Sony, The PSN, And The Communication Black Hole

The fallout from the PlayStation Network hack will be felt for weeks, months and years to come.

We don’t know what’s been stolen from the PSN, but it’s reasonably safe to assume that it’s everything. So, while some might not be particularly worried about credit card theft – after all, you just need to call your bank and they’ll cancel that number and send you a new card – it’s the way this was managed and reported that could end up causing the major issues.

We’re starting to hear, from banks, that they were alerted to the intrusion on or around the 19th, comments from TSA members and beyond suggesting that Sony informed the financial institutions even before they switched off the authentication service on the PSN. We can’t verify this ourselves, but based on what we’re hearing, this is starting to gain ground.

It was on the 26th of April that Sony managed to pull themselves together and tell us what had happened. If the intrusion was between the 17th and the 19th, that’s pretty much a week. A week in which the hacker(s) have seemingly had access to our data – credit cards, purchase history and – worst of all – enough of our ID to start to make some waves.

Name, address, date of birth, security question. It might all be ‘protected’ but it wasn’t encrypted – once the protection broke all this is in the clear, and – potentially – available to anyone. If your security question was your Mother’s maiden name, consider that another blot – ID theft is on the increase, and upwards of seventy million accounts will be a goldmine for the black market.

It’s true to say that this loss is causing a huge problem for Sony. I’m not personally too worried about identity theft or the data that could potentially be seen. Aside from my credit card number, all the data they had access to could have been gathered just as easily by picking through my bins. There will be many who have even more sensitive data than the stuff Sony lost, in public view, on their Facebook pages.

But think about this – if the information is distilled into a searchable list, what’s to say that the next time you’re online the person you’re playing against can’t look up your PSN ID, get your real name and start taunting you? They’ll know your real address, your birthday. And if they’re linked in the database, they’ll know the details of your dependents and sub accounts. It’s this uncertainty that breeds this speculation and Sony’s reluctance to offer comprehensive information only serves to compound that issue.

Make no mistake, people might be happy to say that Sony did the right thing in switching off the service, but the information was – everyone assumes – already extracted and who knows where it could all end up? Scaremongering has been rife since the day the PSN went down, but all this is very real and far too easy to understate: ID theft is a hugely serious matter.

What can we do? Nothing, really. If you’re already signed up to an ID protection scheme then just keep an eye on your credit rating to ensure nobody’s taking out credit in your name, or companies aren’t doing credit checks against you, renting flats, hiring cars, that sort of thing. Just stay vigilant, and hope that the information doesn’t end up on some torrent.

What this debacle has done for me is make me begin to take the measures I should have been taking all along. I use a password generating program to make and securely keep my passwords now, I won’t store my credit card info online again and I’ll even start shredding real-life sources of this data before they go in the bin. It’s always sensible to keep a close eye on statements and accounts but this fiasco has brought that need into sharp focus once again.

As for Sony and the way they’ve handled the communication with customers, let’s just say we’re far from impressed. The eventual statement read more like a legal/PR exercise than a truly apologetic one as it should have been, with more get out clauses than answers – why did it take a week? Why wasn’t the security answer one-way hashed?

Did they actually breach the network and get full access to the databases (and thus managed to dump everything) or did they sniff out packets from PS3s as they went back and forth to the servers,  limiting the damage to just those that were connected? We’ll probably never know, resulting in constant doubt about our identities.

I wouldn’t doubt that Sony are the only company to have had problems like this and we simply don’t hear about it in many other cases. I think the fact that the network has been taken down and is being rebuilt means that it gets a larger place in the spotlight than most companies would give it. For me, though, the security risks are of minimal concern. For me, the bigger issue is the bond of trust that has been broken.

Sony’s reluctance to say anything substantive for a week and then their eventual statement still being largely uninformative is a shambles. When their consumer base needed abject humility, they got legal base covering and vague doublespeak. Customers still don’t have all the facts of the matter or a firm timeframe to expect the service to return. Many people are now paying a subscription for a service which doesn’t exist (PS+) and they have no idea when it will be back.

Will the PlayStation brand ever be the same again? It won’t be easy for them. In a gaming landscape which is becoming more and more dependent on connectivity, digital distribution and micro transactions, Sony have effectively told their consumers that they can’t be trusted to handle these aspects. Even if the network is rebuilt as the most secure in the world, regaining that public perception could be a major stumbling block.

The die hard fans will remain in force, but some of us will be far more reluctant to give Sony (and other major companies) such delicate information in the future – we won’t know the far reaching consequences for some time, but just now this has all been an unmitigated disaster, and one of the biggest leaks in modern history.

There are insane amounts of hyperbole being thrown around the internet about never trusting Sony again but there is an element of truth in there. The simple fact is that much the consumer base will feel that Sony let them down with their silence. That bond of trust is much more difficult to recover than security on a server.