Yahoo Spins A Cautionary Tale Dealing With Data Privacy

Yahoo’s announcement that one billion customer email accounts were breached in 2013 – double that of a previously disclosed data breach incident in 2014 – seems like yet another ominous warning of a ‘dangerous and broken cyberspace’. And a big question users are asking is: why did it take so long for the Yahoo! hack to come to light?

There are a variety of reasons why it could take weeks, months, even three years to announce a major breach - even one affecting one billion email accounts. Seventy per cent of breaches take months or years to discover, according to the 2016 Data Breach Report of Verizon. Often, evidence will only come to light when investigating something else.

Penetration of systems and extraction of data are often separate events.  For example, investigations into the outages on the Ukrainian power grid in 2015 reveal that the systems were penetrated months before the attacks manifested. The intruders just sat and waited for the right time.

Yahoo! says that the attackers might have used forged cookies to access user accounts without having to login. A known feature of cybersecurity, identified by the Global Commission on Internet Governance, is that attack is easier than defence. On what is currently known, the Yahoo! attack doesn’t seem the result of a blatant security flaw– although this may change as more details are revealed.

Whether or not Yahoo! knew of the hacks before it made its announcements, the company’s vulnerability to ‘forged cookies’ may be evidence of crumbling internal security, or poor prioritization by the top team.

Yahoo! apparently failed to invest in intruder-detection mechanisms. For some time, news reports have been circulating about internal differences between its security and top management teams. The reports highlight a disconnect between two key functions within the organization, and that lack of coherence itself could create an enabling environment for security breaches.  

When a company is hacked or suffers a data breach, its response and public communications can make or break its reputation. Taking leadership over the situation and an effective communications plan can restore the shaken trust of a company’s clients and the public. Talk Talk’s disarray following a hack ensured that it was in the headlines for weeks.  In contrast, Tesco Bank had refunded customers and resumed normal service days after an ‘unprecedented’ cyber bank-robbery.

New national and international laws and regulations will compel companies to report major data breaches (for example, the EU General Protection Data Regulation to come into force in 2018). Having a well-thought out plan will not only comply with regulations, it will support (rather than hamper) criminal investigations and enable the company to show leadership during a crisis. Yet, 42 per cent of companies (opens in new window) do not have a communication plan for when a cyber-attack hits.

The reputational damage caused by a mishandling of its consequences can be more destructive than the attack itself. Yahoo!’s massive data breaches are currently being investigated by the FBI. They have led to sustained negative press coverage which in turn may lead to public scepticism of the company.  This also has the potential to jeopardize the acquisition deal by Verizon, which is now reportedly looking into either a price cut or into killing the deal altogether. This fate, for a once world-leading technology company, should be sobering for all.

Time for higher standards

But it is important to remember that in many ways, even before the Yahoo! hacks, customer emails were not necessarily as private as users may have believed.  Thanks to the terms of service of major technology providers, (opens in new window) online communications carry a far lower expectation of privacy than would be tolerable in offline equivalents. This is precisely what people ‘agree’ to when they sign up to free accounts from Yahoo!, Google and other major providers.  The business models of many technology platforms are highly exploitative: in Shoshana Zuboff’s coinage, these ‘extractive industries’ embody ‘surveillance capitalism’.

Users’ personal information is already out there, including private (even legally privileged) communications. The current so-called choice, to agree or not to participate at all, is often impractical and not a choice at all in a society that now all but requires someone to have an email address. That leaves many with little alternative but to accept the conditions of Yahoo! or another free email service. It is time for higher standards of privacy in the online environment and real, not illusory, choices about how much information users wish to share with platforms, governments and advertisers.  Respect for user privacy would also improve protections against the ever-increasing scale of hacks.

Chatham House Expert Comment

Emily Taylor
Associate Fellow, International Security

Joyce Hakmeh
Academy Fellow, International Security Department

« GCHQ Is Investing In Cybersecurity Start-Ups
Fallout In Russia : One Suspicious Death & Three Cyber Spies Arrested »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Dark Reading

Dark Reading

Dark Reading is the most trusted online community for security professionals.

Radisys

Radisys

Radisys offers software, products, integrated systems, and professional services for communication service providers and telecom solution vendors.

Radware

Radware

Radware is a global leader of application delivery and cyber security solutions for virtual, cloud and software defined data centers.

France Cybersecurity

France Cybersecurity

France Cybersecurity represents the French cybersecurity industry to raise international awareness of French cybersecurity capabilities and solutions.

BaseN

BaseN

BaseN is a full stack IoT Operator. We control the full value chain in order to provide ultimate scalability, fault tolerance and security to our customers.

Secusmart

Secusmart

Secusmart provide highly secure and encrypted speech and data communication solutions.

TeachPrivacy

TeachPrivacy

TeachPrivacy provides computer-based privacy and data security training that is engaging, memorable, and understandable.

SolutionsPT

SolutionsPT

SolutionsPT enables customers to strengthen their Operational Technology (OT) network to meet the ever increasing demand for performance, availability, connectivity and security.

Blake, Cassels & Graydon (Blakes)

Blake, Cassels & Graydon (Blakes)

Blakes is one of Canada’s top business law firms serving national and international clients in specialist areas including cyber security.

Vuntie

Vuntie

Vuntie blend European craftsmanship, performance and open-source technology to deliver cybersecurity services including penetration testing, incident response, training and consultancy.

Wickr

Wickr

Wickr's mission is to secure the world's most critical communications. Wickr provides the highest standard of encryption trusted by millions worldwide.

Advent One

Advent One

Advent One are recognised for solving intricate dilemmas, not only making technology work but building foundations that customers can grow upon in an effective and secure way.

Guardey

Guardey

Guardey protects thousands of SME's environments. Whether your team works at the office, at home, at the customer or remotely. We protect your business. We do this in an accessible and affordable way.

ArmorPoint

ArmorPoint

ArmorPoint redefines the traditional approach to cybersecurity by combining network operations, security operations, and SIEM technology in one platform.

Stacklok

Stacklok

Stacklok are an Open Source first security company enabling safe Open Source Software consumption.

ABM Technology Group

ABM Technology Group

ABM Technology Group (formerly True IT) provide business information technology services, solutions, and consulting for small to mid-sized organizations.