Archive
The failure of enterprise to prepare for cyberattacks
Late last month, Zeitgeist went with friends to his local theatre to see “Teh [sic] Internet is a Serious Business”. The play, a story of the founding of the hacktivist group Anonymous, was the most well-publicised dawn of cyberattacks on businesses and governments. The organisation, at its best, set it sights on radical groups that promoted marginalisation of others, whether that was the Church of Scientology in the US or those trying to dampen the Arab Spring in Tunisia. This collective, run by people, some of whom were still in school, showed the world how vulnerable institutions were to being targeted online. We wrote about cybersecurity as recently as this summer, summarising the key points in a recent report from The Economist on what was needed to mitigate against future attacks and how to reduce the damage such attacks inflict. The issue is not going away (and in fact is likely to become worse before it gets better).
It was back in January that management consultancy McKinsey produced a report, ‘Risk and responsibility in a hyperconnected world: Implications for enterprises’, where they estimated the total aggregate impact of cyberattacks at $3 trillion. There is much to be done to avert such losses, but the current picture is far from rosy. Most tech executives gave their institutions “low scores in making the required changes”, the report states; nearly 80% of them said they cannot keep up with attackers’ – be they nation-states or individuals – increasing sophistication. Moreover, though more money is being directed at this area, “larger expenditures have not translated into an increased maturity” yet. And while the attacks themselves carry potentially devastating economic impact on a company, their prevention comes at a price too for the business, beyond the financial. McKinsey reports that security concerns are delaying mobile functionality in enterprises by an average of six months. If attacks continue, the consultancy posits this could result in “a world where a ‘cyberbacklash’ decelerates digitization [sic]”. Revelations about pervasive cyberspying by Western governments on their own citizens could well be a catalyst to this. Seven points are made in the report for enterprises to manage disruptions better:
- Prioritise the greatest business risks to defend and invest in.
- Provide a differentiated approach to defence of assets, based on their importance.
- Move from “simply bolting on security to training their entire staff to incorporate it from day one into technology projects”.
- Be proactive; develop capabilities “to aggregate relevant information” to attune defence systems
- Test. Test. Test again.
- Enlist CxOs to help them understand the value in protection.
- Integrate risk of attack with other corporate risk analysis
Given the amount of business and social issues that involve digital processes – “IP, regulatory compliance, privacy, customer experience, product development, business continuity, legal jurisdiction” – there is a huge amount of disagreement about how much state involvement there should be in the degree to which enterprises must take steps to protect themselves. This is an important point for discussion though, and we touched on it when we wrote about cyberattacks previously.
But that report was way back in January, things must have solved themselves since then, right? Last week, PwC reported that corporate cyber security budgets are being slashed, even while cyberattacks are becoming far more frequent. The FT reported that global security budgets fell 4% YoY in 2014, while the number of reported security incidents increased 48%. Bear in mind these are only reported incidents. This is potentially no bad thing, if we’re to go by McKinsey’s diagnosis of too much money being thrown at the problem in the first place. At the same time, it’s not exactly comforting.
Only a few days after PwC’s figures were published, JP Morgan revealed that personal data for 76 million households – about two-thirds of total US households – had been “compromised” by a cyberattack that had happened earlier in the year. Information stolen included names, phone numbers and email addresses of customers. It was also revealed that other financial institutions were probed too. Worryingly, the WSJ reports that investigators disagree on what exactly the hackers did. It was also unclear who was to blame; nation state or individual. Such disagreements over the ramifications of the attack, the identity of the attackers as well as the delayed revelation of the attack itself, illustrate just how necessary transparency is, if such attacks are to be better protected against and managed in the future.
For those in London at the end of the month, The Economist is hosting an event for those who apply, on October 21, examining “how businesses can and should respond to a data breach, whether it stem from a malicious insider, an external threat or simple carelessness”. Hope to see you there.
Netflix à la française – Musings on an empire
A recent essay for Foreign Affairs, “The State of the State”, criticises Western governments for failing to innovate. The authors make an unfavourable comparison with China, which, though still autocratic in nature, has at least looked abroad for ways to make the state work better (if only in a necessarily limited scope). One doesn’t need to look much farther than France to see what happens when the state fails to innovate. President Hollande has done his very best to inculcate a backward ideology of indolence among its workers, but the negative effects of over-regulation have been present in France for some time. One major step that is in drastic need of undertaking is the simplification of France’s opaque labour laws, the code for which runs to 3,492 pages, according to a recent article in The Economist. A stark and laughable example of the limits of such a code is elaborated on below,
“[The code] impose[s] rules when a firm grows beyond a certain limit: at 50 employees, for example, it must create a works council and a separate health committee, with wide-ranging consultative rights. So France has over twice as many firms with 49 staff as with 50.”
France of course also has a strong sense of state oversight and sponsorship when it comes to the media industry. L’exception culturelle has long dominated discourse about what content is appropriate and designated to be high art. Such safeguarding of domestic product has been a thorn in the side of late of the EU / US trade partnership, threatening to derail negotiations. Some have argued that such promotion of homemade productions serves not to diminish foreign imports – a love of Americana has not subsided in France – but rather only to preserve a niche. Regardless, argues a recent editorial in one of France’s national newspapers, it has left the country’s media sector susceptible to disruption.
Today’s Le Monde newspaper features a front page editorial on the arrival Monday to the country of Netflix. The company announced its plans for European expansion at the beginning of the year. It won’t have everything its own way, though. Netflix will have to adapt to a very different market environment. The Subscription Video On Demand (SVOD) market is well-established, and it will see much competition from incumbents (last year annual revenues for companies based in France providing such services exceeded EUR10m). These incumbents charge little or nothing for their services, relative to the $70-80 a month Americans pay to a cable company to watch television, according to The Economist, which states “Netflix struggled in Brazil, for example, against competition from local broadcasters’ big-budget soaps”. Moreover, current government policy dictates a 36-month long window from cinema release to SVOD. We’ve argued against the arbitrariness of such windows before, for a variety of reasons, but here such policy surely negatively impacts Netflix’s projected revenues. Such projections will be curbed further by stringent taxes and a further dictat that SVOD services based in France with annual earnings of more than EUR10m are required to hand over 15% of their revenues to the European film industry and 12% to domestic filmmakers, according to France24. As well as traditional competition, Netflix also faces threats from OTT rivals, such as FilmoTV. One possible way around such competitor obstacles is the promotion of itself as a complementary service. The New York Times earlier this spring elaborated,
“Analysts say Netflix, which has primarily focused on older content more than on recent releases, could also survive in parallel to European rivals that have invested heavily in new movies and television shows. Netflix in some ways serves as a living archive, with TV shows like “Buffy the Vampire Slayer” from the 1990s or movies like “Back to the Future” from 1985. Such fare has enabled the company in Britain, for example, to partner with the cable television operator Virgin Media, which offers new customers a six-month free subscription to Netflix when they sign up for a cable package.”
Such archive content will come in handy, particularly given that, as Le Monde points out, Netflix had previously sold the rights to its flagship series ‘House of Cards’ to premium broadcaster Canal Plus’ SVOD service Canal Play (which itself is investing in new content). The article hesitates to guess how much of a success the service will be in France – something Citi has no problem in doing, see chart below – instead looking to the music industry for an analogy, where streaming has become a dominant form of engaging with the medium. As in other markets, streaming services have met with increasing success, particularly with younger generations. For Le Monde, the arrival of Netflix will undoubtedly ruffle a few feathers, but the paper also hopes it will blow away the cobwebs of an industry that has become comfortable in its ways; it hopes the company will provide a piqûre de rappel (shot in the arm) for the culture industry. Netflix’s ingredients – by no means impossible to emulate – of tech innovation, easy access and pricing and a rich catalogue, should be a lesson to its peers. The editorial only laments that it took an American company to arrive on French shores for businesses to get the message.

Citi foresees huge takeup of Netflix in tech-savvy UK, but relative to other territories France is expected to see strong growth too in the coming years
UPDATE (16/9/14): TelecomTV reported this morning that Netflix has partnered with French telco Bouygues. The company will offer service subscriptions “through its Bbox Sensation from November and via its future Android box service. Rival operators are refusing to host Netflix on their products”.
“Lots and lots of files” – Privacy, data and a new currency
One of the seminal television shows of the 1990s, The X-Files played on myths, legends and government paranoia to worldwide critical and popular acclaim. One of the key episodes of the series found the lead characters, FBI agents Mulder and Scully, happening upon an abandoned mining facility. Contained inside were row upon row of filing cabinets. Inside, thousands of names spilled forth. The sheer number of file drawers is a visual feast for the viewer. But there is more; one of the agent’s names is in those files. Personal data on her (in the form of a tissue sample) has been taken without consent. Down the rabbit hole we go…
We have always operated under the assumption that governments must surveil in order to protect its citizens. The difference today, as Edward Snowden has so plainly shown, is firstly that you are the one being watched, and secondly that the sheer extent of the surveillance and the pervasive nature of its collection is staggering. The pervasiveness of all this is a key point. Not much in the way of policy has changed really in the past fifty years, it’s just that spying on swathes of the world’s population has become increasingly easier and cheaper. Back in 2006, the UK’s Information Commissioner’s Office warned that the country was moving “towards pervasive surveillance”. Such a prophecy seems to have turned into reality. It creates an uncomfortable feeling that those in charge do not have our best interests at heart, or at least that the ends do not justify the means.
Some of the finest publications in the world have been struggling to make sense of what all this means; Zeitgeist is using this post to highlight some of those key thoughts and issues covered. Back in September, The New York Times reported, paradoxically,
“Even agency programs ostensibly intended to guard American communications are sometimes used to weaken protections. The N.S.A.’s Commercial Solutions Center, for instance, invites the makers of encryption technologies to present their products to the agency with the goal of improving American cybersecurity. But a top-secret N.S.A. document suggests that the agency’s hacking division uses that same program to develop and ‘leverage sensitive, cooperative relationships with specific industry partners’ to insert vulnerabilities into Internet security products.”
Zeitgeist remembers dining alone in New York in September poring over the news. The NSA tried to ask for permission to legally insert a ‘backdoor’ into all digital encryption, but were denied. So they went ahead and did it anyway. They influenced government policy that led to fundamental weaknesses in encryption software. Last week, a federal judge considered the constitutionality of the US’s surveillance programmes. He called the technology used by the NSA “almost Orwellian” and ordered it to stop collecting the telephone records of two plaintiffs. It is one of several cases currently underway.

Click to see The New Yorker’s infographic on what personal data is made available to social networks and their advertisers
Of course, such spying would have not have been possible without the consent – tacit or otherwise – of companies in the private sector. There is clamor in the US, UK, Brazil and other countries for more restrictive regulation that makes it harder to collect consumer data. Such policy could make data analysis and collection onerous and might have a significant impact for those businesses that make a living out of using such data. As The Economist puts it,
“Should all this make it harder and costlier for companies to gather information, that would hurt the likes of Facebook and Google, which depend on knowing enough about their customers to ping them with ads that match their tastes.”
The New Yorker recently featured a fascinating article complete with unnerving infographic (excerpted image above) showing just how much information we display on our various social networks is then shared with the platform and its advertisers. This month, a new film, Her, arrives in cinemas, from the director of Being John Malkovich. The heroine is a disembodied voice – acted by Scarlett Johansson – who serves as operating system. The line between her servitude and rapid consumption of all her user’s data quickly becomes blurred. As the reviewer Anthony Lane puts it, also for The New Yorker,
“Who would have guessed, after a year of headlines about the N.S.A. and about the porousness of life online, that our worries on that score—not so much the political unease as a basic ontological fear that our inmost self is possibly up for grabs—would be best enshrined in a weird little [film]?”
Unsurprisingly, the results of a recent YouGov poll in the UK showed consumers were now far less willing to part with their own data. Almost half would be less willing to share their personal data with companies in the next five years. A mere 2% said they would be more willing to do so. Part of the problem lies in a lack of transparency: who is using my data, which piece of information exactly, and how does it benefit them? More importantly, what am I getting in return for surrendering my data? Steve Wilkinson of Ernst & Young offered little in the way of cheering news, “Many customers have recognised that businesses are using their personal information to help increase revenues, and are starting to withdraw access to their private data… In spite of this, there is a reluctance to adopt incentives that encourage consumers to part with personal data”.
Writing in the FT yesterday, Evgeny Morozov penned an excellent article claiming the media was spending far too much time on the intricacies of government involvement rather than how the whole cocktail mixes together. The overreach, according to the author, is being treated as an aberration, that will disappear in the face of tighter controls and the harsh light of day. It should instead, Morozov argues, be treated as part of a worrying trend in which “personal information – rather than money – becomes the chief way in which we pay for services – and soon, perhaps, everyday objects”. The article continues,
“Now that every piece of data, no matter how trivial, is also an asset in disguise, they just need to find the right buyer. Or the buyer might find them, offering to create a convenient service paid for by their data – which seems to be Google’s model with Gmail, its email service… [W]e might be living through a transformation in how capitalism works, with personal data emerging as an alternative payment regime. The benefits to consumers are already obvious; the potential costs to citizens are not. As markets in personal information proliferate, so do the externalities – with democracy the main victim. This ongoing transition from money to data is unlikely to weaken the clout of the NSA; on the contrary, it might create more and stronger intermediaries that can indulge its data obsession.”
“Should we not be more critical of the rationale, advanced by the NSA and other agencies, that they need this data to engage in pre-emptive problem-solving? We should not allow the falling costs of pre-emption to crowd out more systemic attempts to pinpoint the origins of the problems that we are trying to solve. Just because US intelligence agencies hope to one day rank all Yemeni kids based on their propensity to blow up aircraft does not obviate the need to address the sources of their discontent – one of which might be the excessive use of drones to target their fathers. Unfortunately, these issues are not on today’s agenda, in part because many of us have bought into the simplistic narrative – convenient to both Washington and Silicon Valley – that we just need more laws, more tools, more transparency.”
“I hope for the comedy… I suspect the horror. Possibly in the future you’ll no longer be permitted to be who you think you are, or even who you’re pretending to be: You will be who they say you are, based on your data-mined, snooped-upon online presence. You’ll be stuck with that definition of yourself. You won’t be able to take off the mask.”
Such disconcerting thoughts on having your own personality dictated to you might once have been the stuff of science-fiction, apt for an episode of The X-Files. Besides adages of truth being stranger than fiction, the clarion call of these publications appears to be that people should be sitting up and taking notice of what has been going on over the last ten years with extensive policy / data / consumerism creep. It is not just the NSA, but the way society intertwines information for monetisation that must be scrutinised if we are to avoid having to worry about trivial things like playing videogames in peace.