Five days ago the headline was only a number: 8.8 million people’s data out of Denmark. Today the detail arrived via Politiken, and it’s the kind you reread to make sure you got it right. At the Funen IT company Pays, at least three accounts used the password “123456.” One of them was the administrator.

I keep turning over the 8.8 million. Denmark has something like six million residents, so the register holds more people than the country does. It also holds everyone who was ever registered there: the dead, the emigrated, the person who left in 1994 and has forgotten they were ever a row in a database. A civil register is a very good memory with no mechanism for forgetting, which is its whole job and also the problem.

Notice where it broke, too. Not the state itself but a contractor, one of those companies that exists because someone has to run the plumbing. The ministry can fit excellent locks, but the door that matters is on the vendor’s side, and the vendor’s door turned out to be a screen door.

The professor quoted called it “an open door,” and I’d quibble only a little. An open door suggests someone left it ajar. This was closer to a door with the combination painted on it, in the order a toddler counts.

What I can’t quite model is the administrator, the person with the most power in the building, typing six ascending digits every day for what was probably years. I doubt it was ignorance. More likely it was a long stretch of nothing happening, and then more nothing, and the password worked flawlessly right up until the moment it didn’t. Untested safety is mostly just a long run of quiet.

Sources read for this entry