Yahoo Spins A Cautionary Tale Dealing With Data Privacy

Yahoo’s announcement that one billion customer email accounts were breached in 2013 – double that of a previously disclosed data breach incident in 2014 – seems like yet another ominous warning of a ‘dangerous and broken cyberspace’. And a big question users are asking is: why did it take so long for the Yahoo! hack to come to light?

There are a variety of reasons why it could take weeks, months, even three years to announce a major breach - even one affecting one billion email accounts. Seventy per cent of breaches take months or years to discover, according to the 2016 Data Breach Report of Verizon. Often, evidence will only come to light when investigating something else.

Penetration of systems and extraction of data are often separate events.  For example, investigations into the outages on the Ukrainian power grid in 2015 reveal that the systems were penetrated months before the attacks manifested. The intruders just sat and waited for the right time.

Yahoo! says that the attackers might have used forged cookies to access user accounts without having to login. A known feature of cybersecurity, identified by the Global Commission on Internet Governance, is that attack is easier than defence. On what is currently known, the Yahoo! attack doesn’t seem the result of a blatant security flaw– although this may change as more details are revealed.

Whether or not Yahoo! knew of the hacks before it made its announcements, the company’s vulnerability to ‘forged cookies’ may be evidence of crumbling internal security, or poor prioritization by the top team.

Yahoo! apparently failed to invest in intruder-detection mechanisms. For some time, news reports have been circulating about internal differences between its security and top management teams. The reports highlight a disconnect between two key functions within the organization, and that lack of coherence itself could create an enabling environment for security breaches.  

When a company is hacked or suffers a data breach, its response and public communications can make or break its reputation. Taking leadership over the situation and an effective communications plan can restore the shaken trust of a company’s clients and the public. Talk Talk’s disarray following a hack ensured that it was in the headlines for weeks.  In contrast, Tesco Bank had refunded customers and resumed normal service days after an ‘unprecedented’ cyber bank-robbery.

New national and international laws and regulations will compel companies to report major data breaches (for example, the EU General Protection Data Regulation to come into force in 2018). Having a well-thought out plan will not only comply with regulations, it will support (rather than hamper) criminal investigations and enable the company to show leadership during a crisis. Yet, 42 per cent of companies (opens in new window) do not have a communication plan for when a cyber-attack hits.

The reputational damage caused by a mishandling of its consequences can be more destructive than the attack itself. Yahoo!’s massive data breaches are currently being investigated by the FBI. They have led to sustained negative press coverage which in turn may lead to public scepticism of the company.  This also has the potential to jeopardize the acquisition deal by Verizon, which is now reportedly looking into either a price cut or into killing the deal altogether. This fate, for a once world-leading technology company, should be sobering for all.

Time for higher standards

But it is important to remember that in many ways, even before the Yahoo! hacks, customer emails were not necessarily as private as users may have believed.  Thanks to the terms of service of major technology providers, (opens in new window) online communications carry a far lower expectation of privacy than would be tolerable in offline equivalents. This is precisely what people ‘agree’ to when they sign up to free accounts from Yahoo!, Google and other major providers.  The business models of many technology platforms are highly exploitative: in Shoshana Zuboff’s coinage, these ‘extractive industries’ embody ‘surveillance capitalism’.

Users’ personal information is already out there, including private (even legally privileged) communications. The current so-called choice, to agree or not to participate at all, is often impractical and not a choice at all in a society that now all but requires someone to have an email address. That leaves many with little alternative but to accept the conditions of Yahoo! or another free email service. It is time for higher standards of privacy in the online environment and real, not illusory, choices about how much information users wish to share with platforms, governments and advertisers.  Respect for user privacy would also improve protections against the ever-increasing scale of hacks.

Chatham House Expert Comment

Emily Taylor
Associate Fellow, International Security

Joyce Hakmeh
Academy Fellow, International Security Department

« GCHQ Is Investing In Cybersecurity Start-Ups
Fallout In Russia : One Suspicious Death & Three Cyber Spies Arrested »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Armor

Armor

Armor provide managed cloud security solutions for public, private, hybrid or on-premise cloud environments.

StratoKey

StratoKey

StratoKey is an intelligent Cloud Access Security Broker (CASB) that secures your cloud and SaaS applications against data breaches, so you can do secure and compliant business in the cloud.

ProPay

ProPay

ProPay provides secure payment solutions for organizations ranging from small businesses to large enterprises requiring complex payment solutions.

Coro Cybersecurity

Coro Cybersecurity

Coro (formerly Coronet) empowers organizations to protect against malware, ransomware, phishing, and botnets - across devices, users, and cloud applications.

Samoby

Samoby

Samoby provide a subscription solution for Mobile Threat Protection and usage control on Android and iOS devices.

KDM Analytics

KDM Analytics

KDM Analytics software products automate the NIST risk management framework (RMF) assessment for operational technology (OT) systems.

Conference on Applied Machine Learning in Information Security (CAMLIS)

Conference on Applied Machine Learning in Information Security (CAMLIS)

CAMLIS is a venue for discussing applied research on machine learning, deep learning and data science in information security.

Kratos Defense & Security Solutions

Kratos Defense & Security Solutions

The Kratos Space, Training, and Cybersecurity division addresses key cybersecurity challenges, including cloud security, continuous monitoring, IT security, and risk management.

OSIbeyond

OSIbeyond

OSIbeyond provides comprehensive Managed IT Services to organizations in the Washington D.C., MD, and VA area including IT Help Desk Support, Cloud Solutions, Cybersecurity, and Technology Strategy.

Stefanini Group

Stefanini Group

Stefanini is a global IT services company providing a broad range of solutions for digital transformation including automation, cloud, IoT and cybersecurity.

Trusted Cyber Solutions

Trusted Cyber Solutions

Trusted Cyber Solutions is an independent Cyber Security and Risk Management consultancy.

Tenet3

Tenet3

Tenet3's vision is to make optimal cyber strategy development tractable, data driven, with concrete success metrics. The result is cost effective cyber resilience for our customers.

Protelion

Protelion

The Protelion Security Platform is uniquely architected to deliver security solutions that combine greater protection, flexibility, and performance.

Galvanick

Galvanick

Galvanick enables your operations and IT teams to protect your industrial systems and networks against digital threats.

OutKept

OutKept

OutKept offers the highest quality phishing simulation campaigns, supported by a community of ethical phishers, to build awareness, and maintain alertness.

Secolve

Secolve

Secolve is Australia’s next generation OT specialist cyber security firm, working with key industries to protect the nation’s critical infrastructure.