December 16, 2014
Unlike many cybersecurity incidents in recent months, the recent cyberattack on Sony Pictures Entertainment was grounded in something other than stealing money or customer credit information. Instead, it seems these hackers are mostly interested in making Sony look bad, and boy are they doing a good job of it.
Leaked emails of executives mocking celebrities’ egos or offering racially tinged exchanges about President Obama’s movie preferences have dominated headlines, and the hackers have promised even more juicy material is to come. Sony had been relatively quiet on the issue other than a few written apologies from executives responsible for questionable email content.
This weekend, however, several media reported receiving a letter from attorney David Boies, a high-profile litigator who is most commonly associated with his representation of the U.S. government in its antitrust suit against Microsoft or for being the lead counsel for Vice President Al Gore in the 2000 Florida election case that reached the Supreme Court. The letter demanded that media not use any of the stolen material in news reports, threatening legal action if they did. Most legal experts have questioned that strategy’s efficacy, basically saying “good luck enforcing that,” but it shows the quandary Sony faces: What the heck can we do here?
Even worse, cyber experts have suggested that given the volume of material stolen, these leaks could continue for months or even years. Sony may, in fact, be unable to contain the continued flow of embarrassing leaks, and their legal sabre rattling may or may not have teeth. So it had better start thinking about what exactly has been compromised and how it intends to respond to the water torture approach these hackers intend to take.
If I were in Sony’s shoes, I’d consider revealing some of the more damaging stuff and start being a bit more proactive in public or private apologies, internal reprimands and company policy changes to steal the thunder from the hackers. Then find a way to take control of the conversation online where it has already taken flight – it’s simply too juicy for media and the public to ignore, and the threats of legal action aren’t going to dissuade anyone from talking about it.
The lesson for the rest of us is that cyberattacks can take on virtually any form, and we should never assume it will be only about money. And as Sony is learning the hard way, reputational damage can be even more painful than having your bank account drained.