5‑5

5 Cyber Security

Responding to Cyber Attacks during theTokyo 2020 Games
ONISHI Masaki

HOSODA Naofumi

NAKANISHI Katsuhiko
IBAYASHI Hiroaki

In the past there were many cyber attacks on the Olympic and Paralympic Games that could affect the operation of theGames On the Tokyo 2020 Olympic and Paralympic Games many cyber attacks were observed and reached their peakduring the Olympic Games We describe some representative examples and how we responded to these attacks with thesecurity solutions implemented and the security operations matured during the Games preparation period
Keywords：Tokyo 2020 Games Cyber attacks Security operations

1．PrefaceAs described in this Special Issue “5‑4 Cyber Security

2．Security Operation Structure during theGames

Operations for the Tokyo 2020 Games” the Olympic and

The Security Operation Centre (SOC) located within

Paralympic Games Tokyo 2020 (hereinafter referred to

the Technology Operation Centre (TOC) increased staff

as “Tokyo 2020 Games”) matured the security opera-

members and expanded security operation hours one

tions in preparation for the Games Cyber attacks weremonth before the opening ceremony of the Olympic

continuously observed since the early preparation

Games The SOC was in full operation two weeks before

period and the volume peaked during the Games with athe opening ceremony of the Olympic Games

total of 450 million security events observed during theoperated 24 hours a day in three group of a 12‑hour shiftGameswith a total of approximately 130 staff members (FigureandIn this article we describe representative examples of1) During the Paralympic Games the number of staff

security responses during the Games and how wemembers and operating hours were reduced comparedresponded to cyber attacks and successfully defended
the Games

ONISHI Masaki
Technology Services Bureau The Tokyo Organising Committee of the Olympic
and Paralympic GamesHOSODA Naofumi
Technology Services Bureau The Tokyo Organising Committee of the Olympic
and Paralympic Games
NAKANISHI KatsuhikoTechnology Services Bureau The Tokyo Organising Committee of the Olympic
and Paralympic GamesIBAYASHI Hiroaki
Technology Services Bureau The Tokyo Organising Committee of the Olympic
and Paralympic GamesThe Journal of The Institute of Electronics Information and Communication Engineers Vol 105 No 8 Supplement pp 279‑284 August 2022
© 2022 The Institute of Electronics Information and Communication Engineers

Figure 1

SOC (©2021‑International Olympic Committee‑All
Rights Reserved)

Special Issue : Technology and Innovation in the Olympic and Paralympic Games Tokyo 2020279

to those during the Olympic Gamesvary with some attacks targeting a weak point withThe SOC received support from the Japan Cybercrime

minimal accesses while others on the other handControl Center (JC3) and the Japan Computer Emer-

require a large number of accesses over a wide area ingency Response Team Coordination Center (JPCERT/

order to find a weak point The number of logs and alerts

CC) which dispatched liaison members that served as aalso varies greatly depending on the implementation andpoint of contact

nature of security measures

In recent years

theDuring the Games the security monitoring status wasnumber of logs and alerts has increased explosively duereported and shared at regular daily meetings by

to the improvement of detection technology which

members of the International Olympic Committee

enables highly detailed detection of risk events as well(IOC) the International Paralympic Committee (IPC)

as the incorporation of various types of data for advanced

Olympic Broadcasting Services (OBS) Atos SE NTT

analysis of attacks which is not limited to security On

Communications Corporation Nippon Telegraph andthe other hand the technology for narrowing down the

Telephone East Corporation and others

truly dangerous information from such tremendous

In Section 3 we describe the security events andinformation is also becoming more sophisticated and inincidents observed during the Games and our responses

many cases the number of outputs is significantly

to them

reducedThe numerical values vary greatly depending on the

3．Cyber attacks and Security Responses
during the GamesIn Section 3 we discuss the significance of numericalvalues in security operations and the security eventsnature of the attack and the implementation of security
solutions and the size of the number cannot be used tocompare the danger and scale of attacks against different
environments or the strength of security solutions andthe adequacy of operational systems

observed in the four domains : the Back Office Network(BON) used by the Tokyo Organising Committee

32

450 Million Security Events

members for their work the Competition Network

Based on the 3 1 Table 1 shows the 450 million(CPN) that connected the venues the Olympic Technol-

security events during the Games This is a tabulation of

ogy Network (OTN) serving various VLANs dedicatedthe external accesses blocked by the perimeter defense

to the Tokyo 2020 Games stakeholders and the websites

from the number of logs collected for each domain listed

located on the Internet (websites) We also describe ourin 3 3 to 3 5 This is a numerical index that represents

security response to the fake live‑streaming site dealt

the number of attacks which is not easily affected by thewith based on the security intelligence

implementation of solutions

but is not necessarily

proportional to the degree of danger
31

Significance of Numerical Values in Security
Operations

In security operations

In the three domains of BON

CPN

and OTN

accesses from outside that are blocked by Unified Threat
operators check a large

Management (UTM) or other means are included The

number of logs and alerts generated by variety of

number of detected and blocked attacks that started

solutions and classify them into incidents includingfrom routes other than external accesses is not included

attacks and false positives that require action and thenin the figures in Table 1 In addition the number of

respond to them Actual figures for these logs alerts

alerts is greatly reduced because only one alert is issued

responses and others are provided here as supplements

for each series of blocked accesses with a high‑risk level

Please note however that these figures are specific to

In the Web domain this applies to accesses blocked byeach domain and environment at the time of the Tokyo

Content Delivery Network (CDN) It is the total number

2020 Games and are not comparable to those of different
environments
The number of attacks itself does not indicate thedegree of danger The number of attacks varies greatly

Table 1

Number of External Accesses Blocked by Perimeter
Defenses (Approximate Numbers)
BON/CPN

OTN

Web

Total
AmountNumber of external
150 million
accesses blocked［cases］

140
million160
million450
milliondepending on the social conditions geopolitical risks
attack trends attacker motivation and other factors in
the host country The quality and quantity of attacks
280

THE JOURNAL OF THE INSTITUTE OF ELECTRONICS INFORMATION AND COMMUNICATION ENGINEERS

Table 2

Number of Security Responses in BON
Olympic Games Period(7 23 2021‑8 8 2021)

Paralympic Games Period(8 24 2021‑9 5 2021)

Number of security alerts notified by security solutions［cases］．

5 808

1 134

Number of reports/inquiries from users and others
confirming details of security alerts［cases］
．

80

70

Number of security incidents affecting staff andsystems［cases］．

00Reference : Number of logs stored in SIEM ＊［case］．

13 343 465 345

6 863 991 707＊Not all security solution alerts/logs are included In addition to security logs logs required for security
incident response are also includedof accesses blocked by three types of filters : rule‑based
rate‑based

and reputation‑based

The details aredescribed in Section 3 5
33

Security Responses in BON/CPN

During the Games as in the preparation period weanalyzed reports from staff and alerts notified by eachsecurity solution and identified the extent of the impact
and causes which were then addressed (Table 2)
During the Games availability was emphasized andsince the target response time was different between the

Figure 2

Number of Account Locks in Azure AD

Games preparation period and the Games an even fasterand more precise response was required
This section describes an example of a suspicious e‑

stakeholders and alert them to the situation

mail sent by a person related to the Games whose e‑mailAs another example we describe a security event foraccount was compromised which was detected during

the Tokyo Organising Committee accounts Figure 2

the Olympic Gamesshows the number of account locks observed in Azure

In the early morning of August 4 2021 a suspicious e‑

Active Directory (Azure AD) a Microsoft authentica-

mail was sent to seven Tokyo Organising Committeetion service used by the Tokyo Organising Committee

staff members by a person whose e‑mail account had

The account lock function was set to lock the account forbeen compromised

The suspicious e‑mail had ana predetermined time after a predetermined number ofattached file and when the attached file was opened aconsecutive password authentication failures As shown

screen that resembled a Microsoft login page wasin Figure 2 a large number of account locks occurredfrom July 23 2021 the day of the opening ceremony ofdisplayed
All suspicious e‑mails were quarantined before they

the Olympics while almost none occurred during thereached the e‑mail accounts of the staff members

Paralympic Games Analysis of the accounts that were

through e‑mail security measureslocked showed that the source IP addresses were almost

and the staff

members did not receive the e‑mails There was no

all connections from overseas

access history for the destinations linked to in theaccounting for about half of the total number of accountattachments and the proxy was set to block them so

locks

there was no impact on the Tokyo Organising Commit-

Since account locking was not implemented to prevent
legitimate use

teewith five countries

there was no impact on businessWe contacted the organization that the person whose

operations We confirmed that no unauthorized accesse‑mail account was compromised belonged to and asked

occurred based on the attack analysis originating fromthem to take action We also shared the case with thethe accounts that were locked In addition since theintelligence sharing platform which the IOC establishedTokyo Organising Committee used two‑factor authenti-

to share information among the Tokyo 2020 Gamescation for all authentication it was difficult for unauthor-

Special Issue : Technology and Innovation in the Olympic and Paralympic Games Tokyo 2020281

Table 3

Number of Security Responses in OTN
Olympic Games Period(7 23 2021‑8 8 2021)

Paralympic Games Period(8 24 2021‑9 5 2021)

Number of security alerts notified by security solutions［cases］．

5 287

772

Number of reports/inquiries from users and others
confirming details of security alerts［cases］
．

92

29

Number of security incidents that were analyzed andblocked or otherwise addressed［cases］
．

12

13

Reference 1 : Total number of security solution logs
［cases］．

70 878 430

90 432 424

Reference 2 : Number of OTN connected clients［units］．
(Unique daily cumulative total)

1 429 149

578 435＊It is unknown whether users and systems were actually affected or not since terminals/systems connected to
OTN are brought by users

ized access to occur due to password leakage andorganization that owned the system and asked them topasswords were reset for all staff members immediately

take action and also took measures using the UTM

before the Games The risk of this security event was

deployed in OTN

low

In addition with the cooperation of the National centerof Incident readiness and Strategy for Cybersecurity

34

Security Responses in OTN(NISC)We responded to security events and incidents such as

the National Institute of Information andCommunications Technology (NICT) JC3 JPCERT/

port scans and vulnerability scans from external sourcesCC

and malware infection of PC terminals brought in by thevendors we detected the open resolvers with improp-

Tokyo 2020 Games stakeholders Table 3 shows theerly configured Domain Name System (DNS) settings

ICT‑ISAC Japan (ICT‑ISAC‑J)

and security

number of security events and incidents handled No

the use of outdated software with vulnerabilities and the

security incidents occurred on the Tokyo Organisingstate in which the management screen of the system was

Committee‑managed PCs and IT systems deployed inaccessible from the Internet etc We also contacted the

OTN

organization that owned the system and ask them to

Focusing on the figures of Reference 1 and Reference 2

take actionin Table 3 the number of logs was higher during the

The combination of various monitoring methods such

Paralympic Games than during the Olympic Games

as Threat Hunting and external monitoring is importanteven though the number of connected terminals wasfor the early detection of such cases As an example ofsmaller during the Paralympic Games We assume that

this we describe in this special issue “5‑6 Find Evil‑this is because the detection function continued to be

Know Normal : Tokyo 2020 Games Threat Hunting from

improved and added as new attack information became

Internal and External Perspectives” and “5‑7 Impact

available during the Games enabling more detailed

Analysis of Cyberattacks to the Critical Sites bymonitoring and increasing the number of logs generated

External Monitoring”

in the later stages of the GamesWe describe an example in which an attacker targeted

35

Security Responses on the Websites

a vulnerable IT environment built by a Tokyo 2020

At the past Games attacks on websites increased

Games stakeholder and exploited it as a stepping stone

rapidly around the time of the opening ceremony of the

The organization was using the Internet connection with

Games The Figure 3 appears to be different from thosea global IP addressin Figure 6 of “3‑9 Tokyo 2020 Games‑Time Official

As a result of detecting andanalyzing suspicious communications from the global IP

Website and Mobile Application” in this special featureaddress it was found that the system brought in by thethis is due to the difference in the units used for theorganization was in an open proxy state allowing any

aggregation In the “Tokyo 2020 Games─Time Official

user to connect from the Internet and was being used to

Website and Mobile Application” the figures are based

relay communications to phishing sites and malware

on the number of page views from the perspective ofsites and to relay spam mailanalyzing user trends while in this article the figures282

We contacted the

THE JOURNAL OF THE INSTITUTE OF ELECTRONICS INFORMATION AND COMMUNICATION ENGINEERS

Figure 3

Table 4

Number of Blocked Websites

Number of Security Responses on the Web
Olympic Games Period(7 23 2021‑8 8 2021)

Paralympic Games Period(8 24 2021‑9 5 2021)

160 129 766

3 618 826

Number of security alerts notified by security solutions［cases］．

10 631

6 266

Number of reports/inquiries from users and others
confirming details of security alerts［cases］
．

498

340

Number of security incidents affecting staff andsystems［cases］．

00Reference : Number of logs stored in SIEM ＊［case］．

1 050 662 927

292 163 428

Number of accesses blocked［cases］．

＊Not all security solution alerts/logs are included

are based on the number of accesses from theby a specific country region or providers

perspective of analyzing the content of access Both of

In addition to these there were many small‑scale

the numbers of blocks are based on the number ofsuspicious accesses but both the quality and quantity

blocked accesses Although accesses to official Web sites

were similar to those seen in the period before the start

dominated the number of blocked accesses a consider-of the Games and they were not unique and could be

able number of accesses were also made to other sites

blocked by the rule‑based and reputation‑based filters

The content of these blocked accesses was to access agroup of web domain sites at high frequency for several

Table 4 summarizes the number of alerts and security
responses in the Web domain

In the architecture

hours to check for the use of vulnerable software or

adopted in our operation

inappropriate settings

accesses are combined into a single alert

Although we observed sucha series of unauthorizedaccesses frequently before and after the opening

Attacks on Web systems are often carried out using

ceremony they were typical attacks for known vulner-

vulnerabilities as a foothold In any case whether theseabilities rather than accesses based on the characteris-accesses were intended as attacks or not it was very

tics of the Tokyo 2020 Games website and because theimportant to protect the Games by preventing them infrequency was unusually high and included many widely

the preliminary investigation phaseknown attack methods they could be easily blocked byrate‑based and rule‑based filters

Some of them

36

Security Response from Security Intelligence

repeatedly requested specific content and may have

While monitoring information provided by the Secur-

intended to overload the service but these were also

ity Intelligence Service and similar domains under theeasily detected and quickly blocked by the rate‑based

name of the Tokyo 2020 Games we detected sites thatfilter and did not adversely affect the service These

pretended to be live‑streaming sites for the Torchsource IP addresses varied and were not characterized

Relay the Olympic Opening Ceremony and various

Special Issue : Technology and Innovation in the Olympic and Paralympic Games Tokyo 2020283

competitions etc

that no vulnerabilities were left behind during the Games

There were three main types of methods used toaccess fake live‑streaming websites

preparation period and left no foothold for attacker toAfter a user

penetrate the system The number of attacks peakedaccesses the fake live‑streaming site the following cases

during the Games but the degree of danger is not

were observed :proportional to the number of cyber attacks During the
preparation period for the Games we not only re-

(
(
(

)

A case in which the user is led to a spam site

sponded to security incidents such as suspicious e-mails

that abuses browser notificationsand vulnerabilities within the Tokyo Organising Com-)mittee but also detected site defacements and e‑mailA case in which the user is asked to sign up fora paid VPN service

account compromises of the Tokyo 2020 Games stake-)holders and responded in cooperation with the Tokyo

A case in which the user is asked to enter credit
card information

2020 Games stakeholders and took a series of appropriate measures without missing events that could have

In particular we observed a rapid increase in theserved as footholds for attacks

number of similar fake live‑streaming sites a few days

ensuring security during the Games

which resulted in

before the opening ceremony of the Olympic Games On
the day of the opening ceremony we confirmed thatusers were transferred to the fake live‑streaming sitefrom a legitimate domain of Japanese company We also
confirmed that users were being directed to the fakelive‑streaming website through fake official accounts on
YouTube (a video distribution site) and Twitter (asocial networking service)
NISC JC3 JPCERT/CC and security vendors also
detected similar fake live‑streaming sites We asked
each organization to provide us with information on fakelive‑streaming sites they detected Then we cooperated
with external organizations such as security vendors toregister the sites with the anti‑phishing function of thebrowsers and to take down the sites In total we
detected and responded to more than 400 fake live‑(Received February 28 2022 ; Revised March 16 2022)

ONISHI Masaki
ONISHI Masaki was engaged in security
management at NTT Communications Corporation He has been seconded to the Tokyo 2020
Organising Committee as the Director of
Security Operation Cyber Security Department Technology Services Bureau since 2018
During the Games he was responsible for the
security incident response at the SOC
HOSODA Naofumi
HOSODA Naofumi has been working for ISP
backbone operation and analysis of cyberthreats at NTT Communications Corporation
He has been seconded to the Tokyo 2020
Organising Committee as Security Operations
Manager of the Cyber Security Department
Technology Services Bureau since 2014 During the Games he was in charge of web
security operations at the SOC

streaming sites

4．Conclusion
We described the cyber attacks observed during theGames and the responses to them During the Games
we observed cyber attacks from outside and internal
attacks caused by devices brought in by the Tokyo 2020
Games stakeholders but we were able to successfully
defend the Games without any security incidents
affecting the Games operations
In retrospect however the efforts made during theGames preparation period were just as important as
those made during the Games The significance of theperiod for operational maturity was described in thisSpecial Issue “5‑4 Cyber Security Operations for the

NAKANISHI Katsuhiko
NAKANISHI Katsuhiko was engaged insecurity incident response and cyber exercise
at NEC Nexsolutions Ltd and has been
seconded to the Tokyo 2020 Organising Committee as the Director of Cyber Attack
Response Department Security Bureau andCyber Security Department Technology Services Bureau since 2015 During the Games he
was responsible for the overall security operations at the SOC
IBAYASHI Hiroaki
IBAYASHI Hiroaki has been working in theservice development of cloud and security
businesses at NTT Communications Corporation since 2014 and has been seconded to theTokyo 2020 Organising Committee as the
Director of Cyber Security Department Technology Services Bureau During the Games he
was responsible for the overall security operations in the SOC

Tokyo 2020 Games” An even more important factor in
the success of stable operations during the Games was
284

THE JOURNAL OF THE INSTITUTE OF ELECTRONICS INFORMATION AND COMMUNICATION ENGINEERS