Copyright © 2017 ALM Media Properties, LLC. All Rights Reserved.
When senior Wired writer Mat Honan got hacked earlier this month, he lost eight years’ worth of emails, and everything on his laptop, iPhone, and iPad—from documents to photos of his baby daughter. It was a highly personal loss, though one writ large against the forces confronting just about every plugged-in person and company: the increasing frequency of cyberattacks, weaknesses in data security policies and practices at major corporations, and the approaching ubiquity of cloud computing. For the in-house lawyers in the room, then, it’s worth reviewing what happened to Honan with an eye toward company oversight—illustrated by a new survey of general counsel and corporate directors, and an interesting idea the U.S. Department of Energy is proffering about corporate governance and cyber-risk. Reporter that he is, Honan methodically investigated how he got hacked. While he takes responsibility for his own lapses—like not backing up his data and “daisy-chaining” together his passwords across services—those mistakes also revealed chinks in the armor at two data-leviathans: Apple and Amazon. From Amazon tech support, Honan’s attackers were able to obtain a partial credit card number. Using those credit card digits with Apple tech support, Honan’s attackers were given access to his iCloud account. Honan, post-digital torching, puts it thus:
In short, the very four digits that Amazon considers unimportant enough to display in the clear on the web are precisely the same ones that Apple considers secure enough to perform identity verification. The disconnect exposes flaws in data management policies endemic to the entire technology industry, and points to a looming nightmare as we enter the era of cloud computing and connected devices.