‘Y2K’ Fictionalizes The Past Cyber Threat—But More Are Coming

This is an article from our newsletter “Science Goes To The Movies.” To get a story about the science of popular movies and TV in your inbox every month, subscribe here.

In “Y2K,” a “Superbad” knockoff group of teens celebrate the new millennium on New Year’s Eve, 1999. At exactly midnight, all electronic devices go haywire and start massacring the partiers.

This absurd and gory computer takeover makes the actual Y2K problem look tame by comparison, but for IT and national security experts, it was actually pretty serious.

The infamous “Y2K bug” happened because of the way that computers store dates. At the time, computer systems coded dates as DD/MM/YY, meaning there was no way to distinguish 2000 from 1900 since both end in double zeros.

At the turn of the millennium, some experts predicted that the date change from ‘99 to ‘00 would cause widespread computer errors and throw recordkeeping and infrastructural systems into chaos, creating problems ranging from wrong dates on digital clocks to airplanes falling out of the sky. However, thanks to cybersecurity professionals, major disruptions were mostly avoided.

While Y2K didn’t end the world, it’s not the last disruptive cyber event we’ll encounter. There’s another issue with how computers track time—and that alarm is set for 2038.

What Is The 2038 Problem?

To many computers, time officially began at 00:00:00 on January 1, 1970. Most don’t count days or months—they count the seconds after that moment using a process called Unix time.

To retain information, time-related or otherwise, computers translate data into a binary code of ones and zeros. Many older systems use 32 “bits,” or binary digits, to represent dates. To represent 00:00:01 on January 1, 1970, for example, the binary number would be:

00000000000000000000000000000001

The problem is, there are only so many combinations of ones and zeros that can fit in 32 slots, and the first digit represents if the value is positive or negative. Computers using 32 bits to track time will hit an overflow error exactly 2,147,483,647 seconds after January 1, 1970—at 3:14 a.m. on January 19, 2038. At that point, the binary count will switch to representing a negative number, taking the date back to 2,147,483,647 seconds before January 1, 1970.

But what does it matter if computers have the wrong time? For starters, being off by even one second has caused outages on major websites, like Facebook and Reddit. In the bigger picture, the way computers calculate time deeply affects how we track our lives, says Dr. Nathan Malkin, a cybersecurity researcher at the New Jersey Institute of Technology.

For example, if a computer system’s date isn’t accurate, that can affect how it tracks things like work shifts, doctor’s appointments, or the validity of documents that expire, like passports and driver’s licenses.

Who’s Solving the 2038 Problem?

This problem has a simple solution: store time as a 64-bit integer, which wouldn’t reach its maximum until billions of years in the future. If programmers are vigilant about updates, major consequences of the 2038 problem can be avoided. 

But that’s a big if.

Well-tended systems like Windows and Mac make necessary updates all the time, but embedded systems that use simpler computers, like those in automatic lights, medical equipment, and smart appliances might not have regularly scheduled updates.

“I think these ‘Internet of Things’ devices is where a lot of that risk is going to come from,” Malkin says.

He gives the example of automatic lighting systems in an airport. “Maybe the company that installed it in the airport went out of business 20 years before 2038,” he says. “Somehow they’ve managed to make it work. But who’s going to be the one to update that?”

Despite these risks, Malkin says that the 2038 problem isn’t something to fret about too much. Software companies started publishing information to help people update their systems from 32 to 64-bit as early as 2003.

Despite requiring lots of coordination and updates, Malkin believes that most systems will have necessary protections by 2038, “but it’s really hard to say definitively [that] this is going to be fully solved by then,” he adds.

Worth The Watch?

“Y2K” is a charming collection of hyper-specific ‘90s references that, much like the crisis itself, I managed to survive. I was born in 1999, so I wasn’t as nostalgic as some other audience members, but the movie’s sheer oddness won me over. See it if you love the 90’s, Fred Durst, or the celery man Tim and Eric sketch.

“Y2K” is in theaters now.