The Ashley Madison Data Breach Report
Total Page:16
File Type:pdf, Size:1020Kb
Caught in the (Privacy) Act – The Ashley Madison data breach report 1 Briefing note September 2016 Caught in the (Privacy) Act – The Ashley Madison data breach report Ashley Madison, a website targeted at people seeking a discreet affair, is now widely known by the Clifford Chance is the legal sponsor of public for all the wrong reasons. One of these Deloitte Technology reasons is its failure to properly secure the personal Fast 50 Australia and is information of its users. The company which owns proud to support Ashley Madison, Avid Life Media (ALM), whilst Australia's growing technology companies. headquartered in Canada had users in more than 50 countries (including Australia) who engaged with Ashley Madison and ALM's other popular websites What we've learnt Established Men, Cougar Life and Man Crunch. The joint report of the Office of the Privacy Commissioner Beware! – any company doing business in Australia of Canada (OPC) and the Office of the Australian may be subject to the Australian privacy laws, even Information Commissioner (OAIC) into the breach if it has no physical presence provides important lessons for those concerned in Australia. Any business that holds about user privacy. personal information electronically must adopt affected. The OPC and the OAIC What happened? clear and appropriate jointly investigated ALM's privacy processes, procedures and As has been publicised across the practices and policies at the time of systems to handle information globe, in July 2015, a group called the data breach and also reviewed a security risks. 'The Impact Team' announced that number of related issues. The report they had hacked ALM and threatened prepared by the OPC and OAIC (Joint When considering whether to expose the personal information of Report) provides great lessons for your processes, procedures Ashley Madison users unless the site businesses, especially for those and systems are adequate, was shut down. ALM did not agree to where user privacy (and secrecy) is at consider the potential risk of this demand and reported the breach the core of their business. harm to individuals from to the OPC. On 18 and 20 August information being released. 2015 The Impact Team published What went wrong? Be transparent with your information, which included the Under the Australian Privacy Act 1988 users about the use of their account details of about 36 million (Australian Privacy Act), the information and be careful of Ashley Madison users. fundamental test for whether a representations your business Of the accounts released, there were contravention has occurred was makes about how securely more than one million Canadian users whether ALM had taken such steps their information is being held. and about 670,000 Australian users as were reasonable in the 2 Caught in the (Privacy) Act – The Ashley Madison data breach report circumstances to protect the personal pro-active assessments of Accuracy of email addresses: information it held. It's important to privacy threats, and evaluations ALM's lack of systems for keep in mind that a data breach or of security practices to ensure verifying whether an email other security compromise does not ALM's security arrangements address was real and associated necessarily mean that there has been were, and remained, fit for with an actual user of Ashley a contravention of either the purpose; and Madison, exposed potential non- Australian Privacy Act or the 3. Adequate training to ensure all users to reputational harm Canadian Personal Information staff (including senior (famously in the case of NZ Protection and Electronic Documents management) were aware of, Prime Minister John Key, a fake Act (PIPEDA). and properly carried out, their email address privacy and security obligations [email protected] was Process, procedures and appropriate to their role and the registered). systems nature of ALM’s business. Transparency with users: ALM The primary lesson from the Joint What should you look out failed in a number of instances to obtain their users fully informed Report is that it's crucial for any for? business that holds personal consent. For example, users information electronically to adopt In addition to the key elements were not notified until after clear and appropriate processes, identified above, the Joint Report registration that they could not procedures and systems to handle makes a number of observations with delete their account without information security risks, supported respect to the particular paying a fee and further, only by adequate expertise (internal or circumstances in the Ashley Madison after paying for the deletion were external), particularly where the data breach. informed that their information would be kept for 6-12 months for information is sensitive or could cause Trust marks: At the time of the chargeback purposes. significant harm to the individuals breach the Ashley Madison affected. website had a number of trust But we're not in When assessing what are reasonable marks which conveyed general Australia… processes, procedures and systems a impression that the website company should consider the adhered to a high level of Whilst ALM is headquartered in potential risk of harm to individuals security. Given the nature of Canada, it is subject to the Australian from the release of the information. In information and the impression Privacy Act because it carries on some circumstances the release of a conveyed by these marks, the business in Australia through its name or an email address may not in level of security safeguards marketing in Australia and targets its itself be harmful but in the case of actually in place should have services to Australian residents. Ashley Madison, the association of been commensurately high. It is also subject to the Australian such basic information with the Examples include the "SSL Privacy Act because it collected website was enough to cause Secure Site" graphic, "100% information from individuals physically reputational harm to users. Discreet Service" and "Trusted located in Australia at the time of the Security Award". data breach. Key missing features Indefinite retention and "Pay This extraterritoriality of the Australian The Commissioners identified three for Privacy": ALM had a policy Privacy Act has significant key elements that ALM's security of indefinitely retaining implications for the risk management framework was lacking: information and a premium "Pay for Privacy" service which forced of any company transacting and doing 1. Documented information security users to pay to permanently business in Australia (especially policies or practices, including delete their profiles. Neither of technology businesses) or collecting appropriate training, resourcing these were considered personal information from people and management focus; acceptable under the Australian located in Australia. 2. An explicit risk management Privacy Act. process - including periodic and Caught in the (Privacy) Act – The Ashley Madison data breach report 3 Who should be notified? Importantly, ALM have undertaken to confirm in writing to the OAIC its The Australian Federal Government is implementation of each undertaking currently considering legislation and to provide all documents and creating a serious data breach information that may be requested by mandatory notification regime. The the OAIC. The OAIC will be draft bill imposes on regulated entities monitoring closely! an obligation to notify the OAIC of a 'serious data breach' and take such Collateral consequences steps as are reasonable to notify the It has been recently reported in the individuals affected by the serious Financial Times that a British cyber data breach of the incident or if not security firm has searched through practicable, publish a copy of the data from recent breaches of popular statement provided to the websites, including Ashley Madison. Commissioner on its website and publicise the contents of the The firm found that Ashley Madison statement. alone yielded corporate emails and passwords of more than 200,000 Given the extraterritorial reach of the people working for big companies. It Australian Privacy Act, non-Australian was reported that in many instances entities, like ALM may become work passwords were reused. This subject to the mandatory data breach creates an additional security threat reporting. Further, once published for companies and a need to focus on such information will inevitably lead to security from a cultural perspective. pressure to report breaches in other relevant jurisdictions, even if there is no legal obligations to do so in those jurisdictions. What happens next? ALM have agreed to address the concerns of the Joint Report. Some of the undertakings are set out below. conduct a comprehensive review of protections in place for information; undertake steps to ensure staff are aware of and follow security procedures, which will include an appropriate training program; provide the OAIC with a report from an independent third party documenting the measures taken; cease its practice of indefinite retention of information; and amend its account creation process to ensure accuracy of information. 4 Caught in the (Privacy) Act – The Ashley Madison data breach report Contacts Sydney Perth Lance Sacks Justin Harris Partner Partner T: +61 2 8922 8005 T: +61 8 9262 5503 E: [email protected] E: [email protected] Jerrem Ng Shane Stewart Senior Associate Senior Associate T: +61 2 8922 8069 T: +61 8 9262 5507 E: