The millennium bug was real – and 20 years later we face the same threats | Martyn Thomas | Opinion

On New Year’s Eve 20 years ago, Scottish air traffic controllers called the emergency room in London to say their radar had failed as they could see no aircraft. The radar was actually working perfectly. All flights had been cancelled because of fears that planes or airports would fail at midnight because of the “millennium bug”. Around the world, plenty of other people were anxious too.

The first signs of this “Y2K problem” or the Year 2000 bug had appeared 12 years earlier in 1988 when a batch of tinned meat was rejected by a supermarket because it appeared to be more than 80 years past its use-by date. Four years later, Mary Bandar of Winona, Minnesota, was invited to join a kindergarten class because according to a computer she was four. Aged 104, she decided against.

Since 1951, when Joe Lyons introduced the world’s first business computers to manage their bakeries and cafes, dates had been abbreviated in computer data. To save space and speed up processing, the century was omitted, so January 1900 was 01/00 and December 1999 was 12/99, just as it still is on the front of credit cards today.

This made sense when all the dates were in the same century. But the supermarket’s tinned meat had a use-by date of January 2000, and Mary Bandar was born in July 1888; these dates, 01/00 and 07/88 looked like January 1900 and July 1988, making the meat 88 years too old in 1988 and 104-year-old Mary just four again in 1992.

Such errors caused amusement at first but gradually businesses realised the huge problem they faced. By 1995, the New York Stock Exchange had completed a seven-year project to correct all its systems at a cost of $30m, but most organisations had hardly started: a UK survey in 1995 found that only 15% of senior managers were aware of the problem. Time was short and urgent action was needed. TaskForce 2000 led an awareness campaign, later joined by Action 2000 with a £17m government budget. Auditors started telling companies that they would not sign off audits unless those firms had credible assurance that they would survive beyond January 2000. By 1998 the G8 summit and the UN were coordinating international action.

I led Deloitte Consulting’s Y2K work internationally in the mid-1990s. It wasn’t just business IT that had Y2K errors. Many PCs could not handle dates in 2000. Faults were found in the computers that controlled factories and offshore oil platforms. The UK’s Rapier anti-aircraft missile system had a Y2K fault that would have prevented it firing. Almost everywhere we looked we found computers that processed dates and had to be checked: 10% of Visa credit-card machines couldn’t handle cards that expired after 1999, so Visa asked member banks to stop issuing cards with 00 expiry dates and said it would fine banks up to £10,000 per month until their systems were corrected. For most companies, the work required to find and fix all-important systems was by far the biggest IT project they had ever undertaken.

Internationally, correcting Y2K problems cost thousands of person-years of effort and many billions of pounds. The UN International Y2K Coordination Centre estimated the cost as between $300bn and $500bn. Then 1 January passed without a catastrophe and the myth started that the threat had been grossly exaggerated.

There were many failures in January 2000, from the significant to the trivial. Many credit-card systems and cash points failed. Some customers received bills for 100 years’ interest while others were briefly rich for the same reason.

Internationally, 15 nuclear reactors shut down; the oil pumping station in Yumurtalik failed, cutting off supplies to Istanbul; there were power cuts in Hawaii and government computers failed in China and Hong Kong. A customer at a New York state video rental store had a bill for $91,250, the cost of renting the film The General’s Daughter for 100 years.

One serious UK problem was recognised only when a heath visitor in Yorkshire noticed an unusual number of babies being born with Down’s syndrome. More than 150 pregnant women were given the wrong results from tests because the computer system that was used in nine hospitals calculated the women’s date of birth incorrectly from January 2000; it had worked perfectly for the previous decade. The result was that women who should have been identified as being in a high-risk category were wrongly told that they did not need further testing.

The millennium bug was real and the internationally coordinated effort was a great success. Tens of thousands of failures were prevented. Some suppliers took advantage and sold unnecessary upgrades to their customers, but those of us who worked days, nights and weekends to meet the hard deadline of December 1999 are angered when ignorant people think that because we succeeded, the threat was not serious.

Y2K should be seen as a warning of the danger that arises when millions of independent systems might fail because of a single event. But this lesson has not been learned. Today, millions of systems rely on the GPS signal to provide the accurate timing, positioning and navigation on which our communications, defence, financial systems and food supplies depend. Yet the GPS signal is easy to jam and could be disabled for days or weeks by a major solar storm. Today, so many computer systems use the same software that a single cyberattack could spread rapidly and cause chaos. And 20 years ago, we did not have automated just-in-time supply chains with their much greater vulnerability.

Twenty years ago we showed that committed international action could overcome a critical threat. We shall need that commitment again.

• Martyn Thomas is emeritus professor of IT at Gresham College