Investigation Finds One UCLA Lecturer Maintains the Time-Zone Code Behind Billions of Phones

A single text file under every clock

According to an investigation published by sheets.works, almost anything on a phone that shows a time — alarms, boarding passes, meetings — depends on one text file, the time zone database, which records the clock rules governments have announced over the decades. Every Android phone, every iPhone and most servers on the internet derive local time from it.

The file's official coordinator is Paul Eggert, a computer science lecturer at UCLA who has held the unpaid role since 2012; Arthur Olson started the database in 1986 at the US National Institutes of Health. sheets.works puts the number of Android phones and iPhones running the file at about four billion, and notes that servers, Macs and laptops would push the figure higher.

The work is constant and concentrated. Release 2026e went out on 29 September, and its first note records Manitoba moving to a permanent -05 offset on 31 October — the change that stops clocks going back in Winnipeg — entered by two volunteers a month in advance. Of the 251 changes made to the file in the past year, sheets.works counted 218 by Eggert and 28 by Tim Parenti. In May 2020, Eggert asked the project's mailing list to appoint Parenti as his backup, "in case I am no longer available due to retirement or whatever."

The project has already survived a legal threat. In 2011 an astrology software company sued Eggert and Olson, claiming some of the file's history came from an atlas it owned; the mailing list and download site were switched off until IANA, which keeps the internet's master lists, took them over later that month. The Electronic Frontier Foundation defended the pair for free, and the suit was dropped in February 2012.

Counting who actually commits

To test how common this is, the authors downloaded the full change history of 23 pieces of software that phones, browsers and servers rely on, and counted everyone who made ten or more changes to each between October 2025 and October 2026. Eleven of the 23 projects had one or two people doing the regular work. The piece frames its findings against xkcd's familiar "Dependency" comic, in which modern digital infrastructure balances on a small block maintained thanklessly by one person.

When one maintainer becomes a vulnerability

The xz compression tool, found on nearly every Linux server and inside every iPhone, is looked after by Lasse Collin in Finland, who described it on the mailing list in 2022 as an "unpaid hobby project" while citing long-term mental health issues. After months of pressure on the list and a stream of useful fixes from a contributor named Jia Tan, Collin granted Tan greater access; in 2023 Tan made 304 changes to Collin's 172. Versions Tan released in February 2024 carried a hidden route into Linux servers, discovered on 29 March by Microsoft engineer Andres Freund after SSH logins began using more processor time than they should. Nobody has established who Jia Tan is.

Other maintainers carry personal rather than malicious risk. Denis Pushkarev, who wrote core-js — by his own count running on about half of the thousand busiest websites — raised $57 a month when he asked for donations in 2019. After a fatal road accident he was imprisoned in January 2020 and released about ten months later, while downloads of his library nearly doubled. This year he wrote 95 percent of its changes and has two sponsors on GitHub.

Exceptions that found funding

Some solo projects have recently attracted money. Todd Miller, responsible for 5,408 of the 5,409 changes to sudo between 2008 and 2018, publicly sought a sponsor in February 2026; after The Register covered the note, the project's Open Collective reached roughly $61,700 a year with 30 GitHub sponsors, making it the best-funded one-person effort in the count. libjpeg-turbo, the JPEG decoder shipped in Android and major browsers, is run as a one-person business whose general funding at one point covered about 8 to 10 hours of labour a month; its maintainer wrote 98 percent of this year's changes. SQLite is maintained by four people, is estimated to run in over a trillion databases, and funds itself through support contracts sold by creator D. Richard Hipp's company; the project removed its developers page, saying "there are a lot of crazy people in the world who might misuse that information."

Why it matters

The internet's foundations look broad from the outside, but at the base sits a layer of hobby-scale and one-vendor projects. The xz backdoor showed that thin maintenance is a security exposure, not just a sustainability concern; the time zone database shows how much everyday behaviour — every clock on four billion phones — leans on a couple of volunteers and a mailing-list succession plan. What the sheets.works count adds is scale: roughly half of the critical projects it examined are, in practice, one or two people.