On the evening of December 12, 2000 I was messing around on my computer and watching the news on TV at the same time.
This time of year was a very exciting time as the 2000 presidential election was in question. The battle for the presidency between Al Gore and George W. Bush still wasn’t decided all because of Florida. The key electoral-college votes from Florida couldn’t be decided because the votes for Gore and Bush were so close that they had to be recounted. At times it was almost laughable because the news networks would show people sitting for hours on end examining paper ballots for ‘dimpled-chads’, ’swinging-chads’, and ‘pregnant-chads’, etc. There was even one point in which the ballots were all boxed up inside a Ryder truck and sent to Tallahassee. Just like the slow-paced police chase of O.J. Simpson, news helicopters were following this Ryder truck as it transported the ballots. It was silly.
Because so much was at stake, the Gore campaign sued (for some reason or another) and the case went all the way to the Supreme Court. Basically the decision the Supreme Court makes will ultimately decide if Gore or Bush wins the election. On the evening of December 12th around 10:30pm, the Supreme Court finally ruled in Bush’s favor.
While I was watching this breaking news, I decided to get a little creative and crafted up some crazy story about how Al Gore, not accepting defeat, hijacks the Ryder truck full of ballots and threatens to kill himself unless they change the ruling.
I’ve done something a little similar to this before on September 6, 2000 with regards to the RIAA trying to stop MP3’s. So I wrote up a spoof story, Federal judge, Janet Reno bans all use of the internet - impacting more than 400 million Americans and 700 million others worldwide.
That evening I wrote my spoof story using a story from CNN about the Ryder truck full of ballots as a template. I think I used Microsoft Word 2000 as the editor as it downloaded all of the necessary files (images, javascript?, and style sheets). So I yanked out the original story and placed in my spoof story:
Al Gore Hijacks Ryder Truck Full of Ballots
Back them, my domain was still billimek.com but such a story wouldn’t have as much dramatic effect if the URL had ‘billimek.com’ in it. Instead, I was able to craft it such that the URL for the story was:
http://www.cnn.com&story=breaking_news@1076628671/top_story/
At first (or even second) glance, the URL appears to be a valid CNN.com story.
The trick is the @. Web browsers see a ‘@’ as an identifier to represent a login username and password. In other words, the browser will treat everything before the @ as a username.
The number just after the @ is 1076628671. That number is another key part of the spoof. Back then billimek.com’s IP address was 64.44.12.191. There is a special technique to obscure IP addresses as ‘DWORD’ values.
Now billimek.com’s IP address is 206.158.52.61. The ‘dword’ equivalent is 3466474557. This can be determined for any IP address using a special tool. To make this example more concrete, http://billimek.com/jeff and http://3466474557/jeff are both the same thing (assuming billimek.com’s IP address doesn’t change).
I finished creating the spoof story around midnight on 12-12-2000 and posted the spoof link to a small #politics channel on the efnet IRC server. I figured I would give the few people chatting something funny to read. Right after that I went to bed.
At this time, I always had a bandwidth monitor running (ntop) to see what sort of bandwidth utilization my link is taking up. When I woke up around 6am the next day, the graph showed my link completely saturated. The apartment complex I live in has a T1 line wired to it for use by all of the subscribers for the entire complex. I was very worried at this because I was, all by myself, sucking up all of the available bandwidth for the entire apartment community. This wouldn’t go un-noticed and my ISP would take action against me. I also had a terminal window opened to my web server log and text was flying by as hundreds of requests were coming in for the AL Gore story.
The first thing I did was shut down the apache web server to stop the flow. I then spent about 30 minutes doing some quick analysis of the logs. Most of the requests were coming in from refers from other ‘web-based’ news sites. This meant that people were hitting my story from a link from other pages.
The next thing I saw made me really nervous. There were many hits from the turner.com domain. Turner Broadcasting (at this point in time, at least) owns CNN. To make matters worse, people from turner.com were looking at other parts of my website, including my resume. I also noticed what appeared to be a port-scan of my computer from turner.com.
I was getting really scared at this point in time as I think what I did could be considered a copyright violation, among other things. I had proprietary CNN content hosted on my computer and I represented a story as being a legitimate CNN story. At this time, I added a rule to apache to redirect any requests for the spoofed story back to cnn.com’s home page. I then turned back on the web server and went to work.
At work I was in a day-long technical design session with a few other people. I was still feeling very apprehensive about the whole thing, thinking that I was going to get in trouble. Someone asked me what was bothering me and I explained the whole situation. Everyone in the room got a great laugh out of it and assured me that probably nothing would happen.
We broke for lunch and when we came back a guy I work with told me that during lunch his wife told him people she went to lunch with were talking about this Al Gore story they heard Neil Boortz (a radio talk-show host) talking about. Apparently the word had really spread and even radio shows were talking about it.
When I got home, I did some web log analysis and it turns out that I had about 340,000 hits between midnight and 6am:

In addition, it looks like several websites ran stories on this.
One was The Register whose story was Spoofed story pokes fun at Gore.
Another story was on metafilter.org.
[H]ardOCP.com ran a blurb about the story as well.
I know there were some more news sites that linked to the story, but I can’t remember who they were anymore. Some searching on the net revealed some new info, however:
A TrustedToolbar product featuring ’spoof protection’ uses my spoof as an example of what it protects against.
A Stanford computer science professor used my spoof as a question on a homework assignment.
An MIT ‘course notes‘ references my spoofed URL under the section, ‘Confusing URLs’.
Fortunately, in the end, nothing happened to me. I think this is most likely because I acted quickly and removed it. I hate to think what would happen if Turner broadcasting decided to make an example out of me.
It’s amazing how posting the link to an obscure chat room at midnight could spread so quickly and so far in such a short amount of time.