![\"cyber-security\"](\"http:\/\/jolt.richmond.edu\/files\/2017\/03\/cyber-security-346x242.jpg\")
<\/p>\n<\/p>\n
By: Kaley Duncan,<\/p>\n
Cyber-security is a growing concern worldwide.[1]<\/a> Continued increase in information sharing via the internet has left this information susceptible to hacker exploitation.[2]<\/a> The motive for many cyber-attacks is to sell information gained to sites that use that information for identity theft. [3]<\/a> If you are like me, your passwords are not only less than creative, but are also likely used for multiple accounts. As such, if your security information has been compromised, the effects can be far-reaching; it could affect not only information from your recent email correspondences, but possibly more important information, such as your bank account number and social security number.[4]<\/a> Big companies, and even the government, have been looking for ways to combat these hacks.[5]<\/a> So far in 2016, nineteen companies including Target, Walmart, Snapchat, and the IRS have been targeted by hacking schemes. [6]<\/a> Recently, another prominent name has been added to the list.<\/p>\n On Thursday, September 22nd<\/sup>, the email platform Yahoo confirmed that 500 million of its user accounts had been hacked.[7]<\/a> This is the largest security breach on record.[8]<\/a> Stolen information included emails, passwords, birth dates, telephone numbers, and, in some cases, even security questions.[9]<\/a> To make matters worse, Yahoo informed the public that these hacks started in 2012 and were just recently discovered by the company\u2019s security team.[10]<\/a><\/p>\n Multiple lawsuits have been filed including a class action alleging gross negligence.[11]<\/a> The suit, filed by New York resident Ronald Shwartz, contends Yahoo\u2019s security team knew of the breach long before they disclosed it to the public.[12]<\/a> Thus far, it is unclear when exactly Yahoo personnel were made aware of the 2012 security breach, but many sources state the company was alerted to the security issues in the Summer of 2016.[13]<\/a> Yahoo claims to have conducted security sweeps since 2012, including one on September 9th, 2016, that led it to believe there was no reason for concern.[14]<\/a><\/p>\n Yahoo CEO Marissa Mayor, has released little information regarding the controversy. However, from what little she has commented, the company seems to believe this was a state-sponsored hack.[15]<\/a> A state-sponsored hack is a cyber-security attack conducted by a foreign government.[16]<\/a> \u201cYahoo has been stingy with the facts, but that may be at the request of U.S. law enforcement or the intelligence community,\u201d said Leo Taddeo, a former special agent in charge of the FBI\u2019s New York cyber-crime office, in an interview with The Washington Post.[17]<\/a> \u201cIf, in fact there are signs of a state actor, the authorities would definitely prefer to keep the details out of public domain. Otherwise, the hackers may get tipped off to the U.S. government\u2019s sources and capabilities.\u201d[18]<\/a><\/p>\n Others wonder if the new merger with Verizon had something to do with Yahoo\u2019s reluctance to release information on the breaches to the public. Verizon is currently on track to acquire Yahoo for $4.8 billion, a figure that may be affected by the hack.[19]<\/a> In fact, a study done by Ponemon Institute found that the average cost to remediate data per user is approximately $158.[20]<\/a> According to those statistics, upwards of $70 billion would be required to mitigate the cost of this size cyber-security breach. Not surprisingly, this will likely affect the company\u2019s worth.[21]<\/a><\/p>\n Senator Mark Warner, a Democrat from Virginia and cofounder of the Senate Cyber-Security Caucus, is suspicious of Yahoo\u2019s failure to disclose information that is of such \u201cvital importance\u201d \u201cto keep the public and investors informed\u201d and voiced his concerns in a letter to the U.S. Securities and Exchange Commission.[22]<\/a> Currently there is no federal law requiring the prompt disclosure of security breaches of this nature.[23]<\/a> \u201c[The] seriousness of this breach at Yahoo is huge,\u201d said Warner in a statement made Thursday afternoon.[24]<\/a> Recent security breaches, namely those affecting Target and Yahoo, have compelled Warner to promote legislation protecting consumers.[25]<\/a> In fact, Warner is \u201cworking on bipartisan legislation to create a comprehensive, nationwide, and uniform data breach standard requiring timely consumer notification for breaches of financial data and other sensitive information.\u201d [26]<\/a> Most states have already enacted statutes requiring disclosure to consumers.[27]<\/a><\/p>\n For example, pursuant to Virginia Code \u00a718.2-186.6(B):<\/p>\n If unencrypted or unredacted personal information was or is reasonably believed to have been accessed and acquired by an unauthorized person and causes, or the individual or entity reasonably believes has caused or will cause, identity theft or another fraud to any resident of the Commonwealth, an individual or entity that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach of the security of the system to the Office of the Attorney General and any affected resident of the Commonwealth without unreasonable delay.[28]<\/a><\/p>\n While the phrase \u201cwithout unreasonable delay\u201d is largely left up to interpretation, according to the Ponemon Institute report, the average amount of time required to discover a malicious security breach is roughly 229 days. [29]<\/a> If Yahoo personnel have been forthcoming with their investigation, it took them nearly two years to discover this major security breach, three times the suggested average. [30]<\/a> One cannot help but speculate, was this really a reasonable delay in disclosure or a calculated cover-up? As new facts emerge the motive may be revealed, but until then the public is left with concerns about Yahoo\u2019s transparency.<\/p>\n <\/p>\n [1]<\/a> See<\/em> generally <\/em>Phenom Institute, 2016 Cost of Data Breach Study: Global Analysis, at 1 (2016), http:\/\/www-01.ibm.com\/common\/ssi\/cgi-bin\/ssialias?htmlfid=SEL03094WWEN (analyzing statistics of cyber data breaches worldwide).<\/p>\n [2]<\/a> See <\/em>Ali Hedayati, An Analysis of Identity Theft: Motives, Related Frauds, Techniques, and Prevention<\/em>, 4 J. of L. & Conflict Resol. 1, 2\u20133 (2012), http:\/\/www.academicjournals.org\/article\/article1379859409_Hedayati.pdf<\/p>\n [3]<\/a> See id <\/em>at 10.<\/p>\n [4]<\/a> See id <\/em>at 4.<\/p>\n [5]<\/a> See <\/em>Riley Walters, Cyber Attacks on U.S. Companies Since November 2014<\/em>, Heritage.org, http:\/\/www.heritage.org\/research\/reports\/2015\/11\/cyber-attacks-on-us-companies-since-november-2014 (last visited October 3, 2016).<\/p>\n [6]<\/a> See <\/em>Judy Leary, The Biggest Data Breaches in 2016, So Far<\/em>, Identity Force Blog, https:\/\/www.identityforce.com\/blog\/2016-data-breaches<\/p>\n [7]<\/a> See <\/em>Kif Leswing, Yahoo Confirms Major Breach \u2013 and it Could be the Largest Hack of All Time<\/em>, Business Insider (Sept. 22, 2016), http:\/\/www.businessinsider.com\/yahoo-hack-by-state-sponsored-actor-biggest-of-all-time-2016-9<\/p>\n [8]<\/a> http:\/\/www.mercurynews.com\/2016\/09\/23\/yahoo-hit-with-class-action-lawsuit-over-massive-data-breach\/<\/p>\n [9]<\/a> See <\/em>Nicole Perlroth, Yahoo Says Hackers Stole Data on 500 Million Users in 2014<\/em>, N.Y. Times (Sept. 22, 2016), http:\/\/www.nytimes.com\/2016\/09\/23\/technology\/yahoo-hackers.html?_r=0<\/p>\n [10]<\/a> See id.<\/em><\/p>\n [11]<\/a> See <\/em>Reuters, Yahoo is Sued for Gross Negligence Over Huge Hacking<\/em>, Fortune (Sept. 23, 2016), http:\/\/fortune.com\/2016\/09\/23\/yahoo-is-sued-for-gross-negligence-over-huge-hacking\/<\/p>\n [12]<\/a> See id.<\/em><\/p>\n [13]<\/a> See <\/em>Hayley Tsukayama, Data Breach: What Yahoo Knew When Could Cause it Trouble<\/em>, Union-Bulletin.com, http:\/\/www.union-bulletin.com\/news\/business\/data-breach-what-yahoo-knew-when-could-cause-it-trouble\/article_0e099de4-880a-11e6-ba24-cff074054d7e.html (last visited October 3, 2016).<\/p>\n [14]<\/a> See <\/em>Paul Szoldra, Yahoo Won\u2019t Answer the Most Important Question About its Massive Hack<\/em>, Business Insider (Sept. 28, 2016), http:\/\/www.businessinsider.com\/yahoo-massive-hack-2016-9<\/p>\n [15]<\/a> See Account Security Issue FAQs<\/em>, Yahoo.com, https:\/\/help.yahoo.com\/kb\/account\/SLN27925.html?impressions=true (last visited October 1, 2016).<\/p>\n [16]<\/a> See <\/em>Timour Rashed, State Sponsored Hacking and Cyber Security Policy<\/em>, Tim Tech Support Blog (Apr. 18, 2012), http:\/\/timourrashed.com\/state-sponsored-hacking-and-cyber-security-policy\/<\/p>\n [17]<\/a> See <\/em>Hayley Tsukayama, Could Yahoo be in Trouble with the SEC?<\/em>, The Washington Post (Sept. 28, 2016), https:\/\/www.washingtonpost.com\/news\/the-switch\/wp\/2016\/09\/28\/could-yahoo-be-in-trouble-with-the-sec\/<\/p>\n [18]<\/a> Id. <\/em><\/p>\n [19]<\/a> See <\/em>Perlroth, supra <\/em>note 9.<\/p>\n [20]<\/a> See<\/em> Phenom Institute Report, supra <\/em>note 1 at 1.<\/p>\n [21]<\/a> See <\/em>Leswing, supra <\/em>note 7.<\/p>\n [22]<\/a> See Senator Warner Calls on SEC to Investigate Disclosure of Yahoo Breach<\/em>, Mark R. Warner Blog (Sept. 26, 2016, 12:15 PM), http:\/\/www.warner.senate.gov\/public\/index.cfm\/bloghome; See also <\/em>Letter from Mark R. Warner, U.S. Senator, to The Honorable Mary Jo White, U.S. SEC Chair (Sept. 26, 2016) (https:\/\/www.scribd.com\/document\/325367178\/20160926-Letter-to-SEC-on-Yahoo-Breach).<\/p>\n [23]<\/a> See <\/em>Perlroth, supra <\/em>note 9.<\/p>\n [24]<\/a> See <\/em>Mark R. Warner Blog, supra <\/em>note 22.<\/p>\n [25]<\/a> See id.<\/em><\/p>\n [26]<\/a> Id. <\/em><\/p>\n [27]<\/a> Nat\u2019l Conf. of State Legislatures: Security Breach Notification Laws, (Jan. 4, 2016), http:\/\/www.ncsl.org\/research\/telecommunications-and-information-technology\/security-breach-notification-laws.aspx<\/p>\n [28]<\/a> Va. Code Ann. \u00a7 18.2-186.6 (2016).<\/p>\n [29]<\/a> See <\/em>Ponemon Institute Report, supra <\/em>note 1 at 3.<\/p>\n