Yahoo Spins A Cautionary Tale Dealing With Data Privacy

Yahoo’s announcement that one billion customer email accounts were breached in 2013 – double that of a previously disclosed data breach incident in 2014 – seems like yet another ominous warning of a ‘dangerous and broken cyberspace’. And a big question users are asking is: why did it take so long for the Yahoo! hack to come to light?

There are a variety of reasons why it could take weeks, months, even three years to announce a major breach - even one affecting one billion email accounts. Seventy per cent of breaches take months or years to discover, according to the 2016 Data Breach Report of Verizon. Often, evidence will only come to light when investigating something else.

Penetration of systems and extraction of data are often separate events.  For example, investigations into the outages on the Ukrainian power grid in 2015 reveal that the systems were penetrated months before the attacks manifested. The intruders just sat and waited for the right time.

Yahoo! says that the attackers might have used forged cookies to access user accounts without having to login. A known feature of cybersecurity, identified by the Global Commission on Internet Governance, is that attack is easier than defence. On what is currently known, the Yahoo! attack doesn’t seem the result of a blatant security flaw– although this may change as more details are revealed.

Whether or not Yahoo! knew of the hacks before it made its announcements, the company’s vulnerability to ‘forged cookies’ may be evidence of crumbling internal security, or poor prioritization by the top team.

Yahoo! apparently failed to invest in intruder-detection mechanisms. For some time, news reports have been circulating about internal differences between its security and top management teams. The reports highlight a disconnect between two key functions within the organization, and that lack of coherence itself could create an enabling environment for security breaches.  

When a company is hacked or suffers a data breach, its response and public communications can make or break its reputation. Taking leadership over the situation and an effective communications plan can restore the shaken trust of a company’s clients and the public. Talk Talk’s disarray following a hack ensured that it was in the headlines for weeks.  In contrast, Tesco Bank had refunded customers and resumed normal service days after an ‘unprecedented’ cyber bank-robbery.

New national and international laws and regulations will compel companies to report major data breaches (for example, the EU General Protection Data Regulation to come into force in 2018). Having a well-thought out plan will not only comply with regulations, it will support (rather than hamper) criminal investigations and enable the company to show leadership during a crisis. Yet, 42 per cent of companies (opens in new window) do not have a communication plan for when a cyber-attack hits.

The reputational damage caused by a mishandling of its consequences can be more destructive than the attack itself. Yahoo!’s massive data breaches are currently being investigated by the FBI. They have led to sustained negative press coverage which in turn may lead to public scepticism of the company.  This also has the potential to jeopardize the acquisition deal by Verizon, which is now reportedly looking into either a price cut or into killing the deal altogether. This fate, for a once world-leading technology company, should be sobering for all.

Time for higher standards

But it is important to remember that in many ways, even before the Yahoo! hacks, customer emails were not necessarily as private as users may have believed.  Thanks to the terms of service of major technology providers, (opens in new window) online communications carry a far lower expectation of privacy than would be tolerable in offline equivalents. This is precisely what people ‘agree’ to when they sign up to free accounts from Yahoo!, Google and other major providers.  The business models of many technology platforms are highly exploitative: in Shoshana Zuboff’s coinage, these ‘extractive industries’ embody ‘surveillance capitalism’.

Users’ personal information is already out there, including private (even legally privileged) communications. The current so-called choice, to agree or not to participate at all, is often impractical and not a choice at all in a society that now all but requires someone to have an email address. That leaves many with little alternative but to accept the conditions of Yahoo! or another free email service. It is time for higher standards of privacy in the online environment and real, not illusory, choices about how much information users wish to share with platforms, governments and advertisers.  Respect for user privacy would also improve protections against the ever-increasing scale of hacks.

Chatham House Expert Comment

Emily Taylor
Associate Fellow, International Security

Joyce Hakmeh
Academy Fellow, International Security Department

« GCHQ Is Investing In Cybersecurity Start-Ups
Fallout In Russia : One Suspicious Death & Three Cyber Spies Arrested »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

NuHarbor Security

NuHarbor Security

NuHarbor is a leading information security consulting and advisory firm specializing in Information Security, Compliance, and Risk Management.

2|SEC Consulting (2-SEC)

2|SEC Consulting (2-SEC)

At 2|SEC Consulting, we deliver an end-to-end service of cyber and information security solutions which are tailored to each client’s exact security needs.

Code Dx

Code Dx

Code Dx is a software application vulnerability correlation and management system.

Digital Infrastructure Association (DINL)

Digital Infrastructure Association (DINL)

DINL is the leading representative for companies and organisations which are active within the Dutch digital infrastructure sector.

Sectigo

Sectigo

Sectigo is a leading cybersecurity provider of digital identity solutions, including TLS / SSL certificates, DevOps, IoT, and enterprise-grade PKI management, as well as multi-layered web security.

La Fosse Associates

La Fosse Associates

The InfoSec Recruitment team at La Fosse Associates specialises in placing Information Security & Risk professionals on a permanent and contract basis.

CyberQ Group

CyberQ Group

CyberQ is an award winning cyber security consultancy and services provider and an innovator in Artificial Intelligence and Automated Cyber Security.

Mendoza Ventures

Mendoza Ventures

Mendoza Ventures is a venture capital fund focusing on pre-seed Artificial Intelligence (AI), Fintech, and Cybersecurity startups.

Allthenticate

Allthenticate

Allthenticate Single Device Authentication (SDA), enables seamless authentication in both the physical and digital words while unifying management in one easy-to-use interface.

GRSi

GRSi

GRSi deliver next-generation systems engineering, cybersecurity, technology insertion and best practices-based Enterprise Operations (EOps) management.

Ampere Industrial Security

Ampere Industrial Security

Ampere is an industrial security firm. We specialize in industrial control systems (ICS) and operational technology (OT) security.

LBMC

LBMC

LBMC is a professional services solutions provider in accounting and finance, human resources, technology, risk and information security, and wealth advisory services.

RankedRight

RankedRight

RankedRight empowers security teams to take immediate action on their most critical risks.

Orbis Cyber Security

Orbis Cyber Security

Orbis is one of the leading cybersecurity company in USA. Our cybersecurity specialist defends your data, combat threat, and modernize your compliance.

IONIX

IONIX

IONIX is the attack surface management solution that uses Connective Intelligence to shine a spotlight on exploitable risks across your real attack surface and its digital supply chain.

EmberOT

EmberOT

EmberOT is at the forefront of operational technology (OT) security, offering cutting-edge solutions designed to protect critical infrastructure within energy, utilities, and manufacturing sectors.