PSN Not Secure Enough, Says Japan

See the original here.

Sometimes you just can't get no respect. Sony's bringing PSN back around the world... except for Japan, where the government wants more security measures in place before they'll allow PSN to come back. I guess we're not entitled to as much protection as Japanese consumers deserve.

This is all going to make a great PR case study someday. Perhaps not as much fun as Facebook attempting to use a PR agency to dish dirt on Google, but instructive nonetheless. (Though reading the sordid tale of Facebook and PR giant Burson-Marsteller is highly entertaining in an oh-my-god-did-they-really sort of way.)

PSN Coming Back, But Sony Isn't Secure

Encouraging hackers to create more downtime?

Two stories at odds with one another...

First off, Sony is bringing back the PlayStation network... actually, PSN should now be up for everyone. You'll need to download a software update, and of course you should be changing your password, but now you can enjoy your PSN goodness again after nearly a month without it.


Second, how secure is it really in Sony's network? Reuters did some investigating, asking the CTO of the partially government funded US Cyber Consequences Unit to check out Sony's security. He found numerous problems just by doing some Google searches, locating servers, files, and sensitive areas that should have been locked down. Reuters was kind enough to tell Sony about what they found, so hopefully those areas have been secured now. Still, being able to just Google and find a security management console for A Sony web site is disturbing.

At least Sony has brought back the network and they can try to move past this nasty little incident and hope that everyone forgets all about it, preferably before E3 takes place. I suppose it can happen, given how everyone was able to look past the Red Ring Of Death problem that Microsoft had with Xbox 360's. Of course, in that case it was pretty clearly a hardware design issue, and once they changed the design the problem mostly went away. It's not exactly the same with network security. We all hope Sony has learned a thing or two about locking down networks against hackers, but how can we really be sure?

Sony has announced a bunch of freebies for customers to try and make up for the problem, and I'm sure the customers will probably not hold it against Sony for long. At least, that should be true if no unusual charges show up on their next credit card statements. The bigger issue for Sony is the developers who lost a lot of money from the outage. Perhaps they are being handled quietly, individually, and being asked not to comment further. But Sony does need to make some public gestures to reassure potential developers that they will not lose money being PSN developers.

Sony, Running Out Of Feet, Shoots Itself In Another Appendage

It only does everything.

Just when you think Sony's had enough time to figure out how to talk to people about the PSN/SOE hack attack, they issue another public statement and you think "Have these guys learned nothing?" This time, Sony is attempting to deal with developers. You know, those companies that provide the games that are sold on PSN... those companies who have seen their PSN revenue drop to zero for the last three weeks, with no end in sight.

Apparently there's been no official communication from Sony to developers regarding the outage until a couple of days, ago, when VP of Publisher Relations Rob Dyer sent out this email. It's worth reading as an example of how not to communicate in a crisis. Let me summarize the contents of the letter for you: "We had a big break-in and customer data was compromised. We deeply regret that this occurred. We are sure it won't happen again, and thanks for your support. We'll keep you updated."

Let's start with the fact that this email was sent out, not on day two or three of the outage, but after more than three weeks of outage. Good communication? That's an insult. Sure, I bet all the developers were in communication with their account executives at Sony about the issue, and were getting information. But that's back-channel stuff, not Official Word. Not something you can take to your investors or shareholders to explain what happened to your revenue numbers this month. Or when that might stop.

As to the content, Sony didn't tell developers anything they didn't already know about the break-in or the outage. Sony didn't even really apologize; they just "deeply regret that this incident has occurred." Nice use of the passive voice there, Sony, to avoid taking any responsibility. Maybe the lawyers wanted them to avoid any language that might open them up to a lawsuit. I don't know whether that will work, but certainly it's not helping make anyone affected feel any better.

Finally, you'll note the important thing that's missing from this letter: Any mention of recompense to the developers for the lost revenue. Or, indeed, any mention of revenue, even obliquely. If you have lost thousands, or hundreds of thousands, or maybe even millions of dollars because of lost sales, you might be a trifle peeved that Sony isn't mentioning that fact.

Microsoft, if they haven't already done so, should be communicating with all the PSN developers and saying something like this: "Hey, put your games on Xbox Live and we'll guarantee we don't have an outage. In fact, we'll back that up by promising to pay you the average daily sales you normally get if any outage ever does occur." Microsoft could probably even get an insurance policy to cover those costs for them.

Sony should, in fact, be telling their developers that they'll be recompensed for their lost revenue. Hell, they should have told them that on Day 1 of the outage. Any developer that looks at creating a PS3 exclusive title for download will doubtless conclude that's just stupid, because then you might lose a month of revenue with no warning. At least if your title is on Xbox Live as well as PSN, you'll only lose part of the revenue. With this logic, PSN will not be seeing exclusive titles... which loses an advantage to Microsoft. Bad play, Sony.

Sony still gives the impression of floundering, after three weeks of crisis. It's going to be a very difficult E3 for them; I hope they get their act together soon. But hope is fading after three weeks... this incident is going to have long-term damage to the Sony brand, I fear.

Sony's PSN Outage Costing Developers

Will Sony debut a new PSN logo at E3? Probably not this one.

Sony's still not ready to say exactly when the PlayStation Network will return,,, they are still conducting "comprehensive system checks". A report from Bloomberg pegged May 31 as the date, but Sony has denied there's a firm date for PSN's return. Perhaps... but the pressure is growing on Sony every day that passes.

It's not just 100 million gamers annoyed at Sony for allowing hackers to get to their data; it's developers who sell products on PSN. That is, they used to sell products on PSN, and they hope to do so again someday. Meanwhile, they are not making any money. In some cases, this is a substantial hit; Capcom has gone on the record as saying the PSN outage is costing them hundreds of thousands of dollars, possibly into the millions. (Damn, does this mean the price of smurfberries is gonna rise? Maybe you might want to purchase a wheelbarrow or two.)

They're not the only ones; Q-Games, developer of PixelJunk, says they're losing a lot of money, too. While Sony has announced some efforts to compensate gamers for the lost network time, nothing has been announced so far to help developers. Maybe Capcom can absorb a million dollar loss, but they aren't happy about it; smaller developers who may be more reliant on the revenue from their PSN games could be seriously hurt.

Game developers are no doubt starting to wonder if they should be investing resources in PSN games if the service is going to be unable to generate revenue for weeks or months at a time. Or if that's deemed unlikely to happen again, if they've been hurt by Sony and not properly assuaged, perhaps they may just put their efforts into Xbox Live instead.

Sony's got to spend time on damage control on many fronts here: PR, developers, financial industry, network security, and key executives wondering if they'll keep their jobs after this debacle. All when they should be working hard on E3 and the big PR opportunity to look good for the world for the coming year. Now, though, they'll have to work hard just to avoid looking like villains or inept bumblers. (I'm sure they feel some sympathy for the Pakistani officials who are trying to avoid both of those categories right now.)

Anyway, Sony, remember the developers... you'd better make some gestures in their direction, too, or you could find that PSN has a lot fewer new games in the future.

Sony Offers Identity Theft Protection

It's been a busy week for Sony, as the scramble continues to deal with the enormous hacker intrusion and the consequences to Sony's brand. A major development this week has been a public letter from Sony CEO Howard Stringer. The gist of the matter: Howard Stringer apologizes. Finally. Why on earth it took two weeks for Sony's CEO to make a public statement can only be attributed to the Japanese culture, I suppose, where admitting a problem is the very last thing you want to do. All very well and good in Japan, I suppose, but Sony is an international company, and they need to handle their international customers, too.

Meanwhile, Sony has offered a free identity protection service for 12 months through Debix, Inc. for PSN users in the United States. Users in other territories will hopefully be offered similar deals. Hey, you'll get priority access to licensed private investigators! I bet you never thought you'd get that with your PSN membership.

Meanwhile, the return of PSN has been delayed for some indefinite period. we're now at 19 days and counting, with no specific start date being mentioned yet. Just to rub salt in Sony's wounds, apparently, the hackers responsible for the attack (who have been lying low) posted personal info from 2500 PSN customers to a dormant Sony web site. Sony did manage to notice and shut down the site, but it is one more embarrassment to add to the list. 

Sony's considering offering a reward for information leading to the arrest of the hackers. Hey, maybe you can win a free game! The identity of the hackers remains a mystery, at least publicly, though some Anonymous veterans have stated in interviews they believe that members of the group were in fact responsible, despite denials.

So the wounds continue to ooze, and Sony's efforts to stop the bleeding have so far proven too feeble. Maybe it's time for Kevin Butler, Sony's faux VP they use for PR purposes, to go on the record about the situation. At least we can get some laughs that way. Sony needs some dramatic victory to really turn the PR situation around... maybe they should call Seal Team Six.

Sony Shoots Self In Other Foot

Maybe Sony could hire him for security.

Just when things seem darkest... maybe they're about to get worse. Sony's had a bad couple of weeks with the PlayStation Network problem, where they've had to shut down the service (still down after two weeks) and admit that over 77 million user accounts were compromised, and possibly credit information was taken, but they can't really be sure. Oh, hey, we're sorry that some really nasty bad guys did this to you, and we plan to offer you a whole free month of PlayStation Plus!

Now Sony has admitted that the PSN break-in isn't their only problem. Sony Online Entertainment (SOE) has admitted that 24.6 million accounts have been compromised, and over 12,000 credit card numbers stolen. The hits just keep on coming, don't they? Sony has admitted that this happened around the same time PSN was hacked, though why Sony didn't figure this all out until now is a damn good question.

Hey, Sony, there's an old Washington D.C. adage about PR, and it's one you should take to heart right now. It's called the Rule of Holes: When you find yourself in a hole, STOP DIGGING.

Sony's problems just went from bad to worse. Their PR response has been inadequate, and questions keep multiplying among users and the press, which is always a good sign that your PR efforts haven't been thorough enough. It seems inevitable at this point that Sony will still be dealing with the fallout at E3, given that the FBI is now involved, Congressional hearings are being scheduled, and there seems to be no end to the bad news from Sony.

Some analysts are speculating Sony may offer a PS3 price cut sooner rather than later to help their image get on track... Too soon, I think. It might be interpreted as "we'll sell the PS3 for less because it's not secure" which is not quite the message you want to send right now.

So what should Sony be doing? A more forthright presentation replete with data and sincere apologies would be good. Especially noting exactly how Sony screwed up on its security, which shouldn't cause any danger to Sony because they've plugged that hole, right? I hope so. Explain why moving your servers to an undiscolsed location is part of the fix... this kind of implies that there was a physical breach of security, not just a hacker coming in over the data lines. What really happened? What does Sony really know about what data was accessed?

At this point I'm starting to see that Sony's gaming brand could be negatively affected. And it's not going to stop there; Microsoft and Nintendo have to be ready to state just how this won't be happening to them, and how tight their security is. Sony has the highest hurdle to climb here, though. They should think about some dramatic move to restore their reputation...

Sony Still Losing Hit Points

Ouch.

Sony is still reeling from the hack attack on the PlayStation Network that exposed 77 million customers to possible theft of their personal information. Sony's not sure if any credit card info was taken, but then there's this story: Supposedly 2.2 million credit card numbers are up for sale on some underground message boards, with sellers claiming to have taken them from Sony. Of course, it's not clear if this is just someone trying to capitalize on the publicity or the actual thieves, but it's not good news for Sony either way.

Now we have an Australian man who had $2000 in charges run up on his credit card, and he thinks Sony is the source for the credit card info. Again, bad news for Sony either way... the PR hits just keep accumulating. Sony's PR efforts have been rather lame at best, with a few blog posts and vague reassurances. Many users are pissed that Sony took so long to figure out there might be a credit card problem, and to reveal facts to users about the breach.

I think it's clear Sony is carefully trying to avoid saying anything that might help a lawsuit against it... and lawyers are already filing class action suits against Sony. But Sony has other problems... like preserving its positive brand name, and trying to get a handle on this issue before E3. The nightmare scenario is that Sony spends its E3 press time talking about the breach rather than new products. Some observers have not been kind regarding Sony's efforts so far, like this one. I think Sony is going to have to step up its efforts in a major way in order to avoid worse effects down the line.

Take some PR lessons from Sony's experience. If you have a major problem, try to get out in front of the story. Communicate a lot. Avoid the passive voice, own up to the problem, explain how you are dealing with it, and tell the customers what you're going to do for them to make it right. Bad things do happen to good companies; but good companies show they can handle it adroitly. So far, Sony looks more like a deer in the headlights than a calm, confident videogame hero about to solve a problem.

PlayStation Network Hacked, Outage Continues Indefinitely

Caution: Here There Be Hackers.

Sony finally admitted today that a hacker had broken into their network, and had accessed personal data on the subscribers. That would be 70 million subscribers who now are wondering if their credit card data is being sold on the Russian black market, or in some other shadowy corner of the Internet.

Users were wondering why Sony didn't tell them until after a week of an outage that was only supposed to be a very short-term thing. Sony says they didn't know the information database had been compromised until yesterday. I guess when you've got a database that huge, looking in every corner could take a while.

Anyway, the outage will last for some unknown period of time... perhaps another week. Which is a big disappointment to Playstation owners hoping to do some multiplayer online gaming. Or for developers hoping to make some money selling games over PSN. Losing a couple of weeks of sales could be thousands of dollars lost.

I think it's good for Sony to take its time and make sure everything is totally secure, and I'm sure they're going to be reviewing their security and how this whole thing happened in the first place. I wouldn't want to be the person in charge of IT for this network... not a happy time for them and their team.

It does show the value in diversification... like developers having games on more than one platform so their cash flow doesn't go away for a couple of weeks when there's an outage. Or perhaps Sony may have more than one backup or layer of security in the future.

I bet Microsoft is going around checking the locks on Xbox Live this week to make sure they aren't the next target.

Small Developers, Big Games

I'd like to highlight one of the cool games I saw at GDC, which is coming out March 15th on the Playstation Network: Slam Bolt Scrappers from Firehose Games. It's a fine example of how a small team can turn out a fun game that's quite capable of keeping up with the big guys. It reminds me a lot of Super Smash Brothers, but Slam Bolt Scrappers has a co-op play mode as well as a competitive mode, and it has a nice strategic component as well. The combination means you'll be playing it for quite a while, especially with the fun animation and sounds. You can see for yourself with the trailer above; check out their website too.

When small teams can produce games of this quality and get them distributed via PSN or other major platforms, it's a great thing for the industry. The big challenge is marketing, and finding enough players. Fortunately, with digital distribution the game's lifespan is orders of magnitude better than what it would be as a boxed retail product. If this game was in GameStop, you'd have to get it in the first month after release because you'd likely never see it after that. Stores only stock the latest releases, unless it's one of a handful of best-sellers or a used title. Digitally distributed titles last as long as you care to keep putting effort into marketing them, and if it takes a few months to find an audience it doesn't hurt (except for a few months of nailbiting for the developers, that is).

If you've got a PS3, check out this game. It's fun, and it's a taste of the best part of the gaming industry.

XBox Live Arcade Analysis, and some PSN

In a world where speculation is often passed along as truth, it's nice to get a dose of data now and then. Here's some from XBox Live Arcade: April's numbers. It's interesting to note some comparisons between XBox Live and PSN; the number of players for Capcom's Final Fight was actually higher for PSN. Seems like the price drop for the PS3 has now made the unit quite competitive. It doesn't hurt that you get a Blu-Ray player in your PS3, either. (Now there's some upcoming news about PSN debuting a premium network soon, to compete even more with XBox Live... cross-game chatting, free games, downloads of full games, and best of all, cloud-based game saves. Yum.)

As you can see from the list, the top games can hit over 1 million players... and then there are many games in the low thousands. Still, it's a wide range, and there's plenty of room for moving up in the numbers if you can do some effective marketing. Major Nelson promoted one game as a 33% off sale for one day, and that boosted numbers by about 6,000 over what would have been expected.

The marketplace for downloads continues to evolve, and the marketing tools tend to lag behind. It's really necessary to put some creativity into the marketing efforts, not just the game development.