Mark ở vũ trụ khácVIMark học AI
Mark ở vũ trụ khác · Another Universe Big Events Revisited #2 · Technology · Prevention

The Y2K Bug

31/12/99 00

The two-digit year bug · the world fixed it from about 1995 to 2000 · New Year's Eve 1999

Whatcomputers stored years as 2 digits, so "00" could be read as 1900
Scaleabout $100 billion spent on fixes in the US, 1995–2001
Paradoxfixed so well that many people believe there was never a bug
Main sourcesUS Senate report "Y2K Aftermath" (2000), US Commerce Department, OMB, the President's Y2K Council

Source: US Department of Commerce, "The Economics of Y2K and the Impact on the United States" (17 Nov 1999); US Senate Special Committee on the Year 2000 Technology Problem, "Y2K Aftermath – Crisis Averted" (29 Feb 2000). The full texts were blocked in the working environment and were checked through search excerpts.

One-minute recap

Essence

An old shortcutIn the 1960s memory was very expensive, so the year was stored as "68", not "1968".
About $100 billionSpent by US businesses and government on fixes, from 1995 to 2001.
Deadlines with teethUS banks had to finish testing critical systems by 30 June 1999, or face a lower rating.
A quiet New YearMore than 250 glitches in about 75 countries, fixed quickly, none causing serious disruption.
The prevention paradoxNothing happened, so many people concluded it was "a hoax".

Source: memory cost from the New York Review of Books, 23 Sep 1999 (secondary source); $100 billion from the US Department of Commerce (Nov 1999); the 30 June 1999 deadline from the FFIEC via FDIC letters (FIL-98-38, FIL-98-93); more than 250 glitches from the Senate report of 29 Feb 2000 as reported by CBS News (secondary source).

Part 1

The question of the event

The world spent hundreds of billions of dollars on a single date, and then nothing happened. Was the money wasted, or was it the reason nothing happened? The short answer: mostly the second, but nobody can prove it 100%, and that is exactly what makes all prevention work hard.

The answer is Mark's assessment, based on the US Senate report (2000) and the sources in Part 9. The global "hundreds of billions" is a forecast by Gartner ($300–600 billion) and IDC ($297 billion), secondary sources.

1960s–1996Shortcut and warningTwo-digit years saved memory. In 1993 the article "Doomsday 2000" sounded the alarm.
→
1997–1999MobilisationDeadlines for banks, a presidential council, an information-sharing law, the Fed prepares cash.
→
2000–2001Quiet, then doubtedA few hundred small glitches. Many people called it a hoax.
Part 2

Timeline

From a memory-saving shortcut to a New Year's Eve watched hour by hour.

Y2K timeline from 1993 to 2001 in four stages: warning (1993 to 1996), mobilisation (1997 to 1998), testing (1999), after the rollover (2000 to 2001). Milestones: 6 Sep 1993 Doomsday 2000 article; 5 May 1997 FFIEC five phases; 4 Feb 1998 Executive Order 13073; 2 Apr 1998 Senate committee; 19 Oct 1998 information-sharing law; 30 Jun 1999 bank testing deadline; 1 Oct 1999 Fed liquidity facility; 31 Dec 1999 rollover; 29 Feb 2000 Senate final report; Sep 2001 Sheffield screening error disclosed. warning 1993–1996 mobilise 1997–98 test 1999 after 2000–01 6 Sep 1993"Doomsday 2000" 5 May 1997FFIEC: 5 phases Feb–Apr 1998council + committee 19 Oct 1998info-sharing law 30 Jun 1999bank test deadline 1 Oct 1999Fed cash facility 31 Dec 1999rollover 29 Feb 2000final report Sep 2001missed: Sheffield
Seven years of warnings, two years of real work. Most of the effort was packed into 1997–1999, once agencies set deadlines with consequences. The diagram is not to an even time scale.Source: Computerworld, 6 Sep 1993 (secondary source); FFIEC, 5 May 1997, via FDIC FIL-50-97; Executive Order 13073 (4 Feb 1998); Senate Resolution S.Res.208 (2 Apr 1998); Public Law 105-271 (19 Oct 1998); FDIC FIL-98-38; Federal Reserve (Special Liquidity Facility); Senate report of 29 Feb 2000; BBC, Sep 2001, via Slashdot (secondary source).
1960s · The shortcutMemory in 1960 cost roughly a million times more per unit than in the late 1990s. Storing "68" instead of "1968" was a sensible saving.
6 Sep 1993 · "Doomsday 2000"Peter de Jager writes in Computerworld, one of the first major warnings in the press.
5 May 1997 · Banks get a scheduleThe Federal Financial Institutions Examination Council (FFIEC) splits the work into five phases: awareness, assessment, renovation, validation, implementation. Inventory critical systems by 30 Sep 1997.
4 Feb 1998 · The President's CouncilExecutive Order 13073 creates the President's Council on Year 2000 Conversion, chaired by John Koskinen, who reports directly to the President.
2 Apr 1998 · The Senate sets up a committeeThe Special Committee on the Year 2000 Technology Problem, chaired by Robert Bennett, vice-chaired by Christopher Dodd.
19 Oct 1998 · Information-sharing lawThe Year 2000 Information and Readiness Disclosure Act (P.L. 105-271): Y2K information shared in good faith is shielded from lawsuits.
30 Jun 1999 · The banks' deadlineTesting of critical systems complete. By Sep 1999, 99% of federally insured financial institutions had finished.
1 Oct 1999 · The Fed prepares cashOpens a special liquidity facility until 7 Apr 2000 and increases its 1999 currency order.
Nov – Dec 1999 · Counting the costCommerce: about $100 billion in the US (1995–2001). OMB: federal agencies spend $8.38 billion; critical systems 99.9% compliant.
31 Dec 1999 · The rolloverA ground processing station for a US reconnaissance satellite system fails for about 2–3 hours and switches to a backup.
29 Feb 2000 · "Crisis averted"The Senate's final report: more than 250 glitches in about 75 countries, fixed quickly, no serious disruption. The same day is the leap day 29 Feb 2000, a second test date.
Sep 2001 · A missed bugNorthern General Hospital (Sheffield, UK) discloses that about 150 prenatal screening results had the wrong risk level because of a Y2K bug in its software.

Source: New York Review of Books, 23 Sep 1999 (memory; secondary source); Computerworld, 6 Sep 1993 (secondary source); FDIC FIL-50-97 (9 May 1997); Executive Order 13073; S.Res.208; Public Law 105-271; FDIC FIL-98-38 and FDIC/Fed documents of Sep 1999 (99%); Federal Reserve: Special Liquidity Facility and Governor Kelley's speech of 29 Jul 1999; Commerce, 17 Nov 1999; OMB 11th quarterly report (Dec 1999); Defense Department briefing of 4 Jan 2000 via UPI and NYT (secondary source; reported duration varies from 2–3 hours to "several hours"); Senate report of 29 Feb 2000 via CBS News (secondary source); BBC, Sep 2001, via Slashdot and Computer Weekly (secondary source). Checked through search excerpts.

Y2K costs. US federal government: $8.38 billion (OMB). Whole US: about $100 billion (Commerce Department). Whole world: forecast of $300 to $600 billion (Gartner, secondary source), drawn dashed because it is a forecast. US federal (OMB)$8.38 billion whole US (Commerce)about $100 billion world (forecast)$300–600 billion? one scale for all three rows. The dashed band is a forecast, not a measurement.
The US number was counted by agencies, the world number is only a forecast. When someone says "the world spent $600 billion", remember it is the top of a late-1990s forecast.Source: OMB, 11th quarterly report on Y2K (Dec 1999): $8.38 billion, fiscal years 1996–2000 (GAO had a different estimate, about $8.7 billion; secondary source); US Department of Commerce, 17 Nov 1999: about $100 billion, 1995–2001; Gartner $300–600 billion and IDC $297 billion (secondary sources).
Post 1

Timeline

2-digit years1993$100 billionrollover
Post 2

Key decisions

bank deadlinescouncilsharing lawrole-play
Post 3

What the world learned

prevention paradox"avoided" log2038
Part 3

Key decisions

Seen through the eyes of the time: nobody knew how many programs would break, only that the deadline could not move.

The FFIEC's five phases for banks: awareness, assessment (inventory and priorities by 30 Sep 1997), renovation (largely done by 31 Dec 1998), validation (critical systems tested by 30 Jun 1999), implementation. Missing the testing deadline meant a Needs Improvement rating, more than 30 days late could mean Unsatisfactory. 1 · awarenesseveryone knows 2 · assessmentinventory · 30/9/1997 3 · renovation31/12/1998 4 · validation30/6/1999 5 · implementationbefore 1/1/2000 late on testing: "Needs Improvement" · 30+ days late: possibly "Unsatisfactory" by Sep 1999: 99% of federally insured institutions had tested critical systems
Turning a vague worry into a dated schedule. The deadlines only carried weight because they were tied to examination ratings.Source: FFIEC, "Year 2000 Project Management Awareness" (5 May 1997) via FDIC FIL-50-97; testing guidance and rating framework via FDIC FIL-98-38, FIL-98-93 and New York Fed circular 11052; the 99% figure from FDIC/Fed documents of Sep 1999. Checked through excerpts.

1 · Turning advice into deadlines with consequences

FFIEC · 1997–1999

Who decided, what they knew

The bank regulators (FFIEC), May 1997. They knew the bug was real, but nobody knew how many programs in each bank used two-digit years.

What they chose

Inventory first, then dated steps: test plan (30 Jun 1998), start testing (1 Sep 1998), finish testing (30 Jun 1999), tied to examination ratings.

Outcome

By Sep 1999, 99% of federally insured institutions had tested critical systems. On 1 Jan 2000, US banking had no major disruption.

Source: FDIC FIL-50-97, FIL-98-38, FIL-98-93; FDIC/Fed documents of Sep 1999 (99%); Senate report of 29 Feb 2000 via CBS News (no serious disruption; secondary source).

2 · One person in charge, quarterly reports

Executive Order 13073 · 4 Feb 1998

Who decided, what they knew

President Clinton, Feb 1998. Less than 23 months to go. Each department fixed things its own way, and nobody had the full picture.

What they chose

A President's Council on Year 2000 Conversion, chair John Koskinen reporting directly to the President, one representative per department, OMB publishing progress each quarter.

Outcome

OMB's 11th quarterly report: federal critical systems 99.9% compliant, total spending $8.38 billion (fiscal years 1996–2000).

Source: Executive Order 13073 (American Presidency Project, Clinton White House archive); OMB 11th quarterly report (Dec 1999). Checked through excerpts.

3 · Letting people tell the truth without fear of lawsuits

Public Law 105-271 · 19 Oct 1998

Who decided, what they knew

Congress and the White House (bill sent by OMB and Koskinen on 27 Jul 1998). Companies hesitated to disclose their readiness for fear of being sued if the information proved wrong.

What they chose

A "Good Samaritan" law: Y2K information shared in good faith is shielded; a temporary antitrust exemption until 14 Jul 2001. It does not cover systems that actually fail.

Outcome

Partners and suppliers had a legal basis to exchange test results. Its exact impact has not been measured (Mark's assessment).

Source: signing statement for S. 2392, 19 Oct 1998 (American Presidency Project); Clinton White House archive; Florida Bar Journal and FindLaw (secondary sources).

4 · Preparing for fear, not just for bugs

Federal Reserve · 1999

Who decided, what they knew

The US Federal Reserve, 1999. Banks had almost finished testing, but people and markets might pull cash out of worry, even if no machine failed.

What they chose

A bigger currency order (inventory built by Aug 1999), a special liquidity facility from 1 Oct 1999 to 7 Apr 2000, and options on overnight borrowing sold to dealers.

Outcome

A New York Fed staff report (2006) concluded that the Y2K options eased bond dealers' year-end fears.

Source: Federal Reserve, Governor Kelley's speech of 29 Jul 1999; Special Liquidity Facility documents; New York Fed staff report 266 (2006). Checked through excerpts. The article does not use the figure "$50 billion in extra cash" because no source could be found.

Part 4

What the world learned

What changed after Y2K, and one lesson the world learned backwards.

The prevention paradox. Top branch: no fix, many systems fail, everyone sees the disaster. Bottom branch: fix early, almost nothing happens, and many people conclude there was never a problem. The best outcome is the hardest one to prove. year-00 bug no fix widespread failureseveryone sees, everyone believes fix early almost nothing"must have been a hoax" illustrative diagram, no numbers
Done well, it looks unnecessary. There is no control experiment for the whole world, so the "hoax" side always has room. The only answer is to record what was fixed.The interpretation is Mark's. Facts: Senate report "Y2K Aftermath – Crisis Averted" (29 Feb 2000); National Geographic Education on the "hoax" view (secondary source).
Know what you haveMany organisations inventoried all their systems and software for the first time, because the FFIEC required an inventory by 30 Sep 1997.
Contingency plansThe FFIEC issued guidance on Y2K business risk (Dec 1997); "what if it breaks" became a required part.
Public-private sharingThe 1998 law showed that a legal safe harbour can get companies talking. Mark sees it as a model for later risk-information sharing.
The next bug: 2038Unix clocks counting seconds in a signed 32-bit integer overflow at 03:14:07 UTC on 19 Jan 2038. Many systems have moved to 64 bits; old embedded systems remain a risk.

Source: FDIC FIL-50-97 (inventory by 30 Sep 1997); FFIEC statement on Y2K business risk, Dec 1997, via New York Fed circular 10958; Public Law 105-271. The 2038 date is arithmetic: 2³¹ − 1 seconds after 00:00 UTC on 1 Jan 1970. The "model for later" view is Mark's.

More: the lesson the world learned backwards

The most quoted lesson after Y2K was "don't panic next time". That is the wrong lesson: there was no need to panic this time because people panicked at the right moment, two years early.

The Senate report also noted something few remember: 32 countries, including Australia, the UK, Canada and Germany, reported "no incidents" to the International Y2K Cooperation Center, even though the press reported incidents in those very countries. Part of "nothing happened" came from under-reporting.

Source: Senate report of 29 Feb 2000, quoted in Deseret News, 29 Feb 2000 (secondary source). The "learned backwards" view is Mark's.

Part 5

Fact check: what is true and what is myth

14 things often said about Y2K, checked against US government documents and clearly labelled sources. Tap a row to see why.

SOLIDUS businesses and government spent about $100 billion on Y2K

US Department of Commerce (17 Nov 1999): about $100 billion over 1995–2001, about $365 per American (per-person figure via Nextgov, secondary source). Computerworld (secondary) says it could reach $114 billion.

SOLIDThe US federal government spent about $8.4 billion

OMB 11th quarterly report (Dec 1999): $8.38 billion, fiscal years 1996–2000. GAO had a different estimate of about $8.7 billion (secondary source). Different scopes, not one wrong number.

SOLIDBanks were held to deadlines with real consequences

FFIEC: critical systems tested by 30 Jun 1999; late meant "Needs Improvement", more than 30 days late could mean "Unsatisfactory" (FDIC FIL-98-93). By Sep 1999, 99% had finished.

SOLIDThe Fed prepared cash specifically for the rollover

A special liquidity facility from 1 Oct 1999 to 7 Apr 2000, priced 150 basis points above the federal funds target; a larger currency order for 1999. The often-quoted "$50 billion" could not be sourced.

SOLIDThe US passed a law so companies would dare to share Y2K information

Public Law 105-271, signed 19 Oct 1998. It shields information shared in good faith, but not liability for systems that actually fail.

CAUTION"Italy, Russia and South Korea spent little and were fine, so the US overspent"

These countries did not see more problems (National Geographic Education; Russia spent up to 100 times less than the US per Gartner via ACM TechNews; secondary sources). But dependence on computers differed, Koskinen argued US systems were more complex, and 32 countries reported "no incidents" despite press reports. No causal study exists.

CAUTION"Programmers back then were sloppy"

Memory in 1960 cost roughly a million times more than in the late 1990s; storing two digits was a sensible saving (NYRB 1999, secondary source). The mistake was that programs lived far longer than anyone expected, and nobody fixed them once memory got cheap.

CAUTION"The world spent $300–600 billion"

That is a late-1990s Gartner forecast, not a measurement. IDC estimated about $297 billion (1995–2001). Both are secondary sources.

CAUTION"Peter de Jager was the first to warn"

"Doomsday 2000" (Computerworld, 6 Sep 1993) is the best-known warning in the press. "First" is a common label, not a proven fact.

CAUTION"2038 will be another Y2K"

Signed 32-bit Unix clocks overflow at 03:14:07 UTC on 19 Jan 2038 (arithmetic). The risk is real for old systems, but many have moved to 64 bits. It is too early to say it will be as big as Y2K.

FALSE"Y2K was a hoax, nothing happened in the end"

The bug was real and was fixed at a cost of about $100 billion in the US. Even so, the Senate report still recorded more than 250 glitches in about 75 countries. "Nothing" was the result of the fixing, not proof there was no bug.

FALSE"There were no incidents on New Year's Eve"

A ground station for a US reconnaissance satellite system failed for about 2–3 hours (Defense Department briefing, 4 Jan 2000, via UPI and NYT; secondary sources). There were also problems at a nuclear power system in Ukraine and a few 911 systems in the US (Senate report via CBS News, secondary source).

FALSE"Planes would fall and power would go out worldwide"

It did not happen. The Senate report: glitches were fixed quickly and none caused serious disruption.

FALSE"Once 1 Jan 2000 passed, Y2K was over"

2000 was a leap year (divisible by 400), so 29 Feb 2000 was a second test date. In Sep 2001, Northern General Hospital in Sheffield (UK) disclosed that about 150 prenatal screening results had been miscalculated because of a Y2K bug (BBC via Slashdot, Computer Weekly; secondary sources).

Source: as noted in each row; full list in Part 9.

Part 6

Verdict: how the world responded

Scores are Mark's assessment based on the sources in Part 9, not figures from a study.

Early detection
3/5
Transparency
4/5
Coordination
5/5
Learning afterwards
3/5
Overall
4/5
Done right
  • Bank deadlines with consequences, tied to examinations
  • One person in charge, progress published each quarter
  • A law that allowed sharing, a Fed that prepared for fear
Done wrong
  • Warnings from 1993, strong action only from 1997–1998
  • Many countries under-reported glitches, hard to compare
  • Not enough record of "what was avoided", so the "hoax" story spread

Y2K was one of the most successful acts of prevention of the computer age. Its biggest weakness was not the fixing but the telling: the world could not prove its own success.

More: why the "hoax" story is easy to believe

Press coverage in late 1999 included doomsday forecasts: planes falling, wide blackouts. When those did not happen, people compared the outcome with the worst forecast, not with "what if nothing had been fixed".

Some professionals had real doubts: former Pentagon CIO Paul Strassmann said "I think we have been had" (secondary source). The useful question is not "was there a bug" but "was the money well spent": many Y2K budgets also paid to replace old systems altogether.

The "More" section is Mark's commentary; Strassmann quoted from ACM TechNews, Jan 2000 (secondary source).

Part 7

Work lesson: done well, prevention looks unnecessary, so record what you avoided

For any prevention work: security, backups, testing, maintenance, workplace safety.

Four habits: inventory before fixing; deadlines with consequences; keep an avoided log; write a post-event report with numbers. 1 · inventory firstknow what you havethen estimate cost 2 · deadlines with teethdate + owner + consequencenot just "try hard" 3 · "avoided" logone line per fixwhat if not fixed 4 · post-event reporttell it in numberseven when quiet "Nothing happened" is also a result that needs proof.
Each habit comes from something done right in 1997–2000. The FFIEC inventory, the 30 June 1999 deadline, and the Senate's "Crisis Averted" report. Habit 3 is the missing piece.Source: FDIC FIL-50-97, FIL-98-93; Senate report of 29 Feb 2000. The habits are Mark's suggestions.
Inventory before asking for moneyList what could break and which items are critical. Base the budget on the list, not on the worry.
Deadlines with consequencesEach milestone has a date, an owner, and what happens if it slips.
An "avoided" logFor each bug found: date, where, who would have been hit if it were not fixed, and a rough cost.
A post-event report, even when quietHow many bugs fixed, how many slipped through, how long they took. That is the evidence for the next budget request.
Check your own team: 5 questions

1. The last prevention work your team did well: does anyone outside the team know what it avoided?

2. Does the team have a list of systems, accounts and contracts about to expire? Which ones are "critical"?

3. Does the next prevention milestone have an owner and a consequence if it slips?

4. If your manager asks "there were no incidents last year, why do you still need budget?", what number can you show?

5. What is your team's "2038": an expiring certificate, an unsupported library, the only person who knows a system about to leave?

Y2K Aftermath: Crisis Averted.Title of the final report of the Special Committee on the Year 2000 Technology Problem, US Senate, 29 Feb 2000.
Part 8

Read next

US Senate, "Y2K Aftermath – Crisis Averted" (2000)52 pages, with glitches listed by sector and by country, plus the committee's lessons.
"The Journey to Y2K: Final Report of the President's Council on Year 2000 Conversion" (29 Mar 2000)Koskinen's council on how it coordinated dozens of agencies and industries.
US Department of Commerce, "The Economics of Y2K and the Impact on the United States" (1999)How the cost was estimated and why Y2K did not slow growth.
Big Events Revisited #03: The dot-com bubble (1995–2002)Separate real technology from inflated prices; measure in real money, not "page views".
Part 9

Primary sources

Priority to documents from Congress, the White House, Commerce, OMB, the FFIEC and the Fed. The working environment blocked government sites, so the primary documents were checked through those sites' own excerpts in search results, without opening the full texts. Secondary sources are labelled.

  1. US Senate, Special Committee on the Year 2000 Technology Problem, "Y2K Aftermath – Crisis Averted: Final Committee Report", 29 Feb 2000, S. Prt. 106-42. govinfo.gov
  2. US Senate, Resolution S.Res.208 (105th Congress), 2 Apr 1998, creating the committee. govinfo.gov
  3. US Department of Commerce, Economics and Statistics Administration, "The Economics of Y2K and the Impact on the United States", 17 Nov 1999. commerce.gov
  4. OMB, "Progress on Year 2000 Conversion", 11th quarterly report (Dec 1999). archives.gov
  5. Executive Order 13073, "Year 2000 Conversion", 4 Feb 1998. govinfo.gov
  6. President's Council on Year 2000 Conversion, "The Journey to Y2K: Final Report", 29 Mar 2000.
  7. Year 2000 Information and Readiness Disclosure Act, S. 2392, Public Law 105-271, 19 Oct 1998; signing statement. presidency.ucsb.edu
  8. FFIEC/FDIC, FIL-50-97 (9 May 1997, "Year 2000 Project Management Awareness"); FIL-98-38; FIL-98-93; New York Fed circulars 10951, 10958, 11052. fdic.gov · fdic.gov
  9. Federal Reserve, Governor Edward Kelley's speech of 29 Jul 1999; Special Liquidity Facility; New York Fed staff report 266 (2006). federalreserve.gov · newyorkfed.org
  10. US Department of Defense, Deputy Secretary John Hamre's briefing of 4 Jan 2000 (archived by FAS). fas.org
  11. Secondary sources: CBS News and Deseret News, 29 Feb 2000 (Senate report); Nextgov, Nov 1999, and Computerworld (costs); GovExec (OMB, GAO); UPI, New York Times, Route Fifty (satellite); Peter de Jager, "Doomsday 2000", Computerworld, 6 Sep 1993; New York Review of Books, 23 Sep 1999 (memory); Iowa Legislative Fiscal Bureau 1996 and American Banker (Gartner, IDC); National Geographic Education and ACM TechNews, Jan 2000 (Italy, Russia, South Korea, Strassmann, Koskinen); BBC, Sep 2001, via Slashdot and Computer Weekly (Sheffield); Florida Bar Journal, FindLaw (1998 law).