Yahoo!’s announcement that one billion customer email accounts were breached in 2013 – double that of a previously disclosed data breach incident in 2014 – seems like yet another ominous warning of a ‘dangerous and broken cyberspace’. And a big question users are asking is: why did it take so long for the Yahoo! hack to come to light?
There are a variety of reasons why it could take weeks, months, even three years to announce a major breach - even one affecting one billion email accounts. Seventy per cent of breaches take months or years to discover, according to the 2016 Data Breach Report of Verizon. Often, evidence will only come to light when investigating something else.
Penetration of systems and extraction of data are often separate events. For example, investigations into the outages on the Ukrainian power grid in 2015 reveal that the systems were penetrated months before the attacks manifested. The intruders just sat and waited for the right time.
Yahoo! says that the attackers might have used forged cookies to access user accounts without having to login. A known feature of cybersecurity, identified by the Global Commission on Internet Governance, is that attack is easier than defence. On what is currently known, the Yahoo! attack doesn’t seem the result of a blatant security flaw– although this may change as more details are revealed.
Whether or not Yahoo! knew of the hacks before it made its announcements, the company’s vulnerability to ‘forged cookies’ may be evidence of crumbling internal security, or poor prioritization by the top team.
Yahoo! apparently failed to invest in intruder-detection mechanisms. For some time, news reports have been circulating about internal differences between its security and top management teams. The reports highlight a disconnect between two key functions within the organization, and that lack of coherence itself could create an enabling environment for security breaches.
When a company is hacked or suffers a data breach, its response and public communications can make or break its reputation. Taking leadership over the situation and an effective communications plan can restore the shaken trust of a company’s clients and the public. Talk Talk’s disarray following a hack ensured that it was in the headlines for weeks. In contrast, Tesco Bank had refunded customers and resumed normal service days after an ‘unprecedented’ cyber bank-robbery.
New national and international laws and regulations will compel companies to report major data breaches (for example, the EU General Protection Data Regulation to come into force in 2018). Having a well-thought out plan will not only comply with regulations, it will support (rather than hamper) criminal investigations and enable the company to show leadership during a crisis. Yet, 42 per cent of companies do not have a communication plan for when a cyber-attack hits.
The reputational damage caused by a mishandling of its consequences can be more destructive than the attack itself. Yahoo!’s massive data breaches are currently being investigated by the FBI. They have led to sustained negative press coverage which in turn may lead to public scepticism of the company. This also has the potential to jeopardize the acquisition deal by Verizon, which is now reportedly looking into either a price cut or into killing the deal altogether. This fate, for a once world-leading technology company, should be sobering for all.
Time for higher standards
But it is important to remember that in many ways, even before the Yahoo! hacks, customer emails were not necessarily as private as users may have believed. Thanks to the terms of service of major technology providers , online communications carry a far lower expectation of privacy than would be tolerable in offline equivalents. This is precisely what people ‘agree’ to when they sign up to free accounts from Yahoo!, Google and other major providers. The business models of many technology platforms are highly exploitative: in Shoshana Zuboff’s coinage, these ‘extractive industries’ embody ‘surveillance capitalism’.
Users’ personal information is already out there, including private (even legally privileged) communications. The current so-called choice, to agree or not to participate at all, is often impractical and not a choice at all in a society that now all but requires someone to have an email address. That leaves many with little alternative but to accept the conditions of Yahoo! or another free email service. It is time for higher standards of privacy in the online environment and real, not illusory, choices about how much information users wish to share with platforms, governments and advertisers. Respect for user privacy would also improve protections against the ever-increasing scale of hacks.
Emily Taylor is an internet governance expert and an associate fellow of Chatham House. She has worked in the domain name industry since 1999. Joyce Hakmeh is a legal and development expert working on the Middle East and North Africa region since 2006. Her areas of expertise include cybercrime, rule of law, good governance, international criminal justice, and international aid.