Horror movie

CRITICS who don’t like a film usually pen scathing reviews of it. But “The Interview”, a comedy from Sony Pictures Entertainment that includes a scene depicting the assassination of Kim Jong Un, North Korea’s leader, has provoked a far more damaging response from one particular bunch of detractors. On December 8th hackers who had attacked the studio’s computer systems demanded that it stop showing what they called “the movie of terrorism” to avoid further chaos.

Part of Sony, an electronics maker, which also saw its PlayStation gaming network briefly taken offline on the same day the warning was issued, Sony Pictures is the latest in a long line of firms to have been hacked this year. JPMorgan Chase, a bank, and eBay, an e-commerce giant, are among other well-known companies that have suffered breaches. But the Sony case is striking for at least two reasons.

The first is the way in which the studio’s attackers, who call themselves the “Guardians of Peace”, or #GOP, have behaved since cracking its digital defences in late November. Most hackers like to pinch valuable data discreetly and then scarper before being spotted. But Sony Pictures’ assailants have instead taunted the studio publicly; leaked the social-security numbers of some 47,000 of its current and former employees; published sensitive financial information such as salaries; distributed copies of several yet-to-be-released films online; and posted incendiary e-mails between executives (which are now all the talk in Hollywood).

In a chilling twist, some Sony Pictures staff also received e-mails that threatened them and their families, though it is unclear whether these were sent by the original hackers or another group. As The Economist went to press, cybersleuths drafted in by the studio were still trying to discover who is behind the attack.

Much suspicion has focused on North Korea, which has denied responsibility, but not ruled out the possibility that the hack might be the handiwork of “supporters and sympathisers”. Experts note that independent hackers who enjoy informal state backing are becoming a big problem that needs international attention. “Diplomacy to tackle cybercrime has to be a priority,” says Mark Weatherford of the Chertoff Group, a consulting firm.

Protecting sensitive data should be a priority too. But the other striking thing about Sony Pictures’ experience is that it has highlighted sloppy practices at an arm of a firm that should be especially careful about its security. Sony, after all, has a record of tangling with hackers. It first enraged them back in 2005 when its music division included particularly aggressive software on compact discs (remember those?) designed to frustrate folk trying to “burn” copies of them.

Then in 2011 Sony sued some young hackers who had cracked the code on its PlayStation 3 gaming console so they could run any software they liked, rather than just Sony’s own offerings. That triggered a reprisal from Anonymous, a hacker collective, which brought down Sony’s PlayStation network for several weeks and pinched the details of some 100m accounts. The same year Lulzsec, another “hacktivist” outfit, broke into Sony Pictures’ systems and pilfered account data. This wave of attacks hammered Sony’s share price and led to executives being asked to explain the mess to Congress.

Given all this, one would expect Sony Pictures’ internal practices to meet the gold standard of cyber-security. Yet the firm, which did not respond to repeated requests for comment, seems to have made some elementary errors, including leaving social-security numbers and salary data unencrypted, and storing passwords in a file conveniently entitled “Password”.

More digital damage may yet emerge. “This hack looks like a multi-headed hydra and we may only be in the early days of it,” explains Marc Goodman, a cybercrime expert. Sony Pictures will not be looking forward to any sequels.