Held Hostage: Why Cyber Attacks Against Film and Media Industries Are on the Rise

• Author: Keisha M. McClellan - H. Drew McClellan
• Position: Keisha M. McClellan (kmcclellan@kentlaw.iit.edu) is the former head of creative for The Oprah Winfrey Show and an award-winning television producer. She is currently a second-year law student at Chicago-Kent College of Law with a deep interest in the intersection of intellectual property, digital media, and data privacy; a member of the Moot ...
• Pages: 18-65

Published in Landslide® magazine, Volume 10, Number 4 , a publication of the ABA Section of Intellectual Property Law (ABA-IPL), ©2018 by the American Bar Association. Reproduced with permission. All rights reserved.

This information or any portion thereof may not be copied or disseminated in any form or by any means or stored in an electronic database or retrieval system without the express written consent of the American Bar Association.

By Keisha M. McClellan

and H. Drew McClellan

Image: iStockphoto

Published in Landslide® magazine, Volume 10, Number 4, a publication of the ABA Section of Intellectual Property Law (ABA-IPL), ©2018 by the American Bar Association. Reproduced with permission. All rights reserved.

This information or any portion thereof may not be copied or disseminated in any form or by any means or stored in an electronic database or retrieval system without the express written consent of the American Bar Association.

companies are particularly vulnerable. Technological

advances enable media companies to achieve more output

with less production expense, but such efciencies create new

access points for would-be hackers.3 Ironically, technologi-

cal innovations that transformed the lm and media industries

have also lowered the barrier to safeguarding intellectual

property. Digital cameras enable photographers and direc-

tors to shoot footage for longer hours with less outlay: tape

and lm stock expenses substantially decrease with the use of

digital photography equipment. Additionally, digital editing

systems and software create new efciencies by storing huge

quantities of content in a digital format. But this means the

prized content of a studio is being stored on a platform that

may be easily compromised.

Further, studios’ age-old production model of partner-

ing with external experts in areas such as special effects,

graphics, and audio mixing creates additional nefarious

opportunities for cyberattackers. Cyber thieves hope that

“lax network security at these vendors will allow easy access

to content that they can hold hostage for a ransom.”4 Grady

KeishaM. McClellan (kmcclellan@kentlaw.iit.edu) is the former head of creative for The Oprah Winfrey Show and an award-winning

television producer. She is currently a second-year law student at Chicago-Kent College of Law with a deep interest in the intersection

of intellectual property, digital media, and data privacy; a member of the Moot Court Honor Society; and a founding member of the Cyber

Security and Data Privacy Society. She also holds an MA in broadcast journalism from the University of Missouri. H. Drew McClellan

(McClellan_Drew@lacoe.edu) is chair of the cinematic arts department at the renowned Los Angeles County High School for the Arts

(LACHSA). He holds an MFA from the University of Southern California’s Graduate School of Cinematic Arts, has studied global media

industries in Beijing, China, at Peking University/London School of Economics, and is an accomplished writer, director, and producer whose

work has aired on Netix and Viacom, as well as at the NYLA International Film Festival.

I ntellectual property (IP) theft is rapidly becoming a

favored currency for cybercrime. The data breaches

of nancial and other sensitive information records

of companies such as Equifax, Anthem, JPMorgan

Chase, Merck, and the global shipping rm Maersk

dominate news headlines and threaten to bring cor-

porate America to its knees.1 According to the

Organization for Economic Cooperation and Devel-

opment, “U.S. brands and patents are more likely

to be infringed than those of any other nation,

making up as much as 20% of all goods

seized in the global counterfeit trade.”2 This

article examines a startling new trend in

cybercrime: hackers are going beyond

the theft of consumer data and nan-

cial information and now are holding

the intellectual property of prominent

lm and media companies hostage.

Why hackers are increasingly tar-

geting media intellectual property

Why Cyber Attacks against Film and

Media Industries Are on the Rise

on a global scale, why attorneys

and the companies they represent

should view avoiding these attacks

as strategic risk management, and

what approaches can ameliorate the

impact of such inevitable hacking will

be addressed.

Reliance on Digital Platforms

and External Vendors Increases

Vulnerability to Cyber Theft

With the increased frequency and scale of

twenty-rst-century piracy, lm and media

Summers, chief technology ofcer at information security

rm FireEye, says, “Hackers have realized you might have a

very well-funded security program at a Disney or Comcast,

but if you step down the supply chain, you’re going to nd a

special effects crew or a sound editor who doesn’t have good

security.”5

Film and media companies’ modern-day reliance on

digital technology and external creative increase their suscep-

tibility to IP theft. Digitalization of the industry may carry

the benets of time and cost efciency, but it also carries the

burden of increased risk of cyberattacks. Years ago, would-be

content pirates required actual physical access to a rough-

cut of a pilot or movie to do damage. But that is not the case

Published in Landslide® magazine, Volume 10, Number 4 , a publication of the ABA Section of Intellectual Property Law (ABA-IPL), ©2018 by the American Bar Association. Reproduced with permission. All rights reserved.

This information or any portion thereof may not be copied or disseminated in any form or by any means or stored in an electronic database or retrieval system without the express written consent of the American Bar Association.

now. By example, when a group known as “thedarkoverlord”

hacked and released 10 new episodes of Netix’s popular

series Orange Is the New Black on the media-sharing website

Pirate Bay, industry insiders worried which network would be

next as the hackers teased on Twitter, “Oh, what fun we’re all

going to have.”6 In its statement regarding the hacking, Net-

ix noted that “[a] production vendor used by several major

TV studios had its security compromised.”7

The Pool of Potential Cyber Thieves Is More Diverse

The digital world of content collection and storage has

democratized the IP threat. Film and media intellectual prop-

erty face cyber threats from a myriad of bad actors. Cyber

thieves can compromise a media company’s system with

fewer resources than were required in the past, because a

satchel of money to bribe executives or an elaborate physical

intrusion plan is no longer needed. This means that cyber-

criminals can operate as part of an elaborate criminal network

or a small or solo operation from many remote corners of the

world. In sum, technological innovations can lower the bar-

rier of cybercrime deterrence.8

In their New York Times op-ed piece, DennisC. Blair and

Keith Alexander lament that “intellectual-property theft costs

America up to $600 billion a year,” and that “China accounts

for most of that loss.”9 A string of embarrassing hacks of

social media accounts for the CEOs of Facebook, Google,

and Uber by OurMine has purportedly linked back to a Saudi

Arabian teenager.10 And for North Korea, ultimately linked

to the notorious Sony hack of 2014 and the 2017 global ran-

somware attack called WannaCry, cybercrime is “an almost

perfect weapon for a Pyongyang that is isolated and has lit-

tle to lose.”11 Thus, from foreign nation-state hackers to lone

cyber wolves, IP theft has the dubious distinction of poten-

tially leveling the playing eld between lesser-resourced

criminals and corporate America.

IP Theft Is Valuable and Easy to Commit in the

Digital Age

The lm and media industries’ deep nancial pockets and the

contemporary ease of stealing and ransoming content hint

as to why these industries are increasingly more attractive

to cybercriminals (see g. 1). When asked why he robbed

banks, infamous bank robber Willie Sutton replied, “Because

that’s where the money is.”12 So, too, with lm and media

industries. The sheer size and inuence of movie studios and

media companies make their loss of content a signicant

loss nancially and competitively with regard to other indus-

try players. Film and media companies are desired targets

because they are content powerhouses with global audi-

ences. “The thieves are aiming for quality now, not quantity,

and with Hollywood studios, especially those with massive

fan bases, there’s a lot of potential for payments.”13 Plus,

would-be cyber criminals can strike “without putting a lot of

resources into their attacks, potentially making them worth a

try even if they don’t have a high chance of success.”14

Intellectual property is primarily valuable for the rights it

prohibits others from having. “Elusive as intellectual property

boundaries are, the business value they secure is enormous,”

says renowned IP expert, author, and Stanford Law professor

Paul Goldstein.15 Because the lm and media industry busi-

ness model is dened by IP content, cyberattacks can threaten

the very core of a studio’s brand reputation and livelihood:

the devaluation of a media company can occur in the after-

math of a high-prole breach incident. For instance, “Verizon

reached new terms for its acquisition of Yahoo and exacted a

$350 million discount toward its purchase price because of

the Russian hacks.”16

The Technology or Motive Itself Can Serve as a

Serendipitous Shield

At times, damage control from a breach incident can result

surprisingly from a hacker’s lack of strategy. A hacker’s post-

ing of unreleased episodes of a popular Netix show had little

effect because the pirated episodes were not easily accessi-

ble to the general public. In essence, if a show “lands on The

Pirate Bay and nobody watches, did it really stream?”17 Addi-

tionally, sometimes a breach incident may be orchestrated to

aid a company in discovering important vulnerabilities. Our-

Mine, a group known for compromising the Twitter accounts

of Facebook’s Mark Zuckerberg and Google’s CEO Sundar

Pichai, claims its hacks have a positive purpose: “[W]e are

just trying to tell people that nobody is safe.”18

Drivers of Increased Risk in Film and Media Industries

Financial Diversity of

Potential Thieves Technological

• Magnitude of nancial stakes

– Value of IP to lm and media

companies

– Revenue impact potential:

earnings erosion and stock price

• Ratio of ransom payments and value

of IP to owners

• Time sensitivity of IP (lm, TV, and

streaming show releases)

• Increased number of potential

cyber thieves/hackers

– Activists

– Disrupters

– Governments

– Financial gain seekers

• Wide variety of theft entry points

for potential cyber thieves via

outsourced vendors

• Emergence of “opaque” payment

mechanisms (cyber currencies)

• Proliferation of hacking software

and ransomware

Figure 1