W32/Virut on the WildList, the register of malware reported in circulation. Virut spread aggressively and changed its appearance with each infection, and the lab had generated samples in large numbers; it was the same family that had ended Symantec's run of passes in August. Avira missed a single sample, a miss so rare the score table was widened to show it; Sophos also missed one, and its developers traced it to a few days around the submission deadline when detection of a tiny share of Virut samples had broken. "A single miss is all it takes," wrote John Hawes, the test director, conceding that some vendors might feel hard done by. AhnLab, Fortinet, Kingsoft and Frisk's F-PROT also failed; Symantec, McAfee, Kaspersky, Microsoft's Forefront and India's Quick Heal and K7 passed. Virut kept spreading: on 17 January 2013 Poland's domain registry, NASK, took over 23 domains used to control it.
⏳ Time capsule — October 2009
- On 2 October the International Olympic Committee, meeting in Copenhagen for its 121st session, chose Rio de Janeiro for the 2016 Summer Games, beating Madrid by 66 votes to 32 in the final round after Chicago had gone out first with 18. Rio became the first South American city chosen to hold them.
- On 7 October Venkatraman Ramakrishnan, born in Chidambaram in 1952 and a physics graduate of the Maharaja Sayajirao University of Baroda, was named with Thomas Steitz and Ada Yonath for the Nobel Prize in Chemistry, for their work on the structure and function of the ribosome. He was a group leader at the Medical Research Council's Laboratory of Molecular Biology in Cambridge.
- On 9 October the Norwegian Nobel Committee, chaired by Thorbjørn Jagland, awarded the Peace Prize to Barack Obama "for his extraordinary efforts to strengthen international diplomacy and cooperation between peoples". Nominations had closed on 1 February, less than two weeks after his inauguration; he said he was surprised and deeply humbled.
- On 22 October Windows 7 went on general sale, three months to the day after its release to manufacturing. By April 2010 Microsoft said more than 100 million licences had been sold, the fastest of any operating system it had made.
Who keeps the copy
October 2009 gave the argument about where data should live what was described at the time as the biggest disaster in cloud computing's short history, then, five days later, Microsoft's word that most of it had been recovered. The Sidekick treated the server as safe and the handset as fragile; for a fortnight it ran the other way. The design won anyway: the smartphones that followed keep contacts and photos the same way, a working copy in the hand and the master on a server. The lessons were about copies and concentration rather than clouds: Code Spaces closed in June 2014 because its offsite backups could be deleted from the same console as production, and Amazon's storage in Northern Virginia went dark in February 2017; the same region failed again in October 2025.
The other two stories came through the front door, which has not been bricked up. Phish Phry needed hands as much as skill: writers of convincing emails in Egypt, and in America people willing to open accounts and draw the money out. Mules were the target again when police in three countries moved against Zeus in October 2010, and almost all those arrested after Pune's Cosmos Bank cash-out in August 2018 were mules. The Hotmail list's favourite password, 123456, turned up more than 3,000 times in Gawker's in December 2010 and close to two million times in Adobe's in October 2013. The answer, when it came, was not a better password but one that cannot be typed into a counterfeit page: the passkey, shipped by the large platforms from 2022.