Continuing ramifications of the Sony Hack… and privacy lessons to be learned

February 6, 2015 |

There have been no shortage of  lessons to be learnt from the the Sony Hack.  Poor cyber  security and systems layed the foundations for the hack attack.  It was less to do with evil geniuses breaching an impenetriable defence and more to do with inadequate and compromised privacy infrastructure.  There is more to be learnt from the hack, starting with who was responsible.  The suspected origin of the attack has varied from, initially, North Korea to a disgruntled insider to, most recently, Russian as reported in Report Claims Russians Hacked Sony.

The other aspect of the Sony Hack has been the ever widening consequences of the breach.  It acted as a trigger for the President’s call for greater cyber security and improved data breach notification laws.  Now in Amy Pascal: A Cautionary Tale in an Age Without Privacy the reputational impact on breach of individual privacy becomes apparent.  The frank and all too often foolish emails from Ms Pascal were accessed by hackers and disclosed for the world to see.  A glaring lesson in the need for proper privacy protections, as well as a lesson in being careful about what one writes.

The article provides:

From the moment a series of racially insensitive jokes about President Barack Obama and her controversial back-and-forth leaked emails about A-list actors and talent became public, Amy Pascal was widely perceived as a dead executive walking.

Fairly or not, the Sony Pictures studio chief has become a corporate cautionary tale for the digital age. On Thursday, it was announced that Pascal was exiting her perch of more than a decade as gracefully as could be expected, landing a production deal at Sony with the promise of a four-year commitment to back a mixture of critically and commercially oriented projects.

But in her new role, Pascal still has some fence mending ahead of her.

“Her relationships and her effectiveness in dealing with talent had been compromised,” said Hal Vogel, a media analyst. “It’s a healthy move for her and the studio. It’s the kind of thing that requires a shift in leadership and an opportunity to change direction and put all of this behind them.”

Pascal’s replacement at the studio will likely come from within Sony’s current ranks, according to individuals with knowledge of the situation. Among the contenders, TriStar chief and former Fox Filmed Entertainment chairman and CEO Tom Rothman has run a major film studio and Sony production president Michael De Luca has deep relationships with talent, but Columbia Pictures president Doug Belgrad likely has the inside edge. He’s popular on the Culver City lot and has a firm grasp of finances.

As for Pascal, she will remain in place throughout May and will help with the transition. Industry observers and analysts predict that the new production company offers Pascal a chance to restore her damaged brand as a creatively minded executive with a passion for film that’s rare in bottom-line oriented Hollywood.

Dave Logan, author of the book “Tribal Leadership” who teaches leadership at USC’s Marshall School of Business, thinks Pascal can repair her reputation if she re-emerges as an apologetic figure who has learned from her mistakes. “I actually think if she plays this right, she’s going to come out from it at least as strong,” Logan says, adding that people love a comeback story. “If she publicly apologizes and spends time out of the spotlight and appears to have changed. She’ll become one of those figures seen as having depth. I don’t think it’s going to happen right away. But if she approaches it the right way, this can turn into an important learning moment, not a career-ending moment.”

Even before the hack, Pascal weathered rough waters as Sony struggled with profits. After the studio suffered 2013 box office bombs “After Earth” and “White House Down,” hedge fund manager Daniel Loeb wrote a public letter advocating that Sony Entertainment be spun off from its parent company. (Loeb’s hedge fund, Third Point, invests in Variety.)

The public denouncement set off widespread panic and $100 million in cost-cutting — among the casualties, reportedly, was a personal assistant for Pascal who made $250,000 annually. Pascal had been telling her staff that she needed “The Amazing Spider-Man 2? to gross $1 billion to keep her job. The May 2014 tentpole release topped out at $709 million worldwide, and the bad buzz from an “Annie” reboot prompted rumors that Pascal could be pushed out after the holidays.

But the Sony hack turned the business leader into an unwitting celebrity. She suddenly felt the glare of tabloid reporters and TMZ paparazzi, with websites dredging up her salty conversations with producer Scott Rudin about Angelina Jolie and President Obama.

The ordeal that Pascal and Sony went through after leaks of stolen email exchanges, budget information and financial details ordered by North Korea in retaliation for the studio’s Kim Jong-un assassination comedy, “The Interview,” cost the studio $15 million “in investigation and remediation costs,” according to Sony’s earnings report on Wednesday, although it’s expected to have wider ramifications across the corporate landscape.

Pascal’s most shortsighted move, analysts claim, is not that she participated in jokes about the president preferring movies like “The Butler” and “Twelve Years a Slave,” or shared her unvarnished opinions of Harvey Weinstein and Leonardo DiCaprio. It’s that she did it on company email instead of her private address.

“There is no such thing as a reasonable supposition of privacy,” said Brian Solis, a digital analyst at the research and advisory firm Altimeter Group. “Privacy isn’t what it used to be, and in an era of Anonymous and other factions like it, it’s easy to hack into something and expose skeletons in everyone’s closet.”

In a recent Vanity Fair story on the Sony hack fallout, Pascal was described as an obsessive emailer. However, she has tempered her enthusiasm for electronic communication. The magazine noted that she now uses four different devices to communicate and has changed her email addresses and passwords.

That Pascal was widely perceived to be vulnerable during the last months of her reign obscures the fact that she achieved remarkable longevity, having been president of the studio since 1996 and co-chairman since 2006.

“Every studio head is quite aware of the fact that they are fungible,” said Howard Suber, professor of film history at UCLA. “She became the issue. The films are supposed to be the issue, and anything that distracts from that, you’re going to have people say, ‘Do we really need this person?’”

Pascal’s relationships with talent may be strained, and the 56 year-old exec has been on an apology tour of late with people who were maligned in her leaked emails and those of her top lieutenants. Yet, she still has an enviable contact list and is a favorite of top film business players such as George Clooney, Aaron Sorkin and CAA managing director Bryan Lourd, all of whom rose to her defense during the hacking fallout. Insiders say that if she’s to survive as an important Hollywood figure, it will be thanks to these relationships.

Even now, many filmmakers and producers aren’t shy about singing Pascal’s praises. Kenny Ortega, who directed the 2009 Michael Jackson documentary “This Is It,” said Pascal inspires loyalty because of how she nurtures filmmakers. In his case, that meant bolstering him in the wake of the King of Pop’s unexpected death months prior to the release of “This Is It.”

“She pushed me to tell the story,” Ortega said. “I was traumatized and going through a lot of grief at the time. Basically, she said, ‘You need to step out of your own way. You need to find objectivity or don’t do it.’ And at the end of the day, she let me make my movie. She had strong ideas, but at the end of the day, she trusted that I knew the story.”

Ortega says that Pascal has tried to show remorse for what happened. “I think we all make mistakes,” Ortega said. “I think she knows that she blew it with regard to language and correspondence. I think she came out and said, ‘Don’t let this define me.’ We should give her a shot. She’s an extremely talented and gifted woman who has proven herself in the industry.”

The saga of the hack and its impact has been entertainingly described in Vanity Fair’s An Exclusive Look at Sony’s Hacking Saga which provides:

The devastating moment that Amy Pascal and Michael Lynton learned Sony had been taken hostage by vicious cyber-criminals targeting The Interview, was just the beginning of the drama. Mark Seal speaks with Seth Rogen and Evan Goldberg for an inside account of Hollywood caught in the crosshairs.

At 8:30 A.M. on November 24, the Monday before Thanksgiving, Amy Pascal arrived in her office in the Thalberg building, on the Sony Pictures lot, in Culver City, California. Pascal, 56, is among the most powerful people in Hollywood. Having spent 35 years in the trenches—from low-level secretary to her current job as co-chairman of Sony Pictures Entertainment, the global television-digital-and-motion-picture conglomerate—she has earned the expansive third-floor office that was occupied by studio head Louis B. Mayer, in the 1930s and 1940s, when the Sony lot was the domain of mighty Metro-Goldwyn-Mayer, and Mayer was known as “the Lion of Hollywood.” It was on these soundstages and movie sets that Atlanta was burned in Gone with the Wind and Dorothy followed the Yellow Brick Road to Oz. Since Sony and a consortium of investors purchased MGM, in 2005, its films have earned 142 Academy Award nominations, 10 of them for best picture.

The studio’s secrets were safe in Mayer’s day, when they died within the walls of a soundproof telephone room adjoining his office. Pascal believed she didn’t need the soundproof room. Like everyone else in the entertainment industry these days, she communicated through e-mail that was believed to be secure. But this morning, as she began her day, she discovered that a bizarre specter had hijacked her computer. The screen glowed with a blood-red skeleton baring its fangs, and the words “Hacked By #GOP.”

Superimposed over the skeleton was an ominous warning:

We’ve obtained all your internal data including your secrets and top secrets.

If you don’t obey us, we’ll release data shown below to the world.

The “data” below consisted of five links that would turn out to be the internal records of the entertainment giant.

Pascal thought it was a joke. Still, she called Michael Lynton, 55, Sony Pictures’ C.E.O. and chairman, who occupies an office down the hall. He and Pascal have been a team for nearly a decade now; Lynton handles administration and business affairs, leaving Pascal free to deal with the creative side of making movies.

Lynton told her he’d been advised of the skeleton’s threat while driving to the studio that morning, having received a call from Sony’s C.F.O., David Hendler, who explained they’d been hacked by an organization called Guardians of Peace. They were shutting Sony’s entire computer system down, including the network, Internet, and any customer-facing sites, to stop any further damage.

On the previous Friday, November 21, Lynton, Pascal, and several other Sony executives had been sent an e-mail from a group calling itself “God’sApstls,” which included a demand for “monetary compensation” and to “pay the damage, or Sony Pictures will be bombarded as a whole.” On one of the company’s Twitter feeds, the same group had posted a crude depiction of Lynton and Pascal as ghouls in a surreal doomsday backdrop, along with a warning: “You, the criminals including Michael Lynton will surely go to hell. Nobody can help you.”

Neither Lynton nor Pascal had seen those messages—Lynton’s had become lost in his in-box; Pascal’s had gone to her spam.

Now what the 3,500 employees on the lot had started calling “the screen of death” flashed on every computer that was turned on in the massive Sony Pictures Entertainment network worldwide. Employees were instructed to immediately turn off their computers and ensure that their phones and tablets were disconnected from Wi-Fi and not to engage in e-mail or download anything on the company lot.

At that point it seemed like a temporary inconvenience. “A one-day problem,” one Sony supervisor was calling it. For Pascal, it must have seemed too predictable, too “on the nose,” to employ the screenwriting term for dialogue that’s too obvious. So she returned to her workday, packed with meetings with producers, writers, agents, and executives, before the town shut down that Wednesday evening for Thanksgiving.

Such was the opening scene in what would become the entertainment industry’s most hair-raising real-life thriller. The studio had been taken hostage by vicious, unknown cyber-criminals who would release the company’s internal data into the hands of the media, leak by leak, eight giant dumps in all.

The hacking of Sony Pictures would become “an international crisis, the cyber-attack that put Americans’ vulnerability on display, a free speech cause, an Oval Office gut-check, and a cautionary tale for the future of warfare,” says Rich Klein, a partner at the Washington, D.C.-based advisory firm McLarty Associates.

November Surprise

November 24 was a quiet day in Seth Rogen and his production-company partner Evan Goldberg’s office on the Sony lot. Rogen was away; Goldberg was at his computer.

“One of the guys working in editorial rushed in and told me to deactivate the Wi-Fi on my cell phone and iPad,” Goldberg recalls. “I asked, ‘Why?’ And he just said, ‘Sony got hacked! I need to tell everyone else!’ and left to spread the word.”

When Goldberg stepped outside, the usually sunny studio lot looked like a scene from This Is the End—the 2013 Rogen-Goldberg comedy in which the real James Franco throws a party with his real-life pals during the not-real-life apocalypse. “There were messages pinned up all over saying the hack had happened,” adds Goldberg, who joined the technologically adrift employees wandering the lot.

Suddenly it was a pre-Digital Age at Sony. Whoever hacked the company had not only stolen its internal data; they had wiped out everything in their wake. Sony’s e-mail system was down and out, so employees were forced to communicate by paper memos, texts, phone calls from their personal cell phones, and temporary e-mail addresses. The studio’s executives were reduced to using BlackBerrys unearthed from the basement of the Thalberg building.

A command center was set up in a special room in the Gene Kelly building, the soundstage where the dancer’s Singin’ in the Rain had been filmed, in 1951. Key members of Sony’s executive team began holding standing meetings at 9 and 4, to map out a plan of action. But there were few clues other than the company’s computers, which had gone dark except for the skeleton and the warning “Determine what will you do till November the 24th, 11:00 PM (GMT).”

When that time came and passed and nothing happened, Sony’s executives, including Lynton and Pascal, breathed a sigh of relief. “We want to thank you for all your hard work, innovative thinking and positive attitudes as we work to resolve the system disruption that we are experiencing,” read the printed “Message from Michael and Amy” that Sony’s employees received as they entered the studio’s gates on November 25. But it was only the eye of the hurricane.

It was just like a movie, and it was also about a movie. A comedy called The Interview.

Seth Rogen and Evan Goldberg, both now 32, had met in Bar Mitzvah class in their hometown of Vancouver, British Columbia. In their office on the Sony lot both would eventually aspire to go beyond the movie-comedy cliché of “trying to get laid over and over again,” as Rogen once put it, and to focus on something more relevant—without losing the laughs.

Rogen, along with Goldberg, had been a staff writer for Sacha Baron Cohen’s Da Ali G Show. Cohen’s 2006 raunchy comedy, Borat, had proven that a movie could satirize a real country—in Borat’s case Kazakhstan—and get away with it. In 2010, while filming The Green Hornet, Rogen was seized by an idea: “a film about a journalist obtaining an interview with someone infamous and then being approached by the C.I.A. to assassinate that person,” he recalls.

Rogen, Goldberg, and their writing partner Dan Sterling decided there was comedic gold in North Korea and its despot, Kim Jong Il, then 69, who had led what President George W. Bush called one of the three “Axis of Evil” nations. According to the propaganda, Kim Jong Il was born during a double rainbow, learned to walk at the age of three weeks, wrote 1,500 books in college, and composed six world-class operas.

The dictator found escape in movies, eventually shaping his country’s movie industry, “as writer, producer, executive and critic; [he] made the country’s most famous actress, Song Hye Rim, his mistress; and even penned a book called On the Art of the Cinema,” wrote Amy Nicholson in L.A. Weekly. In 1978, Kim—determined to import talent—ordered the kidnapping of a respected South Korean filmmaker and his actress ex-wife and forced them to make propaganda films and a knock-off of Godzilla.

Kim Jung Il “was the perfect villain, not just because of how unusual he was, but because no rational person would ever try to defend him,” say Rogen and Goldberg in an e-mail. “North Korea has one of the worst human rights records on earth and no freedom of speech whatsoever. Once we began researching in earnest, the idea of in some way shedding light on this situation became incredibly appealing.”

They pitched the movie to Sony: a buddy comedy of sorts, in which a vapid entertainment-TV talk-show host, Dave Skylark, played by Franco, and his semi-bumbling producer, played by Rogen, are recruited by the C.I.A. to assassinate Kim Jong Il. “They seemed to love the idea in the room and we left feeling good,” says Goldberg. “Before we even got to the parking lot, they called to tell us they were going to buy it.”

The studio executives’ love came with a caveat. “They just wanted to discuss if it should be about the real [North Korean regime] or a fictitious dictator,” he recalls, “and that we would discuss it as we moved forward.”

On December 17, 2011, Kim Jong Il died of a massive heart attack, and the filmmakers lost the master of propaganda, who had used his government “to solidify the Kim family as god figures,” Rogen and Goldberg say. They needn’t have worried. Only 28 at the time, with close-cropped hair, Kim Jong Un, Kim Jong Il’s son and successor, soon assassinated his uncle for being a “traitor” and “worse than a dog,” and reportedly killed his deputy defense minister for insufficiently grieving over Kim Jong Il’s death.

“We have a file in the building somewhere of all the insane shit they say,” Goldberg told Rolling Stone. Much of that “insane shit” made it into The Interview, including the opening scene, in which an adorable little North Korean girl sings, “Die America, die,” before a vast audience. “Oh please won’t you die? … May your women all be raped by beasts of the jungle, while your children are forced to watch.”

It’s Not Just a Movie

For real-life North Korean children, a large number of whom live without electricity and are chronically hungry, the way out is through math and science, the better to become a North Korean cyber-warrior. The best and the brightest vie for admission to Mirim College, a military school that trains its students in computer sciences. Once students graduate from Mirim, they live in the capital city of Pyongyang, where they are allowed to bring their families, which is “considered the ultimate privilege in North Korea, with better housing, better food, better health care, better everything,” says Robert Collins, of the Committee for Human Rights in North Korea. The graduate is then prepared for one thing when it comes to the U.S.: “Attack, attack, attack. When you say hacking, think about attacking. They want to bring down systems.”

The title of Rogen and Goldberg’s proposed movie was originally Kill Kim Jong Un, but was later softened to The Interview. Still, the debate over setting the movie in the real North Korea and assassinating its real dictator or using a fictitious country continued at table reads of the script on the Sony lot with Rogen, Goldberg, and a team of leading comedians and actors, including Jonah Hill and Sacha Baron Cohen. “We asked the group if they thought it would be a good idea to call the character Kim Jong Un and the consensus was that it would make the movie funnier and more interesting,” say Rogen and Goldberg.

“Backing down from having the dictator in the film be Kim Jong Il (and ultimately Kim Jong Un) seemed wrong,” they add. “That would be like saying, ‘Don’t make fun of Hitler because it’ll piss off Hitler.’ Because Hitler’s power comes from people being too afraid of Hitler to stop Hitler from being such a Hitler. And instead of our film looking back on past events, it could actually tackle something current.”

Amy Pascal loved the script, and she and Michael Lynton went along with Rogen and Goldberg’s insistence that naming the real country and its dictator would provide the movie an indispensable “edge.” In March 2014, The Interview had its “second recruited test screening,” with studio executives present. “The audiences loved the movie, and so the studio was thrilled,” say Rogen and Goldberg.

The trouble started when a teaser trailer of the movie was released, in June. In Tokyo, Sony’s chief executive, Kazuo Hirai, president and C.E.O. of the parent Sony Corporation, was “very much concerned about this film,” according to leaked internal e-mails. Hirai believed the movie could enrage Japan’s volatile enemy and neighbor, and he was right. (Sony is the only studio currently owned by the Japanese, whom the North Koreans have hated since the Japanese occcupation of Korea from 1910 to 1945.)

On June 25, the Korean Central News Agency posted a statement from the country’s foreign minister blasting the U.S. for “bribing a rogue movie maker” to produce a “film on insulting and assassinating the supreme leadership.” The release of the movie would be “intolerable,” “terrorism,” and “a war action.” The minister threatened decisive and merciless countermeasures if the movie was released.

Rogen and Goldberg, who read about the backlash online, were surprised—not by the threat but by the timing. “We knew they would likely say something extreme and confrontational as they constantly do in international politics,” they recall. “But we were surprised that it happened so quickly. We thought maybe once the movie came out, there would be some reaction. We didn’t think the first teaser would be the thing that started it all.”

Publicly, the filmmakers acted as if the threat was cause for celebration. “There was a lot of high-fiving,” Rogen told the Los Angeles Times. “It was exciting!” he recalls. “There was a moment where everyone got in a room and we were like, ‘OK, so that happened … So everyone’s cool? We’re not going to shy away from this?’ ”

Amy Pascal had their backs, but for the first time she received demands from Sony’s Tokyo headquarters to change a movie. “WE NEED SETH TO MAKE ALL THE FILM CHANGES AND THEN PRAY KAZ IS COMFORTABLE,” she wrote in an e-mail. Making Kaz Hirai comfortable meant getting Rogen and Goldberg to soften the final scene, in which the dictator’s head was to explode violently. Rogen was determined not to lose the laugh, he wrote to Pascal on August 15. “The head explosion can’t be more obscured than it is” or the joke wouldn’t work. “This is now a story of Americans changing their movie to make North Koreans happy,” he continued. “That is a very damning story.”

“This isn’t some flunky,” Pascal shot back. “It’s the chairman of the entire Sony Corporation who I am dealing [with].”

After much debate, cuts were made: the assassination scene would be less gory. With Kaz Hirai’s blessing, the movie was moved from fall to Christmas, where it would go head-to-head with big, seasonal releases: Disney’s Into the Woods and Universal’s Unbroken.

While publicly embracing the controversy, Rogen and Goldberg privately sought assurances. They contacted Rich Klein at McLarty Associates, who “walked them through the North Korean pattern of behavior going back to the 1980s.” Klein warned the filmmakers that North Korea is a government-sanctioned participant in terrorism and assassinations that has kidnapped civilians, and that its officials “have acted irrationally when they feel cornered.” How? “A physical strike in the U.S. would be beyond North Korea’s capabilities,” Klein said. “But we firmly believed that the North Koreans could try to stop the movie through a cyber-attack.”

But Lynton had assurances from the Rand Corporation, the global-policy think tank, on whose board he sits, that Sony was safe to release the film. Also, he spoke to the U.S. assistant secretary of state for East Asian and Pacific affairs, who didn’t foresee problems with North Korea over the film.

“Michael, I talked with Amb. King a few minutes ago,” Bruce W. Bennett, a senior Rand Corporation defense analyst, wrote Lynton in an e-mail last June when North Korea began saber rattling. He was referring to Ambassador Robert King, the U.S. State Department’s special envoy for North Korean human-rights issues. “Their office has apparently decided that this is typical North Korean bullying, likely without follow-up, but you never know with North Korea. Thus, he did not appear worried and clearly wanted to leave any decisions up to Sony.” (King did not respond to a request for comment.)

Can You Hack It?

The walls of Sony Pictures Entertainment are tall and white, and until now they have been impenetrable. “We live in a time when there are amazingly few leaks,” Peter Bart, the veteran production executive and former editor in chief of Variety, says of the new Hollywood, where studios are fortresses run by multi-national corporations, whose information is tightly controlled. But it became apparent that Sony’s walls had been breached when, on November 25, four of the studio’s unreleased movies—including Annie but not The Interview—were posted on pirate Web sites.

As Pascal, Lynton, and others rushed to remove the pirated movies from the Internet, the company’s crisis-management team—a group of top executives who had practiced for emergencies, including fires and earthquakes—gathered in the command-post room in the Gene Kelly building.

“Holy shit,” Sony’s C.F.O., David Hendler, told the group. They hadn’t merely suffered a looting of their computer systems but the systems had been destroyed by a “firebomb,” “unprecedented” in the annals of corporate attacks, they would soon be told by investigators.

The day before, when Sony’s computers had first been seized by the screen of death, company executives called FireEye, Inc., the cyber-security firm whose C.O.O., Kevin Mandia, is arguably America’s premier cyber sleuth. Within 24 hours, nearly a dozen of Mandia’s best investigators arrived on the Sony lot from their offices across the country. “You’d love to think it’s guys getting out of black cars with shades on in their black suits,” Mandia says. “But it’s guys getting out of their own cars with their laptop bags and a bunch of special cables and specialized software.”

Meanwhile, a team of F.B.I. operatives mobilized to track down what the bureau’s director, James Comey, would later compare to its former nemeses John Dillinger and Bonnie and Clyde, only now able to “do a thousand robberies in all 50 states in the same day from their pajamas from Belarus.”

“Everybody is sitting around a desk, food being brought in, working almost 24/7, everybody’s analyzing…. It’s a quiet room until somebody finds something,” Mandia tells me of his team, which was working both in the Gene Kelly building command post and at Corporate Pointe, near LAX. The first clue arrived at 9:11 A.M., Saturday, November 29, when Kevin Roose, a 27-year-old senior editor at, was one of several journalists who received an odd e-mail:

Hi, I am the boss of G.O.P.

A few days ago, we told you the fact that we had released Sony Pictures films including Annie, Fury and Still Alice to the web.

Those can be easily obtained through internet search.

For this time, we are about to release Sony Pictures data to the web. The volume of the data is under 100 Terabytes.

What followed were links to data that had been posted on the anonymous sharing site Pastebin, along with a password, “diespe123.” Roose almost hit Delete. Surely, he thought, it was spam. But he opened it “on a whim,” and there in neat, labeled folders were 26 archives of what he would call an “insane” trove of Sony Pictures internal information. Most tantalizing was a spreadsheet of Sony employees’ salaries, including those of its top executives.

He e-mailed Sony’s communications department to check on the legitimacy of the data. No response. On December 1, Roose posted the first story about the dump. HACKED DOCUMENTS REVEAL A HOLLYWOOD STUDIO’S STUNNING GENDER AND RACE GAP, read the headline. The story revealed that 15 of Sony’s highest-paid executives were white and all but Pascal were male.

The next day Roose posted a second story about the leak, which, he wrote, included “a spreadsheet listing the names, birth dates, and social security numbers of 3,803 Sony Pictures employees, including all of the company’s top executives…. A spreadsheet listing Sony Pictures employees who were fired or laid off in 2014 as part of the company’s reorganization along with reasons for their termination … [and] detailed performance reviews.”

Now Sony’s employees, whose confidential information had been leaked, were “coming to work afraid,” one executive recalls. Disturbing reports began arriving: one employee was alerted that someone was using her credit-card number to buy handbags on Rodeo Drive; another was advised that someone was trying to apply for a new credit card in his name, using his bank information.

The studio’s crisis-management team set up “concierge desks” in front of some of the buildings named for the legends who had worked there: Gable, Garbo, Garland, Stewart, Hepburn, Crawford. Employees lined up to get help with credit protection and fraud alerts, and with setting up new e-mail and phones. The F.B.I. came in to give victim counseling and seminars on identity theft.

But no concierge desk could make things right for Sony’s executives as the sky fell upon them with one humiliating revelation after another, eight leaks in all, with an estimated 38 million files. It seemed the hackers knew what would “draw the most blood,” as screenwriter Aaron Sorkin would later put it. They used the media as their messenger, e-mailing alerts to writers at various Web sites—Gawker, BuzzFeed, Mashable, the Verge, Re/code, the Daily Beast, and others—directing them to the file-sharing sites where they could download the latest, which would eventually include: negative employee feedback; personal information, including Social Security numbers, for the studio’s employees and stars; profit-and-loss statements of films and television shows; pilot scripts for upcoming Sony television shows and movies, including a script of the newest James Bond movie, Spectre; and countless e-mails.

“It’s your false [sic] if you think this crisis will be over after some time,” the hackers wrote in an e-mail to Sony upon the release of their third dump, on December 5, by which time considerable sensitive data had been published in the American media in what Lynton would call “a feeding frenzy.”

On most days, Lynton ate lunch in Sony’s commissary, his table open to whoever wanted to sit down and talk. He was a patient executive, a Harvard Business School graduate, fluent in four languages, whose professional life had been spent solving problems head-on. But now he didn’t have answers for his employees who sat down at his lunch table. He didn’t even know who their enemy was. “There is no playbook for us to turn to,” Lynton would tell them in two “all hands” meetings during the crisis.

A terrifying threat had been planted in that December 5 e-mail from “the head of GOP,” which many Sony employees had received on their handheld devices and personal computers: “Please sign your name to object the false [sic] of the company at the email address below if you don’t want to suffer damage. If you don’t, not only you but your family will be in danger.”

Now the threat was personal. But Lynton, Pascal, and other Sony executives were still unsure of the reason. “They haven’t demanded anything,” they kept telling one another. Then, on December 8, the demand arrived from the G.O.P. in a message to Sony’s staff: “Stop immediately showing the movie of terrorism which can break the regional peace and cause the War! You, SONY & FBI, cannot find us. We are perfect as much [sic].”

The Interview.

Pascal immediately advised Rogen, Goldberg, and Franco about it, and she stayed in contact with them on an hourly basis.

You’ve Got E-mail

On the Saturday before the hack, Pascal had reveled in the three loves of her life: family, friends, and movies. She e-mailed a former Sony employee (“Boy do we miss you”), assured a famous actor that she hoped to work with him soon (“still have a lot of my fingers crossed”), and reminded a longtime colleague how much she loved making movies with him.

She and her husband, Bernie Weinraub, a former entertainment writer for The New York Times, were looking forward to another Thanksgiving with their teenage son, Anthony. (“We are making cookie people all afternoon if you wanna bring the girls over,” she e-mailed a fellow Sony executive, extending the invitation to several others.)

On December 8, the G.O.P. dumped its fourth payload, which included Pascal’s Microsoft Outlook e-mail folders—and her world fell apart. She was in her office when someone told her the news: “They have your e-mails.”

Oh, no.

Pascal is an inveterate, exuberant, uninhibited communicator, a maestro of the e-mail art form, corresponding 24–7 by desktop, laptop, and smartphone (Sony Xperia, of course). Too many to count. Write. Send. Forget. But overnight the technology had become a weapon, and the hackers were releasing the studio chief’s unmediated thoughts and words in an attempt to humiliate her.

She combed her memory for indiscretions, and then called—not e-mailed—everyone she could think of who might be affected. She warned them that e-mails might surface containing things she may have said in a moment of anger, frustration, or disappointment. She hoped it helped that she was telling them in advance.

As the most damaging bits from 5,000 of her e-mails were posted on various news and entertainment Web sites, the business of Hollywood stopped while industry insiders clicked on the Web sites that posted the worst.

“I tried not to look, but … ,” a Hollywood agent told me during Sony’s weeks from hell. “When the nude pictures of Jennifer Lawrence came out online, I didn’t click on them. On the principle of it, I just hit Delete.” But when Pascal’s e-mails came rolling out in an unrelenting wave of brutal disclosure, few could look away. “We always say, ‘I’d love to be a fly on the wall,’ and these e-mails made us privy to all these conversations,” the agent continued. “On principle, it’s wrong. If the tables were turned, in a million years I would not want anyone to read my private correspondence, but … ”

Some of the most explosive revelations were the fiery exchanges between Pascal and her former boss and 30-year colleague, the petulant, assistant-terrorizing producer Scott Rudin. In their e-mails, Rudin dragged Angelina Jolie through the muck, calling her a “spoiled brat” and a “camp event” with a “rampaging spoiled ego.”

These and other e-mails were written and received at all hours, from Pascal’s home, office, car, and even, at one point, from Rosh Hashanah services. Overnight, she became the face of the hack: for some she was its sinner, for others its saint. But she was usually embraced by actors in their e-mails to her. “Everyone says this about Amy: ‘She’s talent-friendly,’ ” notes one studio executive. “And now the very thing that is her stock-in-trade could be the very thing that brings her down…. The lapse in judgment happened when they decided to call him by name,” the executive says, referring to Kim Jong Un. “Anybody would have said, ‘This guy’s a lunatic and you’re going to run into problems.’ Their failure was to let Seth Rogen and [Goldberg] go ahead with this…. It’s a movie! And not necessarily a good one!”

On December 10, BuzzFeed published an exchange between Pascal and Rudin, in which Pascal asked Rudin what she should ask President Obama when she saw him at a fundraising breakfast in Los Angeles organized by Jeffrey Katzenberg, the C.E.O. of DreamWorks Animation SKG. “Should I ask him if he liked DJANGO?,” Pascal wrote in what she would later call “a lapse in my thinking.” “12 years,” Rudin replied, meaning 12 Years a Slave. To which Pascal replied, “Or The Butler … ” It was private, spur-of-the-moment banter between two old friends and colleagues, but when it became public it roared across Hollywood like a brush fire. On the night of the leak, Pascal, who supported Obama in both elections, called Lynton at home. Upset? No, devastated. Both Pascal and Rudin publicly apologized, Pascal in two emotional meetings with Sony’s entire 3,500-member Culver City staff. Always relentlessly proactive, she called the White House to apologize, and then called Al Sharpton, who had, upon the disclosure of the Obama e-mails, publicly lambasted Pascal.

She died a thousand deaths but was determined to focus on her work and her employees, although she did cease e-mailing. Cold turkey. But only briefly. Then she cheated and was back on her keyboards again, although cautiously and using a personal e-mail account. She relentlessly read everything about herself, her company, and the hack, online and in the papers, until she finally stopped herself from doing so. Only sleep brought her respite—nothing interferes with Amy Pascal’s sleep—but in the morning it would all begin again.

At the height of the hack, the vociferous Scott Rudin—whose e-mails are famously so Shakespearean, a friend says, that Rudin has received an offer to publish them—called Michael Lynton. Perhaps to explain? Or apologize? Lynton, not wanting to become involved, didn’t take the call.

The hackers had, with the release of the Obama-related e-mails, isolated Amy Pascal from some who might have otherwise supported her. She received calls, flowers, and letters of support from too many people to name. But these were private defenders, and no one seemed eager to step up publicly. “Sony publicity asked a producer, who is high-profile and can be outspoken, to speak in support of Amy,” recalls a Hollywood agent. “The producer took a pass. Because there were still thousands of e-mails to be released, this producer didn’t want to take a stand when two days later another damaging e-mail could be released.”

Two men came forward to support Pascal and Sony. “I’m going to write something,” Aaron Sorkin, the screenwriter of The Social Network, told her. Sorkin had himself been maligned in the hack, but he considered the e-mails “minor insults” in a bigger picture. “The Sony Hack and the Yellow Press” was the title of the op-ed piece by Sorkin published in The New York Times on December 14. In it, he blasted the media as conspiring with the hackers and defended Pascal and the other victims of the hack, insisting that, because their e-mails contained no evidence of any Sony wrongdoing, the media outlets that distributed their private correspondence were “morally treasonous and spectacularly dishonorable.”

George Clooney, who has a production deal with Sony, had a lunch scheduled with Pascal, which just happened to fall at the height of the hack last December. They met in the Sony commissary, and Pascal asked Lynton to join them. Once they sat down, Clooney mentioned a petition he had written with his agent, Bryan Lourd, the powerful managing director of Creative Artists Agency. “This is not just an attack on Sony,” they wrote. “It involves every studio, every network, every business and every individual in this country…. We will stand together.”

Clooney said that he and Lourd wanted the leaders of film and television studios, music companies, and other industries to sign the petition to show solidarity.

“Nobody stood up,” Clooney would tell Mike Fleming Jr., of, who published the petition online. Not one studio head, talent agent, movie, television, or music executive would sign his petition. Not even the Motion Picture Association of America, the trade organization that represents the six major Hollywood studios, would come to Sony’s defense. (Executives at two studios I contacted claimed they hadn’t received the petition. “I wouldn’t have signed it anyway,” says one industry leader. “I don’t think it’s our responsibility to do something for Sony. They’re our competitors.”)

On December 16, Sony’s C.F.O. called Michael Lynton. “We’ve just received an e-mail,” he said, which he read to Lynton over the phone.

Soon all the world will see what an awful movie Sony Pictures Entertainment has made.

The world will be full of fear.

Remember the 11th of September 2001.

We recommend you to keep yourself distant from the places at that time.

(If your house is nearby, you’d better leave.)

The eighth data dump, which followed, included Lynton’s own e-mail folder. But he wasn’t concerned about that. The mention of 9/11, however, ratcheted the action higher. The studio immediately provided security for The Interview’s producers and stars. Co-producer Evan Goldberg was filming an episode of Joseph Gordon-Levitt’s television series, HitRecord on TV. “One second I’m talking to people at Sony to arrange bodyguards to be sent to my house, the next I’m directing David Krumholtz to pretend his dick is a gun and that he’s shooting bottles out of the sky,” recalls Goldberg.

Rogen was in New York with James Franco, on the last leg of The Interview media tour. “I was scheduled to be on Fallon, Meyers and more,” he said. “As soon as the threats came in, all my press was canceled.”

The first theater cancellation was Landmark’s Sunshine Cinema on Manhattan’s Lower East Side, where The Interview’s New York premiere was to be held. “We found out online that the theater for our premiere in New York was pulling out,” recall Rogen and Goldberg. “Seth was on a flight back to LA but I was at Sony and managed to get in touch with the studio [executives],” adds Goldberg. “They said they were going to try and find a replacement location and would proceed as planned. A few minutes after that, I found out the first major theater chain had completely pulled out. And then it was like a horrifying game of dominoes.”

Even though the U.S. Department of Homeland Security would say it had no “credible intelligence” of a plot against movie theaters in the U.S., the major theater chains, concerned for the safety of their audiences, opted out en masse. On December 17 Sony issued a press release: “In light of the desire by the majority of our exhibitors not to show the film … we have decided not to move forward with the planned December 25th theatrical release.”

A firestorm erupted on Twitter. “Disgraceful,” director Judd Apatow tweeted. “A terrifying precedent,” added Jimmy Kimmel. “Hard to believe this is the response to a threat to freedom of expression,” wrote Ben Stiller. “The hackers won,” declared Rob Lowe. “Dear Sony Hackers: now that u run Hollywood … ,” wrote director Michael Moore. Rogen and Goldberg remained publicly silent but were privately devastated. “For a moment it truly seemed possible that our movie might just cease to exist,” they tell me. “It seemed like a rash decision born out of fear. It was disappointing that the immediate reaction was to do exactly what the criminals wanted.”

They called Sony’s executives and “implored them to offer any theater that wanted to show the movie the opportunity to screen it,” Rogen and Goldberg recall. “We felt it was important to make it available to any theater that wished to. Even if ultimately nobody showed it, we felt it was an important statement to make for our film and for freedom of speech. They assured us it would be released.”

On December 19, the F.B.I. issued a statement saying it had enough evidence to conclude that the government of North Korea had been behind the hack. How did they know? In 2010, the U.S. National Security Agency hacked into North Korea’s computer network, according to The New York Times. The purpose: to track the country’s nuclear-arms program. But when North Korea knocked out almost 50,000 computers at South Korean banks and media companies in March 2013, the focus shifted to cyber-warfare. North Korean four-star general Kim Yong Chol reportedly had given the order to go after Sony, and members of the country’s elite hacking unit, 6,000 hackers strong, based in both North Korea and China, began “spear-phishing,” sending e-mails that, with one click by a Sony employee, would allow the hackers access to, and eventual control of, Sony’s computer network. Without raising the suspicions of the National Security Agency—accustomed to North Korea’s constant barrage of phishing—the hackers spent from September to mid-November of last year “mapping Sony’s computer systems, identifying critical files and planning how to destroy computers and servers,” according to the Times, before identifying themselves as the G.O.P. and launching the attack that shut down Sony.

That same day Lynton was in the CNN greenroom in the Time Warner Center, in New York, preparing to be interviewed by Fareed Zakaria, when President Obama came on the greenroom television screen for his year-end press conference. Lynton was surprised when the president was asked about Sony’s not moving forward with The Interview, and he was dismayed by the president’s response. “I think they made a mistake,” said Obama. “I wish they had spoken to me first. I would have told them, Do not get into a pattern in which you’re intimidated by these kinds of criminal attacks.”

A pit grew in Lynton’s stomach. He had contacted the State Department about the movie in June, the script had initially been shown to a member of then secretary of state Hillary Clinton’s staff, and Lynton had spoken to someone at the White House about the film just three days previously, to ensure that the Sony hack was receiving adequate attention. He had expected Obama to say that he was going to respond to North Korea or whoever had hacked Sony and that the White House would come to Sony’s aid. He was wounded and disappointed, but Lynton showed little emotion on CNN. “We have not caved,” he said. “We have not given in. We have persevered.”

President Obama’s public rebuke was like the arrival of the cavalry for Rogen and Goldberg. “It was surreal and thrilling,” they tell me. “It gave Sony the momentum they needed to get the movie out there.” What Lynton hadn’t revealed, to either the filmmakers or CNN, was that as soon as the theaters dropped the movie he had begun seeking alternative distribution avenues. First, he called several major cable operators and satellite providers, hoping to distribute the movie by pay-per-view. But none of them wanted to put their own systems in jeopardy; neither did the larger digital platforms. Finally, Lynton thought of someone who had the capability to release the movie online and who might be supportive of Sony’s plight. He called Google’s executive chairman, Eric Schmidt.

Google had survived cyber-attacks from other countries, so Schmidt felt confident that it could withstand a hack as strong as the one that had decimated Sony. Schmidt agreed to help. Google’s systems were capable of “taking the load” of streaming the movie to millions of viewers.

On the Tuesday before Christmas Schmidt and his team were on the Sony lot, preparing for the launch. By December 24, Lynton also had a commitment from Microsoft’s Xbox Video. Independent theaters across America were also eager to show the picture. The Interview was going to get its Christmas release after all.

On Christmas Eve, Lynton went to lunch in the Sony commissary. The studio was down to a skeleton crew as I.T. workers continued to repair computer systems. It was a month to the day since the hackers had invaded Sony with their “screen of death.” But the studio was still very much alive and still in the business of making movies. Lynton got a sandwich and, as always, sat down at one of the commissary’s communal tables. Soon, employees starting coming over. Some shook his hand. Others said they were proud to be a part of the company.

At 10 A.M. Pacific time on December 24—purposely during the day, so that Google’s sizable tech team could respond to any sign of attack—The Interview went online. It was rented or purchased 2 million times in the first four days ($5.99 to rent and $14.99 to own). Many of the independent theaters across America that showed the film were sold out. By late January, the movie had become the best-selling online release of all time, earning $40 million in online sales, and was streaming on Netflix.

Today, Amy Pascal’s e-mails are shorter and safer. For security reasons, she’s using four separate handheld devices, with various names and passwords. But while her e-mails have diminished, her passion for the movies has not. She returned to work on Monday, January 5, the town clamoring to work with her, or for her. Some insiders are cynical about the support, so late in coming. “I guarantee you, somebody who is telling Amy Pascal that they’re there for her and ‘Please let me know if there’s anything I can do’ is, on the side, angling for her job,” says a rival studio executive.

But Amy Pascal does not act as if she’s going anyplace anytime soon. She is excited to be developing Ghostbusters 3, an all-female version of the 1984 hit comedy, which she feels will become the studio’s first female franchise.

Elsewhere in Hollywood there is a new wariness of electronic communication. “Everybody’s scrubbing down, checking for compromising e-mails,” says one veteran producer. “Delete, delete, delete.”


One Response to “Continuing ramifications of the Sony Hack… and privacy lessons to be learned”

  1. Continuing ramifications of the Sony Hack… and privacy lessons to be learned | Australian Law Blogs

    […] Continuing ramifications of the Sony Hack… and privacy lessons to be learned […]

Leave a Reply