On 28 November 2010 the New York Times, the Guardian, Der Spiegel, Le Monde and El País began publishing stories drawn from 251,287 dispatches sent by more than 250 American embassies and consulates, and WikiLeaks posted the first 220 cables themselves; the Times had its copy from the Guardian. The cables were dated between December 1966 and February 2010. Around 15,000 were marked secret, some 100,000 confidential and more than 130,000 unclassified; none was top secret. On 26 November WikiLeaks, through its lawyer, had invited the State Department to say which disclosures might harm individuals. The department's legal adviser, Harold Koh, replied the next day: "We will not engage in a negotiation regarding the further release or dissemination of illegally obtained U.S. Government classified materials."
The cables carried the marking SIPDIS, for SIPRNet distribution: they had been posted to the State Department's Net-Centric Diplomacy database, which could be reached over SIPRNet, the Defense Department's secret-level network. The number of people cleared to use SIPRNet was put in that week's reporting at more than three million. The arrangement belonged to the years after 11 September 2001, when, as the department's under secretary for management, Patrick Kennedy, later told the Senate, "the focus was on providing technical solutions to information sharing." It was one channel among several: Kennedy said some 250,000 cables had been posted to the database, while 2.4 million, ten times as many, went out in the same period through other systems to 65 agencies.
How they left was partly on record. On 27 May an army intelligence analyst at Forward Operating Base Hammer, near Baghdad, was arrested after online chats with Adrian Lamo, a hacker who reported the analyst to investigators and gave the logs to Wired, which published excerpts in June. In the logs the analyst spoke of coming in "with music on a CD-RW labelled with something like 'Lady Gaga'". At her court martial in February 2013 Chelsea Manning gave her account: an officer had emailed the link to the cables portal around her section in late December 2009; she downloaded the cables with Wget, a standard downloader, from 28 March to 9 April 2010, copied them to a rewritable CD and on 10 April uploaded them to WikiLeaks from her own computer.
Washington's first answers were about access. Jacob Lew, director of the Office of Management and Budget, dated a memorandum 28 November telling every agency that handled classified information to form a security assessment team and check "that users do not have broader access than is necessary to do their jobs effectively". The same day the Pentagon listed what it had ordered since Robert Gates commissioned two reviews in August, after the Afghan war logs of July: writing to removable media disabled on classified computers, two-person rules for moving data to unclassified systems, and monitoring for anomalous behaviour "similar to procedures now being used by credit card companies". The State Department suspended SIPRNet access to its database; its spokesman, P.J. Crowley, said the connection had been "temporarily severed".
Eighteen Minutes in April
On 17 November 2010 the US-China Economic and Security Review Commission published its annual report, which said: "For about 18 minutes on April 8, 2010, China Telecom advertised erroneous network traffic routes", adopted elsewhere, "routing all traffic to about 15 percent of the Internet's destinations through servers located in China", Senate, military and NASA sites among them. The Commission had "no way to determine what, if anything," was done with the data; headlines made it 15 per cent of the world's traffic. China Telecom, in an email to Reuters, denied any hijack. Researchers disputed the headlines and one another. BGPmon, which flagged the event on the day, counted some 37,000 prefixes from a network that normally announced about 40, around 11 per cent of the table, and asked why an attacker would hijack China's own address space. Arbor Networks' Craig Labovitz, drawing on traffic data from 80 providers, saw "no statistically significant increase" in traffic to China Telecom's networks. A 2013 study by Rahul Hiran, Niklas Carlsson and Phillipa Gill found some traffic had indeed flowed through China Telecom's network and out to its destination, and that data alone could not tell accident from intent.
Between 807 and 1,210 Hertz
On 12 November 2010 Eric Chien of Symantec wrote that tips from a Dutch Profibus expert had "connected a critical piece of the puzzle". Stuxnet, its purpose argued over since September, was hunting frequency converter drives, which set the speed of electric motors, from two makers Symantec identified as Vacon of Finland and Fararo Paya of Tehran. It acted only when they ran between 807 and 1,210 hertz, and over months briefly shifted their output to 1,410 hertz, then 2, then 1,064. Drives above 600 hertz, Symantec noted, were export-controlled in the United States because they could serve uranium enrichment, though it did not know every application at such speeds. On 16 November International Atomic Energy Agency inspectors saw enrichment at Natanz halted; the agency's report a week later gave no reason. On 29 November President Mahmoud Ahmadinejad told reporters, as Reuters rendered it: "They succeeded in creating problems for a limited number of our centrifuges with the software they had installed in electronic parts." He did not name the software. Nobody attributed the worm on the record that year; the reporting that did came in January 2011 and June 2012.
Recorded for a Tax Inquiry
In November 2010 the magazine Open, and two days later Outlook, published transcripts of telephone calls between the corporate lobbyist Niira Radia and politicians, journalists, industrialists and officials; Outlook added audio of some 140 conversations. The recordings were the Income Tax department's. A complaint to the finance minister on 16 November 2007 had alleged that Radia had built a Rs 300 crore business in nine years and was an agent of foreign intelligence agencies. The Director General of Income Tax (Investigation) proposed surveillance, and the Union Home Secretary, the official the Telegraph Rules require to sign interception orders, approved it. Her phones were tapped in two spells between August 2008 and July 2009, and copies of about 5,800 calls later went to the Central Bureau of Investigation. In December the tax department told the Supreme Court that it could not practically retrieve the copies in circulation, and ruled out its own offices as the source.
On 29 November Ratan Tata, then chairman of the Tata group and one of those heard talking to Radia, petitioned the Supreme Court. The leak, he argued, infringed his right to privacy under Article 21; he asked the court to have the recordings retrieved, the leak investigated and further publication stopped, in print or as audio on the internet. In October 2013 the court, in the proceedings on his petition, directed the CBI to examine issues the conversations raised. In September 2022 the CBI told it that fourteen preliminary inquiries had found no criminality, and an Additional Solicitor General suggested the petition could be settled in the light of the judgment of August 2017 that made privacy a fundamental right.
Six days to an open Kinect driver
Microsoft put the Kinect on sale in North America on 4 November 2010, at $149.99 alone or $299.99 with a 4GB Xbox 360: an infrared depth camera built on a design licensed from PrimeSense of Tel Aviv, a colour camera and a microphone array, with software that read players' bodies and voices in place of a controller. By 29 November Microsoft counted more than 2.5 million sold worldwide. On launch day Adafruit Industries offered $1,000 for an open-source driver; when Microsoft told CNET it would work with law enforcement to keep the sensor "tamper-resistant", the prize rose, reaching $3,000. It was claimed on 10 November, three hours after the European launch, by the Spanish hacker Hector Martin, whose driver brought the depth and colour images into a Linux laptop. On 19 November Microsoft's Alex Kipman told NPR's Science Friday that the Kinect had not been hacked: its USB connection had been left unprotected by design. Microsoft showed its own SDK in April 2011, and Apple bought PrimeSense in 2013.
Security Essentials offered through Microsoft Update
In the first week of November 2010 Microsoft began offering Security Essentials, its free anti-virus program, to American users of Windows XP, Vista and 7 as an optional update, after a similar start in Britain on 19 October. The offer appeared only on genuine copies of Windows with no detectable anti-virus product. Trend Micro's Carol Carpenter said that commercialising Windows Update raised "significant questions about unfair competition". Panda Security's Luis Corrons asked Microsoft to push every free anti-virus product, not just its own, on the model of the browser ballot it had agreed with the European Commission. Microsoft answered that the offer came through Microsoft Update, an opt-in service distinct from Windows Update, a distinction Trend Micro said most consumers would miss. AVG, Avira and Avast did not complain. On 1 November Webroot bought Prevx, a cloud-based anti-malware firm in Derby, and days later AVG agreed to buy DroidSecurity of Tel Aviv, whose free Android scanner had passed 4.5 million downloads. Prevx's technology underpinned Webroot SecureAnywhere, launched in October 2011; Webroot's own sale is February 2019's story.
⏳ Time capsule — November 2010
- On 8 November Barack Obama, who had arrived in India two days earlier, told a joint session of Parliament in New Delhi that he looked forward to "a reformed United Nations Security Council that includes India as a permanent member".
- On 13 November Aung San Suu Kyi was freed and appeared before supporters at her house in Rangoon, six days after a widely criticised general election; she had been detained for 15 of the previous 21 years.
- On 16 November the Beatles' thirteen remastered studio albums, the two volumes of Past Masters and the Red and Blue collections went on sale on iTunes worldwide; Apple counted more than 450,000 albums and two million songs sold in the first week.
- On 28 November the European Union approved an €85 billion rescue package for Ireland, a week after the finance minister, Brian Lenihan, had asked for international help.
The month access became the story
The cables did not stay edited. In February 2011 two Guardian journalists printed in a book the passphrase to an encrypted copy of the whole file, which one of them had been given by Assange in 2010 and understood to be temporary; on 2 September 2011 WikiLeaks published all 251,287 cables unredacted, and its five partner newspapers said jointly that they deplored the decision. The Hindu had begun publishing India's share, about 5,100 cables, in March 2011. Chelsea Manning was convicted on 30 July 2013 of offences that included espionage, acquitted of aiding the enemy, and sentenced on 21 August to 35 years; President Obama commuted the sentence on 17 January 2017, and she was released that May. What hosting and payment companies did about WikiLeaks belongs to December.
Access was rebuilt around distrust of the insider. In March 2011 the Pentagon told the Senate it had disabled writing to removable media on all its SIPRNet machines except about 12 per cent kept for operational reasons, largely in deployed areas, with kiosks and a two-person rule for moving data, and Executive Order 13587 of 7 October 2011 created an Insider Threat Task Force to build a government-wide programme for "deterring, detecting, and mitigating insider threats". Neither prevented the disclosures of June 2013, by a contractor working for the National Security Agency, nor the CIA files WikiLeaks began publishing in March 2017. In India, Tata's petition was still before the Supreme Court in 2022, five years after it held privacy to be a fundamental right and a year before the country passed its first data protection law.