The thought that started this one arrives every election season. As campaigns heat up, the news fills with breaches, leaks, botnets, and influence operations, and I catch myself feeling that the attacks are intensifying, that somewhere behind the headlines there is a rhythm: quiet years, then surges, clustered around the moments when public opinion is worth the most to manipulate. And every time, I want to actually see it. Zoom out to thirty years of incidents, watch the density rise and fall, drag the view across 2016, 2020, 2024, and check whether the wave I feel is a wave that exists.
I could not find any place to do that. The feeling stayed a feeling, unverifiable either way, which is the kind of itch this site exists for.
Breachline is the instrument I wanted. It puts the entire dark history of computing on a single, beautiful, zoomable timeline. Every notable bug, virus, worm, breach, vulnerability, ransomware wave, and state-linked operation, from the Morris worm of 1988 to LoveLetter in 2000 to WannaCry in 2017 to whatever happened last Tuesday, each one a dated, categorized, sourced point on one infinite horizontal line. Scrolling is traveling through time, and zooming moves from decades to years to days. At a distance you see density, eras, surges. Up close you see events, each opening into a summary, its categories, and its sources.
The assembly is the product
My research turned up something strange. Everything needed for this exists, and the thing itself does not. CSIS maintains a serious list of significant cyber incidents, but it is a chronological list, not a visual instrument. Wikipedia’s timeline of viruses and worms has historical depth, as linear text. There are static pedagogical timelines, generic contributive timeline platforms with no security focus, and at least one lovely open-source zoomable timeline engine with no cyber content in it. Each piece has the flaw the others solve.
So Breachline is an assembly job, not a research project or a data-collection moonshot. It takes proven engine patterns, existing openly licensed data as the seed corpus, and one opinionated interface. The design principle from my earliest notes still holds and deserves to be printed verbatim: the scroll must be delightful. If dragging through three decades of digital catastrophe does not feel like flying over a landscape, nothing else about the project matters, because a timeline’s entire value is the desire to keep moving through it.
Key Features
- One line, infinite zoom. Decades collapse into density bands; days expand into individual incidents. No pagination, no per-year pages, no PDF. The navigation is the interface.
- Events as sourced objects. Every point carries a date, a title, a short summary, categories, and at least one source. No source, no event; that rule is absolute and enforced at submission.
- Categories as color, impact as size. Malware, vulnerabilities, data breaches, ransomware, state-linked operations, influence campaigns, each a color; the size of a point reflects impact against published criteria. Any single impact score, though, is an editorial judgment dressed as a number. The criteria are public, arguable, and versioned, which is the only honest way to run one.
- The density layer. The founding feature, for my founding itch: a view that renders incident frequency over time as a landscape, with optional context overlays, election periods, major conflicts, so anyone can put the pattern they suspect next to the record and look. The tool draws the two lines; it refuses to draw the conclusion.
- Attribution with confidence levels. This is where a cyber timeline either grows up or becomes a propaganda surface. “Attributed to” is, in this field, a claim made by someone: a government, a security vendor, a journalist. Breachline never states that a state did something; it states who made the attribution and with what confidence, on the event card itself. Contested attributions show as contested.
- Public contribution, boring on purpose. A submission form with mandatory fields and mandatory sources, a proposed/validated/rejected status, and a visible edit history. No gamification: points and badges attract volume, and volume without verification is how a sourced timeline rots.
- Made to be embedded. Any slice of the line, a year, an incident cluster, a category, can be embedded in an article, a course, or a conference deck. Embeds are the distribution.
The honest tensions
First, the founding question must stay a question. Suppose the density view does show surges around elections. That still would not prove what my gut believes, because the timeline records documented incidents, and documentation has its own rhythms: security vendors publish more during news cycles, journalists look harder when elections loom, and disclosure laws changed what gets reported at all. More visible attacks and more attacks are not the same fact. Breachline’s job is to make the record visible and let the reporting bias be part of the conversation, not to launder my hunch into a chart. If anything, making that distinction legible to normal people would be the project’s finest contribution.
Second, the attribution minefield deserves a second paragraph, because influence operations are the category where this project touches geopolitics. The 2016 intrusion into a US political party, attributed by US intelligence agencies to Russian services, is among the most documented events of its kind. Plenty of others rest on a single vendor report and a preponderance of maybes. A timeline that flattens that spectrum into equal-looking dots becomes disinformation about disinformation. Encoding the uncertainty is the moral core of the product, not a nice-to-have.
Third, the treadmill. Incidents happen weekly, and a timeline that visibly stops updating dies in public, the emptiness after its last event reading as abandonment. Sustainability has to be designed in: semi-automated imports from the maintained public lists, a small review crew, and an institutional partner, a university lab or a security nonprofit, as the long-term home.
And fourth, retention. Timelines are visit-once products. People come, fly through it, feel things, and leave. That is fine, because this is a resource, not a startup. Its success metrics are citations, embeds, classrooms, and journalists who reach for it on deadline, not daily active users.
Monetization
The answer is the same as for my Obscurantism Clock, this project’s sibling. It is a civic project, and pretending it is a venture would ruin it. Costs are nearly nothing, a static-first architecture on free hosting with versioned JSON data. Sustaining it looks like grants in the digital-literacy and security-education space, sponsorship credits from security firms that want association without editorial influence (a line that must be written into any deal), and perhaps a supporter tier for the clean embed API. The data itself stays open, because the seed corpus came from open sources and the project’s legitimacy depends on giving back under the same terms.
Next Steps: How I’d Build It
Phase one is a static prototype with a hundred events in a single category (malware history is the natural pick, since Wikipedia’s corpus is deep and openly licensed) and one obsession: making the zoom and scroll feel wonderful. No accounts, no submissions, no filters. If a hundred points on a line do not make a visitor want to keep dragging, stop there and lose nothing.
Then licensing hygiene before scale. Wikipedia content is CC BY-SA and requires attribution and share-alike, the open timeline engines and event archives on GitHub carry their own licenses to respect, and institutional lists like CSIS get cited and linked, never scraped wholesale. An afternoon of reading licenses costs nothing; retrofitting a corpus does.
Then the categories, the density layer, the attribution model, and only after all of that, public contribution with its review process. Community is the last brick, not the first, because an empty review queue with clear rules beats a full one with none.
Closing
Breachline is the dark history of the connected world on one line you can fly over, built to show patterns without asserting them, and to treat “who did it” with the honesty that question deserves. It belongs to the same family as my Obscurantism Clock, instruments for seeing slow alarming things, and it shares blood with ThreatShield too. Both are tools for a web that has never been more useful or less trustworthy.
If you build this, tell me, and send me the link with the view zoomed out to 1988. I want to see the whole landscape at once, and then I want to drag it, slowly, toward now.
