Here's a sample from the forthcoming report. It's one of the case studies. There are 11 of these in the full report.
Sony PlayStation Network hacks
Overview
What media reports often described as the Sony PlayStation
Hack was actually a series of hacks and problems with a set of related systems
over several days. The main focus of attention for data protection authorities
was the potential theft of personal information of more than 70 million users
of the Sony PlayStation Network. The internal investigation of this hack
resulted in the PlayStation network platform being unavailable for several
days. PlayStation Network (PSN) is the network that provides the online
component of the popular PlayStation games console: it allows users to purchase
and download games and additional content, to communicate with friends and to
host online multiplayer games.
Other related hacks were discovered during the investigation
into the PlayStation Network hack. First, the website of Sony Online
Entertainment (SOE) was compromised, with hackers potentially gaining access to
personal information of 24.6 million customers.[1]
The SOE network was taken offline on 2 May 2011. Second, personal
information on a Sony website was indexed by Google, leading to 2,500 names and
partial addresses from a 2001 Sony sweepstake competition being discovered on a
public-facing website on 7 May 2011.[2] Third,
the Sony Pictures Entertainment website was hacked between 27 May and 2 June
2011, with the hacking group LulzSec claiming responsibility,[3]
and for which several purported members of LulzSec were subsequently charged.[4]
This hack resulted in the theft of confidential data relating to 100,000 users
of the Sony Pictures website. Several other hacks followed through May and June
2011.[5]
There were several investigations into the PlayStation
Network data breaches, which for the most part occurred independently of each
other. Many data protection authorities rapidly stated that they would look
into the breaches to ascertain the applicability of their data protection law
to the case and any jurisdiction that their offices might have. The UK
Information Commissioner’s Office (ICO) conducted an investigation into the PlayStation
Network data breach and issued Sony with a monetary penalty of £250,000. There
were also a large number of separate investigations into this data loss by
various actors in the United States, including the Federal Trade Commission,
the House of Representatives, numerous Attorneys General, and the FBI.
Sequence of key events
17-19 April 2011
|
Sony learns that the PlayStation Network and Qriocity
network had been hacked and begins an internal investigation.
|
20 April 2011
|
Sony PlayStation Network and Qriocity services are
suspended.
|
22 April 2011
|
Sony confirms that the PlayStation Network suspension is
due to external intrusion.
|
25 April 2011
|
Sony’s forensic teams confirm the scope of the personal
data they believe taken, but cannot rule out credit card information.
|
26 April 2011
|
|
April 2011
|
The Office of the Australian Information Commissioner
(OAIC) conducts an investigation into Sony Computer Entertainment Australia’s
role in the PSN data loss.
|
2 May 2011
|
Sony confirms that 12,000 credit card numbers and 24.7
million customers’ account information may have been stolen. The credit card
numbers are apparently encrypted and do not include expiry dates.
|
2nd June 2011
|
Sony restores all PlayStation Network Services in all
areas other than Japan.
|
29th September 2011
|
The OAIC publishes results of investigation of Sony
Computer Entertainment Australia.[8]
|
25th July 2012
|
The ICO serves a Notice of Intent on Sony.
|
12th October 2012
|
The ICO receives written representation from Sony.
|
19th October 2012
|
US Federal judge rules that plaintiffs could not claim
that Sony violated US customer protection statutes because the PSN services
were provided free of charge.
|
14th January 2013
|
The ICO issues a penalty of £250,000 against Sony Computer
Entertainment Europe (SCEE) Limited.[9]
|
1.1.3 Reasons for investigation
Several data protection authorities undertook investigations
to determine the applicability of local law to the hacks after they became
public knowledge. The Office of the Australian Information Commissioner (OAIC)
conducted its “own motion” investigation into the PlayStation Network hack in
April 2011. This investigation was conducted because Australian citizens had
been affected by the network hack. The OAIC investigation was limited to the
activities and role of Sony Computer Entertainment Australia, a subsidiary of SCEE.
Similarly, the Office of the Privacy Commissioner for Personal Data in Hong
Kong also conducted enquiries into Sony Computer Entertainment Hong Kong. The
Office of the Privacy Commissioner of Canada announced its intention to look
into the PSN data loss in late April 2011, with particular attention to its
effects on Canadians, and would determine its next move once it had a better
understanding of events.[10]
The Office does not appear to have subsequently issued a report of findings on
any such investigations. Other data protection authorities, such as the New
Zealand Privacy Commissioner, maintained contact with their international
equivalents without conducting their own investigation.[11]
The PlayStation Network platform is operated by Sony Network
Entertainment Europe Limited (SNEE), which is a wholly owned subsidiary of Sony
Computer Entertainment Europe. SNEE is responsible for the network in Europe,
the Middle East, Africa, Australia and New Zealand. The network platform,
including the database of customer information, was maintained on behalf of
SNEE by a US service provider, which is another part of the Sony group. SNEE is
based in London and therefore comes under the purview of the ICO. The ICO
described the loss of customer information by Sony as “the most serious breach
reported to us”.[12] The breach was
self-reported to the ICO by SNEE, and the ICO subsequently undertook an
investigation.
There were several overlapping investigations into the hack
in the United States. Sony Computer Entertainment America (SCEA) is the
US/North American equivalent to SNEE and both are part of the Sony Group, which
in turn is headquartered in Japan. Sony Online Entertainment publishes online
multiplayer games. The US headquarters of Sony Online Entertainment is in New
York.[13]
The Federal Bureau of Investigation confirmed that it was investigating the
hacks as a cybercrime, with the focus of its investigation being the hackers
responsible, and not the involvement or conduct of Sony in regard to the breach
of personal data. The FBI subsequently
arrested and charged several people allegedly involved in the perpetrating the hacks.
The House of Representatives subcommittee on Commerce, Manufacturing and Trade
conducted a hearing on the threat of data theft to American consumers, which
produced a letter to the chairman of SCEA, asking several questions about the
timing and extent of the breach, when Sony became aware of the incident, when
it notified customers and the authorities, and the details of any data security
and retention practices.[14] Sony’s
response to this letter provided details about its internal investigation, and
cited the complexity of the investigation as the key reason for the delay in
informing customers and the authorities.[15]
Twenty-two US state attorneys also demanded answers to questions from SCEA.[16]
The Federal Trade Commission may also have had jurisdiction due to potential
impacts on US consumers, but does not appear to have produced a report of any
investigation.
Findings of investigation
The Office of the Australian Information Commissioner (OAIC)
investigation concluded that as SCE Australia did not hold any personal
information relating to the PlayStation Network platform, it had therefore not
breached Australia’s Privacy Act 1988. The OAIC report made a distinction
between information disclosed to the public and information accessed as a
result of “a sophisticated security cyber attack against the network platform”,
and stated that a targeted attack on an organisation did not necessarily
signify that the organisation had failed to take “reasonable steps” to secure
personal data.[17] The Commissioner was,
however, concerned about the delay between SCE Europe becoming aware of the
incident and notifying both customers and the OAIC. The Privacy Commissioner
for Personal Data, Hong Kong, stated on 26 July 2012 that his office
would not pursue any further investigation, on the assumption that the cause of
the intrusion had been identified, and that preventative measures had been
taken.[18]
The UK Information Commissioner’s Office disagreed with the
Australian conclusion, stating that the PlayStation Network hack that resulted
in the loss of customers’ personal data could have been avoided. That the
database had been targeted in a deliberate criminal attack did not mitigate the
finding that the security in place was not sufficient to protect the personal
data being held. As a data controller under the Data Protection Act 1998, SCEE
had failed to ensure that the service provider maintained adequate security
standards. The ICO considered the contravention of Section 4(4) of the Data
Protection Act 1998 to be serious, because the measures taken by the data
controller did not ensure a level of security appropriate to the harm that
might result from unauthorised or unlawful access and processing of the stored
information. The monetary penalty of £250,000 was therefore reasonable and
proportionate, but would not impose undue financial hardship upon the data
controller. The ICO could potentially have issued a fine of up to £500,000.[19]
Aggravating factors included serious contravention due to the nature and volume
of data; placing other accounts at risk; that the data controller should have
been aware of the risk; that the data controller should have acted sooner; and
that the data controller is part of a multinational group with resources and
expertise. Mitigating factors included the focused and determined criminal
attack; the complexity of the PSN system; the fact that some steps were taken
to secure the network; that there had not been a previous similar breach; that
the personal data lost is unlikely to be misused and that no misuse has yet
been reported; that data subjects were informed and reparations offered; that
the data controller fully co-operated with the commissioner; that substantial
remedial action has been taken; and that the breach has had a significant
effect on the data controller’s reputation.
The lawsuits filed against Sony (SCEA) alleging that Sony
knew that its security was insufficient prior to the attack were dismissed by a
judge in Southern California on the grounds that the named plaintiffs were not
subscribers to the premium features of PSN, and therefore Sony had not breached
California’s consumer protection laws. Judge Anthony Battaglia also stated that
Sony could not be held fully responsible for the loss as there was no such
thing as perfect security.[20]
Forms of co-operation
In general, there is little evidence of any significant or
structured co-operation between data protection authorities in the
investigation of the Sony PlayStation Network data breach or other associated
hacks against Sony. Rather, investigations were primarily conducted by national
data protection authorities where they believed it appropriate. Where it
occurred, co-operation between data protection authorities was limited to ad
hoc communication between the authorities and the sharing of any findings at
the conclusion of individual investigations.
The OAIC investigation into SCE Australia was one of the
earliest investigations. The OAIC states that it advised other privacy
regulators about its findings, particularly the Asia Pacific Economic
Cooperation (APEC) member countries.
Many data protection authorities who issued press releases regarding the
Sony PlayStation breach also noted that they would maintain communication with
peers in other countries during their investigations. Details of this
communication or co-operation are generally limited. The Australian
Commissioner also stated that he did not intend to re-open this investigation
following the ICO’s decision regarding SCE Europe.[21]
The OAIC did, however, note the complexity of the Sony case, and cited this as
a driver towards increased international co-operation.
There is evidence of collaboration between the FBI and the
Department of Justice in the investigation of the criminal side of the hacks.[22]
This presumably builds on regular co-operation between the FBI and its
overseeing Department. It appears that the 22 different state Attorneys General
each wrote their own investigative letters to Sony, rather than sharing a
single inquiry.
Several parts of the Monetary Penalty Notice issued by the
ICO have been redacted.[23]
It is uncertain if the redacted or un-redacted version of this Notice was
shared with other data protection authorities. The Notice does not give details
of any collaboration between the ICO and other data protection authorities.
Notably, the respective Sony subsidiaries seem to have
co-operated with the law enforcement and data protection authorities in each
instance, and alongside the voluntary reporting of the breach to the UK
commissioner, this co-operation was taken into account by the ICO as a
mitigating factor in determining the appropriate monetary penalty.
Conclusions
From this case study, we draw the following conclusions:
- The corporate structure of Sony’s various divisions and way that it operated services made issues of jurisdiction and responsibility potentially problematic.
- Most data protection authorities that investigated the PlayStation Network hacks examined the activities of the local subsidiary of the Sony Group within their jurisdiction (for example, SCE Australia and SCE Hong Kong). Several data protection authorities therefore concluded that because those subsidiaries were not directly involved in processing data in relation to the hacked network, there was no further need for investigation.
- The PlayStation breach appears to have been influential in increasing the perceived need for global co-operation between Data Protection Authorities, due to the inter-related nature of the Sony group, the complex flows of personal information involved, and the possibility of a single event affecting a large number of citizens.
[1] Sony Online Entertainment,
“Dear Valued Sony Online Entertainment Customer”, Sony Online Entertainment, 2 May 2011., https://www.soe.com/securityupdate/
[2] Wisniewski, Chester, “Sony
succumbs to another hack leaking 2,500 ‘old records’”, Naked
Security, 7 May 2011. http://nakedsecurity.sophos.com/2011/05/07/sony-succumbs-to-another-hack-leaking-2500-old-records/
[3] FBI, “Member of hacking
group LulzSec arrested for June 2011 intrusion of Sony Pictures computer
systems”, press release, Los Angeles, 22 September 2011. http://www.fbi.gov/losangeles/press-releases/2011/member-of-hacking-group-lulzsec-arrested-for-june-2011-intrusion-of-sony-pictures-computer-systems
[4] FBI, “Six hackers in the
United States and abroad charged for crimes affecting over one million
victims”, press release, New York, 6 March 2012. http://www.fbi.gov/newyork/press-releases/2012/six-hackers-in-the-united-states-and-abroad-charged-for-crimes-affecting-over-one-million-victims
[5] Security Curmudgeon, “Absolute
Sownage: a concise history of recent Sony hacks”, Attrition.org, 4 June 2011. http://attrition.org/security/rant/sony_aka_sownage.html
[6] Information stolen likely
included: name, address (city, state, zip), country, e-mail address, birthdate,
PlayStation Network/Qriocity password and login, and handle/PSN online ID. It
is also possible that profile data, including purchase history and billing
address (city, state, zip), and PlayStation Network/Qriocity password security
answers may have been obtained. Seybold, Patrick, “Update on PlayStation
Network and Qriocity”, PlayStation.Blog ,
26 April 2011. http://blog.us.PlayStation.com/2011/04/26/update-on-PlayStation-network-and-qriocity/
[7] Arthur, Charles, “Anoymous
says Sony accusations over PlayStation
Network hack are lies”, The Guardian,
5 May 2011. http://www.guardian.co.uk/technology/blog/2011/may/05/anonymous-accuses-sony-hack-PlayStation-network
[8] Office of the Australian
Information Commissioner, Sony PlayStation Network/Qriocity: Own Motion
Investigative Report, 29 September 2011.
[9] Information Commissioner’s
Office, “Sony fined £250,000 after millions of UK gamers details compromised”,
Press release, 24 January 2013. http://www.ico.org.uk/news/latest_news/2013/ico-news-release-2013
[10] Hartley, Matt, “Breach
rattles watchdogs”, Financial Post,
27 April 2011.
[11] Privacy Commissioner,
“Media Release: PlayStation data breach”, Press release, 28 April 2011.
[12] BBC “Sony fined over
‘preventable’ PlayStation data hack” BBC
News, 24 January 2013.
[14] House of Representatives,
“The Threat of Data Theft to American Consumers: Hearing before the
Subcommittee on Commerce, Manufacturing and Trade, of the Committee on Energy
and Commerce, House of Representatives”, US Government Printing Office,
Washington, DC, 4 May 2011.
[15] Hirai, Kazuo, “Letter to
the Honorable Mary Bono Mack and Honorable G.K. Butterfield”, 3 May 2011.
[16] As an example, see
Jepsen, George, “Re: Sony PlayStation Breach” letter, Hartford, Connecticut, 27
April 2011. http://www.ct.gov/ag/lib/ag/press_releases/2011/sonytrettonltr042711.pdf
[17] Office of the Australian
Information Commissioner, Sony PlayStation Network/Qriocity: Own Motion
Investigative Report, 29 September 2011.
[18] Office of the Privacy
Commissioner for Personal Data, Hong Kong, “Privacy Commissioner completes
enquiries with Sony on Resumption of PlayStation Network Service in Hong Kong”,
press release, 26 July 2012. http://www.pcpd.org.hk/english/infocentre/press_20120726c.html
[19] Information
Commissioner’s Office, Data Protection Act 1998 Monetary Penalty Notice: Sony
Computer Entertainment Europe, 14
January 2013.
[20] Kerr, Dana, “Sony PSN
Hacking lawsuit dismissed by judge”, CNET,
23 October 2012.
[21] Office of the Australian
Information Commissioner, “Sony PlayStation Network: Statement from the
Australian Privacy Commissioner, Timothy Pilgrim”, press release, 25 January
2013.
[22] Li, Shan, “Justice
Department probes hacker attack at Sony’s PlayStation Network”, Los Angeles Times, 5 May 2011. http://articles.latimes.com/2011/may/05/business/la-fi-sony-probe-20110505
No comments:
Post a Comment