David Petraeus went to the White House on the afternoon of 8 November 2012 and asked to be allowed, for personal reasons, to resign as director of the Central Intelligence Agency. The President accepted the next day, and in a message to the agency's workforce Petraeus wrote that he had shown "extremely poor judgment" in an extramarital affair. What belongs in this magazine is not the affair but the means by which the head of an intelligence service was found out, by an investigation that had not been looking for him. It had opened in May 2012, when a woman in Tampa, Florida took a handful of anonymous, harassing emails to an FBI agent she knew. The account that sent them had been registered under no usable name.
A name was not required. Each time the account was used, its provider recorded the internet address it had been reached from, and the hour; several of those addresses belonged to hotel networks. Agents took the dates to the hotels, asked for the guest lists and looked for a name on more than one: by the second or third hotel, as Christopher Soghoian of the American Civil Liberties Union set out on 13 November, the overlap is likely to be one person. The New York Times described a second method beside it, checking which other accounts had been opened from the same address. Under the law as it stood, records of that kind could be had on a subpoena, without a judge. Both roads led to Petraeus's biographer, Paula Broadwell.
Her own mail carried the next step: messages from an account under a pseudonym, which investigators had worked out by the end of the summer belonged to the director. The Associated Press, citing a law-enforcement official, then described the arrangement the two had used. At least some messages were composed in a shared Gmail account and left in the drafts folder rather than sent, for the other to log in and read where they lay; nothing passed between two inboxes. The purpose is to leave no transmission to intercept, and it fails exactly where the hotels did. A draft rests on the provider's servers as any message does, and every login to write one or read it leaves an address and a time behind.
The FBI told the Director of National Intelligence, James Clapper, on the evening of 6 November, election day. On 14 November the President said he had seen no evidence that classified information had been disclosed in a way that harmed national security. That lasted two and a half years. On 23 April 2015, in a federal court at Charlotte, Petraeus pleaded guilty to a misdemeanour of unauthorised removal and retention of classified material: eight notebooks holding covert officers' names, war strategy and notes of talks with the President, lent to his biographer in 2011 and denied to FBI agents that October. He was given two years' probation and fined $100,000, against $40,000 in his plea agreement. Nobody was charged over the emails that started it: prosecutors in Tampa declined the case that December.
Attempts, and a country switched off
Israel's operation in Gaza opened on 14 November 2012 with the killing of Hamas's military chief, Ahmed Jabari, and closed in a ceasefire on the 21st; a UN Human Rights Council report the following March counted 174 Palestinians killed, 107 of them civilians, and six Israelis. On 18 November the finance minister, Yuval Steinitz, whose ministry defends the government's websites, said they had taken more than 44 million hacking attempts since the operation began. Attempts, not intrusions, and his own count: one succeeded, he said, on a site he would not name, which was back inside ten minutes. Anonymous published under the OpIsrael banner a list of nearly 700 Israeli sites it claimed to have defaced or downed. Eight days after the ceasefire a state left the network entirely. At 10:26 UTC on 29 November, Renesys reported, all 84 of Syria's address blocks became unreachable; CloudFlare watched routes withdrawn provider by provider in two minutes, and noted that Syria's four cables — three landing at Tartous, one overland into Turkey — would have had to fail together. Syria's information minister said terrorists had cut the lines, not the government. Service began returning on 1 December.
One clicked link, three months
On 20 November 2012 South Carolina's governor, Nikki Haley, released Mandiant's account of how the state's Department of Revenue lost the tax records of 3.8 million people. A phishing email reached several employees on 13 August and at least one clicked it; on 27 August an intruder used that employee's credentials on the department's Citrix remote access; on 12 September database backups were copied to a staging directory, then compressed into encrypted archives and sent out, 74.7 gigabytes unpacked. The department learned of it on 10 October, when a law-enforcement agency arrived with three people's stolen records; the state made it public on 26 October, counting 3.6 million Social Security numbers. They were not encrypted, nor were some 3.3 million bank account numbers. Haley said the state could have done better, blamed ageing systems and federal guidance that did not require encryption, and announced the revenue director's resignation. A week earlier Adobe had taken its Connect users' forum offline after a hacker calling himself ViruS_HimA claimed about 150,000 accounts from it; Adobe confirmed the compromise and reset the passwords, kept as MD5 hashes, without putting a figure of its own to the loss.
The post, the like and the section
Bal Thackeray, founder of the Shiv Sena, died in Mumbai on 17 November 2012, and the city closed for his funeral the next day. That Sunday a young woman in Palghar, then in Thane district, wrote on Facebook that the shutdown owed more to fear than respect; a friend liked it. Both were arrested on 19 November — first under section 295A of the Penal Code, then under section 505(2) with section 66A of the Information Technology Act, which punished sending by computer information that was grossly offensive or menacing — and released on bail. A clinic belonging to one woman's uncle was ransacked. Markandey Katju, chairman of the Press Council, wrote to the chief minister demanding action against the officers; on 27 November the home minister, R.R. Patil, announced the suspension of the Thane rural superintendent of police and a senior inspector, and the Bombay High Court moved the magistrate who remanded them. The police said no charge sheet would follow.
The petition came within days. On 29 November a law student, Shreya Singhal, had hers mentioned before Chief Justice Altamas Kabir, who agreed to hear it next day; on 30 November the Court issued notice to the Union government and Maharashtra. Before the month ended the Centre had announced that no arrest under the section should be made without the prior approval of an officer of at least deputy commissioner rank in the districts, or inspector general rank in the metros — the requirement the advisory of 9 January 2013 put to the states, and which the Supreme Court told them to follow in May 2013. None of it touched the words of the section. That waited until 24 March 2015.
Weapons that choose their own targets
On 19 November 2012 Human Rights Watch and Harvard Law School's International Human Rights Clinic published Losing Humanity: The Case against Killer Robots, fifty pages urging a pre-emptive treaty ban on weapons that could pick out and fire on targets on their own. Two days later the deputy secretary of defence, Ashton Carter, signed Directive 3000.09, requiring that American weapons with autonomy let commanders and operators exercise "appropriate levels of human judgment over the use of force"; any that would select and engage targets unaided, beyond narrow exceptions, needed two under secretaries and the chairman of the Joint Chiefs to approve them before development and again before fielding. Human Rights Watch later called it the first such policy of any country. In the laboratories, IBM reported simulating 530 billion abstract neurons on Lawrence Livermore's Sequoia; Spaun, from Waterloo, published in Science on 30 November, had 2.5 million and could read handwritten digits and write its answers with a simulated arm. The directive was revised in January 2023; a treaty ban is still being argued over in Geneva.
Sophos taken apart in public
On 5 November 2012 Tavis Ormandy, a Google security engineer, published Sophail: Applied attacks against Sophos Antivirus, his second paper on the product. Anti-virus products, he wrote, by design "introduce a vast attack surface to a hostile environment". Sophos's parsers for PDF, Visual Basic 6, CAB and RAR files were flawed, and he built an exploit from the PDF overflow that needed no click and could spread itself by email; a buffer-overflow guard, meanwhile, undid the address randomisation Windows had offered since Vista. He advised keeping the product off high-value networks. Sophos, sent a draft on 10 September, had shipped fixes on 22 October and 5 November, promised the last for 28 November, and said none had been exploited in the wild. On 8 November Symantec's Ransomware: A Growing Menace estimated, conservatively, that ransomware posing as the police was earning more than $5 million a year for gangs already known for banking trojans and fake anti-virus; up to 2.9 per cent of victims paid. Ormandy turned the same method on much of the industry by June 2016.
⏳ Time capsule — November 2012
- On 6 November Barack Obama was re-elected President of the United States, taking 332 electoral votes to Mitt Romney's 206 and 51.1 per cent of the popular vote against 47.2.
- On 13 November Jab Tak Hai Jaan opened in cinemas — the last film directed by Yash Chopra, who had died on 21 October at the age of eighty.
- On 15 November, the day after the Chinese Communist Party's 18th National Congress closed, the first plenary session of its new Central Committee elected Xi Jinping general secretary and chairman of the party's Central Military Commission; the Politburo Standing Committee was cut from nine seats to seven.
- On 26 November the Aam Aadmi Party was formally launched by Arvind Kejriwal and colleagues out of the anti-corruption movement of 2011, its constitution adopted two days earlier; it formed its first government in Delhi in December 2013.
What the login records held
The lesson was not that a spy chief had been careless with webmail. It was that a handful of ordinary records — which address, at what hour, from which hotel — was enough to undo him, and could be had without a judge. Three weeks later, on 29 November, the Senate Judiciary Committee approved Patrick Leahy's amendment requiring a warrant for the content of email whatever its age. It went no further. The House passed an Email Privacy Act 419 votes to none in April 2016 and again in 2017; neither became law, and the 180-day line of 1986 stands in 2026. What changed was scale: by June 2013 the same class of record — who contacted whom, and when — was being surrendered daily for an entire telephone network.
The rest of the month reads now as first drafts. The two months between the clicked link in South Carolina and the call from a law-enforcement agency are the gap every detection programme since has been built to close. Adobe's 150,000 forum hashes were a rehearsal for the 38 million accounts it lost in October 2013. OpIsrael returned each spring, beginning on 7 April 2013 (April 2013), and counting attempts, which measures noise at a firewall rather than loss, survives in official figures. Syria's blank hour on 29 November was a demonstration rather than a fault: the national shutdown became an instrument of ordinary government, and the longest a democracy has imposed began in Kashmir in August 2019. Section 66A was struck down, and went on being used for years after.