Why Is This Happening?
When you think about it, large databases containing the information of millions of people are always prime targets for hackers. This is why the companies and governments that control these databases often run a tight ship (except when they don’t), employing extraordinarily strong measures to secure all their records. It would take an attack with extreme sophistication to rip a hole in the security of these entities. I’m talking about hardware that today would cost millions or even billions of dollars. Of course, very few people have an incentive to make such an acquisition unless there’s a government involved in it somehow. The reason why governments are so hungry for the data of another country’s population is because they have a direct incentive to gather information. Information is power, and acquiring it gives governments leverage over others. Some governments tap data streams sent through the Internet alleging that this would aid efforts against terrorism (the NSA PRISM scandal is one of the largest examples). Again, this is another way states can leverage information that they gather if they so choose.
Who’s Doing Something About It?
Corporations, naturally, have taken initiatives to protect users online by analyzing traffic patterns and spotting where an attack appears to be state-sponsored. Twitter has joined the effort to warn users online that their accounts are being targeted by state-sponsored entities. Microsoft did so at the very beginning of 2016. Despite the lack of any centrally-organized efforts, these companies are attempting to minimize the harm that comes to individuals from the practice of gathering a citizen’s information illegitimately. To determine whether the attack was state-sponsored, one must only look at the level of sophistication. Attempts from individual hackers (even a team) often have very erratic patterns, while state-sponsored hacking appears to be well-orchestrated and brutal with strong hardware that could only be acquired with a large organization’s budget.
What Can You Do?
If you find an email from an official address (i.e. the address Twitter/Microsoft/etc. usually uses to send you notifications) telling you that you may have been targeted by a state-organized effort, you should immediately change your passwords and enable two-step authentication in every service that allows you to. Doing so will minimize the chances that your personal information will be leaked or that you will suffer any financial loss. While we’re talking about solutions, we’d like to hear what you have to say! If you have any ideas on what people should do if they receive such a warning, please leave a comment describing what you think should be added to the action plan.
