2016 in the archive: the year with a hole in it

Three months holding 148 entries, at 49 a month, in a year running at 237 a month everywhere else. If those months would otherwise have matched the rest, roughly 563 entries are absent — about a fifth of what the year should contain.

That figure rests on an assumption and cannot do otherwise. Nothing inside a record reports what is not in it, so the size of an absence has to be inferred from what surrounds it. The estimate would be wrong if those three months had genuinely been quiet, and there is no version of this calculation that does not require assuming they were not.

What makes the assumption defensible is the recovery. The month after the gap returns to 195 and the one after that to 201, both close to the year's ordinary level. A real reduction in activity does not end on a particular date and resume at its previous rate, and the sharpness of both edges is what distinguishes a gap in collection from a change in the world.

A second check points the same way, and it turns on how the thinning is distributed. A genuine lull is always selective: conference-driven material vanishes first, seasonal campaigns disappear, anything pegged to a product launch calendar goes with them, while the steady background carries on much as before. What survives inside these three months is nothing so uneven. It is a proportional slice, with the familiar categories sitting at close to the weights they hold elsewhere in the year. Uniform thinning across unrelated topics is the fingerprint of subtraction; selective thinning is the fingerprint of a quiet spell, and the second is simply not present.

The gap was found by looking at the shape rather than by reading anything. That is the only way it could have been found, and it is the reason the shape gets looked at first on every page in this series.

This is the part that resists the comfortable explanation. Inside the gap, 82% of entries carry a written summary. Outside it, 24%. The months with a fifth of the volume have more than three times the descriptive coverage.

If the record had simply been running badly for a quarter — an interruption, a lapse in attention, a system not working — the entries captured during it would be expected to be worse rather than better. They are markedly better, and by a margin too large to be chance.

Two readings fit. One is that a smaller, more selective capture was operating in those months, taking fewer items and describing each properly. The other is that whatever supplied most of the year's volume was absent, leaving behind a residue that had always been better documented and was simply usually outnumbered.

This archive does not contain what is needed to choose between them, and the honest thing is to say so rather than pick the more satisfying one. What both readings share is the conclusion that matters: the gap is a property of collection, not of the field, and the entries inside it are evidence about a smaller population rather than a worse one.

It also means the summary rate for 2016 as a whole — 28% — is a blend of two different regimes and describes neither. Any figure that averages across a discontinuity has the same problem, and most published averages never mention whether they contain one.

611 entries name where they came from, across 216 distinct publications. Split by the gap, the difference is as sharp as the one in summaries: 80 publications inside the three months against 166 outside them.

Half the breadth, in a fifth of the volume. Proportionally the gap months draw on more distinct titles per entry than the rest of the year, which is the same signature the summaries showed: fewer items, each better attributed and better described.

The six most frequent publications across the year:

• 47helpnetsecurity.com
• 28itproportal.com
• 23securityaffairs.co
• 21itsecurityguru.org
• 21theregister.co.uk
• 19informationsecuritybuzz.com

Two independent measurements now point the same way, which is worth more than either alone. Whatever happened in those three months did not degrade the record; it reduced it, and what survived is a better-documented sample than the surrounding year rather than a damaged version of it.

That distinction has a practical edge. A degraded record should be discounted. A reduced one should be reweighted, and its contents are usable for anything that does not depend on how much of it there is — which is precisely the line this page has been drawing between rates, proportions and totals.

Worth setting down plainly, since this archive records so little of it and the mechanism explains why the subject mattered far beyond the week it happened.

The material was domestic hardware. Security cameras, digital video recorders and home routers, sold on price, shipped with a short list of factory credentials, and reachable from the open internet over a remote-login protocol that predates almost everybody using it. Assembling them required no exploit and no vulnerability in the ordinary sense — scanning wide address ranges, trying a handful of username and password pairs, and keeping whatever answered.

The target was not the services that went dark. It was a company providing name resolution: the lookup that turns a typed address into a machine to connect to. Flooding it meant that services which were running perfectly well became unreachable, because nothing could find them. Users experienced an outage at companies that had suffered no outage.

Three parties, and none of them in the relationship you would expect. The owners of the cameras noticed nothing; their devices continued recording their hallways throughout. The affected businesses had no contractual link to the devices and no ability to influence them. And the intermediary between them was a dependency almost nobody had written down, because resolution is the kind of service you only think about when it stops.

That arrangement is why it became a reference point. Every subsequent argument about concentration — a single provider whose failure takes an unrelated set of organisations with it — has this shape, and this is the earliest instance in this archive where all three parties are clearly separable.

The remedy proposed afterwards was equally instructive, because there was not really one available to the victims. A business cannot patch a stranger's camera, cannot compel a manufacturer in another jurisdiction to ship an update, and cannot decline to depend on name resolution. What followed was regulatory: labelling schemes, procurement rules, proposals about default passwords in consumer equipment, and eventually legislation in several countries requiring unique credentials on shipped devices.

That is the pattern whenever harm falls on somebody with no relationship to its source. Contractual pressure works when a buyer can walk away; here the buyer of the insecure device suffered nothing and the party suffering had bought nothing. The only lever left sits with whoever can set conditions on manufacture, and reaching for it took years.

It is also, on the evidence above, the single worst-recorded major event in the collection. The month holds 3 entries about it. Anybody reconstructing the period from this archive alone would not know it had happened.

The European data protection regulation appears 0 times in 2016. It was adopted that April.

The following year it appears 64 times, and by the year after that it is the largest single subject in this archive, generating more entries than the attacks everybody remembers. The gap between adoption and attention is roughly eighteen months.

That interval is the useful part. A rule with a two-year implementation period produces almost nothing while the period is long, and everything once the deadline is close enough to organise around. Nobody writes readiness advice twenty-four months out because nobody is ready to read it.

The same shape should be expected of anything with a distant compliance date. The absence of writing about an obligation says nothing about whether the obligation exists, and the arrival of writing about it is a signal about calendars rather than about risk.

In one place, and it is already stated there. The page for 2018 uses 2016 as part of a baseline for a decline, and it excludes these three months from the average rather than letting them drag it down. With them included the baseline falls by about fifty entries a month and the later decline looks gentler than it was.

Elsewhere the effect is smaller because the comparisons are proportional. A subject's share of the entries carrying a summary is unaffected by a gap that removed entries of both kinds, and every cross-year figure in this series is calculated that way for unrelated reasons that turn out to help here.

The general practice is worth naming since it applies well beyond this archive. When part of a series is known to be incomplete, the choice is between excluding it, interpolating across it, or showing it and saying so. The first hides a real observation, the second invents data, and the third is the only one that leaves the reader able to disagree.

That consumer hardware is infrastructure. Devices sold on price, shipped with a default password and never updated turned out to be capable, in sufficient numbers, of removing access to large parts of the internet — which is the argument this site sets out about connected devices and who is responsible for them.

That availability can be attacked without touching the target. Nothing belonging to the affected services was compromised; what failed was something they all depended on, which is the earliest clear instance in this archive of the concentration argument that recurs every year afterwards.

That responsibility for a device outlives the sale of it. Nobody had previously needed an answer to who maintains a camera for the decade it hangs on a wall, because nothing much depended on it. The question arrived with the outages and has not been satisfactorily answered since; support periods, update commitments and end-of-life declarations remain voluntary in most markets, and a device bought this year will still be running, unpatched and reachable, long after the company that made it has stopped existing or has simply stopped caring.

And, for a reader of records rather than of the field: that a year can look complete and not be. Nothing about 2016 announces the absence. It was found by counting, and the only reason it is on this page rather than quietly averaged into a trend is that somebody compared three months against their neighbours.