2008
Information Security Incident Survey
Report[Abstract]

English Edition
Ver. 1.0

NPO Japan Network Security Association
Security Incident Investigation Working Group
March 31, 2010

© Copyright 2010 NPO Japan Network Security Association (JNSA)

Table of Contents
1

INTRODUCTION .......................................................................................................................... 1

2

OBJECTIVES ................................................................................................................................ 1

3

ANALYSIS RESULTS OF PERSONAL INFORMATION LEAKAGE INCIDENTS ........................................ 2

4

5

3.1

SURVEY METHODOLOGY ....................................................................................................................2

3.2

OVERVIEW ......................................................................................................................................3

3.3

TOP TEN PERSONAL INFORMATION LEAKAGE INCIDENTS ...........................................................................4

3.4

INDUSTRY TYPE ................................................................................................................................5

3.5

CAUSE ..........................................................................................................................................10

3.6

LEAKAGE MEDIA/ ROUTE .................................................................................................................14

3.7

SCOPE OF LEAKAGE .........................................................................................................................16

3.8

INTERANNUAL ANALYSIS ...................................................................................................................18

2008 PROJECTED COMPENSATIONS FOR DAMAGES CALCULATION .............................................20
4.1

TOTAL PROJECTED COMPENSATION FOR DAMAGES ................................................................................20

4.2

PROJECTED COMPENSATION FOR DAMAGES PER PERSON ........................................................................21

4.3

PROJECTED COMPENSATION FOR DAMAGES PER INCIDENT ......................................................................24

4.4

SUMMARY: PROJECTED COMPENSATION FOR DAMAGES .........................................................................25

CALCULATING PROJECTED COMPENSATION FOR DAMAGES RELATED TO PERSONAL INFORMATIONLEAKAGE ...................................................................................................................................27
5.1

OBJECTIVE OF CALCULATING PROJECTED COMPENSATION FOR DAMAGES ...................................................27

5.2

EXPLANATION OF THE PROJECTED COMPENSATION FOR DAMAGES CALCULATION MODEL .............................27

5.2.1

Process behind the Formation of the Projected Compensation for Damages Calculation
Model.....................................................................................................................................28

5.2.2

Explanation of the Calculation Model Input Values...............................................................29

5.2.3

Projected Compensation for Damages Calculation Model ....................................................35

6

CONCLUSION.............................................................................................................................36

7

CONTACT INFORMATION ...........................................................................................................39

8

APPENDIX DEFINITIONS FOR CAUSES OF INFORMATION LEAKAGE..............................................40© Copyright 2010 NPO Japan Network Security Association (JNSA)iJNSA Survey and Research Committee Security Incident Investigation Working Group
Working Group Leader
Hisamichi

OhtaniNTT DATA Corporation

Members Contributing to this Report
Hironori

Omizo

JMC Risk Solutions CO.,LTD

Kousetsu

KayamaFUJITSU LIMITEDHarutoKitanoOracle Corporation Japan

Tomoharu

Sato

BroadBand Security, Inc.

Yasuhiko

Sato

Microsoft Co., Ltd.

Go

Seino

Oracle Corporation Japan

Masayuki

Hiroguchi

RICOH HUMAN CREATES Co., Ltd.

Shiro

Maruyama

LAC: Little eArth Corporation Co., Ltd.

Eiji

Yamadadit Co., Ltd.

Tadashi

Yamamoto

SOMPO JAPAN RISK MANAGEMENT,INC.

Nobuo

Yoshikawa

FUJITSU LIMITED

Tetsuya

YoshidaKanematsu Electronics Ltd.

Nao

Yasudadit Co., Ltd.

Copyrights and Attributions
This report has been produced by the NPO JAPAN NETWORK SECURITY ASSOCIATION (JNSA)
Security Incident Investigation Working Group. While the JNSA retains the copyrights to thiswork, this report is offered as public information. Any other works quoting this report, in whole
or in part, must include an attribution to the JNSA copyright. Further, if you wish to quote a
portion or all of this report in a book, magazine, or in seminar materials, etc., please firstcontact the JNSA at sec@jnsa.org.
© Copyright 2010 NPO Japan Network Security Association (JNSA)© Copyright 2010 NPO Japan Network Security Association (JNSA)

1 Introduction
This report represents the sixth survey and analysis of personal information leakage
incidents/ accidents (“incidents,” hereafter) conducted by the JNSA Security Incident
Investigation Working Group (“the Working Group”). As with the prior year’s report, the 2008
report utilizes the same survey methodology established in the 2003 report.
Also as with the prior year’s report, the Working Group followed the established survey
protocol, collecting and analyzing information related to personal information leakage incidents(“incidents”) published during 2008 in newspapers, on Internet news sites, and via othersources.
This report summarizes the results of our analysis of projected compensation for damages,
using certain information (type of business/ organization involved in the incident, number ofvictims, cause of information leakage, route of information leakage, etc.) and our JO Model(JNSA Damage Operation Model for Individual Information Leak), based on the survey data.
Herein, we will report our aggregation/ analysis results for 2008 incidents (including an analysisof the causes giving rise to such results), as well as our analysis of trends over time, based on
our accumulation of data over the past five years.

2 Objectives
This report is the result of an independent survey and analysis of information leakage
incidents reported between January 1 and December 31, 2008.
Personal information is regarded as an information asset, the protection of which ismandated under the Personal Information Protection Act of Japan. Accordingly, the leakage of
personal information is a risk of which corporate managers should be well aware.
The Working Group has produced this report for the purpose of raising topics for debate both
now and in the future, for helping corporate management assess the proper scope of the risks
associated with information security, and for assisting management in reaching appropriate
investment decisions, as such relate to the “likelihood of legal reparations.”© Copyright 2010 NPO Japan Network Security Association (JNSA)
1

3 Analysis Results of Personal Information Leakage Incidents
3.1 Survey Methodology
Working Group members collected public reports (including documents released fromprivate organizations) from newspapers, Internet news, and other news sources between
January 1 and December 31, 2008, compiling data related to Personal Information Leakage
Incidents. As in prior years, Working Group members categorized and evaluated the type ofbusiness or organization involved, the number of victims affected by the incident, the causes
of information leakage, the route of information leakage, etc., based on the information
available. Next, the Working Group used an independently developed formula (“JO Model”)
to calculate projected compensation for damages related to these incidents.
Data for this survey was collected manually from information related to incidents
published over the Internet, noting information necessary for incident analysis from details
in the articles or other documents located. Working Group members have expended best
efforts to collect as much information as possible; however, the reader should understandthat the Working Group was not able to make an exhaustive collection of all articles
published that relate to incidents. The Working Group will respond to reader feedback, andcorrect any results herein that are determined to be in error. If you intend to use this report,
please use the latest version released through our website.

© Copyright 2010 NPO Japan Network Security Association (JNSA)
2

3.2 Overview
Compared to 2007, the number of leakage incidents during 2008 increased significantly,
amounting to 1,373 incidents (an increase of 509 incidents). This was primarily due to anincrease in the number of incidents across many different industries, including Education/
Learning Support, Finance/ Insurance, Services, and Transportation. In particular, a certain
local government was very active in reporting information leakage incidents, which
impacted the number of incidents for the year.
The number of victims of information leakage incidents for 2008 amounted to 7.23 million
individuals, the fewest number since the Personal Information Protection Act came into
effect, and the first time that the number decreased year‐to‐year. One major reason for thisdecrease is that there were no large‐scale personal information leakage incidents thatsignificantly exceeded one million victims. In other words, this means that the occurrence ofan unexpectedly large personal information leakage incident has much to do with thenumber of victims and amount of damages during the year in question. Because an
unexpected large‐scale incident has a major impact on the number of victims and total
amount of projected compensation for damages, it is difficult to accurately track interannual
trends.
The number and overall ratio of incidents attributed to Operational Error andAdministrative Error increased significantly, while the number of incidents attributed to
Unauthorized Information Removal experienced a decrease. The following table shows thesummary of data collected for 2008:
Table 1: Summary Data of 2008 Personal Information Leakage Incidents

Number of Victims

7,232,763

Number of Incidents

1,373

Total Projected Compensation for Damages
Number of Victims per Incident¥236,725,290,000

*1

5,668

Average Projected Compensation for Damages per Incident*1
Average Projected Compensation for Damages per Victim*2¥185,520,000¥43,632*1: Averages exclude 64 incidents for which the number of victims was unknown. Projectedcompensation for damages per person was calculated for each incident, after which the total of theindividual results was divided by the number of leakage incidents. Please understand that thisnumber is not the projected total compensation for damages divided by the number of individuals
affected.
*2: As this average value includes statistical outliers, we first calculated the projected compensation
for damages per person for each incident, and then used this figure to calculate the average value of
projected compensation for damages per person for all incidents. Accordingly, we ask the reader tounderstand that this figure is not the projected total compensation for damages divided by the© Copyright 2010 NPO Japan Network Security Association (JNSA)
3

3.3 Top Ten Personal Information Leakage Incidents
Table 2 shows the 10 largest incidents occurring during 2008. There were no large‐scale
incidents during 2008 that affected significantly more than one million victims, and only one
incident that affected approximately one million people. Through 2007, at least one incident
occurred each year that affected significantly more than one million people, which skewed
the statistical results.
Looking at the top 10 incidents by industry shows a greater bias toward certain industries
than 2007, with many incidents occurring in the Government Services and Finance/
Insurance industries. However, the Wholesale/ Retail and Telecommunications industries
also experienced information leakage incidents included in our top 10. As to cause,
Administrative Error was the culprit in many circumstances. This is due to the fact that, since2007, stronger internal controls have resulted in more stringent intra‐organizational
information management, leading to the detection of large‐volumes of erroneous
information disposal.
Table 2: Top 10 Incidents
No.

Numberof Victims

Industry Type

Cause

1

995,023 Government Services (Not Otherwise Categorized)

Administrative Error

2

766,356 Government Services (Not Otherwise Categorized)

Administrative Error

3

653,424 Wholesale/ Retail

Unauthorized Access

４349,827 Finance/ Insurance

Administrative Error

５

291,338 Government Services (Not Otherwise Categorized)

Administrative Error

6

269,350 Finance/ Insurance

Administrative Error

7

262,781 Government Services (Not Otherwise Categorized)

Administrative Error

8

254,677 Finance/ Insurance

Administrative Error

9232,970 Telecommunications

10

213,443 Government Services (Not Otherwise Categorized)

Internal Crime/
Internal Fraud
Administrative Error

number of individuals affected.

© Copyright 2010 NPO Japan Network Security Association (JNSA)
4

3.4 Industry Type
(1)

Single‐Year Analysis (Number of Incidents)
Utilities: Electricity,
Gas, Heat, Water
2.8%
Construction
Real Estate 2.0%
2.4%
Manufacturing
2.7%
Transportation
4.1%
Wholesale/ Retail
5.3%

Multi‐Service
1.5%
Hospitality (Restaurant/ Hotel)
0.3%
Forestry
0.1%

Government Services(Not Otherwise Categorized)
34.2%

Services (Not Otherwise
Categorized)
6.4%
Health Care/ Welfare
6.6%
Telecommunications
6.9%
Finance/ Insurance
11.6%

Education/
Learning Support
13.0%

Figure 1: Ratio by Industry Type (Number of Incidents)
Government Services represented the highest ratio of incidents by industry type (34.2%),
followed by Education/ Learning Support (13.0%), and Finance/ Insurance (11.6%). These
three industry types accounted for approximately 60% of all incidents.
Government Services and Finance/ Insurance represent two types of industries in which
the protection of personal information is strictly enforced. Even relatively minor incidents
are reported in numbers, which is likely why these industries have remained at the top of
this list for the past five years. Of the 18 industry types, only the Farming, Fisheries, andMining industries did not experience an incident during 2008. The remaining 15 industries
experienced information leakage incidents to one extent or another, with the top ten
industry types accounting for more than 90% of all incidents. The fact remains that mostindustry types deal with personal information, and most industry types are at risk for theoccurrence of an information leakage incident.

© Copyright 2010 NPO Japan Network Security Association (JNSA)
5

(2)Interannual Analysis (Number of Incidents)

Incidents
500
469
450

Government Services(Not Otherwise Categorized)

400
350
Finance/ Insurance

300

293

250
200

181

150

127

100
64
50
0

Education/
Learning Support

203

2002
(n=63)

2003(n=57)

2004(n=366)

139
114
84
66
54
49
33

139
136
110
70
61
51
52
42
36
1

2005
2006
(n=1032) (n=993)

131

178
159

Telecommunications

98
88
73
65
49
37

95
91
73
56
39
33

Farming
Forestry
Fisheries
MiningConstruction
Manufacturing
Utilities: Electricity, Gas, Heat, Water
Telecommunications
Transportation
Wholesale/ Retail
Finance/ Insurance
Real Estate
Hospitality (Restaurant/ Hotel)
Health Care/ Welfare
Education/ Learning Support
Multi‐Service
Services (Not Otherwise Categorized)
Government Services (Not Otherwise
Categorized)
Not Otherwise Categorized

2007
2008
(n=864) (n=1373)

Figure 2: Interannual Changes in Number of Incidents by Industry Type (Number of Incidents)
Figure 2 shows the number of incidents by industry type as a line graph. Excluding 2007,
the number of incidents in the Government Services industry has increased nearly every
year. The Education/ Learning Support industry has also showed annual increases, except for2007. In contrast, the Telecommunications industry has experienced slight declines after
hitting a peak in 2006.
We believe that the number one factor behind the increase in incidents for theGovernment Services and Education/ Learning Support industries is that these industries
have started to be more conscientious about reporting incidents. Other factors include theincrease in usage of PCs and USB memory devices for work, the increase in the number of
temporary workers in local governments, and the lack of training in preventing information
leakage.

© Copyright 2010 NPO Japan Network Security Association (JNSA)
6

(3)Single‐Year Analysis (Number of Victims)
Health Care/ Welfare 0.8%
Education/ Learning Support 1.2%

Construction 0.1%

Hospitality (Restaurant/ Hotel) 2.2%
Multi‐Service 2.2%
Manufacturing 2.9%

Utilities: Electricity, Gas, Heat,
Water 0.1%
Real Estate 0.1%

Services (Not Otherwise
Categorized) 4.3%
Transportation 4.6%
Government Services(Not Otherwise Categorized)
40.5%

Telecommunications 4.8%

Wholesale/ Retail 13.6%

Finance/ Insurance 22.5%

Figure 3: Ratio by Industry Type (Number of Victims)
Government Services (40.5%), Finance/ Insurance (22.5%), and Wholesale/ Retail (13.6%)
accounted for the top three industries by number of information leakage victims,
representing three‐fourths of all people affected.
As shown in Figure 1, Education/ Learning Support accounted for 13.0% of incidents
during 2008, but only 1.2% of the number of victims, as shown in Figure 3. We believe that
this is due to the fact that much of the personal information involved is on a class‐by‐classbasis, and the scale of incidents is relatively small compared to other industry types.
Similarly, the Health Care/ Welfare industry accounts for 6.6% of all incidents, but only 0.8%
of victims. This appears to be due to the fact that many incidents were limited to thenumber of patients handled by a single physician.
In contrast, Wholesale/ Retail accounted for 5.3% of all incidents, but 13.6% of all victims,
indicating just how much personal information is handled during the course of providing
services.

© Copyright 2010 NPO Japan Network Security Association (JNSA)
7

(4)Interannual Analysis (Number of Victims)

10,000 people
3,000

32.2

2,500
193.5
111.7
67.6

2,000

1,498.6

195.8
61.1

1,500

10.
54.8
346.0

1,000

39.9
65.5
200.0
55.9

88.1

506.8

547.9

947.9

77.3
54.0
60.3
293.2

500

899.1
162.8
98.7

545.7

0

17.8

45.2
75.1

106.7
37.9

116.3

2002
(n=63)

2003(n=57)

2004(n=366)2005(n=1032)

Not Otherwise Categorized
Government Services (Not Otherwise
Categorized)
Services (Not Otherwise Categorized)
Multi‐Service
Education/ Learning Support
Health Care/ Welfare
Hospitality (Restaurant/ Hotel)
Real Estate
Finance/ Insurance
Wholesale/ RetailTransportation
Telecommunications
Utilities: Electricity, Gas, Heat, Water
Manufacturing
Construction
MiningFisheries
Forestry
Farming

0.0

2006(n=993)2007(n=864)2008(n=1373)

Figure 4: Interannual Changes in the Number of Victims by Industry Type (Total)
Figure 4 is a graph showing the aggregated number of victims of personal information
leakage by industry type.
The number of victims experienced year‐on‐year increases for 2004, 2006 and 2007, eachyear having a large‐scale incident involving more than one million victims. Accordingly, thenumber of victims for the industry type experiencing a large‐scale incident distinctly
increased, with Telecommunications standing out in the 2004 and 2006 graphs, andMulti‐Service doing the same for 2007. In other words, the presence of a large‐scalepersonal information leakage incident has more to do with the number of incident victims
by incident type than any particular industry characteristics.

© Copyright 2010 NPO Japan Network Security Association (JNSA)
8Correlative Analysis(5)
10,000 people
350
293
443
300
250
200
150

163

Total
Victims

Not Otherwise Categorized

MiningFisheries

Farming2
Forestry

Construction

32
Real Estate

1 27 1 38
Utilities: Electricity, Gas, Heat, Water

6
Health Care/ Welfare

Hospitality (Restaurant/ Hotel)

49Education/ Learning Support

84

21 16

Multi‐Service

56

70 21 34 16
Manufacturing31

Services (Not Otherwise Categorized)

Wholesale/ Retail

Finance/ Insurance

163
83 33
Transportation

35
63

Government Services(Not Otherwise Categorized)

099

Telecommunications

156

100
50

Incidents
500
450
400
350
300
250
200
150
100
50
0

No. of Incidents(excluding unknown)

Figure 5: Number of Incidents and Number of Victims by Industry TypeThe number of incidents and number of victims traced a nearly proportional relationshipduring 2008. However, there was notable divergence in the trend for number of incidents
and number of victims in the Finance/ Insurance, Wholesale/ Retail, Education/ Learning
Support, and Health Care/ Welfare industry types.
The ratio of victims to incidents in the Finance/ Insurance and Wholesale/ Retailindustries was high, indicating a high number of victims per incident in these two categories.
In the Finance/ Insurance industry, there were a large number of cases where records
covering several years were erroneously disposed of. In the Wholesale/ Retail category,several incidents involved the leakage of all of the user data in a central database forInternet shopping websites. In both situations, the nature of the industry involved is suchthat a single leakage incident involves a large volume of personal data.
In contrast, for the Education/ Learning Support and Health Care/ Welfare categories, thenumber of victims was relatively low compared to the number of incidents. This analysis
shows that in both industry types, despite the high number of opportunities to handle
personal information on a daily basis, only a comparative few individuals are involved ineach case.

© Copyright 2010 NPO Japan Network Security Association (JNSA)
9

3.5 Cause(1)

Single‐Year Analysis (Number of Incidents)
Internal Crime/
Internal Fraud 1.4%
Bug/ Security Hole
1.6%
Worms/ Viruses
2.2%
Configuration Error 4.4%
Unauthorized
Information Removal
5.8%
Theft 11.2%

Unauthorized Access
0.7%
Non‐Intended Use 0.3%
Other 0.3%
Unknown 0.6%

Operational Error 35.2%

Loss/ Misplacement
14.1%
Administrative Error 22.2%

Figure 6: Ratio of Leaks by Cause (Number of Incidents)
Looking at Figure 6, we see that Loss/ Misplacement, Theft, and Operational Error remain
the prevalent causes of information leakage. During 2008, Operational Error andAdministrative Error both increased as a percentage of the total. In particular, Operational
Error experienced a significant increase, representing more than one‐third of the total.
Operational Error occurs most frequently in the following order. One can see where an
information leakage incident can occur when there is a heavy reliance on manual operations
that cannot be countered with technology.
(1) Erroneous delivery of paper media(2) Misdirected email transmission(3) Erroneous delivery of a FAX
The erroneous delivery of paper media and erroneous delivery of FAXes occur frequently
at local government offices. The main causes of these errors can be attributed to putting thewrong documents in the wrong envelope or forgetting to confirm the recipient—errors thatcan be prevented by restructuring work steps or establishing stronger systems. Potential
preventive measures include rules to prohibit interruptions during delivery preparations,establishing certain work areas, and performing double‐checks as important operational andorganizational steps leading to stronger systems and structures. A rule requiring any FAX
containing personal information be sent using the FAX redial function only after first sending© Copyright 2010 NPO Japan Network Security Association (JNSA)
10

a test document to confirm the process could be another effective measure.
Misdirected email transmissions occur with comparative frequency in the corporate
setting. Incidents similar to the erroneous delivery of paper media discussed above occur
frequently, as do the unintentional or intentional inclusion of email addresses in the “To”
head that should properly be included in the “Bcc” header. Accordingly, the same measures
discussed to prevent the erroneous delivery of paper media and FAXes could be effective, as
could the adoption of systems to automate broadcast emails.
The increase of incidents caused by Administrative Error is another notable development
for 2008. Administrative Error has continued to increase since 2007, and has become thenumber two cause of information leaks. Nearly half of administrative errors are theerroneous disposal of information, with many cases involving personal information
accidentally disposed of together with other information.
In our opinion, internal controls have played a significant role in this trend, continuingfrom the prior year. Corporations and other organizations have advanced in sophistication
regarding internal controls, including compliance with laws concerning business activities,
asset preservation, and controls over IT systems. Accordingly, there has been an increase in
the number of organizations that have clarified the standards for when public disclosure isrequired as one of the steps in dealing with information leakage incidents. The results of oursurvey have led us to conclude that in addition to stronger internal information controls,these organizations have engaged in physical inventory counts within their facilities, leading
to more published reports for erroneous disposal and/ or loss of information. We have seen
several cases in which a company or an affiliate has published announcements (additional
announcements) concerning information leakage incidents at around the same time. This
leads us to believe that once an incident has been discovered, the organization goes on toconfirm whether other cases have happened in parallel departments or divisions.
Accordingly, we recommend that organizations perform regular inventory counts toconfirm whether information they maintain within their offices is properly managed.

© Copyright 2010 NPO Japan Network Security Association (JNSA)
11

Interannual Analysis (Number of Incidents)

(2)
100%
90%
80%

2.7%
1.9%
7.9%
1.4%
1.1%
1.6%
2.7%

70%
60%

12.2%

25.8%

1.7%
8.1%

7.9%

11.2%

Unauthorized AccessInternal Crime/ Internal Fraud

14.1%

Bug/ Security Hole

16.6%
19.0%

36.1%

50%
42.1%

5.1%

9.8%
10.7%

Unauthorized Information Removal
Theft
Loss/ Misplacement
Administrative Error
Operational Error

20.4%

20%
10%

22.2%

29.2%

21.6%

Other
Non‐Intended Use

Worms/ Viruses
Configuration Error
20.5%

40%
30%

Unknown

3.9%

2.2%
4.4%
5.8%

8.3%

3.3%

8.3%

35.2%

12.4%

14.7%

18.2%

2005
(n=1032)

2006(n=993)2007(n=864)0%2004(n=366)2008(n=1373)

Figure 7: Interannual Changes in the Ratio of Leaks by Cause (Number of Incidents)
After reaching a peak of 42.1% in 2005, the ratio of Loss/ Misplacement as a cause of
information leak has continued to decline. The ratio of Theft has similarly traced a declining
trend. Since 2006, Operational Error and Administrative Error have been on the increase ascited causes of information leaks. The increase in Administrative Error, which included theerroneous disposal or loss of information within an organization’s physical facilities, isrelated to the increase in small‐scale incidents involving paper media. We believe there are
two main causes for this trend. First, we believe that organizations have taken steps toprevent the removal of personal information from their facilities, resulting in a decrease of
information leaks due to Loss/ Misplacement and Theft—factors that had accounted for ahigh ratio of incidents in the past. In other words, the target of measures related to personal
information management systems and methods focused on areas that had been neglected.
Further, as mentioned earlier, the increase in the number of organizations that have clearly
defined the standards as to when public disclosure of an incident is required as part of their
response to an incident has also had an impact in this area. Second, the cause of incidents in
the Finance/ Insurance industry attributed to Loss in 2005 has, from the standpoint ofinternal controls in 2007, come to be categorized in public announcements as
Administrative Error.
While not shown in Figure 7, the number of incidents attributed to information leakage
due to P2P file‐sharing software declined from 142 incidents in 2007 to 67 incidents in 2008.
We believe that prohibiting the use of P2P file‐sharing software within organizations, andstricter management/ rules regarding the removal of sensitive personal information havebeen effective measures in reducing the number of incidents attributed to this cause.
© Copyright 2010 NPO Japan Network Security Association (JNSA)
12

(3)

Single‐Year Analysis (Number of Victims)
Worms/ Viruses
0.5%
Unauthorized Information
Operational Error 0.4%
Removal 1.0%
Non‐Intended Use
Loss/ Misplacement
0.0%
2.2%
Theft 2.7%
Other 0.0%
Bug/ Security HoleUnknown
0.3%
3.3%
Internal Crime/
Internal Fraud 4.4%
Configuration Error 4.4%

Unauthorized Access
12.0%

Administrative Error 68.9%

Figure 8: Ratio of Leaks by Cause (Number of Victims)
Looking at Figure 8, we see that compared to 2007, the ratio of Loss/ Misplacement and
Theft as causes of information leakage has experienced a decline. Information leakage
attributed to Loss/ Misplacement decreased from approximately 460,000 to 160,000 victims,
with Theft falling from 580,000 to 200,000 victims. While the ratio of Administrative Error isextremely large, compared to 2007, the number of victims fell by a wide margin, from 19.56
million to 4.98 million. One would tend to conclude falsely that the increase in ratio would
lead to an increase in the number of victims. However, we wish to point out that in this case,the number of victims as a whole decreased.

© Copyright 2010 NPO Japan Network Security Association (JNSA)
13

3.6 Leakage Media/ RouteSingle‐Year Analysis (Number of Incidents)

(1)

Other
6.5%
FTP
0.0%

Other 6.5%

Unknown
0.7%

100%
90%

PC Machine
7.3%

80%

Email
8.1%

60%

FAX
43.8%

70%

Mobile
Phone
27.0%

50%

USB or Other
Portable
Recordable Media
9.9%

Paper
Documents
55.9%

40%
30%

Dedicated
Terminal
14.6%
Other
14.6%

20%
10%

Web/ Net
11.7%

0%

Figure 9: Leakage Media/ Route Ratio (Number of Incidents)
The leakage media/ route contributing to the highest number of information leakage
incidents was Paper Documents, with Operational Error, Administrative Error, Theft, andLoss/ Misplacement being the most frequent underlying causes.
Web/ Net is the second‐most‐frequent route, with approximately 40% of such incidents
attributed to Winny and other file‐sharing software. This route continues to make up asignificant portion of incidents as in 2007.

(2)

Interannual Analysis (Number of Incidents)

100%

1.6%
1.6%

90%

12.7%

80%

17.5%
3.5%
1.8%

70%

17.5%

1.6%
3.1%
6.6%

0.8%
6.8%
0.1%
7.7%

16.8%

10.7%

20.5%

8.2%
15.7%

60%
10.5%

50%
40%

3.6%
6.6%
0.3%
6.8%

9.0%
7.4%

84.1%

6.4%

5.1%
5.9%
0.0%
9.8%
10.9%
12.5%

7.3%
11.7%

Unknown
Other
FTP
Email
USB or Other Portable
Recordable Media

15.4%

14.0%

21.1%

10%

9.9%

22.0%

PC Machine

30%
20%

0.7%
6.5%
0.0%
8.1%

45.9%

49.9%

2004
(n=366)2005(n=1032)

55.9%
43.8%

40.4%

2006
(n=993)2007(n=864)

Web/ Net
Paper Documents

14.0%

0%
2002
(n=63)

2003(n=57)

2008(n=1373)

Figure 10: Interannual Changes in Leakage Route Ratio (Number of Incidents)© Copyright 2010 NPO Japan Network Security Association (JNSA)
14The incidence of leakage attributed to Paper Documents decreased between 2005 and2007; however, the number increased to 769 incidents (56.0%) in 2008, compared to 349
incidents (40.4%) in 2007. The ratio of incidents attributed to media/ routes other thanPaper Documents decreased, but this was really a relative change due to the increase inratio for Paper Documents.
USB or Other Portable Recordable Media decreased as a ratio; however, the number ofincidents grew from 94 in the prior year to 136—not what one would call an improvement.
PC Machine likewise declined as a ratio, but the number of incidents did not show an
improvement, with 2008 levels nearly unchanged from 2007.

Single‐Year Analysis (Number of Victims)(3)

PC Machine
2.7%
USB or Other
Portable
Recordable

Email
1.1%

Other
0.3%

Other 0.3%
100%
90%
80%
70%

10.5%

60%
50%
Paper Documents
59.5%

Web/Net24.9%

Dedicated
Terminal

16,126

40%
30%
20%
10%

Mobile Phone

2,453

0%

FAX
177
Other
408

Figure 11: Leakage Media/ Route Ratio (Number of Victims)
Under the category of Paper Documents, there were many incidents involving fewer than
10 and fewer than 100 victims, but incidents involving 100,000 or more victims also
occurred. As a result, this leakage route accounted for 59.5% of all victims of information
leaks during 2008. The ratio represented by Web/ Net experienced a major increase, up
from 1.9% in 2007 to 24.9% in 2008, while USB or Other Portable Recordable Mediadecreased as a percentage from 38.7% in 2007 to 10.5% in 2008.
The underlying cause of information leaks attributed to Paper Documents were, in order,
Operational Error (319 incidents), Administrative Error (231 incidents), Loss/ Misplacement(100 incidents), and Theft (68 incidents). The characteristics of the number of victims due toeach underlying cause were as follows:© Copyright 2010 NPO Japan Network Security Association (JNSA)
15

zOperational Error
Extremely high ratio of incidents in which the number of victims were less than 10z

Administrative Error
A high ratio of incidents in which the number of victims were less than 100;
however, also a high ratio of incidents in which the number of victims were
between 1,000 and 5,000zLoss/ Misplacement, Theft
Most incidents involved less than 500 victims; high ratio of incidents involving 10 to
100 victims

3.7 Scope of Leakage(1)Single‐Year Analysis (Number of Incidents)
50,000 to 100,000
0.6%
10,000 to 50,000
2.5%

100,000 or more
1.4%
Unknown
7.1%

5,000 to 10,000
1.6%
Less than 1034.9%

1,000 to 5,000
7.3%
500 to 1,000
5.7%

100 to 500
16.2%
10 to 100
22.9%

Figure 12: Scope of Leakage by Ratio (Number of Incidents)
According to Figure 12, 34.9% of information leakage incidents involved less than 10
victims, while 22.9% involved between 100 and 500 victims, and 16.2% involved less than
500 victims. Overall, these classifications accounted for 74.0%, or three‐fourths of
information leakage incidents occurring during 2008. Accordingly, we can see that the vast
number of incidents during 2008 involved a relatively few victims. Compared to 2007, theratio of incidents involving fewer than10 victims rose dramatically from 15.7% to 34.9%. We
believe this increase is due to the proactive reporting of small‐scale incidents on the part ofJapan’s organizations.

© Copyright 2010 NPO Japan Network Security Association (JNSA)
16

Interannual Analysis (Number of Incidents)(2)

There were no major shifts in the order of categories (number of victims) between 2005
and 2007, with incidents involving 10 to 100 victims, 100 to 500 victims, and less than 10
victims being most numerous, in that order. During 2008, a total of 79.7% of incidents
involved fewer than 1,000 victims, bringing those categories higher as ratio of the total. We
can conclude from this that most incidents reported were small‐scale affairs involving fewer
than 1,000 victims. The ratio of incidents involving fewer than 10 victims rose dramaticallyduring 2008.
Incidents
100%
11.1%

90%
80%
70%

1.6%
3.2%
9.5%
3.2%

10.5%

8.2%

7.0%

3.3%
1.1%
4.6%
3.0%

3.5%
3.5%
5.3%

4.3%
1.4%
1.8%
7.7%

4.4%
1.9%
0.6%
3.2%
3.2%

4.5%

10.6%

9.1%

13.7%

19.3%

5.7%

8.4%

16.2%

Unknown
100,000 or more
50,000 to 100,000
10,000 to 50,000
5,000 to 10,000
1,000 to 5,000
500 to 1,000
100 to 500

22.5%
22.7%

23.4%
12.3%

10.5%

6.6%

33.3%

50%

7.1%
1.4%
0.6%
2.5%
1.6%
7.3%

6.7%
6.4%

60%

5.9%
2.4%
1.0%
4.7%
2.3%

24.0%

10 to 100
22.9%

Less than 10

40%
6.3%

28.9%

30%
26.3%

20%

23.5%

23.8%

10%
0%

26.2%

27.2%

34.9%
8.8%

6.3%
1.6%

3.5%

2002
(n=63)

2003(n=57)

12.0%

14.2%

2004
(n=366)2005(n=1032)

17.9%

15.7%

2006
(n=993)2007(n=864)2008(n=1373)

Figure 13: Interannual Changes in the Ratio of Classifications by Victims per Incident(Number of Incidents)
Addressing regular corporations in Japan, “businesses dealing with personal information”
falling under the Personal Information Protection Act are those maintaining personal
information for 5,000 individuals or more. However, under the Act on the Protection of
Personal Information Held by Administrative Organs and other laws targeting government
agencies and independent administrative agencies, the tendency is to report even minor
incidents involving one victim, conscious of the duty to safely administer the information
held by the agency in question. We believe that this is one factor behind the higher ratio ofsmall‐scale incidents reported during 2008.

© Copyright 2010 NPO Japan Network Security Association (JNSA)
17

3.8 Interannual Analysis
We performed various analyses based on seven years of incident data collected between
2002 and 2008. However, prior to 2004, few incidents were publicly reported, and thoseincidents that were reported involved major volumes of personal information. Accordingly,
incidents during these years tended to skew the statistical data significantly, and should beviewed more as reference figures in the context of our analysis.
Table 3: Interannual Changes in the Number of Victims and Number of Incidents

2002
2003
2004
2005
2006
2007
2008

Number of
Incidents
62
57
366
1,032
993
864
1,373

Number of Victims
418,716
1,554,592
10,435,061
8,814,735
22,236,576
30,531,004
7,232,763

Average Number ofVictims per Incident*
7,613
30,482
31,057
8,922
23,43237,554
5,668

At 1,373 incidents, 2008 represented the highest occurrence of reported information
leakage since we began collecting statistics in 2002. At the same time, the lack of alarge‐scale incident during 2008 resulted in the lowest total of victims since 2004, at
7,232,763—approximately 24% and 33% lower than 2007 and 2006 respectively. This figure
calculates to approximately one out of every 18 people in Japan, representing a reversal
from last year’s record high numbers, and a historical low of 5,668 victims per incident on
average.
While a record number of incidents occurred during 2008, the average number of victims
was the lowest ever. While the fact that a large‐scale incident did not occur during 2008 wascertainly one contributing factor, we have also considered a greater general publicawareness of personal information protection has led organizations to reportincidents—even small‐scale incidents—more conscientiously.

* Our calculations used 1,276 incidents as the parameter for average number of victims during 2008

(1,363 incidents less 87 incidents in which the number of victims was undetermined).

© Copyright 2010 NPO Japan Network Security Association (JNSA)
18

1,373 incidents

3000
Internal Crime/ Internal Fraud
Other than Internal Crime/ Internal Fraud

2500
1,032 incidents

1400

8.64 million(28.3%)

1200

864 incidents

1000

993 incidents

2000
8.0 million(36.0%)

800

1500
600
1.65 million(15.8%)

1000

900,000(10.2%)
14.24 million(64.0%)

366 incidents

500
63 incidents

10,000 people

420,000(99.9%)

2002(n=63)

130,000(8.6%)

8.78 million(84.2%)
57 incidents
1.42 million(91.4%)

2003(n=57)

2004(n=366)21.89 million(71.7%)

7.92 million(89.8%)

320,000(4.4%)

6.92 million(95.6%)

400
200
Incidents

2005(n=1032)

2006(n=993)2007(n=864)2008(n=1375)

Figure 14: Interannual Changes in the Number of Incidents and Number of Victims due toInternal Fraud (Total)
Since 2005, when the Personal Information Protection Act came into full enforcement,
about 1,000 personal information leakage incidents have been reported in newspapers andInternet news sites each year. 2008 represented the highest number of incidents reported,
at 1,373. Despite the tendency in the news media to not report incidents that do notcontain elements of novelty or “news,” the sheer number of incidents reported on a yearlybasis demonstrates that organizations now accept that public reporting of incidents acts asboth an apology and a public relations measure, asking the cooperation of the news media.
At the same time, the increase in the number of victims between 2005 and 2007 has now
clearly reversed. While we would like to think that this trend stems from improved security
and the wide‐scale implementation of proper precautions, we see that incidents involving
between 5,000 and one million victims was nearly the same as in 2007, with no discernible
decrease. In fact, we believe that this development was mainly due to the lack of an
unexpectedly large‐scale incident of more than one million victims during 2008.
In addition, while the number of victims in incidents attributable to Internal Crime/
Internal Fraud during 2006 and 2007 exceeded eight million each year, the corresponding
figure for 2008 was only 320,000. We believe that greater internal authorization control andprohibitions on removing information from an organization’s premises contributed tomaking theft and unauthorized activities more difficult.

© Copyright 2010 NPO Japan Network Security Association (JNSA)
19

4 2008 Projected Compensations for Damages Calculation
4.1 Total Projected Compensation for Damages
Table 4: Interannual Changes in Total Projected Compensation for Damages
Total Projected Compensation for Damages
Approx. ¥18.9 billion
Approx. ¥28.1 billion
Approx. ¥466.7 billion
Approx. ¥700.2 billion
Approx. ¥457.0 billion
Approx. ¥2.2711 trillion
Approx. ¥236.7 billion

2002
2003
2004
2005
2006
2007
2008

10,000 people
3500¥100 million
25,000¥2.2714 trillion

Compensation for Damages
No. of Leakage Incident Victims

30.53 million

3000

20,0002500
22.24 million

15,0002000
1500

10,000¥700.2 billion
10.44 million
8.81 million¥457.0 billion¥439.3 billion

5,000

1000
7.23 million¥236.7 billion

0¥28.1 billion¥15.1 billion
1.55 million
420,000

2002(n=63)

2003(n=57)

2004(n=366)

500
0

2005
(n=1032)

2006(n=993)2007(n=864)2008(n=1373)

Figure 15: Total Projected Compensation for Damages and Number of Victims
During 2007, the value of personal information and number of large‐scale leakage
incidents resulted in a major increase in the total projected compensation for damages. For
2008, total damages are comparatively low, due mainly to the good fortune of not having alarge‐scale incident during the year.
However, considering the increase in the number of incidents, it is difficult to categoricallydeclare that a lower compensation for damages is reflective of an advanced structure of
information security. Whether these numbers remain low depends mainly on theoccurrence or non‐occurrence of a large‐scale incident.
In addition, the number of victims has experienced a significant decrease. Again,
considering the increase in the number of incidents, we cannot say that information security
has advanced so much as that organizations are now tending to report incidents regardlessof the number of people affected. We must also consider the possibility that the© Copyright 2010 NPO Japan Network Security Association (JNSA)
20

implementation of measures has resulted in a limit to the number of victims in any given
incident.

4.2 Projected Compensation for Damages per Person(1)Single‐Year Analysis
Less than ¥1 million
Less than ¥500,000
2.0%
3.1%
Less than ¥300,000
0.3%
Less than ¥100,000
11.6%¥0 to ¥5,000
11.7%

Less than ¥10,000
27.2%

Less than ¥50,000
17.0%

Less than ¥30,000
27.1%

Figure 16: Ratio of Projected Compensation for Damages per Person (Number of Incidents)
For 2008, projected compensation for damages per person of between ¥5,000 and¥10,000 accounted for the highest ratio of incidents, at 27.2%. Projected compensation fordamages per person between ¥10,000 and ¥30,000 came in second, at 27.1%.

(2)

Interannual Analysis
Table 5: Average Projected Compensation for Damages per Person
2002
2003
2004
2005
2006
2007
2008

¥16,855¥89,140¥105,365¥46,271¥36,743¥38,233¥43,632

For 2007, the average projected compensation for damages per person calculated out to¥38,233. This number increased slightly to ¥43,632 for 2008, but figures have remained
nearly equivalent year‐to‐year since 2005.

© Copyright 2010 NPO Japan Network Security Association (JNSA)
21

[Average Projected Compensation for Damages per Person]
We calculated the projected compensation for damages per person for each incident
that occurred during 2008. The average projected compensation for damages perperson was calculated as the average monetary amount of the projected compensation
for damages for each incident. Accordingly, we calculated the average projectedcompensation for damages per person by totaling the projected compensation fordamages per person for all incidents, and then dividing by the number of incidents.
Please not that the figure we arrived at is not the total amount of projectedcompensation for damages divided by the total number of victims.
The following is our calculation formula and a specific calculation example:
For the two following incidents:
Projected compensation for damages per person for Incident A = ¥aProjected compensation for damages per person for Incident B = ¥b
Average Projected Compensation for Damages per Person = (¥a + ¥b) / 2 incidents■Example
Table 6: Incident Details

Incident A
Incident B

Number ofVictims
1
100(specific example)

Total Projected
Compensation for Damages¥1,000,000¥1,000,000

Projected Compensation
for Damages per Person¥1,000,000¥10,000

Table 7: Projected Compensation for Damages per Person (specific example)
Number ofVictims
Divided by the
number of people
Calculation per thisreportProjected Compensation for Damages per
Person101¥2,000,000 ÷ 101 = ¥19,800

101(¥1,000,000 + 10,000) ÷ 2 incidents = ¥505,000© Copyright 2010 NPO Japan Network Security Association (JNSA)
22

The following shows the interannual changes in the ratio of projected compensations fordamages per person in a graph and by actual number of incidents.
100%
8.1%

0.0%
7.0%

1.6%
1.4%
4.4%

90%

1.5%
11.5%

9.9%

12.3%
22.7%

80%
70%

37.1%

1.6%
6.4%

0.0%
2.1%

0.0%
2.0%

7.3%

9.7%

11.0%

10.3%

14.8%

14.0%

Unknown¥1 million or more
14.2%

60%

Less than ¥1 million

35.5%
39.1%

Less than ¥500,000
Less than ¥100,000

29.8%

50%

42.8%

42.1%

Less than ¥50,000
Less than ¥10,000

40%

Less than ¥5,000

29.5%
37.1%

30%

14.0%
25.0%

20%
10%

15.6%
17.7%

30.0%
27.2%

18.3%

22.8%
10.7%

11.4%

14.3%

14.1%

11.7%

2004
(n=366)2005(n=1032)

2006(n=993)2007(n=864)2008(n=1373)

0%2002(n=63)

2003(n=57)

Figure 17: Interannual Changes in the Ratio of Projected Compensation for Damages per
Person (Number of Incidents)
Looking at the ratio of projected compensation for damages per person, we see that
despite a slight increase in the ratio of incidents between ¥100,000 and ¥500,000, there
have been no significant year‐to‐year changes overall.

© Copyright 2010 NPO Japan Network Security Association (JNSA)
23

4.3 Projected Compensation for Damages per Incident(1)Single‐Year Analysis¥5 billion or more
0.9%
Less than ¥5 billion
Unknown
0.9%
7.1%
Less than ¥1 billion
3.9%
Less than ¥100,000
32.0%

Less than ¥100 million
3.1%
Less than ¥50 million
9.1%
Less than ¥10 million
5.3%
Less than ¥5 million
12.6%
Less than ¥1 million
7.7%

Less than ¥500,000
17.3%

Figure 18: Ratio of Projected Compensation for Damages per Incident (Number of Incidents)
Under the projected compensation for damages, incidents of less than ¥500,000 accountfor approximately half of the total, with incidents of between ¥500,000 and ¥5,000,000
representing 20.3% of the total.
This result indicates that small‐scale incidents in terms of projected compensation fordamages (less than ¥100,000; between ¥100,000 and ¥500,000) involving information of
low value occurred most frequently.

(2)

Interannual Analysis
The total projected compensation for damages for 2008 decreased markedly compared to2007, which was the highest to date. In order of financial impact, the 2008 figure came inbelow that of 2004, the year prior to the full enforcement of the Personal Information
Protection Act.
This development stems from the trends in evidence for incidents that occurred during
2008. The first reason is that, despite a significant increase in the number of information
leakage incidents, a relatively low number of victims were involved in any particular incident.
Second, there were very few incidents that involved a large volume of sensitive information,and there were not incidents involving a major amount of projected compensation fordamages. Based on these two factors, the total amount of projected compensation fordamages decreased compared to the prior year.

© Copyright 2010 NPO Japan Network Security Association (JNSA)
24

100%
10.5%

8.2%

1.6%

3.5%

2.2%
4.6%

8.1%

7.0%

11.3%

90%
80%

3.2%
3.2%
15.8%

70%

4.3%
1.8%
4.9%
9.3%

9.6%

3.5%

7.7%

10.9%

15.6%

7.8%

4.4%
1.2%
1.6%
6.1%
2.6%
10.6%
6.6%

5.9%
2.0%
2.5%
6.6%
4.2%

7.1%
0.9%
0.9%
3.9%
3.1%
9.1%

Unknown¥5 billion or more

12.0%

5.3%

7.2%

12.6%

Less than ¥5 billion
Less than ¥1 billion

60%
30.6%

14.0%

50%

16.4%

6.5%

16.7%

20%

12.3%
3.5%

10%
3.2%
4.8%
0.0%

8.8%

2002
(n=63)

2003(n=57)

0%

3.5%

Less than ¥5 million

8.4%

17.3%

Less than ¥500,000
Less than ¥100,000

8.8%
19.5%

27.4%

Less than ¥10 million
Less than ¥1 million

8.1%

8.8%

30%

7.7%

20.3%

12.3%

40%

Less than ¥50 million

22.1%
7.1%

Less than ¥100 million

9.6%

17.5%

15.7%
32.0%

10.4%
8.5%

2004
(n=366)

12.5%

2005
(n=1032)

17.1%

17.2%

2006
(n=993)2007(n=864)2008(n=1373)

Figure 19: Interannual Changes in the Ratio of Projected Compensation for Damages per
Incident (Number of Incidents)
As in past years, 2008 continued the trend toward an increase in incidents for which the
projected compensation for damages is less than ¥100,000.
With no large‐scale incidents during 2008, we noted a decrease in the ratio of incidents
involving large amounts of projected compensation. However, corporate managers would be
ill advised to relax too much, given the fact that an average of six incidents per month (78incidents) involved projected compensation for damages in excess of ¥100,000,000.

4.4 Summary: Projected Compensation for Damages
We can summarize the trends for total projected compensation for damages during 2008
under the following two points:z

Including two large‐scale information leakage incidents, there were numerous
incidents during 2007 involving projected compensation for damages that vastly
exceeded ¥5 billion. In contrast, there was a marked decline in large‐scale incidents
during 2008, including a decrease in the number of incidents involving projectedcompensation for damages in excess of ¥5 billion. Accordingly, the total projectedcompensation for damages during 2008 was notably less than the 2007 figure.
© Copyright 2010 NPO Japan Network Security Association (JNSA)
25z

Due to the low number of victims per information leakage incident for 2008, theper‐incident projected compensation for damages was comparatively low. Morethan 50% of all incidents involved projected compensation for damages of less than
¥1,000,000. Looking at this fact, we can conclude that 2008 was a year
characterized by a high number of small‐scale incidents.

© Copyright 2010 NPO Japan Network Security Association (JNSA)
26

5 Calculating Projected Compensation for Damages related
to Personal Information Leakage
5.1 Objective of Calculating Projected Compensation for
Damages
One of the earmarks of the Working Group is proposing a calculation model for legal
reparations, and then applying the calculations to actual personal information leakage
incidents.
From its inception the Working Group has engaged in activities analyzing actual incidents
for the purpose of quantifying the corresponding risks and effectiveness of the subsequent
response. The objective behind proposing a calculation model for projected compensation
for damages is to provide organizations with a quantitative understanding of the latent risks
involved in handling personal information.
We report the results of applying our calculation model to Personal Information Leakage
Incidents occurring during 2007 in the following sections of this report. However, our intent
is that organizations use this calculation model to grasp the latent risks connected with thepersonal information possessed within their organizations. We encourage all organizations
to conscientiously apply this calculation model to the personal information maintained andmanaged within their systems.
Please understand that the calculation results shown below are based on the assumptionthat all victims will seek compensation for damages related to the specific incident
described. Our calculations do not reflect any actual payments made in connection with thecorresponding Personal Information Leakage Incident.

5.2 Explanation of the Projected Compensation for Damages
Calculation Model
Our calculations for compensation for damages occurring during 2008 adhere to theresearch methods we used for our 2003 survey.
Our decision was based on the fact that we were unable to discover any legal precedents
related to individuals or groups seeking compensation for damages related to Personal
Information Leakage Incidents subsequent to the conclusion of our 2003 survey.

© Copyright 2010 NPO Japan Network Security Association (JNSA)
27

Please see our 2003 report for details behind the genesis of the calculation model we use
to calculate projected damages.
Here, we will limit ourselves to a simple overview of our model.

5.2.1 Process behind the Formation of the Projected Compensation
for Damages Calculation Model
Incident Research
Research
Incidents
Research
LegalPrecedent
Legal
Precedent

AnalysisAnalyze types of
information
leaked, causes,
number of victims
Research legal
precedent

Create Calculation Model
Determine
input factors,
quantify input
valuesSeek advice ofexperts
Form calculation
model

Verification
Perform
comparative
calculations
between actual
court verdicts andthe results of thecalculation model

Figure 20: Process behind the Formation of the Projected Compensation for Damages
Calculation Model
We developed our calculation model as depicted in Figure 20 above as follows:
1) Preliminary Research
Research and collection of data about publicly announced Personal Information
Leakage Incidents.
At the same time, we also conducted research into past court cases involving invasionof privacy and defamation. Here, as we discussed in our 2003 report, we incorporated
data from the 2003 decision by the Osaka Supreme Court regarding the appeal of thejudgment in the case (No. 1165) related to the leakage of the Uji City basic residential
register into our calculation model.
2) Analysis
We analyzed compilations of the number of victims, the types of information leaked,
the cause of the leakage, the information leakage route, and other factors related to
the Personal Information Leakage Incidents. “3. Analysis Results of Personal
Information Leakage Incidents” describes the results of our analysis for 2008.
3) Calculation Model Creation
Having determined the input factors for our calculation model, we began to develop
the model itself. Input factors included the value of the information leaked, thedegree of social responsibility of the organization (s) involved, and an evaluation of
the post‐incident response by the organization.
© Copyright 2010 NPO Japan Network Security Association (JNSA)
28

Further, we asked for, and incorporated, the opinions of lawyers and other legal
experts.
4) Verification
To measure the credibility of our calculation model, we applied our model to thepreviously mentioned Uji City registry leakage case, comparing the results of ourcalculations with the actual determination of damages ordered by the court. As aresult, the level of damages according to our calculations was essentially the same as
the actual legally mandated figure.

5.2.2 Explanation of the Calculation Model Input Values
We incorporated the following input values into our calculation model:z

Value of the personal information leakedz

Degree of social responsibility of the organization in questionz

Appraisal of post‐incident response by the organization in question

In an actual lawsuit, one would expect that in addition to the factors above, the courts
would also consider the protective measures in place before the incident, the volume of theleaked information, the actual damages incurred, and specific measures taken in responseto the incident. However, for purposes of forming our calculation model, our only sources
are publicly available information, and there are limits in what can be inferred by the otherfactors previously described. In addition, we narrowed the number of input factors,
reasoning that an unnecessarily complicated calculation model would be counterproductive
to our main goal of encouraging organizations to use the calculation model to evaluate theirown risks.
The following describes how we quantified each of the input factors used in our
calculation model.

5.2.2.1

Value of Personal Information Leaked

We categorized the effect of Personal Information Leakage on a victim in terms of“Economic Loss” and “Emotional Distress.” To quantify the extent of the effect, we created achart, with “Economic Loss” on the ‘Y’ axis and “Emotional Distress” on the ‘X’ axis. For thesake of convenience, we call this an Economic‐Privacy Map (EP Map) (Figure 21). The farther
removed from the origin, the greater the respective levels of Economic Loss and Emotional
Distress.

© Copyright 2010 NPO Japan Network Security Association (JNSA)
29

Figure 21: Economic‐Privacy Map (EP Map)
On this EP Map, we plotted the types of leaked information noted from our past research
and analysis of Information Leakage Incidents. We can then use this EP Map plot locations
to derive the type of effect associated with leaked information, or in other words, what levelof value the information represents. Further, in considering the ease of inputting thesevalues into our calculation model, we defined three stages corresponding to the degree of
influence of the X and Y axes on the EP Map, reconfiguring the types of leaked information.
This resulted in our EP Map becoming a Simple‐EP Map (Figure 22).

© Copyright 2010 NPO Japan Network Security Association (JNSA)
30

Figure 22: Simple‐EP Map
However, we did not simply obtain the value of the leaked information according to theplot location between the X and Y values. Rather, we believe that a slight correction isrequired to more easily relate these values to the actual damages incurred. These
corrections have been incorporated into the following formula for calculating the value of
leaked information:■ Value of Leaked Personal Information= Value of Basic Information x Degree of Information Sensitivity x Degree ofEase in Identifying the Individual

a. Value of Basic Information
We assign 500 points as the base value for the Value of Basic Information, regardless ofthe type of information in question.

b. Degree of Information Sensitivity
In general, most definitions of sensitive information are limited to certain types of© Copyright 2010 NPO Japan Network Security Association (JNSA)
31

information defined as personal information, the collection of which is prohibited under JIS
Q 15001. Such information includes personal information that may serve as the root of
philosophical, religious or social discrimination. However, there are certainly other types of
information that may cause Emotional Distress. In our calculation model, we haveestablished levels for three stages of Personal Information as a whole, providing definitions
allowing calculation of the sensitivity of the information from the corresponding values.
Further, we have also included in our calculation model the degree of information sensitivity
for information leading to economic loss.
The Degree of Information Sensitivity is derived from the following formula, using thelocation of the plot (x, y) of the related information on the Simple‐EP Map (=level value).
Degree of Information Sensitivity = (10x‐1 + 5y‐1)
If the leakage consists of several types of information, we use whichever information
generates the largest X and largest Y values. For example, if the leakage involves “Name,address, birth date, sex, telephone number, name of sickness, and account number with a
PIN number,” then the Simple‐EP Map (x, y) will be as follows:“Name, address, birth date, sex, telephone number” = (1,1)“Name of sickness” = (2,1)“Account number with a PIN number” = (1,3)
In this example, the largest X value is “Name of sickness” at “2,” while the largest Y value
is “Account number” at “3.” Plugging these values into our formula, we get:(102‐1 + 53‐1) = (101 + 52) = 35 points

c. Degree of Ease in Identifying the Individual
Degree of Ease in Identifying the Individual represents the ease with which the leaked
Personal Information can be used to specifically identify an individual. For example, if acredit card number is leaked, but there isn’t any information to identify the name, etc. of
the individual, there is a low likelihood of actual damages. Accordingly, we haveincorporated the Degree of Ease in Identifying the Individual into our calculation model. Thisfactor is subject to the determination standards shown in Table 8 below.

© Copyright 2010 NPO Japan Network Security Association (JNSA)
32

Table 8: Degree of Ease in Identifying the Individual— Determination Standards
Degree of Ease in
Determination Standards
Identifying the Individual
Individual may be easily identified.
6“Name” and “Address” are included.
Individual may be identified after certain costs are incurred.
3“Name” or “Address + Telephone Number” are included.
Difficult to identify the individual.
1
Other than that described above.
5.2.2.2

Degree of Social Responsibility of the Organization in Question

As shown in Table 9, the Degree of Social Responsibility is either “Higher than Normal” or“Normal.” The standard for an organization with a “Higher than Normal” degree of Social
Responsibility include those that are described in “Basic Policies related to the Protection of
Personal Information (Cabinet decision April 2, 2004)” as being in a “specific industry that
requires a guarantee of the appropriate handling” of personal information. Included in thisdefinition are public institutions such as government agencies and large companies thatenjoy high levels of name recognition.
Table 9: Degree of Social Responsibility of the Organization Involved in Information
Leakage—Determination Standards
Determination Standard

Higher than
NormalNormalOrganizations in specific types of industries
requiring a guarantee of the appropriate handlingof personal information (medical, financial/ credit,
telecommunications, etc.), public institutions, andlarge companies with high name recognition.
Other normal companies, associations andorganizations.

Degree of Social
Responsibility

2

1© Copyright 2010 NPO Japan Network Security Association (JNSA)
33

5.2.2.3

Appraisal of Post-Incident Response

The appraised value of Post‐Incident Response is based on Table 10 below. In cases where
the Post‐Incident Response is “Unknown, Other,” we assume that no inappropriate
responses were detected, and therefore assign the same value as given to an appropriate
response.
Table 10: Appraisal of Post‐Incident Response—Determination Standards
Determination Standard
Appraisal of Response
Appropriate
1
Inappropriate
2
Unknown, Other
1
Since there are no clear standards as to how to evaluate Post‐Incident Responses, we use
the following response chart compiled from past responses to Information Leakage
Incidents as a guideline for determining an appropriate/ inappropriate response.

a. Examples of Appropriate Responses
zRapid response
zUnderstanding of the circumstances
zPublic announcement of the incident
zSubsequent leakage of the circumstances (Website, Email, letters)
zCommunicating with victims, offering apologies
zOffering apologies to victims (including presentation of gift certificates, etc.)
zEstimates of effects likely to occur
zEstablishment of a claims contact office/ person
zEfforts to retrieve the leaked informationzExpress of appreciation to the party discovering the incident/ full account of theincident
zCompensation to customers
zImprovement of system through management participation
zInvestigation into the cause of the incident
zImproved security measureszReview of all procedureszExpert review of system appropriatenesszImplementation of advice and audits from outside experts

b. Examples of Inappropriate Responseszzz

Issues were indicated, but not addressed
Slow response
Repeated occurrences© Copyright 2010 NPO Japan Network Security Association (JNSA)
34

z
z

Measures were implemented, but were ineffective
False reporting

5.2.3 Projected Compensation for Damages Calculation Model
The following represents an overall view of the Calculation Model, integrating thefactors discussed in “5.2.2 Explanation of the Calculation Model Input Values.” The Working
Group calls the following Projected Compensation for Damages Calculation Model the JO
Model (JNSA Operation Model for Individual Information Leak).”

Projected Compensation for Damages= Value of Information Leakedx Degree of Social Responsibility of the Organizations
x Appraisal of Post-Incident Response= (Value of Basic Information x Degree of Sensitivity
x Ease in Identifying the Individual)x Degree of Social Responsibility of the Organization
x Appraisal of Post-Incident Response= Value of Basic Information [500]x Degree of Information Sensitivity [Max(10x-1 + 5y-1)]
×Ease in Identifying the Individual [6,3,1]
×Degree of Social Responsibility of the Organization [2,1]×Appraisal of Post-Incident Response [2,1]Figure 23: JO Model© Copyright 2010 NPO Japan Network Security Association (JNSA)
35

6 Conclusion
While a record number of information leakage incidents were reported during 2008, theactual number of victims affected was the lowest since 2005. Initially, we attributed this to
more conscientious reporting of all incidents regardless of size, as well as the comparativelack of major incidents involving large numbers of victims. However, the number of incidents
affecting between 5,000 and 1 million victims remains nearly unchanged from 2007.
Accordingly, it is our opinion that the underlying factor behind the decrease in the numberof victims for 2008 is the fact that there were no large‐scale incidents significantly exceeding
1 million victims. Only one incident occurred during the year large enough to involve
approximately 1 million individuals. In other words, through 2007 there was at least one
information leakage incident that significantly exceeded 1 million victims, affecting thestatistical results.
Similarly, 2008 had a low ratio of incidents involving a high amount of projectedcompensation for damages. There were approximately 300 incidents for which the
projected compensation for damages exceeded ¥5 million, a level remaining nearly
unchanged since 2006. A total of 78 incidents involved projected damages in excess of ¥100
million, calculating to a surprisingly high average of six per month. The increase insmall‐scale incidents involving small amounts of projected compensation for damages
resulted in the deceptive appearance of a decrease in incidents involving large amounts ofcompensation for damages.
The significant increase in the number of leakage incidents involving less than 1,000
victims as mentioned above could be a favorable sign that undiscovered personal
information leakage incidents have finally come to light, or that organizations are now more
conscientious of reporting such incidents. However, the number of incidents involving 1,000
or more people has remained nearly constant since 2007. This could be an indication of
declining returns in measures that have been in place for some time with respect topersonal information requiring careful handling. In such a case, we believe that achieving
any greater improvements using the same methods is impractical, and new methods should
be introduced.
Personal information leakage through paper documents remains a frequent cause ofincidents. Paper documents ultimately require manual processing and management, whichmeans an ever‐present risk of erroneous disposal or other mishandling as long as the paper
is maintained. Paper documents present unique issues, including being difficult to trace inthe event of loss, and the fact that paper cannot be encrypted. At present, there a no highly
effective measures against personal information leakage through paper documents, and weanticipate that incidents attributed to this cause will remain a frequent occurrence.
© Copyright 2010 NPO Japan Network Security Association (JNSA)
36

This is why we believe, despite a certain level of adoption of anti‐leakage measures,operational error and other careless mistakes have played a role in the reason why the
number of incidents have not decreased. Even with set office rules and secure work steps,
improved awareness through organizational education, etc., human intervention is always
necessary at some point during the handling of information. Accordingly, operational error
or other careless mistakes are going to occur at some minimum level. While triple‐checks
can be expected to reduce careless mistakes, compared to double checks, someexperiments have shown mistakes to actually increase. Rather than relying either onsoftware measures or operational measures (workflow, double‐checks), we believe that themost effective approach is to implement the best measure for the particular situation.
However, it remains a difficult task to prevent internal crime due to the unauthorized actsof a manager or other individual with authority. Internal crime is facilitated by a certain
existing level of authorization, which limits the effectiveness of system‐based preventive
measures. Accordingly, countermeasures designed to defeat internal crime focus on
monitoring logs, etc. rather than the prevention of the act. Individuals having a certain levelof authority who intend to commit a crime will already know about the presence and detailsof monitoring systems, potentially being able to evade or turn such systems off. In otherwords, there are many cases in which monitoring as a fraud prevention measure is notreliable or cost effective, since such measures cannot actually prevent the act fromhappening in the first place. Obviously, security education will not be effective for anindividual predisposed to committing a crime. Keeping those with authority from seeingorganizational/ systemic weaknesses (crime opportunity theory) is an effective measureagainst internal crime. However, such effectiveness is limited to those individuals who do
not have a strong desire to commit a crime.
In our 2008 survey, we noted instances of retirees or temporary staff whose contracts
have expired removing confidential or personal information, leading to a leakage incident.
We believe that these types of incidents can be prevented by employing the crime
opportunity theory, clarifying staff retirement procedures, and otherwise preventing
opportunities to remove information from within the organization.
Given that the number of victims of information leakage during 2008 was at the lowest
level since 2005, we can conclude that comprehensive technological and organizational
measures against information leakage are being adopted in industries that have a major
impact on society. However, in contrast to other years, there were no unexpectedlarge‐scale incidents that significantly surpassed 1 million victims, while the number of© Copyright 2010 NPO Japan Network Security Association (JNSA)
37

incidents involving 1,000 or more victims remained at the same level as prior years.
We believe that in the four years that have passed since the complete enforcement of the
Personal Information Protection Act, organizations dealing with large volumes of sensitive
personal information have paid more attention to implementing proper measures andhandling procedures. However, excluding the effects of some measures such as against P2P
file‐sharing software, we cannot say with conviction that overall improvements have beenmade. We urge organizations to continue to adopt both systematic and operationalanti‐leakage measures, while at the same time implementing systems designed to beeffective for their particular circumstances, adopting both systematic and operationalanti‐leakage measures.

© Copyright 2010 NPO Japan Network Security Association (JNSA)
38

7 Contact Information
Please submit any comments or questions about quoting sections of this report throughthe inquiry form found at the JNSA website.
*Our system does not provide a confirmation in response to quote inquiries madethrough this form. Thank you for your understanding.

A FAQ sheet about this report is also available at our website. Please refer to this FAQ regarding
comments or questions about quoting sections of this report.
http://www.jnsa.org/faq/incident.html■Inquiry Form
Quote inquiry and comment form:
URL: https://www.jnsa.org/aboutus/quote.html© Copyright 2010 NPO Japan Network Security Association (JNSA)
39

8 Appendix Definitions for Causes of Information Leakage
The Working Group categorized the causes of information leakage as shown in the tablebelow.
Table 11: Approach to Categorization of Causes of Information Leakage
Category
Configuration
Error

Specific Example
A website or otherconfiguration error
allows information to
be viewed fromoutside theorganization; sensitive
information may havebeen viewed.

Operational
Error

Incident occurs due to
misdirectedtransmission of email,fax, regular mail.

Bug/ Security
Hole

Incident occurs due toa Bug/ Security hole in
the OS, application,etc., which allows
sensitive information
to be viewed over theInternet or otherwise
leaked.
Sensitive informationis leaked outside theorganization whenaccess controls are
overcome, and the
network is infiltrated
by external sources.

Unauthorized/
Illegal Access

Determination Criteria
When information has been leaked due toconfiguration errors in web servers, file accessprivileges, etc.
Incidents exploiting configuration errors tointentionally steal information are notcategorized as Unauthorized/ Illegal Access.
Since this is not a software vulnerability, such
incidents are not categorized as Bug/ Security
Hole.
Information leakage due to erroneous
management procedures are categorized as
Administrative Error.
When information has been leaked due to a
mistaken/ inaccurate address, an accidental pushof the wrong operating button, or other humanerror.
Categorized as Operational Error when thelast/ ultimate operation is the cause of theerror. Categorized as a Configuration Error
when email system settings are in error.
When a Bug/ Security Hole in an installed OS orapplication causes an information leakage
incident.
Includes cases where Bug/ Security Hole isleft unaddressed on the user’s system.
Includes cases where software or systemvendor has not dealt with security issue.
When a third party utilizes the network (mainly)
to access a system illegally, resulting in theleakage of information.
Categorizeds as Internal Crime/ Internal Fraud
when an individual internal to the organization(employee, worker, etc.) commits unauthorized/
illegal access.

© Copyright 2010 NPO Japan Network Security Association (JNSA)
40

CategoryInternal
Crime/
Internal Fraud

Specific Example
Sensitive informationis removed by an
employee, temporary
employee or otherindividual internal tothe organization for
fraudulent purposes.
Information stolen isused to commit crime,
is sold, or otherwise
leaked.

Unauthorized
Information
RemovalInformation isremoved from within
the organization by an
employee, temporary
employee, outsidecontractor, vendor,
former employee, etc.
for use at home,customer location orother location, and is
subsequently leaked.

Non‐Intended
Use

Organization‐wide orbusiness‐related useof personal
information for otherthan the original
intended purpose.
Information is sharedwith affiliates or otherexternal organization
outside the original
scope of disclosure.
When a PC or other
other information
media is inadvertantly
lost or misplaced
inside a train,
restaurant, or otheroutside location.
Sensitive information
on a PC or otherinformation media isstolen in the processof an auto or officebreak‐in.

Loss/
Misplacement

Theft

Determination Criteria
When an employee or employee from anothercompany (temporary worker, etc.) inside theorganization engages in unauthorized/ illegal
access or other unlawful activity to remove
information for fraudulent purposes.
Categorized as Internal Crime/ Internal Fraud
even in cases where an intentional fraudulent
act by an organizational outsider involves
unauthorized/ illegal access.
Categorized as Unauthorized Information
Removal in cases where information required
for work or other legitimate purposes isremoved, but in violation of rules.
When information is removed for work or other
legitimate purposes, but in violation of rules.
Striclty speaking, it is “theft” when information or
information media is removed in violation of therules; however, such cases as noted in the left
column are categorized as Unauthorized
Information Removal.
Categorized as Unauthorized Information
Removal, even when an employee takes
sensitive information home, subsequently
leaking such information through P2P
file‐sharing software.
When personal information is used for other thanthe originally intended purpose.
Categorized as Internal Crime/ Internal Fraud
when an employee, temporary employee orother organization insider acts individually touse personal information for a non‐intendeduse.

When information is removed with permission,and is then subsequently lost or misplaced at thedestination or en route. Leakage occurs topersonal/ individual Administrative Error.
Categorized as Administrative Error when
information subject to control is lost within
the organization.
When information is stolen by a third party with
the information recordable media. Auto, officebreak‐in, etc.
Categorized as Unauthorized/ Illegal Accesswhen only information (not a PC or physicalmedia) is stolen.

© Copyright 2010 NPO Japan Network Security Association (JNSA)
41

Category
Administrative
Error

Worms/
Viruses

Other

Unknown

Specific Example
Personal information
is lost after anorganizational move.
The transfer of
personal information
is not sufficiently
verified; transferred
information is lost.
Information disclsure/management rules are
not sufficiently clear;information is
inadvertantly
disclosed.
Personal information(email addresses, etc.)
is leaked without theconsent of theinformation ownerdue to worm or othervirus infection.

Documents belonging
to one person are
included in an
envelope addressed tosomeone else.

Determination Criteria
When information becomes lost or misplaced
within an organization or usual distribution
channel. When information is leaked in thebusiness process due to work procedure error, or
because rules regarding information disclosure
and/ or information management are notsufficiently clear. When responsibility for loss lies
with the organization.
Categorized as Theft when theft occurs due
to administrative error.
Includes cases where information is
inadvertently destroyed due to insufficientmanagement/ administration.
When information is leaked due to virus or worm
infection. Considered Worms/ Viruses when suchis the proximate cause of the leakage.
Includes cases where information is leaked
due to a worm/ virus that takes advantage of
security holes.
Categorized as Worms/ Viruses in cases otherthan when the cause of leakage is due to P2P
file‐sharing software containing worms/
viruses accessing information taken home
without permission (Unauthorized
Information Removal), or when information isleaked from an organization PC using P2P
file‐sharing software (Administrative Error).
Any situations not addressed above.

Cause of the incident is unknown.

© Copyright 2010 NPO Japan Network Security Association (JNSA)
42