Survey Report of Information Security
Incident 2007

English Edition
Ver. 1.0

NPO Japan Network Security Association
Security Incident Investigation Working Group
March 31, 2009

© Copyright 2008 NPO Japan Network Security Association (JNSA)

Table of Contents
1

INTRODUCTION .............................................................................................................. 2

2

OBJECTIVES .................................................................................................................... 2

3

ANALYSIS RESULTS OF PERSONAL INFORMATION LEAKAGE INCIDENTS....... 34

3.1

SURVEY METHODOLOGY ................................................................................................. 3

3.2

OVERVIEW ...................................................................................................................... 3

3.3

TOP FIVE PERSONAL INFORMATION LEAKAGE INCIDENTS ............................................. 4

3.4

SINGLE-YEAR ANALYSIS ................................................................................................. 6

3.5

PROJECTED COMPENSATION FOR DAMAGES CALCULATION RESULTS .......................... 14

3.6

SINGLE-YEAR/ CORRELATIVE ANALYSIS ....................................................................... 16

3.7

INTERANNUAL ANALYSIS .............................................................................................. 17

3.8

INTERANNUAL ANALYSIS OF PROJECTED COMPENSATION FOR DAMAGES ................... 23

CALCULATING PROJECTED COMPENSATION FOR DAMAGES RELATED TOPERSONAL INFORMATION LEAKAGE.............................................................................. 28
4.1

OBJECTIVE OF CALCULATING PROJECTED COMPENSATION FOR DAMAGES ................. 28

4.2

EXPLANATION OF THE PROJECTED COMPENSATION FOR DAMAGES CALCULATIONMODEL ..................................................................................................................................... 28

4.2.1

Process behind the Formation of the Projected Compensation for Damages

Calculation Model .............................................................................................................. 29
4.2.2

Explanation of the Calculation Model Input Values......................................... 30

4.2.3

Projected Compensation for Damages Calculation Model ............................... 36

5

CONCLUSION................................................................................................................. 37

6

CONTACT INFORMATION............................................................................................ 39

7

APPENDIX DEFINITIONS FOR CAUSES OF INFORMATION LEAKAGE .............. 40© Copyright 2008 NPO Japan Network Security Association (JNSA)JNSA Seisaku Committee Security Incident Investigation Working Group
Working Group Leader
Hisamichi

OhtaniNTT DATA Corporation

Members Contributing to this Report
Hironori

Omizo

JMC Risk Solutions CO.,LTD

HarutoKitanoOracle Corporation Japan

Tomoharu

Sato

BroadBand Security, Inc.

Yasuhiko

Sato

Microsoft Co., Ltd.

Masayuki

Hiroguchi

RICOH HUMAN CREATES Co., Ltd.

Shiro

Maruyama

LAC: Little eArth Corporation Co., Ltd.

Eiji

Yamadadit Co., Ltd.

Tadashi

Yamamoto

SOMPO JAPAN RISK MANAGEMENT,INC.

Nobuo

Yoshikawa

FUJITSU LIMITED

Tetsuya

YoshidaKanematsu Electronics Ltd.

Naoyoshi

Yasudadit Co., Ltd.

Copyrights and Attributions
This report has been produced by the NPO JAPAN NETWORK SECURITY
ASSOCIATION (JNSA) Security Incident Investigation Working Group. While the
JNSA retains the copyrights to this work, this report is offered as public information.
Any other works quoting this report, in whole or in part, must include an attribution
to the JNSA copyright. Further, if you wish to quote a portion or all of this report ina book, magazine, or in seminar materials, etc., please first contact the JNSA at
sec@jnsa.org.
© Copyright 2008 NPO Japan Network Security Association (JNSA)© Copyright 2008 NPO Japan Network Security Association (JNSA)

1Introduction
This report represents the sixth survey and analysis of personal information
leakage incidents/ accidents (“incidents,” hereafter) conducted by the JNSA
Security Incident Investigation Working Group (“the Working Group”). As withthe prior year’s report, the 2007 report utilizes the same survey methodology
established in the 2003 report.
Also as with the prior year’s report, the Working Group followed theestablished survey protocol, collecting and analyzing information related topersonal information leakage incidents (“incidents”) published during 2007 innewspapers, on Internet news sites, and via other sources.
This report summarizes the results of our analysis of projected compensation
for damages, using certain information (type of business/ organization involvedin the incident, number of victims, cause of information leakage , route of
information leakage, etc.) and our JO Model (JNSA Damage Operation Model for
Individual Information Leak), based on the survey data. Herein, we will report
our aggregation/ analysis results for 2007 incidents (including an analysis of thecauses giving rise to such results), as well as our analysis of trends over time,
based on our accumulation of data over the past five years.

2

Objectives
This report is the result of an independent survey and analysis of information
leakage incidents reported between January 1 and December 31, 2007.
Personal information is regarded as an information asset, the protection ofwhich is mandated under the Personal Information Protection Act of Japan.
Accordingly, the leakage of personal information is a risk of which corporate
managers should be well aware.
The Working Group has produced this report for the purpose of raising topics
for debate both now and in the future, for helping corporate management assess
the proper scope of the risks associated with information security, and forassisting management in reaching appropriate investment decisions, as such
relate to the “likelihood of legal reparations.”2

3

Analysis Results of Personal Information Leakage
Incidents
3.1 Survey Methodology
Working Group members collected public reports (including documents
released from private organizations) from newspapers, Internet news, and othernews sources between January 1 and December 31, 2007, compiling data related
to Personal Information Leakage Incidents. As in prior years, Working Group
members categorized and evaluated the type of business or organization involved,
the number of victims affected by the incident, the causes of information leakage,
the route of information leakage, etc., based on the information available. Next,
the Working Group used an independently developed formula (“JO Model”) to
calculate projected compensation for damages related to these incidents.
Data for this survey was collected manually from information related toincidents published over the Internet, noting information necessary for incident
analysis from details in the articles or other documents located. Working Group
members have expended best efforts to collect as much information as possible;
however, the reader should understand that the Working Group was not able to
make an exhaustive collection of all articles published that relate to incidents.
The Working Group will respond to reader feedback, and correct any results
herein that are determined to be in error. If you intend to use this report, please
use the latest version released through our website.

3.2 Overview
Compared to 2006, the number of victims by information leakage incidents
grew significantly in 2007, totaling approximately 30,530,000 people (ayear-on-year increase of 8 million victims). Total projected compensation fordamages has likewise increased significantly, amounting to more than ¥2 trillion.
Two large-scale incidents (one in the Multi-Service Industry and one in the
Manufacturing Industry) involving the personal information leakage ofapproximately 23,070,000 people were a major factor in these results.
At the same time, the actual number of incidents decreased by 129 compared to2006, amounting to 864 incidents for the year. Since 2005, the number of annual
incidents has experienced a declining trend. In particular, the number ofsmall-scale incidents (incidents with relatively few victims and incidents
involving a relatively small projected compensation for damages) has been
decreasing overall.
The number and ratio of information leakage incidents attributed to3

“Administration Error” experienced a large increase compared to the prior year.
Meanwhile, incidents attributable to “Loss/ Misplacement” and “Theft” havedeclined.
A summary of data collected for 2007 is provided below:
Table 1: Summary Data of 2007 Personal Information Leakage Incidents

30,531,004
864

Number of Victims
Number of Incidents
Total Projected Compensation for
Damages¥2,271,089,700,000

1Number of Victims per Incident[ ]Average Projected Compensation for
Damages per Incident[1]Average Projected Compensation for2

Damages per Victim[ ]37,554¥2,793,468,000¥38,233

3.3 Top Five Personal Information Leakage Incidents
During 2007, there were two large-scale incidents in which significantly morethan 1 million individuals were affected, only one incident in whichapproximately 1 million individuals were affected, and two incidents in whichapproximately 500,000 individuals were affected. In a typical year, there isusually one outlying incident involving significantly more than 1 million
individuals, which has an impact on our statistical results. For example, theincrease in incidents attributable to “Administration Error” during 2007 was
greatly influenced by “No. 1” of the large-scale incidents identified in Table 2.
Table 2 shows the top five large-scale incidents occurring during 2007. A quick
glance shows that the industry type involved is widely varied. This illustrates thefact that large-scale incidents can occur in any type of industry. We also see that
Averages exclude 64 incidents for which the number of victims was unknown.
Projected compensation for damages per person was calculated for each incident,
after which the total of the individual results was divided by the number of leakage
incidents. Please understand that this number is not the projected totalcompensation for damages divided by the number of individuals affected.
2 As this average value includes statistical outliers, we first calculated the projectedcompensation for damages per person for each incident, and then used this figure to
calculate the average value of projected compensation for damages per person for all
incidents. Accordingly, we ask the reader to understand that this figure is not the
projected total compensation for damages divided by the number of individuals
affected.
1

4

“Administrative Error” is the cause of most of these incidents. “Administration
Error” and “Internal Crime/ Internal Fraud” are both situations caused by theacts of persons with authority inside the organization.
Table 2: Top Five Incidents

1

Number ofvictims
14,430,000

Multi-Service

2

8,637,405

Manufacturing3
４

976,000
649,574５

470,000

No.

Industry Type

Finance/ Insurance
Wholesale/ Retail
Utilities: Electricity, Gas,
Heat, Water

5

Cause
Administration Error
Internal Crime/ Internal
Fraud
Administration Error
Administration Error
Administration Error

3.4 Single-Year Analysis(1)

Industry Type
Hospitality (Restaurant/ Hotel)
1.3%
Transportation 1.2%
Multi-Service
Construction 0.7%
3.7%
Forestry 0.5%

Utilities: Electricity, Gas, Heat, Water 3.7%
Manufacturing 4.3%

Government Servicers(Not Otherwise Categorized) 20.9%

Services (Not Otherwise
Categorized)
5.4%
Real Estate 5.7%

Finance/ Insurance
15.2%

Wholesale/ Retail 7.5%

Health Care/ Welfare 8.4%
Telecommunications 11.3%
Education/ Learning Support
10.2%

Figure 1: Ratio of Incidents by Industry Type (no. of incidents)
In order, the industry types experiencing the greatest number of incidents
during 2007 were Government Services (20.9%), Finance/ Insurance (15.2%),
Telecommunications (11.3%), and Education/ Learning Support (10.2%).
Government Services and Finance/ Insurance have continued to be the number
one and two industry types for incidents between the years 2004 and 2007. Bothof these industry types are heavily regulated by the government, and tend toreport even small-scale incidents, which could be a factor accounting for theseresults.
The top four industry types accounted for a total of 57.6% of incidents during
2007. Of all 18 industry types, only three (Farming, Fisheries, and Mining) did
not experience any information leakage incidents. The remaining 15 industry
types all experienced incidents, with the top 10 industry types representing morethan 90% of the total. Since most industry types deal with personal information,
they are at risk for an information leakage incident.

6Services(Not Otherwise Categorized) 0.5%

Education/ Learning Support 0.4%

Government Servicers(Not Otherwise Categorized) 1.1%

Hospitality (Restaurant/ Hotel) 0.1%
Transportation 0.0%

Telecommunications1.8%

Real Estate 0.0%

Health Care/ Welfare 1.8%
Utilities: Electricity,
Gas, Heat, Water 2.0%

Construction 0.0%
Forestry 0.0%

Wholesale/ Retail 2.5%
Finance/ Insurance 11.3%

Multi-Service 49.1%

Manufacturing 29.5%

Figure 2: Ratio of Incidents by Industry Type (no. of victims)
In order, industry types with the highest number of victims by incidents were
Multi-Service (49.1%), Manufacturing (29.5%) and Finance/ Insurance (11.3%);
the ratios for Multi-Service and Manufacturing were extremely high. These
results are not due to the fact that these industry types experienced numerous
incidents, but rather due to the fact that they both experienced large-scale
incidents during the year under review. Trends in ratio of the number of victims
according to industry type are not necessarily consistent year-to-year. The reason
for this is that, as shown above, the number of victims in an incident can increasesignificantly according to the impact of the industry type experiencing a major
information leakage incident.
Accordingly, the occurrence of a large-scale incident has little, if any, dependent
relationship to any particular industry type; organizations that deal with vast
amounts of personal information are always at risk for large-scale incidents.

7

(2)

Cause of Information Leakage
Internal Crime/ Internal Fraud
Unauthorized Access 0.8%
0.9%
Bug/ Security Hole
1.2%

Non-Intended Use 0.1%
Other 0.6%

Configuration Error 3.9%

Unknown 0.7%
Loss/ Misplacement
20.5%

Unauthorized Information Removal
7.9%
Worms/ Viruses
8.3%

Administration Error 20.4%
Theft 16.6%

Operational Error 18.2%

Figure 3: Ratio of Leaks by Cause (no. of incidents)
As was the case in 2006, Loss/ Misplacement, Theft, and Operational Error
accounted for the bulk of incidents. However, it should be noted that
Administration Error, attributed as the cause of 8.3% of incidents during 2006,
jumped to 20.4% for 2007, reaching nearly the same ratio as Loss/ Misplacement.
We believe that organizational internal controls have had a major impact on
this development. Corporations have made progress in their initiatives withrespect to compliance with laws related to their business activities (including the
Personal Information Protection Act), preservation of assets, and IT controls, etc.,
resulting in stronger management of organizational information. Meanwhile,
greater care in the tracking of organizational assets (including information) has
resulted in corporate announcements of the inadvertent destruction or loss of
information from within corporate facilities.
Details of Administration Error show that nearly half of the incidents were due
to inadvertent destruction, with numerous cases of an organization disposing of
personal information in error with other information; the number of incidents
associated with the loss of portable media (USB flash drives, etc.), as well as theloss of mailed or delivered materials is also notable.
Looking at the details of Operational Error reveal that 47.1% of such incidents
were related to misdirected transmission of email; 38.9% were the erroneousdelivery of paper media, and 9.6% were the erroneous delivery of facsimiles.
See “7 Appendix Definitions for Causes of Information Leakage” for more about
our categorizations and approaches to causes of information leakage incidents.

8Unauthorized Access
0.5%
Worms/ Viruses 0.4%
Bug/ Security Hole
0.6%
Configuration Error 0.3%
Operational Error 0.1%

Loss/ Misplacement 1.5%

Unknown 0.1%

Theft 1.9%
Unauthorized Information Removal
2.2%Internal Crime/ Internal Fraud
28.3%

Administration Error
64.1%

Figure 4: Ratio of Leaks by Cause (no. of victims)
Compared to 2006, Loss/ Misplacement as a cause of incident fell fromapproximately 4.13 million individuals affected to approximately 460,000; Theft
as a cause declined from approximately 1.79 million individuals affected to about
580,000, and the share of overall ratio declined as well. On the other hand,
Administration Error grew in a marked way from approximately 350,000
individuals affected during 2006 to approximately 1.956 million individuals for2007. This significant increase in the number of victims due to Administration
Error was influenced by a major incident in which an enormous amount of
documents on file were inadvertently destroyed.
Due to the effects of this incident, the ratio of incidents due to Internal Crime/
Internal Fraud decreased from 36.0% in 2006 to 28.3% in 2007; however, thenumber of victims increased from approximately 8 million to approximately 8.64
million. Here as well, a single large-scale incident contributed greatly to thisresult.

9

123.47

11.44

12million
10million
8million
6million
4 million

2.35

1.99
0.29

0.28

0.21

0.02

0.00

0.5

0.30

Worms/ Viruses

Operational Error

Non-Intended Use

Other

Unknown

0.44

Loss/ Misplacement

0.99

Configuration Error

2 million
0million

Theft

Unauthorized Information Removal

Bug/ Security Hole

Unauthorized Access

Administration Error

Internal Crime/ Internal Fraud

Figure 5: No. of Victims per Incident by Cause
A comparison of the number of victims per incident categorized by cause of theincident reveals that Internal Crime/ Internal Fraud as a cause of incident far
outstrips any other cause in terms of victims per incident. Figure 3 shows agraph of incident ratios by cause. Internal Crime/ Internal Fraud was low at 0.9%,
and total incidents attributed to this cause actually declined compared to 2006.
Despite the relatively low rate of incidence attributable to this cause, the numberof victims in any particular incident was extremely large. Each year, incidents
involving someone removing sensitive records from an organization—rare though
they may be—involve the leakage of enormous amounts of information. This year
was no exception, with one incident categorized as Internal Crime/ Internal
Fraud affecting an extremely large number of individuals, and also significantly
influencing our calculated per-incident averages.
It appears that organizations need to implement better control measures for
personal information against Loss/ Misplacement and Administration Error, as
well as consider response measures to take in the event of an incident due tointernal crime/ fraud affecting a large number of individuals.

10

Leakage Media/ Route

(3)
100%
90%
80%
70%

Mobile
Phone
41.2%
FTP
0.0%

60%
50%
40%

FAX
29.4%

30%
20%
10%
0%

Dedicated
Terminal
23.5%
Other
5.9%
Other
(Leakage Media/ Route)

Other
5.9%

Unknown
5.1%

Email
9.8%

Paper Documents
40.4%

USB or Other Portable
Recordable Media
12.5%

PC Machine
10.9%

Web･Net15.4%

Figure 6: Ratio of Leakage Media/ Route (no. of incidents)
Figure 6 shows the ratio of incidents according to the route of information
leakage. The single largest media/ route of leakage in terms of number ofincidents was Paper Documents, and all information leakage routes maintained
the same order of occurrence as 2006.
However, the ratio of USB or Other Portable Recordable Media increased from
8.2% in 2006 to 12.5% for 2007. We surmise that this increase is due to the factthat lower prices for the media have resulted in the greater adoption of USB andflash memory, as well as insufficiencies on the part of organizations in user
management and in dealing with this type of media. The ratio of incidents
occurring through the Web/ Net route experienced an increase during 2006,
owing mainly to Winny and other file sharing software; however, the ratio for2007 declined slightly.
We have introduced a minor change to our terms used in our briefs and reports.
Please note that we now use the term “USB or Other Portable Recordable Media”
instead of “FD or Other Portable Recordable Media” used in the past.

11

100%
Email
0.2%
Web･Net
1.9%

80%

60%

FTP
0.0%
Other
0.1%

PC Machine
2.6%

Dedicated Terminal
35,15140%
Paper Documents
55.5%

20%

0%

USB or Other Portable
Recordable Media
38.7%

Mobile Phone
1,802

FAX Transmission Error450
Other
Other 10
(Leakage Media/ Route)Figure 7: Ratio of Leakage Media/ Route (no. of victims)
Figure 7 shows the ratio of information leakage victims (%) according toleakage route. The ratio of incidents categorized under Paper Documents
experienced a very large increase from 7.1% in 2006 to 55.5% in 2007. As
mentioned previously, a major incident involving the inadvertent destruction of alarge number of documents on file had a significant impact on this category.
120,000

10.9

100,000
80,00060,0004.9
40,00020,000
0.8

0.4

0.0

ＦＴＰ

0.1

Ｅｍａｉｌ

0.1
Other

Ｗｅｂ・
Ｎｅｔ

MachineUnknown

ＰＣ

Paper Documents

USB or Other Portable
Recordable Media

0

0.7

Figure 8: No. of Victims per Incident by Leakage Media/ RouteEven when comparing the number of victims per incident according to leakage
media/ route, we see that a large number of victims associated with incidents

12involving USB or Other Recordable Portable Media. As mentioned previously, theminiaturization of USB, flash memory and other portable recordable media, as
well as enhancements in storage capacity, have made it particularly easy toremove a large volume of information from within an organization. We believe
this development has had an impact on our findings.
A large-scale incident during 2007 affected the ratio of incidents attributable toPaper Documents as the leakage route. All other ratios appear to be nearly thesame as 2006.

(4)

Leaked Information

100.0%

91.2%

90.0%
80.0%
65.0%

70.0%
60.0%

54.4%

50.0%

44.0%

40.0%
30.0%

22.3%

20.0%

18.3%

0.0%

1.6%

Sex

Account Number
Credit Card Number

Email Address

Birth Date

Phone Number

Address

Name

Other

5.3%

ⅠＤ / Password

6.8%

Age

9.0%

Occupation

10.3%

10.0%

Figure 9: Frequency of Leaked Information
The frequency of Name as leaked information was evident in 91.2% of allincidents--a decidedly high figure. Address came in second at 54.4%, followed by
Telephone Number at 44.0%. We believe the high frequencies shown here are dueto the fact that Name, Address, and Telephone Number are all very basic piecesof personal information. While occurring less frequently, Birth Date (useful for
identifying an individual) at 22.3%, Email Address (susceptible to fraudulent
usage in spam email) at 18.3%, Credit Card Number/ Account Number (used forfraud) at 10.3%, and other personal information that can be used to inflict
tremendous harm have also been the subjects of information leakage.
Other includes membership number, work location, grades, savings accountbalance, description of illness, etc.

13

3.5 Projected Compensation for Damages Calculation
Results(1)

Projected Compensation for Damages per Person
Less than ¥500,000
1.7%
Less than ¥1million
Less than ¥300,000
2.0%
0.5%
¥0 to ¥5,000
Less than ¥100,000
14.1%
10.5%

Less than ¥50,000
15.5%
Less than ¥10,000
30.1%

Less than ¥30,000
25.6%

Figure 10: Ratio of Projected Compensation for Damages per Person (no. ofincidents)
For 2007, the highest ratio of incidents in terms of projected compensation fordamages per victim trended in the ¥5,000 to ¥10,0000 category. Since the¥10,000 to ¥30,000 range made up the bulk of incidents for 2006, we canconclude that 2007 saw a greater number of incidents involving a low projectedcompensation for damages, when simply comparing the number of incidents.
However, the average projected compensation for damages per person[3] did notvary greatly from 2006 at ¥38,233.

3

To compensate for per-incident outliers in this average value, we first performed an individual
calculation of projected compensation for damages per victim. Next, we added these results, andthen divided by the number of leakage incidents. Accordingly, this figure is not the total projectedcompensation for damages divided by the number of victims.

14

(2)

Projected Compensation for Damages per Incident
Greater than ¥5 billion
2.0%
Unknown
Less than ¥5 billion
5.9%
2.5%
Less than ¥1 billion
6.5%

Less than ¥100,000
17.4%¥0.1 billion
4.2%
Less than ¥500,000
17.5%

Less than ¥50 million
12.2%

Less than ¥10 million
7.2%
Less than ¥5 million
16.3%

Less than ¥1 million
8.4%

Figure 11: Ratio of Projected Compensation for Damages per Incident (no. ofincidents)
Approximately 59.6% of incidents involved a per-incident projectedcompensation for damages of ¥5 million or lower. Incidents small in scale andinvolving information of low value (¥Less than ¥10,000, between ¥10,000 and¥50,000) and medium-scale incidents involving valuable personal information(between ¥100,000 and ¥500,000; between ¥10 million and ¥50 million) accountfor a large percentage of leakages during 2007.

15

3.6 Single-Year/ Correlative Analysis
Number of Incidents and Number of Victims by Industry Type(1)
1,498.6

168 incidents

14 million
12 million
129 incidents

899.1

10 million
8 million
6 million
4 million

42 incidents
14.5
10.8

(n=0)

(n=0)

(n=0)

Not Otherwise
Categorized

Mining(n=4)

Fisheries(n=6)

Farming(n=48)

Forestry

Construction(n=9)

Real Estate(n=11)

Transportation(n=83)

48 incidents
11 incidents
4 incidents
9 incidents
6 incidents
3.1
1.3
0.7
0.1
0.0
Hospitality (Restaurant/ Hotel)(n=42)

Education/ Learning Support(n=168)83 incidents

Services (Not Otherwise
Categorized)(n=88)

32.2
Government Services(Not Otherwise Categorized)(n=70)(n=31)

Telecommunications

Health Care/ Welfare(n=59)

31 incidents
60.3
54.8
54.0
Utilities:
Electricity, Gas, Heat, Water(n=129)Wholesale/ Retail(n=34)

Finance/ Insurance

Manufacturing

MultiService(n=31)

88 incidents
70 incidents

59 incidents

34 incidents 77.3

2 million
0346.0

31 incidents

180 incidents
160 incidents
140 incidents
120 incidents
100 incidents
80 incidents
60 incidents
40 incidents
20 incidents
0 incident(n=0)

Total No.
of Victims

No. of Incidents(excluding unknown)

Figure 12: Number of Incidents and Number of Victims by Industry Type
Figure 12 shows the number of victims and number of incidents by Industry
Type on the same graph. Despite the relatively few incidents categorized in“Multi-Service” and “Manufacturing,” the number of victims involved was
relatively large. The cause of this trend, as addressed in “Top Five Personal
Information Leakage Incidents,” lies in the fact that these industry types eachexperienced a large-scale incident involving a large number of victims, somewhat
skewing our survey.
“Government Services,” “Education/ Learning Support,” and other categories
experienced a large number of incidents during 2007; however, these incidents
involved a relatively low number of victims per incident, indicating to theWorking Group that there was a large number of small-scale incidents that
occurred during 2007.

16

3.7 Interannual Analysis
The Working Group conducted a wide variety of an interannual analysis basedon information related to six years’ worth of incidents collected between 2002 and2007. Only a relative few incidents were publicly disclosed between 2002 and2004, and accordingly, information was successfully collected for only a few
incidents. Of those incidents reported, most were serious and large scale innature; accordingly, readers should note that there will be a significantly large
skew in statistical data.

Number of Victims and Number of Incidents (2002 to 2007)(1)

Table 3: Interannual Changes in Number of Victims and Number of Incidents
Number of
Incidents
2002
2003
2004
2005
2006
2007

Number ofVictims

62
57
366
1,032
993
864

418,716
1,554,592
10,435,061
8,814,735
22,236,576
30,531,004

Average Number
of Victims per
Incident[4]7,613
30,482
31,057
8,922
23,43237,554

Table 3 shows the number of incidents, the total number of victims, and theaverage number of victims per incident for the six years between 2002 and 2007.
The number of incidents occurring during 2007 amounted to 0.8 times that of2005, and 0.9 times the number of incidents occurring during 2006, drawing amarginal decrease since the peak of 2005. Despite this decline, the similar
number of incidents for 2006 and 2007 (993 and 864, respectively) leads us toconclude that personal information leakage did not end with the temporary focus
resulting from the 2005 full enforcement of the Personal Information Protection
Act, but rather such incidents have become recognized by the public at large as
general organizational fraud.
The number of victims of personal information leakage during 2007 was,unfortunately, the largest number since we began collecting statistics in 2002.
The number of 2007 victims was 3.5 times that of 2005, and 1.4 times that of2006.
The average number of victims per incident for 2007 was also the highest since
we began this survey—a number affected by several large-scale incidents that
occurred during the year.
Parameter for average number of victims for 2007 was 813 (excludes 51 incidents
for which the number of victims was unknown).

417

1,200 incidents

30 million

25 million

Internal Crime/ Internal Fraud
Other than Internal Crime/ Internal Fraud
No. of Incidents

1,032 incidents

993 incidents

8.64 million(28.3%)

1,000 incidents

864 incidents
20 million

800 incidents
8 million(36.0%)

15 million

600 incidents

1.65 million(15.8%) 366 incidents

10 million

21.89 million(71.7%)

900,000

400 incidents(10.2%)

14.24 million(64.0%)

5 million
63 incidents
420,000
2002(n=63)

57 incidents
130,000

200 incidents

8.78 million(84.2%)

7.92 million

2004(n=366)2005(n=1032)(89.8%)(8.6%)

1.42 million
2003(n=57)

2006(n=993)2007(n=864)

Figure 13: Interannual Changes in Number of Incidents and Number of Victims due
to Internal Organizational Fraud (total)
As discussed earlier in connection with Table 3, the number of incidents has
declined since 2005, but the number of victims has continued to increase. In
addition, the ratio of large-scale incidents accounted for a high number of victims
overall.
In recent years, the number of victims of personal information leakage due to“Internal Crime/ Internal Fraud” has accounted for a high ratio of the total, with
8 million victims in 2006 (36.0% of total) and 8.64 million victims for 2007 (28.3%
of total).

18

(2)

Number of Victims per Incident (2002 to 2007)

100%
11.1%
90%
80%
70%

1.6%
3.2%
9.5%
3.2%

10.5%
7.0%
3.5%
3.5%
5.3%

8.2%
3.3%
1.1%
4.6%
3.0%
13.7%

4.3%
1.4%
1.8%
7.7%

4.4%
1.9%
0.6%
3.2%
3.2%

4.5%

10.6%

9.1%

19.3%

8.4%

6.6%
22.5%

33.3%

23.4%

50%
12.3%

10.5%

6.7%

6.4%

60%

5.9%
2.4%
1.0%
4.7%
2.3%

22.7%

Unknown
Greater than 100,000
50,000 to 100,000
10,000 to 50,000
5,000 to 10,000
1,000 to 5,000
500 to 1,000
100 to 500
10 to 100
Less than 10 people

24.0%

40%
6.3%

28.9%

30%
26.3%
20%

26.2%

23.5%

23.8%

10%
0%

27.2%

6.3%
1.6%
2002
(n=63)

8.8%

12.0%

14.2%

17.9%

15.7%

2004
(n=366)2005(n=1032)

2006(n=993)2007(n=864)

3.5%
2003(n=57)

Figure 14: Interannual Changes in Ratio of Victims per Incident by Category (no. ofincidents)
The ratio of victims per incident in the small “less than 10” and “between 10
and 100” range accounted for 41.4% of the total in 2005, 46.8% of the total in2006, and 41.9% of the total in 2007. The ratio of victims per incident in the large“between 50,000 and 100,000” and “Greater than 100,000” range amounted to
3.2% of the total in 2005, 2.5% of the total in 2006, and 3.5% of the total in 2007.
These figures as well point to the fact that the ratio related to large-scale
incidents was higher in 2007 than in other years.
Despite the decrease, the small-scale group still accounts for a high ratio of thetotal, and as we wrote in our 2006 report, this is likely due to a new
consciousness in society for reporting all incidents—even those involving only a
few victims.

19Cause of Information Leakage (2002 to 2007)

(3)
100%
90%
80%

4.8%

5.3%

15.9%

10.5%

4.8%

7.0%
3.5%

70%

15.8%

60%
50%

2.7%
7.9%
2.7%
9.8%

2.2%
8.1%

7.9%

8.3%
12.4%

20.4%

10.7%
25.8%

14.7%

8.3%
18.2%

8.8%

40%

3.9%

12.2%

8.8%
54.0%

2.1%
1.9%
3.3%
5.1%

36.1%

19.0%

12.3%
30%
20%
10%

16.6%
1.6%
4.8%
3.2%

19.3%

29.2%

21.6%

11.1%

7.0%
1.8%

2002
(n=63)

2003(n=57)

0%

42.1%

2004
(n=366)2005(n=1032)

2006(n=993)

Unknown
Other
Bug/ Security Hole
Non-Intended Use
Unauthorized Access
Configuration Error
Internal Crime/ Internal Fraud
Unauthorized Information Removal
Administration Error
Worms/ Viruses
Operational Error
Theft
Loss/ Misplacement

20.5%

2007
(n=864)

Figure 15: Interannual Changes in Ratio of Leaks by Cause (no. of incidents)“Loss/ Misplacement” and “Theft” have been declining as causes of incidents
since 2005.
Meanwhile, the ratio of “Administration Error” (inadvertent destruction or loss
occurring within the organization’s facilities) has been increasing. We canconceive of two reasons for this trend. The first is that the measures against theunauthorized physical removal of personal information have advanced, focusing
on an area of personal information control and administration that had sufferedto that point from a lack of emphasis. The second is that the cause of publicly
disclosed incidents in the Finance/ Insurance industry categorized as “Loss” in2005 is now categorized as “Administration Error” in 2007, given the perspectiveof the internal controls framework.
The number of incidents attributed to Operational Error has also increasedslightly over time. The Working Group could not read any meaningful trends
from within the Other category.

20

Route of Information Leakage (2002 to 2007)

(4)
100%

1.6%
1.6%

90%

12.7%

17.5%

80%

3.5%
1.8%

70%

17.5%

14.0%

50%
84.1%

1.6%
3.1%
6.6%

6.8%
9.0%

15.7%

0.8%
6.8%

7.4%

8.2%

16.8%
6.4%

5.1%
5.9%

7.7%

10.7%
20.5%

60%

40%

3.6%
6.6%

9.8%
12.5%
10.9%

22.0%

Unknown
Other
FTP
Email
USB or Other Portable Recordable MediaPC Machine
Web･NetPaper Documents

15.4%

10.5%

30%
21.1%
20%
10%

45.9%

49.9%

2004
(n=366)2005(n=1032)

43.8%

40.4%

2006
(n=993)2007(n=864)

14.0%

0%
2002
(n=63)

2003(n=57)

Figure 16: Interannual Changes in Ratio of Information Leakage Route (no. ofincidents)
While leakage associated with Paper Documents continued to account for thebulk of incidents, there has been a notable decline since 2005. Leakage due to“PC Machine” has declined since 2006; however, there has been a marked
increase in leakage due to “Web/ Net” (including P2P file sharing software).
Though not a major change, leakage due to “USB or Other Portable Recordable
Media” has increased.

21

Number of Incidents by Industry Type (2002 to 2007)

(5)

1.4%

100%
6.5%
14.0%
90%

20.4%
16.1%

80%

1.6%

70%

11.3%

60%

4.8%
3.2%

14.0%

34.7%

3.5%

4.8%
50%
21.1%

5.2%
0.5%
7.4%
5.7%
1.4%

40%
30.6%
8.8%

5.3% Transportation
7.7%
1.1%
19.3%

9.8%

3.5%

3.3%
3.0%

2003
(n=57)

2004(n=366)

21.0%

0%
2002
(n=63)

3.2%

5.2%
1.5%

6.4% Services 5.4% Multi3.7% Services
5.1%
Education
10.2% /Learning
11.1%
Support
4.2%

8.4%

3.6%

1.3%

14.0%
Finance/ Insurance

11.0%

7.0%
0.6%

1.6%

13.7%

15.2%

4.7%
1.1%
2005
(n=1032)

Not Otherwise Categorized
Government Services (Not Otherwise Categorized)
Services (Not Otherwise Categorized)
Multi-Service
Education/ Learning Support
Health Care/ Welfare
Hospitality (Restaurant/ Hotel)
Real Estate
Finance/ Insurance
Wholesale/ RetailTransportation
Telecommunications
Utilities: Electricity, Gas, Heat, Water
Manufacturing
Construction
MiningFisheries
Forestry
Farming

7.5% Wholesale/ Retail
1.2%

8.1%
6.4%

Health Care/
Welfare

5.7% Real Estate

28.4%

17.5%

30%

20%

6.7%

8.1%
10.5%

10%

Government
20.9% Services

13.5%

11.3% Telecommunications
6.1%
3.7% Utilities: Electricity, Gas, Heat, Water
5.2% Manufacturing
4.3%
1.4%
2006
(n=993)2007(n=864)

Figure 17: Interannual Changes in Ratio of Incidents by Industry Type (no. ofincidents)
As with 2006, Government Services represented the highest ratio of incidents
by industry type during 2007. The ratio was 20.9% of the total, measuring nearly
the same as 2006. Following Government Services, Finance/ Insurance andTelecommunications were the next-highest industry types—a result similar to2006.
Although not one of the top three industry types during 2007 in terms ofincidents, the ratio of incidents associated with the “Health Care/ Welfare”
industry type was 8.4%, or twice the number for 2006.

22

3.8 Interannual Analysis of Projected Compensation for
Damages
The following table serves as an observation of interannual changes incompensation for damages for the six years between 2002 and 2007.
Table 4: Interannual Changes in Total Projected Compensation for Damages
Total Projected
Compensation for
Damages
2002
2003
2004
2005
2006
2007

Approx. ¥18.9 billion
Approx. ¥28.1 billion
Approx. ¥466.7 billion
Approx. ¥700.2 billion
Approx. ¥457.0 billion
Approx. ¥2.2711 trillion

Average Projected
Compensation for
Damages per
Incident¥275.32 million¥550.38 million¥1.373 billion¥786.8 million¥481.56 million¥2.79347 billion

Total projected compensation for damages for 2007 amounted to the highest
total since the Working Group began this survey. Two large-scale incidents
occurred during 2007, both involving credit card information, account numbers,
and other sensitive personal information. Accordingly, the projectedcompensation for damages associated with these two incidents was enormous,
skewing the total for 2007 compared to other years.
Due to the aforementioned incidents, the average projected compensation fordamages per incident was approximately ¥1,500 greater than in 2006.
The average projected compensation for damages per incident was calculated
excluding the 64 incidents for which the number of victims was unknown. We
calculated the projected compensation for damages per person for each individual
incident, totaled this number, and then divided that figure by the number ofleakage incidents. Readers should note that this figure is not the total of
projected compensation for damages divided by the number of victims.
Table 5: Average Projected Compensation for Damages per Victim
2002
2003
2004
2005
2006
2007

¥16,855¥89,140¥105,365¥46,271¥36,743¥38,233

Meanwhile, the average projected compensation for damages per person

23increased slightly from ¥36,743 in 2006 to ¥38,233 for 2007. The Working Groupalso noted a trend in which the number of incidents involving lower numbers ofvictims per incident decreased overall.
To compensate for outliers in the average projected compensation for damages
per person, we first calculated the projected compensation for damages perperson in each incident, and then calculated an average amount of projectedcompensation for damages per person for all incidents. The reader should
accordingly be aware that this figure is not the total projected compensation fordamages divided by the number of victims.

Total Projected Compensation for Damages and Number ofVictims (2002 to 2007)(1)

35 million¥2..5 trillion

Compensation for Damages
No. of Victims

30.53 million

30 million¥2 trillion
25 million
22.24 million¥1.5 trillion

20 million¥2.2711 trillion
15 million¥1 trillion
10.44 million

10 million
8.81 million¥500 billion
420,000
15.1 billion¥700.2 billion¥439.3 billion
28.1 billion
1.55 million

5 million¥457.0 billion

0

0
2002
(n=63)

2003(n=57)

2004(n=366)2005(n=1032)

2006(n=993)2007(n=864)

Figure 18: Total Projected Compensation for Damages and Number of Victims
Total projected compensation for damages declined for 2006 compared to theprevious years; however, the occurrence of large-scale incidents involving highly
valuable personal information resulted in a significant increase for 2007 to
approximately ¥2.2711 trillion. Of that amount, the two large-scale incidents
accounted for more than ¥1.8600 trillion. The number of victims declined in 2005,
but increased in the subsequent years.

24

(2)

Projected Compensation for Damages per Victim (2002 to
2007)

100%
8.1%

7.0%

1.6%
1.4%
4.4%

90%

1.5%
11.5%

22.7%

70%

37.1%

11.0%

14.8%

14.0%

14.2%

60%
29.8%

50%

2.0%
7.2%

9.9%

12.3%
80%

1.6%
6.4%

42.8%

Unknown
Greater than ¥1 million
Less than ¥1 million
Less than ¥500,000
Less than ¥100,000
Less than ¥50,000
Less than ¥10,000
Less than ¥5,000

35.6%

42.1%
29.5%

40%
37.1%
30%

14.0%

20%
10%

25.0%
15.6%

17.7%

30.1%

18.3%

22.8%
10.7%

11.4%

14.3%

14.1%

2004
(n=366)2005(n=1032)

2006(n=993)2007(n=864)0%2002(n=63)

2003(n=57)

Figure 19: Interannual Changes in Ratio of Projected Compensation for Damages
per Person (no. of incidents)
Incidents for which the projected compensation for damages per person was¥10,000 or less increased in proportion subsequent to 2004. We believe that thistrend is due to a continued increase in the reporting of personal information
leakage incidents that do not involve sensitive information.
Meanwhile, we have noted an increase in the ratio of incidents of ¥50,000 or
greater per person, compared with a declining trend in 2006.

25

(3)

Projected Compensation for Damages per Incident (2002 to
2007)

100%
90%
80%

11.3%

10.5%

1.6%

3.5%

8.1%

7.0%

3.2%
3.2%
15.8%

70%
60%

30.6%

8.2%
2.2%
4.6%

4.3%
1.8%
4.9%
9.3%

9.6%

3.5%

7.7%

10.9%

15.6%

7.8%

14.0%

50%

7.1%
6.5%

20%

27.4%

12.3%
3.5%

10%
0%

6.6%

3.2%
4.8%

8.8%

2002
(n=63)

2003(n=57)

3.5%

6.5%
4.2%

Unknown
Greater than ¥5 billion
Less than ¥5 billion
Less than ¥1 billion
Less than ¥100 million
Less than ¥50 million

12.2%

Less than ¥10 million

7.2%

Less than ¥5 million
Less than ¥1 million
Less than ¥500,000

16.3%

Less than ¥100,000

20.3%
8.1%

8.4%

19.5%

17.5%

17.1%

17.4%

2006
(n=993)2007(n=864)

16.7%
8.8%

8.8%

30%

10.6%

5.9%
2.0%
2.5%

22.1%

12.3%
40%

4.4%
1.2%
1.6%
6.1%
2.6%

9.6%
15.7%
10.4%
8.5%
2004
(n=366)

12.5%

2005
(n=1032)

Figure 20: Interannual Changes in Ratio of Projected Compensation for Damages
per Incident (no. of incidents)
Between 2003 and 2006, we noted increase in the number of incidents for which
the projected compensation for damages per incident was low.
However, compared to 2006, the ratio of incidents involving a per-incident
amount in excess of ¥5 million increased for 2007. There is no doubt that the twolarge-scale incidents occurring during 2007 were the cause of the significant
increase in projected compensation for damages; however, incidents for which theper-incident projected compensation for damages was high showed an overall
increase as well.
Observing this trend in conjunction with the pattern for projectedcompensation for damages per person indicates that incidents for which both theper person projected compensation for damages and per incident projectedcompensation for damages were small experienced an increase until 2006.
However, compared to 2006, ratio of incidents with a small projectedcompensation for damages per person in 2007 (less than ¥10,000) continued todecrease, while the ratio of the number of incidents in which the projectedcompensation for damages per person was greater than ¥50,000 increased. At the26

same time, the ratio of the number of incidents for which the projectedcompensation for damages per incident exceeded ¥5 million also increased.

27

4

Calculating Projected Compensation for Damages related
to Personal Information Leakage
4.1 Objective of Calculating Projected Compensation for
Damages
One of the earmarks of the Working Group is proposing a calculation model for
legal reparations, and then applying the calculations to actual personal
information leakage incidents.
From its inception the Working Group has engaged in activities analyzing
actual incidents for the purpose of quantifying the corresponding risks andeffectiveness of the subsequent response. The objective behind proposing acalculation model for projected compensation for damages is to provide
organizations with a quantitative understanding of the latent risks involved inhandling personal information.
We will report the results of applying our calculation model to Personal
Information Leakage Incidents occurring during 2007 in the following sections of
this report. However, our intent is that organizations use this calculation model
to grasp the latent risks connected with the personal information possessed
within their organizations. We encourage all organizations to conscientiously
apply this calculation model to the personal information maintained andmanaged within their systems.
Please understand that the calculation results shown below are based on theassumption that all victims will seek compensation for damages related to thespecific incident described. Our calculations do not reflect any actual payments
made in connection with the corresponding Personal Information Leakage
Incident.

4.2 Explanation of the Projected Compensation for
Damages Calculation Model
Our calculations for compensation for damages occurring during 2007 adhere to
the research methods we used for our 2003 survey.
Our decision was based on the fact that we were unable to discover any legal
precedents related to individuals or groups seeking compensation for damages
28

related to Personal Information Leakage Incidents subsequent to the conclusionof our 2003 survey.
Please see our 2003 report for details behind the genesis of the calculation
model we use to calculate projected damages.
Here, we will limit ourselves to a simple overview of our model.

4.2.1

Process behind the Formation of the Projected Compensation
for Damages Calculation Model

Incident Research

Analysis

Research
Incidents

Analyze types of
information
leaked, causes,
number of victims

Research
LegalPrecedent
Legal
Precedent

Create Calculation Model
Determine
input factors,
quantify input values
Seek advice ofexperts

Research legal
precedent

Form calculation
model

Verification
Perform
comparative
calculations
between actual
court verdicts andthe results of thecalculation model

Figure 21: Process behind the Formation of the Projected Compensation for
Damages Calculation Model
We developed our calculation model as depicted in Figure 21 above as follows:
1) Preliminary Research
Research and collection of data about publicly announced Personal
Information Leakage Incidents.
At the same time, we also conducted research into past court cases
involving invasion of privacy and defamation. Here, as we discussed in our
2003 report, we incorporated data from the 2003 decision by the Osaka
Supreme Court regarding the appeal of the judgment in the case (No. 1165)
related to the leakage of the Uji City basic residential register into our
calculation model.
2) Analysis
We analyzed compilations of the number of victims, the types of information
leaked, the cause of the leakage, the information leakage route, and otherfactors related to the Personal Information Leakage Incidents. “3 Personal
Information Leakage Incident Analytical Results” describe the results of
our analysis for 2007.

29

3) Calculation Model Creation
Having determined the input factors for our calculation model, we began todevelop the model itself. Input factors included the value of the information
leaked, the degree of social responsibility of the organization(s) involved,
and an evaluation of the post-incident response by the organization.
Further, we asked for, and incorporated, the opinions of lawyers and otherlegal experts.
4) Verification
To measure the credibility of our calculation model, we applied our model tothe previously mentioned Uji City registry leakage case, comparing theresults of our calculations with the actual determination of damages
ordered by the court. As a result, the level of damages according to our
calculations was essentially the same as the actual legally mandated figure.

4.2.2

Explanation of the Calculation Model Input Values

We incorporated the following input values into our calculation model:Value of the personal information leaked

Degree of social responsibility of the organization in questionAppraisal of post-incident response by the organization in question

In an actual lawsuit, one would expect that in addition to the factors above, thecourts would also consider the protective measures in place before the incident,
the volume of the leaked information, the actual damages incurred, and specificmeasures taken in response to the incident. However, for purposes of forming our
calculation model, our only sources are publicly available information, and there
are limits in what can be inferred by the other factors previously described. In
addition, we narrowed the number of input factors, reasoning that an
unnecessarily complicated calculation model would be counterproductive to ourmain goal of encouraging organizations to use the calculation model to evaluate
their own risks.
The following describes how we quantified each of the input factors used in our
calculation model.

(1)

Value of Personal Information Leaked
We categorized the effect of Personal Information Leakage on a victim in termsof “Economic Loss” and “Emotional Distress.” To quantify the extent of the effect,
we created a chart, with “Economic Loss” on the ‘Y’ axis and “Emotional Distress”

30

on the ‘X’ axis. For the sake of convenience, we call this an Economic-Privacy Map(EP Map) (Figure 22). The farther removed from the origin, the greater therespective levels of Economic Loss and Emotional Distress.

Figure 22: Economic-Privacy Map (EP Map)
On this EP Map, we plotted the types of leaked information noted from our past
research and analysis of Information Leakage Incidents. We can then use this EP
Map plot locations to derive the type of effect associated with leaked information,or in other words, what level of value the information represents. Further, inconsidering the ease of inputting these values into our calculation model, we
defined three stages corresponding to the degree of influence of the X and Y axeson the EP Map, reconfiguring the types of leaked information. This resulted in
our EP Map becoming a Simple-EP Map (Figure 23).

31

Figure 23: Simple-EP Map
However, we did not simply obtain the value of the leaked informationaccording to the plot location between the X and Y values. Rather, we believe thata slight correction is required to more easily relate these values to the actual
damages incurred. These corrections have been incorporated into the following
formula for calculating the value of leaked information:■ Value of Leaked Personal Information=

Value of Basic Informationx

x Degree of Information Sensitivity

Degree of Ease in Identifying the Individual

a. Value of Basic Information
We assign 500 points as the base value for the Value of Basic Information,
regardless of the type of information in question.
b. Degree of Information Sensitivity
In general, most definitions of sensitive information are limited to certain typesof information defined as personal information, the collection of which isprohibited under JIS Q 15001. Such information includes personal information

32

that may serve as the root of philosophical, religious or social discrimination.
However, there are certainly other types of information that may cause
Emotional Distress. In our calculation model, we have established levels for threestages of Personal Information as a whole, providing definitions allowing
calculation of the sensitivity of the information from the corresponding values.
Further, we have also included in our calculation model the degree of information
sensitivity for information leading to economic loss.
The Degree of Information Sensitivity is derived from the following formula,using the location of the plot (x, y) of the related information on the Simple-EP
Map (=level value).
Degree of Information Sensitivity=(10x-1 + 5y-1)

If the leakage consists of several types of information, we use whichever
information generates the largest X and largest Y values. For example, if theleakage involves “Name, address, birth date, sex, telephone number, name ofsickness, and account number with a PIN number,” then the Simple-EP Map (x,y) will be as follows:“Name, address, birth date, sex, telephone number” = (1,1)“Name of sickness” = (2,1)“Account number with a PIN number” = (1,3)
In this example, the largest X value is “Name of sickness” at “2,” while thelargest Y value is “Account number” at “3.” Plugging these values into ourformula, we get:(102-1 + 53-1)= (101 + 52)= 35 points

c. Degree of Ease in Identifying the Individual
Degree of Ease in Identifying the Individual represents the ease with which theleaked Personal Information can be used to specifically identify an individual.
For example, if a credit card number is leaked, but there isn’t any information to
identify the name, etc. of the individual, there is a low likelihood of actual
damages. Accordingly, we have incorporated the Degree of Ease in Identifying theIndividual into our calculation model. This factor is subject to the determination
standards shown in Table 6 below.

33

Table 6: Degree of Ease in Identifying the Individual— Determination Standards
Degree of Ease in
Determination Standards
Identifying theIndividual
Individual may be easily identified.
6“Name” and “Address” are included.
Individual may be identified after certain costs are
incurred.
3“Name” or “Address + Telephone Number” are included.
Difficult to identify the individual.
1
Other than that described above.

(2)

Degree of Social Responsibility of the Organization in Question
As shown in Table 7, the Degree of Social Responsibility is either “Higher than

Normal” or “Normal.” The standard for an organization with a “Higher than
Normal” degree of Social Responsibility include those that are described in “Basic
Policies related to the Protection of Personal Information (Cabinet decision April
2, 2004)” as being in a “specific industry that requires a guarantee of theappropriate handling” of personal information. Included in this definition are
public institutions such as government agencies and large companies that enjoy
high levels of name recognition.
Table 7: Degree of Social Responsibility of the Organization Involved inHigher than
NormalNormalInformation Leakage—Determination Standards
Degree of Social
Determination Standard
Responsibility
Organizations in specific types of industries
requiring a guarantee of the appropriate
handling of personal information (medical,
2
financial/ credit, telecommunications, etc.),
public institutions, and large companies withhigh name recognition.
Other normal companies, associations and1organizations.

34

Appraisal of Post-Incident Response(3)

The appraised value of Post-Incident Response is based on Table 8 below. In
cases where the Post-Incident Response is “Unknown, Other,” we assume that no
inappropriate responses were detected, and therefore assign the same value as
given to an appropriate response.
Table 8: Appraisal of Post-Incident Response—Determination Standards
Determination Standard
Appraisal of Response
Appropriate
1
Inappropriate
2
Unknown, Other
1
Since there are no clear standards as to how to evaluate Post-Incident
Responses, we use the following response chart compiled from past responses toInformation Leakage Incidents as a guideline for determining an appropriate/
inappropriate response.

a. Examples of Appropriate Responses


Rapid response

Understanding of the circumstances

Public announcement of the incident

Subsequent leakage of the circumstances (Website, Email, letters)Communicating with victims, offering apologies



Offering apologies to victims (including presentation of gift certificates,
etc.)



Estimates of effects likely to occur

Establishment of a claims contact office/ person



Efforts to retrieve the leaked information



Express of appreciation to the party discovering the incident/ full accountof the incidentCompensation to customers



Improvement of system through management participation

Investigation into the cause of the incident

Improved security measures



Review of all procedures

Expert review of system appropriatenessImplementation of advice and audits from outside experts

35

b. Examples of Inappropriate Responses

4.2.3



Issues were indicated, but not addressedSlow response

Repeated occurrencesMeasures were implemented, but were ineffective

False reporting

Projected Compensation for Damages Calculation Model

The following represents an overall view of the Calculation Model, integrating
the factors discussed in “4.2.2 Explanation of the Calculation Model Input
Values.” The Working Group calls the following Projected Compensation for
Damages Calculation Model the JO Model (JNSA Operation Model for Individual
Information Leak).”

Projected Compensation for Damages= Value of Information Leakedx Degree of Social Responsibility of the Organizations
x Appraisal of Post-Incident Response= (Value of Basic Information x Degree of Sensitivity
x Ease in Identifying the Individual)x Degree of Social Responsibility of the Organization
x Appraisal of Post-Incident Response= Value of Basic Information [500]x Degree of Information Sensitivity [Max(10x-1 + 5y-1)]
×Ease in Identifying the Individual [6,3,1]
×Degree of Social Responsibility of the Organization [2,1]×Appraisal of Post-Incident Response [2,1]Figure 24: JO Model36

5Conclusion
Having collected and analyzed information about incidents occurring during
2007, we noted a somewhat lessening in focus by the general public on
information leakage—a step back from the personal information leakage panicthat occurred between 2004 and 2005 surrounding the enactment of the Personal
Information Protection Act (2005) and Winny issues, and from the heatedreporting and overreaction in connection with the spate of sensitive information
leakage incidents (2006). However, the risk of personal information leakage isstill very present for corporations now as ever. After 2005, the number of victims
involved in incidents continued to grow significantly, with 2007 showing an
unexpected jump of more than 8 million compared to 2006, for a total of 30.53
million victims. Total projected compensation for damages in 2007 exceeded the¥2 trillion mark. Two large-scale incidents during 2007 accounted for 23.07
million victims of personal information leakage, which contributed greatly to the2007 increase. While the number of incidents declined compared to 2006, there
was still an average of 2.4 incidents occurring per day.
Each year demonstrates certain characteristics related to the circumstances
surrounding information leakage incidents. 2005 saw a frequent occurrence ofincidents via Paper Documents, PC Machine, and Loss/ Theft, while ourattention was focused on Internal Crime/ Internal Fraud as the predominantleakage route for 2006. For 2007, we noted an increase in incidents occurring via
Administration Error. We see this change for 2007 as a promising trend. To theWorking Group, this trend signals that treating the inadvertent destruction andintra-organizational loss of personal information as an incident shows theadvancement of measures against the unauthorized removal of personal
information, and that there is an organizational effort for the control andmanagement of personal information—something that had not been a focus in
the past. Proof of this advancement in measures against the unauthorized
removal of personal information lies in the number of incidents involving few
victims and a low projected compensation for damages, which our analysis
results show have been tracing a decreasing trend. We also believe recent trends
in awareness and implementation of organizational internal controls havecontributed to these results. The advancement in implementation of internal
controls and enhanced management of information within the organization, as
well as physical tracking of stored information and documents, has likely
resulted in the uncovering of inadvertent destruction and/ or loss of organization
information.

37

The Working Group has, however, heard frequent rumblings that despite theimplementation of stricter measures, the actual operations involved must be
conducted according to plan to make such measures meaningful. There are
numerous cases in which individuals resent procedures required before removing
information from the work location, intentionally “sabotaging” the operations
determined for taking notebook PCs out of the organization’s facilities. These acts
interfere with the execution of set duties, and lead to lost business opportunities.
The root cause is that procedures for security are disassociated from familiar,
everyday procedures. This is because these procedures are commonly adaptedfrom rules at other organizations, or originate someplace up the line in theorganization by individuals who do not have a full understanding of the actual
work performed in the local workplace. The Working Group believes that those in
the local workplace should be responsible for thinking about security issues,
creating rules that complement local work processes.
The number of small-scale incidents is decreasing, signaling the beginning of
the effects of measures taken. Accordingly, the next big issue for corporations is
to deal with large-scale incidents. The four industry types that deal with large
volumes of information (Government Services, Finance/ Insurance,
Telecommunications, Education/ Learning Support) are highly susceptible to theoccurrence of incidents. These four industry types must be continuously
conscious of reducing the likelihood of an incident. Meanwhile, there are a wide
variety of industry types for which large-scale incidents (such as the Top Five
Incidents above) can occur. There is an equal potential for incidents to occur inany company that collects/ uses a large volume of personal information,
regardless of industry type. Most industry types utilize personal information.
Accordingly, most industry types are at risk for a major information leakage
incident. And while the likelihood of occurrence may be small, it represents alarge loss for a corporation, so we believe that the preparation of contingency
plans and business continuity planning (BCP) is recommended to limit potential
losses.

38

6Contact Information
Please address any comments about this report, or any inquiries about quoting
the content of this report in other published works, to the contact address below:■Contact
JNSA Office
URL: http://www.jnsa.org
E-mail: sec@jnsa.org

39

7

Appendix Definitions for Causes of Information Leakage
The Working Group categorized the causes of information leakage as shown in
the table below.
Table 9: Approach to Categorization of Causes of Information Leakage
Category
Configuration
Error

Specific Example
A website or otherconfiguration error
allows information
to be viewed fromoutside theorganization;
sensitive
information may
have been viewed.

Operational
Error

Incident occurs due
to misdirectedtransmission ofemail, fax, regular
mail.

Bug/ Security
Hole

Incident occurs due
to a Bug/ Security
hole in the OS,application, etc.,
which allows
sensitive
information to beviewed over theInternet orotherwise leaked.
Sensitive
information isleaked outside theorganization whenaccess controls are
overcome, and the
network is
infiltrated byexternal sources.

Unauthorized/
Illegal Access

Determination Criteria
When information has been leaked due toconfiguration errors in web servers, fileaccess privileges, etc.
Incidents exploiting configuration
errors to intentionally steal
information are not categorized as
Unauthorized/ Illegal Access.
Since this is not a software
vulnerability, such incidents are notcategorized as Bug/ Security Hole.
Information leakage due to erroneous
management procedures are
categorized as Administration Error.
When information has been leaked due to a
mistaken/ inaccurate address, an accidental
push of the wrong operating button, orother human error.
Categorized as Operational Error when
the last/ ultimate operation is the causeof the error. Categorized as a
Configuration Error when email
system settings are in error.
When a Bug/ Security Hole in an installed
OS or application causes an information
leakage incident.
Includes cases where Bug/ Security
Hole is left unaddressed on the user’s
system.
Includes cases where software orsystem vendor has not dealt withsecurity issue.
When a third party utilizes the network(mainly) to access a system illegally,
resulting in the leakage of information.
Categorizeds as Internal Crime/ Internal
Fraud when an individual internal to theorganization (employee, worker, etc.)
commits unauthorized/ illegal access.

40CategoryInternal
Crime/
Internal Fraud

Specific Example
Sensitive
information isremoved by an
employee,temporaryemployee or otherindividual internal
to the organization
for fraudulent
purposes.
Information stolen
is used to commit
crime, is sold, orotherwise leaked.

Unauthorized
Information
RemovalInformation isremoved fromwithin theorganization by an
employee,temporaryemployee, outsidecontractor, vendor,
former employee,etc. for use at home,customer location orother location, andis subsequently
leaked.
Organization-wideor business-related
use of personal
information forother than theoriginal intended
purpose.
Information isshared withaffiliates or otherexternalorganization
outside the original
scope of disclosure.

Non-Intended
Use

Determination Criteria
When an employee or employee fromanother company (temporary worker, etc.)
inside the organization engages inunauthorized/ illegal access or otherunlawful activity to remove information for
fraudulent purposes.
Categorized as Internal Crime/
Internal Fraud even in cases where an
intentional fraudulent act by anorganizational outsider involves
unauthorized/ illegal access.
Categorized as Unauthorized
Information Removal in cases where
information required for work or other
legitimate purposes is removed, but inviolation of rules.
When information is removed for work orother legitimate purposes, but in violationof rules. Striclty speaking, it is “theft” when
information or information media isremoved in violation of the rules; however,such cases as noted in the left column are
categorized as Unauthorized Information
Removal.
Categorized as Unauthorized
Information Removal, even when an
employee takes sensitive information
home, subsequently leaking suchinformation through P2P file-sharing
software.
When personal information is used forother than the originally intended purpose.
Categorized as Internal Crime/
Internal Fraud when an employee,
temporary employee or otherorganization insider acts individually
to use personal information for a
non-intended use.

41

Category
Loss/
Misplacement

Theft

Administration
Error

Worms/
VirusesSpecific Example
When a PC or other
other information
media isinadvertantly lostor misplaced inside
a train, restaurant,
or other outside
location.
Sensitive
information on a PCor other information
media is stolen in
the process of an
auto or officebreak-in.
Personal
information is lost
after anorganizational
move.
The transfer of
personal
information is not
sufficiently verified;transferred
information is lost.
Information
disclsure/management rules
are not sufficiently
clear; information is
inadvertantly
disclosed.
Personal
information (email
addresses, etc.) isleaked without theconsent of theinformation ownerdue to worm orother virus
infection.

Determination Criteria
When information is removed withpermission, and is then subsequently lost or
misplaced at the destination or en route.
Leakage occurs to personal/ individual
Administration Error.
Categorized as Administration Error
when information subject to control islost within the organization.
When information is stolen by a third party
with the information recordable media.
Auto, office break-in, etc.
Categorized as Unauthorized/ Illegal
Access when only information (not a
PC or physical media) is stolen.
When information becomes lost or
misplaced within an organization or usual
distribution channel. When information isleaked in the business process due to work
procedure error, or because rules regarding
information disclosure and/ or information
management are not sufficiently clear.
When responsibility for loss lies with theorganization.
Categorized as Theft when theft occurs
due to administration error.
Includes cases where information is
inadvertently destroyed due toinsufficient management/
administration.

When information is leaked due to virus orworm infection. Considered Worms/ Viruses
when such is the proximate cause of theleakage.
Includes cases where information isleaked due to a worm/ virus that takes
advantage of security holes.
Categorized as Worms/ Viruses in cases
other than when the cause of leakage isdue to P2P file-sharing software
containing worms/ viruses accessing
information taken home without
permission (Unauthorized Information
Removal), or when information isleaked from an organization PC using
P2P file-sharing software(Administration Error).

42Category
Other

Unknown

Specific Example
Documents
belonging to one
person are included
in an envelope
addressed tosomeone else.

Determination Criteria
Any situations not addressed above.

Cause of the incident is unknown.

43