#addressing sonic's moral code
Explore tagged Tumblr posts
lore-of-mobius · 3 months ago
Text
Sonic Has Been Mischaracterized In The IDW Comics Part 2
Part 1 On top of this Sonic has shown no signs of being opposed to killing. For example, in Sonic Mania Adventures Sonic has left Eggman hanging in a trap that Eggman made that he intended to kill Sonic with. Yes Eggman didn't die status quo and all, but that doesn't negate that Sonic left Eggman in this trap what was intended to kill him.
While I don't know a whole lot about the game, in Shadow The Hedgehog Sonic would have to either kill the Black Arms Aliens by either doing it himself, letting Shadow finish them off, or letting them starve in order to protect Earth from them which he seems to have no problem with. Because the Black Arms did intend to use humanity as a food source. It is heavily implied when Black Doom says "humans are a great energy source for us… they will be well kept," everyone acts mortified. In other words Black Doom is implying the Black Arms are going to use humans as well livestock. This is further backed up by what happens right afterwards when he sends his children the Death Leeches to eat Sonic and friends after he paralyzes them. This is straight up confirmed in the Encyclo-speed-ia on page 154. "Black Doom has used the Chaos Emeralds to move the Black Comet to the planet's surface and begins cultivating all life to feed his minions."
On top of this Sonic's response to Shadow in the Japanese version of Sonic Heroes saying "then it looks like you'll have to die." Being "that's my line," which would imply he says this from time to time, probably to Eggman whenever he announces another one of his plans of world domination.
Also, Sonic has been shown to be okay with imprisoning his opponents as we see in imprison Erazor Djinn in Sonic And The Secret Rings. This shows he is not opposed to imprisoning say Eggman. But he probably doesn't do it because locking Eggman up can put others in danger when his Badniks go to set him free. As if I am correct his Badniks look for him when he is missing, and with Metal Sonic or Sage leading them they will be more coordinated. There is a joke about it the Sonic Twitter & TikTok Takeover #7 - All Answers at 27:40 where Sonic does just that, off course he got out somehow aka his Badniks. Also, Sonic does talk about locking Eggman up in the idw x comics so there is that.
Oh yeah Sonic did try to kill King Arthur, even though they were an illusion he didn't know what and did intend to kill him.
Soooo… Yeah this does conflict with his IDW depiction, but so does Sonic Prime. So here's how I see it. One can deal with some of the things said by Sonic by headcanoning them as misinterpretations through the lens of other characters like Surge, Kit, and Eggman. While he still has a view of restorative justice thanks to Amy and Mecha Sonic, it is not his soul way of going about things.
Keep in mind this is not me saying Sonic is actively trying to kill Eggman as if he's the Punisher or is gonna be killing his enemies left and right like Deadpool. That he isn't going to break down Eggman's front door to kill him or take him to prison. But rather he is not like Batman and he is not opposed to it if push comes to shove, and he is not opposed to allowing Shadow to take out Black Doom or in another case Eggman at all(say he's not Mr. Tinker). Or in the case of Mania Adventures, leaving Eggman next to a bomb that Eggman intended to kill Sonic with that for all Sonic new could have been intended to have enough power to wipe out several miles. That Sonic doesn't believe he can't "take away someone's freedom" in the paradox of tolerance, and that he is okay with erasing Mephiles from the timeline for example.
Think of it like Mario, canonically Mario isn't opposed to killing his opponents but doesn't aim to unless push comes to shove. Part 3
Tumblr media Tumblr media Tumblr media Tumblr media Tumblr media Tumblr media Tumblr media Tumblr media Tumblr media Tumblr media Tumblr media Tumblr media Tumblr media Tumblr media Tumblr media
11 notes · View notes
timeclipsed · 4 months ago
Text
@hiswrlds asked: The blue blur's color is vibrant against the purity of winter's coat . It dashes throughout the curves of forests, leaving clear paths in the woods for whoever decides to venture. It speeds across a crystalline frozen lake, the ice takes a few seconds to melt by the severity of speedster's heat after he's already gone . And he continues, unabashedly scarring the winter wonderland until he spots a certain bundle of warm layers & warmer amber fur . " Tails !! " He calls out loudly, somehow managing a perfect halt to speeding pace without tumbling over into the snow . Steam emerges from beneath every footstep now, melting the snow as shoes adjust to temperature & he takes leisurely simple steps towards the fox . As he trots, one can spot a gift bag bouncing on a sling to his arm, and one can only wonder how it managed to survive the trip here at all . " I'm glad I found you, here, I got you something . " Gloved hand reaches inside the bag to pull out a simple caramel brown scarf, it's ... quite big . A really large scarf, Sonic has to put the bag on the ground to be able to hold the length of the scarf with both hands . At the very end corner of it, there are flowers in blue & yellow embroidery, which doesn't look like the work of skilled hands . The blue hedgehog smiles regardless, sharp-toothed grin a little sheepish . " Did the flowers myself, I know they're not really special, but they were the easiest shapes . " It's very hard to admit he's inadept in certain aspects, but he tried . " I know it's not the time for gift-gifting yet, but I didn't know if we'll be able to see each other when it is, so ... "
— ;; CONCURRENTLY ADDRESSED AND GIFTED THE homespun article of warmth, he stares rather wide-eyed and astonished at both it and the gift giver. Strive's guest appearances in his life had become more frequent over weeks and months, to the point where no one at the shop batted an eye whenever he strode in unannounced, flopping down somewhere to make himself at home or to begin trailing Tails during his afternoon tasks.
There shouldn't be a reason, he thinks, why he's this surprised at the fact that Strive would go out of his way to concoct the perfect present for him in the name of the holidays, but nevertheless he still finds himself dry in the throat and rapid blinking away the daring emotions. How long this must have taken, the cost of the garnered materials, the many attempts it certainly took to complete to a level of arguable perfection. One glance can easily read his admitted delectation just by studying his facial features for a second, by noting the way he trails digits along the stitchwork, admiring every bit of the piece gratefully.
Enmity soon fills his stomach at the thought, however, at the audacity, ebbing him further into a spiraling path of seclusion. For him to want to be this close, to already feel this close, to make this trip so frequently, all just because he wants to. Following an invisible line of moral code that jumbles up and reads nonsensical to anyone else who'd dare step up in an attempt to understand.
Betrayed, even then, by the spark of jubilance the scarf brings him, which balled fists clamp rigidly down onto, he realizes he has to end this now. Before they attach at the hip, before his own feelings come spilling out haphazardly, before he learns how to love again.
Tumblr media
❝Oh yeah, cool. Thanks. I think there's space for it somewhere in my closet.❞ Spoken flatly, carelessly bunching it up within one hand, he turns to make his way back into the shop. ❝I didn't get you anything. Sorry or whatever. Seeya!❞
— ;; INSTANTANEOUS REMORSE SETTLES DEEP WITHIN as he slams the door in Strive's face, but he doubles down, flipping the OPEN sign around to read a reddened, bolded CLOSED. Scurrying away, briskly, escaping up the stairs and into his bedroom, a trademark red scarf is promptly discarded onto the floor, replacing the fabric wrapping around his neck with the new flowery, caramel one.
Sinking to the ground onto tremulous knees, arms wrap around his form tightly. Wails leave his lips, cradling himself back and forth to self-soothe effetely.
Tumblr media
❝It's beautiful,❞ he susurrates, vicious hiccupping sobs shortstopping words and syllables, ❝it's one of the best gifts I've ever gotten. You idiot, you stupid dumb idiot, I love it. I... I love you. Please stop coming back. Please...❞
3 notes · View notes
cats-mayhem · 2 years ago
Text
Ok, to preface this, I'm speaking straight from my mind. No planning here. So if anything doesn't make sense I'm sorry.
Warped Sonic being the next antagonist for an arc right after Metal Virus is so fucking cool to me why didn't IDW do that.
Think about it. From what we know of Warped Sonic is that his memories and personality are, well, warped.
The Metal Virus arc, an arc where Sonic's morals and philosophy were put on the line since he let Eggman live freely. An arc where Sonic was panicked and worried that me might've fucked up the world for good by doing that. Someone who exhausted himself to no end trying to fix what he had done. AND IN THE END REALIZED THAT HE WAS ALSO MAKING IT WORSE BY DOING THAT! He was spreading the metal virus everywhere he ran. Spreading it to grass and trees and such. He was actively destroying the planet as well.
So what if you follow that up, with an arc where Sonic is the antagonist. He's Warped Sonic, but still Sonic in the ways of his morals and philosophy. Show us a darker and more fucked up side to Sonic's flawed morals. Make those flaws stand out and criticize them. Make him almost kill Eggman, but not do it last minute since killing isn't in his moral code, he just wants to have fun. Eggman is a big source of entertainment, so let him roam free and eventually he'll do something where Sonic can have more fun.
Show us how he actively harms the people around him by not ending the problem permanently and hindering the people who want a long-term solution. Make him a gaslighter! Make Warped Sonic have the same morals and philosophy as Sonic but put it under a different light.
And when Warped Sonic is defeated, have Sonic remember everything he did as Warped Sonic. Make him realize that he isn't as heroic as his friends make him out to believe. Make his development be about change. SINCE THAT'S WHAT IDW IS ABOUT??? CHANGE!
We get Belle, a robot made by Mr. Tinker, and she has to learn and accept the fact that her father is gone. She changes for the better. She could've still held out hope that her father is still somewhere in Eggman, but she eventually gave up that idea and learned to move forward for the better.
The new diamond cutters are all about changing the present to heal the past wounds. What I mean by that is that Tangle probably chose that name to help Whisper through her trauma. Not stated explicitly but you can read a bit more into it.
Think about how Sonic could change from being Warped Sonic. He doesn't need to change his ideology since NO ideology is perfect. But he could at least address the problems with it and try to make himself better by improving upon himself.
This isn't even bringing up Metal Sonic. Warped Sonic would be Sonic's view of freedom in a more twisted lens. Metal Sonic doesn't have freedom can't even dream about it. He is programmed to do everything Eggman says. And since Metal is Sonic to some degree, you could imply that Metal hates Eggman a bit since Metal is supposed to be Sonic, the embodiment of freedom, but trapped. What if Warped Sonic could be a reflection of Metal's view of freedom? Hmm??
Sorry. Again this was all on my mind and I've just been typing non-stop so this probably doesn't make any sense but it's whatever. I think Warped Sonic could've been cool.
1 note · View note
welcome-to-green-hills · 2 years ago
Note
I forgot you like the science stuff ooooooooh okay and you mentioned mind uploading and I have a THOUGHT.
A HEADCANNON (kinda) because I like ti take pieces of canon and try to fit them all together.
And I'd love your thoughts.
In Sonic Brawl, Rouge says Shadow has Maria's soul. That is super vague, but we do know that Gerald was willing to go to any lengths to save Maria.
... Do you think a backup of her brain was created and 'downloaded' into Shadow?
(I have other thoughts in tandem with this but they're all mildly sad so I just want to ask the fun one💜)
Tumblr media
Hello, my dear!❤️✨
I’m terribly sorry for taking so long on your ask. I wanted to make sure that my answer was reasonable, as well as supplied some knowledge to the character’s purpose of creation. Essentially, I wanted to make sure that I was thorough enough to share my thoughts. I’ve even shared this question with a couple of my colleagues at the lab to hear their thoughts too. This will be a pretty lengthy, but well-educated answer.
I absolutely agree, the journal entries from Sonic Battle are vague. I feel that they are purposefully meant to be vague so that the audience could make their own conclusions on what it means. Short answer: possibly, but I lean more towards “no.” Long and complicated answer can be found under the “read more” tab (because why not😅).
We just don’t know the extent of how extreme Gerald’s plans were with discovering immortality. We’ve seen in SA2, Sonic Battles, Sonic Rivals 2 and ShTH 2005 that Gerald has been known to tamper with very questionable forces in order to achieve immortality at the cost of risking everyone and everything around him. It’s desperation, yes. He care more about Maria than anything else. I think it’s just… really up for debate.
We have a couple of ideas that need to be addressed first in order for me to share my thoughts:
1). Brain uploading requirements, zettabytes
2). Psychology/Ethics and Moral Teachings
BRAIN UPLOADING REQUIREMENTS (ZETTABYTES):
The assumption that Gerald was crafty with uploading a consciousness into a computer is a process called “Whole Brain Emulation (WBE).” This is also referred to as a “mind transfer.” This is a process in which, presumably, has the ability to scan the state of our minds and transfer into a database whether it’s postmortem (deceased) or antemortem (living).
As of now, the process of uploading one’s consciousness into an artificial body or database is a pseudoscience. This means that it’s more of a fantasy sci-fi scenario other than supplying factual results. Whole Brain Emulation would have to take into consideration of scanning layers upon layers of one’s mind and convert them into various strands of code. The human brain is made up of neurons; the human mind has about 86 billion neurons (PNAS, 2012).
In order to even begin scanning the mind, we’d need an exorbitant amount of storage space that could store not even a handful of neurons. We’d need to take into consideration of zettabytes. The human mind itself can store about 1.1950 petabytes of data in a lifetime if it was used at its fullest capacity (Houzel, 2009). That’s roughly two zettabytes. That’s like finding the Pacific Ocean with water twice! Thankfully, we live in a world where we have access to zettabytes. Zettabytes are used to store large sums of data in servers for social media sites, like Tumblr and Twitter. Being able to store all of the data into a database seem plausible, but we still run into a couple of problems.
We would not be able to get a 100% accurate reflection of Maria. If anything, we’d only be able to replicate it via artificial intelligence. We would have to take into consideration of Maria’s mannerisms and wide variety of responses to the world around her.
PSYCHOLOGY/ETHICS AND MORAL TEACHINGS:
With all of the technological advancements made in human history, the capability of transferring organic consciousness into a mechanical device is nonexistent. We might be able to replicate states of consciousness, but we would have to teach AI and code human ethics and morals. In this case, we could make an attempt in replicating Maria’s consciousness to a certain extent. We don’t know a whole lot of Maria’s characteristics other than the fact that she mattered tremendously to both Shadow and Gerald.
The problem here would be that we’d lack a ration and irrational response of decision making of the individual. What we think that we might know of a person might be different from them being right then and there as they respond to the phenomenon. If anything, we wouldn’t have Maria’s internal thinking and logic. Everything that would be coded would not be Maria’s true thoughts, it would be an assumed thought of the AI and/or programmer.
There is no guarantee that the AI will possess every thought and feeling that Maria might have had when transferring her consciousness. In order to get that, we’d have to do extensive psychological research of Maria’s response to every situation in a controlled environment. This would have to be monitored 24/7. The Maria program would have to relearn everything about herself on top of learning culturally acceptable ethics and morals depending on the environment she was raised in.
If this is the case, then Shadow would have to be habilitated into having the same—or nearly the same—mannerisms that Maria would have had if having her consciousness uploaded into his mind. And if she were still a child, then that would take longer. A child is still in the process of knowing themselves and their identity. Because we would only have a secondary source of Maria’s characteristics, we would lack internal feelings of her growing up.
CLOSING STATEMENT:
It’s safer to assume that everything that Shadow has done in his life are his own thoughts and feelings. Shadow is meant to be perceived as his own person. I’m positive that his actions are influenced by Maria and his interactions with the world around him. Most, if not all, of his actions after learning the truth from SA2 are his own. I do not believe that Maria had her consciousness uploaded into Shadow’s mind, but it is a possibility that Gerald thought about it. The problem here is that we might never know. All that we know is that Gerald would have done nearly anything, even using government funding, to save Maria (Windii, 2018).
Most of my thoughts and feelings are told through the perspective of human interactions. We don’t know enough of Shadow’s physiology in order to make a true comparison. Until we learn more about Gerald and Maria’s characteristics, I think that it’s safe to say that this is more of a hypothetical scenario that needs more information.
I hope this answers your question, my dear!❤️✨
SOURCES:
PNAS, 2012: https://www.pnas.org/doi/10.1073/pnas.1201895109
Houzel, 2009: https://www.ncbi.nlm.nih.gov/pmc/articles/PMC2776484/
Ted-ED, 2023: https://youtu.be/2DWnvx1NYUA
Windii, 2018: http://info.sonicretro.org/Sonic_Adventure_2_-_The_Truth_of_50_Years_Ago...
Here’s a great text from the National Institute of Health made that talks about neurogenics: https://www.ninds.nih.gov/health-information/public-education/brain-basics/brain-basics-life-and-death-neuron
22 notes · View notes
spellbook-gayboy · 3 years ago
Text
[CAPE-WATCH HISTORICAL ARCHIVE]: Remembering Brianna Clarke - The First Black Superhero (09/27/2014)
She fought for the freedom of nations, defended the liberties of marginalised peoples and strived for progress and equality in a deeply unequal world. Brianna Clarke, perhaps better known by her superhero alias of Soprano, was a hero in every sense of the word.
 Growing up poor on the streets of Kingston, Jamaica, she always yearned for the chance to better herself and others, and to create a better world. At the young age of eighteen, Brianna discovered the power she would later become iconic for: a devastating sonic scream that could shatter even the strongest ears and destroy everything caught in its way. This ability, coupled with Clarke’s own strong moral code, led her to donning a black costume and doling out justice on her own terms in a crusade against crime inspired by the likes of The Immortal and War Woman, who served as idols for all of her life. She exploded onto the scene in May of 1939, when she single-handedly dismantled a brutal gang terrorising people in her neighbourhood. This event was only the start of her long career as a crimefighter, stopping everything from a human trafficking ring in February 1940 to serial killings in December of 1941. 
However, the event that launched her to international fame wouldn’t come until October 1942, when The Immortal approached her with an offer of working together as part of a team fighting in the Second World War, which she gladly accepted. This team would later become the Defenders of The Free World, where she met her idols as well as newcomers like Red Rush and Frontline. Together, the five of them fought across war-torn Europe, from the bloody beaches of Anzio to the dense forests of Bavaria, fighting Nazi soldiers and supervillains alike with courage and camaraderie. This later led to one of the famous photos of all time, titled ‘The Kick That Ended a War’, which shows Soprano delivering a mean high kick straight to the face of infamous Nazi supervillain Wotan. 
After the war’s end, Brianna Clarke returned to Kingston, resuming her previous activities until the summer of 1947, when she again left to join the first iteration of the Guardians of the Globe. It was on this team that she first began to use her platform to advocate on social issues, calling for the British Empire to grant independence to many of its colonies, starting with India in 1947 and not stopping until the last colony was released. She also focused on racial issues, collaborating with prominent figures in the Civil Rights Movement to desegregate public schools, housing and other settings, as well as giving an address calling for an end to the deeply racist Jim Crow Laws. She also advocated for the decriminalisation of homosexuality in many different nations such as the UK, the US and many others, arguing “any nation that criminalises any aspect of a person’s existence does not have the right to call itself ‘civilised’”.
Clarke also led a fulfilling personal life alongside her public endeavours. She married Sergeant John Parker, a Royal Marine she met in late 1944, in June of 1948, and later had three children with him. One of those children would later follow in her mother’s footsteps and adopt the identity of Sister Siren, of Capes Incorporated USA fame. When she finally retired from super heroics at the age of fifty-three, Brianna invested her vast fortune into opening a Jamaican restaurant in New Orleans, called The Songbird’s Nest, combining family recipes with influences she gained throughout her long career. To this day, the restaurant still stands, now part of a chain all over the Southern US and Caribbean, the heroine’s most enduring legacy. 
The final years of Brianna Clarke’s life were spent in quiet solitude, living on a small estate in upstate New York, her time spent often in the company of her many grandchildren and great-grandchildren. When she died peacefully in her sleep at the old age of niney-four, it seemed as if the entire superhero community joined together to mourn her passing, and many have likened the sheer scale of her funeral to the death of a monarch or world leader. It only seems fitting that such an important and widely loved woman was honoured in a suitable way. Rest in power, Brianna Clarke. 
6 notes · View notes
the-desolated-quill · 7 years ago
Text
Cold War - Doctor Who blog
(SPOILER WARNING: The following is an in-depth critical analysis. If you haven’t seen this episode yet, you may want to before reading this review)
Tumblr media
Here we go again with another Mark Gatiss episode and it always pains me whenever I have to slag him off. I’m a big League of Gentlemen fan and Gatiss has done sterling work with them over the years, but the sad fact of the matter is the stuff he does outside of the League just isn’t very good. His first Doctor Who episode, The Unquiet Dead, was decent but flawed, The Idiot’s Lantern was a ripoff of Little Shop Of Horrors except with none of the charm, Victory of The Daleks was utter crap, and Night Terrors just bored the pants off me. Now here we are with Cold War, and I wish I could say this was the episode where Gatiss finally pulls out all the stops to give us the magnificent Doctor Who story we’ve all been waiting for, but sadly it’s yet another dud I’m afraid.
By far the biggest problem with Cold War is its total lack of originality. An Ice Warrior gets loose aboard a Russian submarine and it’s a fight for survival as the Doctor tries to reason with the alien and save the crew. Yep, this is yet another base under siege story, and it goes through all the cliches. The Doctor meekly trying to persuade the villain to show mercy, the crew splitting up to search for a solution, the monster picking them off one by one, and so on. I’ve seen this kind of story done so many times in Doctor Who now that I was practically nodding off halfway through it. 
Cold War also borrows liberally from other sci-fi stories, the most obvious being Alien, but there’s also elements from other Doctor Who stories too, such as the multiple Silurian stories where the Doctor tries to persuade two sides to play nice, and Dalek where the last surviving member of a warrior race threatens to destroy all of humanity out of desperation and rage. The problem is the reason Dalek worked so well was because of the Doctor’s long history with the Daleks. A relationship he simply doesn’t have with the Ice Warriors. Plus Cold War shares the same problem as The Hungry Earth/Cold Blood where neither side are given any sort of nuance or depth, and therefore it’s hard to empathise with anyone.
Of course Cold War is significant in that it features the long awaited return of classic series monsters the Ice Warriors. Having heard all of my rants about the Cybermen, the Sontarans and the Silurians, you’re no doubt wondering what I, a veteran Whovian, thought about the Ice Warriors during their heyday.
Tumblr media
Yeah, I’ve never really been a fan. Not that they’re bad villains, mind. They’ve had some decent stories in their time. I’ve just never found them to be particularly interesting. The only time I felt the Ice Warriors really came into their own was in the Jon Pertwee era story The Curse Of Peladon. It was a sort of murder mystery plot where an alliance between the Galactic Federation and Peladon was in peril due to someone killing off the delegates. Naturally the Doctor and his companion Jo suspected the Ice Warriors due to their reputation, but then the story pulls the rug out from under us by revealing the true culprit to be the High Priest Hepesh and the realisation that the Ice Warriors really had changed their ways after all. It was a genuinely good twist and opened up a lot of creative possibilities for the Ice Warriors. We’d seen heartless zealots like the Daleks, altruistic foes like the Cybermen and one note pantomime villains like the Master, but we had never seen a monster in Doctor Who that starts out as evil only to realise over the course of the show that what they were doing was wrong and try to make amends. This put the Ice Warriors in an incredibly unique position I feel. One that sadly was never fully capitalised on because in their next and last story, The Monster Of Peladon, the Ice Warriors reverted back to being baddies again.
So what direction does Gatiss take the new, revived Ice Warriors? Are they a morally complex race of warriors trying to make up for past mistakes or boring alien invaders hellbent on world domination?
...
Boring alien invaders hellbent on world domination.
Tumblr media
Great! Yeah! God forbid we should do anything interesting with them!
To the episode’s credit, the new Ice Warriors look really cool. Much more high tech and imposing than the classic series ones. And Gatiss does try to address a few discrepancies in Ice Warrior lore, for example how did a race of cold blooded reptiles survive on a cold planet like Mars? But it’s the characterisation that severely lets this episode down. The Ice Warrior just isn’t a very interesting character. They try to make you feel an emotional connection to him by wheeling out the cliched dead daughter, but the character is just too extreme for us to empathise with. One human zaps him with a cattle prod and suddenly he wants to destroy the world, and the only explanation we’re given as to what justifies such an overreaction is some bollocks about Martian code of ethics. Also, didn’t he attack them first? And I had to let out a hollow laugh when the Doctor said the Ice Warrior would have left them alone if they didn’t zap him. Bit naive, wouldn’t you say? The Ice Warriors are many things, but merciful is not one of them.
And it just gets worse when they then commit the cardinal sin of getting the Ice Warrior to come out of its shell. So instead of the tall, imposing Ice Warrior we were promised, we instead get a pair of green rubber gloves gripping people’s faces and the worst CGI face I’ve ever seen in my life. It’s hard to imagine an Ice Warrior being that fast and nimble out of the suit, (not to mention that spindly looking), not just because I’m so used to the Ice Warriors being slow, sluggish brutes, but also because Earth’s gravity is much stronger than Mars’. Shouldn’t the Ice Warrior be a quivering puddle of slime on the floor? And what was the point of the Ice Warrior ‘disassembling’ people to learn human weaknesses. It never comes into play at any point in the episode. Everything about the naked Ice Warrior just feels utterly divorced from anything I’d associate with them to the point where I question why Mark Gatiss would even call it an Ice Warrior. Why not come up with your own alien? Why bring back the Ice Warriors? And I’d prefer a better reason other than ‘it’s the 50th anniversary.’
The human characters are just as bad. Whenever I’ve seen Cold War related stories, it’s usually from the perspective of the Americans. Hardly ever from the Russians. This is an opportunity for Doctor Who to cover new ground here, but they don’t really. The Russians aren’t actually characters. None of them are given any real development, arc or personality of their own. You have the captain who’s... well... the captain, some douchebag who is obsessed with war and gets promptly killed off, and then you’ve got David Warner’s character who we learn absolutely nothing about other than he’s obsessed with Duran Duran. The rest are just pointless redshirts that I don’t give a single shit about. If you’re going to give me a base under siege story, the least you can do is give me interesting characters that I actually care about, otherwise it’s going to be a bit hard to work up any kind of shock or sadness when they do kick the bucket. There’s no tension because I don’t care who lives or dies.
And speaking of tension, that’s another missed opportunity. It’s the Cold War. The world’s on a knife edge. Any spark or conflict could trigger nuclear armageddon. Combine that with the claustrophobic submarine setting and this episode should be brimming with paranoia and nervous tension. But you never get a sense of that, not only because I don’t give a shit about any of the characters, but also because at no point did I feel the weight or scale of what’s happening. Oh sure the Doctor keeps reminding us about the threat of a nuclear apocalypse, but it never feels imminent because none of the characters seem to take the prospect seriously. For one thing, the Russians are very quick to trust the Doctor and Clara despite them mysteriously appearing out of nowhere and could very well be working for the enemy for all they know, and whenever they do talk about the Cold War, it’s very quickly brushed to the side. Well if the characters are’t bothered by the prospect of a nuclear holocaust, why the fuck should I be? Even the finale with the Doctor praying that the Ice Warrior won’t launch the nukes is undermined by Clara randomly singing Hungry Like The Wolf. Strip all the tension out, why don’t you?
The Doctor is at his most ineffectual sadly, reduced to spouting his usual ‘show mercy’ claptrap and waving his sonic screwdriver around, but what annoys me even more is Clara. Not only is she back to her smug self, reducing the potential threat considerably because if she’s not taking it seriously, why should I, but also there’s an opportunity for a good character arc here that Gatiss botches spectacularly. At one point Clara wonders whether she could have handled her first encounter with the Ice Warrior better and at the end is able to use the memory of the Ice Warrior’s daughter to persuade him to leave. This could have been an effective moment had Clara been allowed to speak to the Ice Warrior freely the first time around instead of being reduced to a mouthpiece for the Doctor (why couldn’t the Doctor just talk to the Ice Warrior himself? They never properly explain that). Clara isn’t given any real agency of her own or licence to screw up, so rather than the ending feeling like a personal triumph for Clara as she grows and develops as a character, she’s instead just a convenient out for Gatiss.
And don’t get me started on all the stuff that just didn’t make sense. How can the Russians mistake a frozen humanoid for a mammoth? Why did that guy thaw the Ice Warrior out other than for the sake of plot convenience? Why would a submarine that was only sent on an Arctic expedition be carrying nuclear weapons? Why would the Russians have automatic weapons on a submarine? How is the Ice Warrior able to hide inside the walls of a submarine? How does the Ice Warrior expect to launch a successful nuclear attack from a submarine that’s stranded 700 meters down below sea level? Oh and the Doctor just happened to have been fiddling with the TARDIS off screen, which just happened to make it disappear to the South Pole, leaving them stranded in the submarine? That’s fucking convenient, isn’t it?
I suppose I don’t hate Cold War. It’s competently made and if you’re someone who can’t get enough base under siege stories in Doctor Who, I’m sure it’s possible to enjoy this one provided you switch your brain off beforehand. The only crime this episode commits is that it’s just really, really dull. The story is cliched, the characters are one dimensional, and the potential of the setting is completely wasted. The only noteworthy thing about Cold War is the Ice Warrior and they don’t even do that very well. Overall it’s a very bland and forgettable episode. Maybe one day the Ice Warriors will get an episode that finally realises their full potential, but it isn’t this one.
15 notes · View notes
whovianfeminism · 8 years ago
Text
Whovian Feminism Reviews “Thin Ice”
Tumblr media
Who gets to travel in time and space?
Doctor Who would probably answer that question with an enthusiastic “Anyone!” Perhaps not everyone should travel with the Doctor. But anyone* who has an open mind, a hunger for adventure, and the will to fight the most terrible things the universe can throw at you could travel with the Doctor.
But some fans have always been aware of the asterisk that comes after anyone*. Perhaps anyone could travel with the Doctor, but not everyone would be accepted wherever the Doctor goes. And Bill Potts -- our second black companion, our first (main) queer companion, and a woman -- is especially aware of the risks of traveling to the past. And she’s still not very sure of the man who’s leading her into danger with a cheshire cat grin.
Sarah Dollard’s astounding second episode for Doctor Who tackles both the personal and the political. “Thin Ice” addresses the risks of traveling through time when you’re from a historically oppressed group, delivers a pointed critique of modern pop-culture whitewashing, and also delivers a compelling character piece between the Doctor and Bill as she discovers what kind of person you have to be to travel with the Doctor.
Tumblr media
Doctor Who has tried to explore the discrimination and oppression the companions could face while traveling in the past, but the results have often been lackluster. “Thin Ice” makes a deliberate call back to one notable conversation from the “The Shakespeare Code,” where Martha flags the danger she might be in while walking around Elizabethan England.
“I’m not going to get carted off as a slave, am I?” she asked the Doctor.
“Why would they do that?” he replied with clear shock and distress, as if he couldn’t fathom a reason why someone would do that to his Black companion. At best, this comes off as a type of well-meaning (yet still insulting) color blindness, as if the Doctor just doesn’t recognize why Martha would be concerned for her safety because he “doesn’t see” Martha’s race. At worst, this feels like a curious and dangerous blind spot in the Doctor’s encyclopedic knowledge of human history. Rather than engaging with the subject, it feels like "The Shakespeare Code” was trying to hand-wave it away and dismiss Martha’s concerns.
When Martha points out she’s not white, the Doctor’s response is hardly reassuring. “I’m not even human,” replies the alien who happens to look shockingly like a white man. He follows up with “Just walk about like you own the place, works for me.” Of course, that absolutely wouldn’t work for anyone who didn’t look like a white guy. It’s remarkably tone-deaf and dangerous to tell marginalized people to walk around with a sense of entitlement to avoid harassment. In my experience, that approach tends to lead to worse harassment.
"Thin Ice” approaches this conversation with much more respect for Bill’s fears. The Doctor doesn’t immediately put two-and-two together and realize that Bill’s discomfort with wandering Regency England has to do with her being black. But once he understands, he doesn’t try to invalidate her feelings. He acknowledges there may be trouble and lets Bill decide what she’ll do.
In “The Shakespeare Code,” the Doctor tries to put Martha’s fears to rest by pointing out two black woman walking ahead of them and saying, “Besides, you’d be surprised. Elizabethan England, not so different from your time.” It’s a another hand-wavey moment to dismiss Martha’s fears, but it’s also the only time we see black women at all. They vanish within seconds, unnamed and without a single line. The remainder of the story is dominated by white characters. 
In “Thin Ice,” black women and people of color are a prominent, powerful presence. Kitty leads her band of street urchins and has a huge role to play in pushing the plot forward. If there was a Bechdel-style test for whether two women of color talk to each other without mentioning a white man, Bill and Kitty would pass. People of color are also prominently visible in the background of Regency London, and Dollard uses that as a way to make a critique of whitewashing in our modern pop culture. History has always been more diverse than our movies and TV shows have cared to admit. 
Tumblr media
In the midst of all this, the Doctor and Bill are wrestling with their evolving relationship from professor and pupil to Doctor and companion. And as Bill learns more about just how alien the Doctor is, their morals and values come into conflict as well.
The Doctor seems to be finding it difficult to step back from his role as a lecturer. Throughout “Thin Ice,” he treats every conflict with Bill as another opportunity to teach her a lesson. When she’s disturbed by the death of Spider, he treats her like she’s throwing a tantrum and tells her that he’s “never had time for the luxury of outrage.” When they are about to confront Lord Sutcliffe, the Doctor orders Bill to be quiet while he interrogates Sutcliffe and lectures her about her temper, confidently saying that “Passion fights, but reason wins.” But Bill’s not here for the Doctor’s lectures or for his posturing about reason vs. passion. 
Which brings us to the truly incredible moment that the Doctor punches Lord Sutcliffe.
Narratively, this moment is absolutely earned. Viewers know that the Doctor is absolutely full of it when he says he’s never had the luxury of outrage. As Bill later says, he’s never had time for anything else! This moment puts that false choice between logic and passion in sharp relief. One is not inherently better than the other, and there are just some situations in which logic cannot win. There’s no reasoning with someone who’s that deeply, confidently racist. At a certain point, they just need to face the consequences of their actions and then be silenced.
“Thin Ice” was written and filmed long before Richard Spencer was punched at Donald Trump’s Inauguration, and yet it has managed to land squarely in the middle of the “Is It Okay To Punch Racist Assholes” conversation. The Doctor seems to fall firmly in the “YES” column. But the punch definitely seemed to touch a nerve with some. One troll on Twitter went so far as to say the episode was anti-white and that Doctor Who had been taken over by “SJWs.”

First of all, if this is the first episode in which you think that Doctor Who is advocating for social justice, I have to wonder if we’ve been watching the same show. Second, I find the assertion that the episode is “anti-white” for portraying an accurate -- even relatively muted -- racist attitude by a white person is truly ridiculous. But I did find his discomfort with showing white people’s racism to be interesting.
Science fiction fans love their allegorical or metaphorical racists. Stormtroopers and Daleks are some of our most popular and enduring pop culture characters, and both are based to some degree on Nazis. But we like our villains to be larger than life figures obscured in costumes, and our heroes facing these villains to be overwhelmingly white. The evils these villains represent can then be a few steps removed from the real world. But there’s something to be said for pulling the racist out from behind the plastic mask or metal suit. Lord Sutcliffe’s racism is very human; it’s practically banal. Our TV shows shouldn’t just address racism allegorically or metaphorically, they should show the actual perpetrators and victims in our own world.
And, for the record, I’m totally in favor of the punch. If Daleks and Cybermen and all the rest should fear the Oncoming Storm and the Destroyer of Worlds if they attempt to harm others, then racists should be afraid that an angry Scottish man with attack eyebrows will punch them in the face if they spew their venom at anyone else. 
Tumblr media
Ultimately, this episode comes down to the value we place on human life. Lord Sutcliffe is the obvious villain because he places no value on any life besides his own. But for most of “Thin Ice,” Bill isn’t sure how much value the Doctor places on human life either.
Twice in “Thin Ice” the Doctor fails to look even remotely disturbed when people are killed right in front of him. His focus is more on retrieving his sonic screwdriver than saving their lives. And when he’s confronted by Bill he confesses that he can’t remember how many people he’s seen die -- or how many people he’s killed. Emotionally, this feels like the inverse to the moment in “Smile” where Bill realizes that the Doctor is the man who saves people. In “Thin Ice,” he’s the man who doesn’t always save everybody. Sometimes, he’s the man who kills them. He’s the man who makes the hard choices about who to save and who to sacrifice. And it’s his casual attitude towards the lives he can’t save that disturbs Bill more than anything. 
But Bill and the Doctor find their equilibrium when they come together to solve the problem. The Doctor invites Bill to participate in his deliberations rather than telling her how to think, and leaves the final decision up to her. Logic and reason are both invoked. Risks are analyzed, lives are weighed, and a judgement is made on the value Bill and the Doctor place on all the lives at stake. They both make each other stronger when they work in tandem, a pattern I hope carries through the rest of the season.
322 notes · View notes
cgmayra · 8 years ago
Note
(All your prompts and writing has given me so much feels Mayra <3 wanna say that you're so talented xD keep up with the great work!) Prompt: The new character in Forces is a very malicious villain and Amy tries to get him on the good side, prove that nothing can be achieved with bad intentions however, things backfire and she's in huge trouble. What will Sonic do? (Can't wait to see what you come up with! XD)
(*crying tears of joy* she said talented and great work, and that it gave her feels, I’m just.. my heart. *grips* Thank you, child. Thank you.)
I actually have been KILLING to write my idea for the new character as a villain. I have two scenarios, one as a man and one as a woman, but both villains. After this one, I’ll definitely have to write the female version! In both of them, either Amy or Sonic is threatened and the other basically saves/helps them out.
I’m so excited~ You are the best for giving me a prompt that allows me to work my magic!!!~<3
Prompt:
As he looked out over the battlefield, seeing how Eggman’s minions were doing and also analyzing team strategies, the villain suddenly took notice of a girl fighting the crowd.
“Oh?” his curiosity peaked up as he smirked, “Cubot. Orbot.”
The two robots shivered, deeply afraid of him, maybe even more so than Eggman since this mercenary had a ‘darker’ moral code than even he…
“Who’s she?” he looked fondly to the scene, but there was something sinister in his questioning.
“…” the robots looked to each other, worried about giving him information.
The man turned his head back, “Do I not recall your creator giving you strict instruction to inform me on my enemies?”
The robots, on either side of him, suddenly scooted back and gripped each other in a clanking hug. They saw what he did to their kind…
“S-sh-she’s Amy Rose, sir!”
“N-no one of any great importance really. Her skill set is mostly a balance of raw power and extraordinary speed.”
“Y-yeah! And the self proclaimed girlfriend of Sonic the-EMPH!” Orbot shoved a hand up over Cubot’s speaker.
“You idiot! He doesn’t need to know that!”
“What? A girlfriend?” he suddenly looked down at the girl, fighting to her heart’s content.
He suddenly smirked, and began to chuckle.
“She’s the queen of this little band of fools?”
“Q…queen?” the two looked at each other, confused.
He laughed again, leaning his head up before looking back down and seeing Sonic come in to take out a few robots around her.
She smiled and nodded to him as he winked and gave her a thumbs up, and sped off.
He adjusted his gloves, pulling them down. “Come on, boys. You know what they say…” he walked with absolute steadiness that didn’t seem earthly, as his quills suddenly stood on end, as if he was excited for the events his mind imagined to unfold…
“If you want to learn the strength of the pack…
                                                 ,,,you attack the queen.”
Amy swung around and dodged a large robot arm that had swung down at her, then, taking the A.I robot by surprise, she twisted her hammer to where it’s edges gripped the crook of it’s arm, and pulled it over herself and let it smash to the ground.
She wiped some sweat off her brow, seeing her work here was done.
“My, you really are a strong alpha female…”
“Huh?”
Amy turned around, but only saw a shadow within the flames.
“I’m amazed they left you unguarded… without any way to call for help..”
“Who are you..? And I’m perfectly able on my own!” Amy held her hammer up, confident as she glared into the flaming silhouette, as it continued to walk around and behind the flame.
He laughed lightly, before the silhouette showed him raising his hand up, as if gesturing skyward. “I simply wanted to see what would happen if I got you alone… I suppose my little strategy worked. Look,… no cameras.”
She took a second to turn and look up, seeing that the cameras Eggman installed were destroyed.
Her eyes traced the area for origin of destruction, but was suddenly met by a fierce wind that broke the flames from him, creating a curtain effect of a kind that parted a way for him, as he charged her and gripped her neck.
“Augh! Ahh…” she gripped his arm and pulled it back, but noticed his being was still hovering from the launch.
His steel eyes were fixated on her, as he slowly moved to place a foot on the ground, and then another.
“You certainly are a careless queen. Turning your eyes from the enemy.” he tilted his head as she struggled.
He eyed her hand.
“You have… a remarkable strength about you.”
“L…Let me go!”
“Why? It’s almost a dream to hold you close..” he suddenly pulled her towards him, shocking her into a gasp, before he looked down at her and moved his hand to punch her in the gut.
“Ack..! Ugh…” she dropped her hammer, as he saw her hand loosen from his own and moved his grip to her chin, pulling her up so she didn’t fully collapse.
“Oh, you’re no fun…” he moved his lips carefully over the side of her face, barely closing his eyes as he took in her scent. “I would have at least thought you’d scream for help…”
“I don’t… urk… scream.” she twitched her eyebrow, before pushing back and summoning her hammer from the ground, swinging it.
He reached up and gripped it, but she smiled.
“What?” He lost his suave as Amy traced the fearful surprise in his eyes.
She cleverly hammed a fist into his stomach, as he slowly bent over from the impact, and moved away, rubbing her hand on her chin and then wiping the side of her face off.
She stood boldly, as if with pride. “I guess I’m not as stupid as you thought. Thanks for the idea.” She narrowed her eyes, “You must be Eggman’s new puppet, right? The Metallic bender.”
He gripped his stomach, having purposefully let her go to get away, and then looked up from kneeling on one knee.
He shook his head and rose up again, shaking off the pain by rotating his shoulders, and again, laughing lightly.
“You amaze even the most dangerous of foes.” he complimented, before shifting a flirty eye back to her. “Perhaps that why you’re a solo queen.”
“Excuse me?” Amy rose an eyebrow. “Look, I don’t know what you’re getting at here…”
She readied herself for another counter, in case he charged again. But he just laughed, bending over and then arching his back to do so.
“But what you’re doing is wrong! Can’t you see that? They’re must be some mercy and justice in you!”
“Mercy?” he suddenly, and with sharp precision, cut off his laughter to smile and look back at her.
The turning of his body made her step back slightly, before making sure her footing was sturdy enough to take a blow.
Why was he so… cheery?
“Heh. You speak of mercy… What? Ah!” he suddenly pointed to her, “You… no,…” he slightly moved his head back, as if questioning his own theory. “You’re not trying to reform me,… are you? Oh, that’s precious. You see… people like you will always be prey. Believing that the… oh, what would you call it… natural order of things can be pursued against itself to a far better nature than presented.” he casual swung himself towards her in his walk, as if completely confident in both his words and the unsettling situation.
As he approached, he snapped his fingers and searched for a word, but once having it, continued on before stopping in front of her, eyeing her and not even giving her hammer the corner of his eye…
“But you’re forgetting something very important, Queen Rose.” he looked so innocent as he pouted with a shake of his head, mocking her.
He spoke quietly, and watched her intently as he moved ever so slightly closer to her.
Then his tone grew vicious, and his true hangs appeared as he leaned above and down to loom over her with every bit of a bite to his words…
“You forget that some in this world love the suffering of others! The pure torture of taking everything one loves away from them. And the screams of their last hope lost.”
“…Like I said.” Amy breathed hard quietly, but it showed by the bouncing of her chest that she was unnerved by his reaction.
“I don’t scream.”
He suddenly shifted his fierce demeanor, leaning back and laughing.
“You are too idealistic, Rose! Oh, queen of the rebellion! You are truly a prize worth risking a king’s anger for.” he bent his head back down as she attempted to swing her hammer out, but he dodged it.
“I will enjoy ripping every last bit of fight out of you… and crippling your friends into a submission that will cost them more then the war… but their very lives…” he started to quickly advantage on her.
“Ge… Get away from me!” Amy continued to fight him, as he dodged and blocked, going to hits but she skillfully deflected and at times, reflected them.
He was hit away, at last, before looking fierce and animistic in his eyes.
Fire burned in his eyes much like the surroundings, as he held his arms outstretched.
“What’s wrong, queen? Refusing to reform me? Have you given up!?” he slammed his hands down, and the robot parts around him spiraled upward and formed armor around his being.
“Let’s dance.” the that had just formed helmet clicked down.
—————————————————————————————-
Eggman was trying to turn on his cameras, but the spy system seemed busted. “Dratt! I thought Sonic and his pathetic friends would never find them this time!”
Orbot and Cubot, coming through the door first, looked worriedly at each other as they pushed their fingers up nervously together, and swiped them over the other before addressing Eggman.
“Sir… we need to talk.” Cubot started, gesturing up to the doctor.
“Not now! Can’t you see I’m working blind?”
The two looked at each other.
“That’s the thing! You’re new recruit is-!”
“Doctor. I’ve arrived.”
The two froze up, clanking in fright as they turned around.
He smiled, looking easy as his eyelids drooped to show how calm he was.
He looked to the robots.
With every bit of poison that sounded like charmingly smooth music, he spoke to them, “Hello, boys.”
They hugged each other again, afraid he may have overheard them about to warn Eggman.
“Hmm? What’s gotten into you two?” Eggman looked down at how intimidated they were, before looking around and seeing the mercenary put Amy down, gently stroking a quill out from upon her face, as if obscuring her face was a sin in his eyes.
A lesser sin… perhaps… to those that he’s already performed…
“There’s been a change of plans, Eggman.”
“EMPEROR EGGMAN to you.” He stood tall, folding his arms, and suddenly extremely suspicious.
“What’s this all about?” he cocked an eyebrow up.
He smirked, and walked forward, “I want to rearrange our little deal.”
“…Go on?” Eggman was still curious why Amy was there, but figured he’d explain soon enough.
“The girl. I want her apart of the deal.” he fondly turned back to Amy. “I was planning to knock her out and use her as bait to rile up her teammates. But I grew slightly fond of her. If you really do robotize the world, I’d like to have at least one… play thing in it.” he turned back to Eggman.
Eggman, suddenly feeling a bit fatherly for the first time, threw his arms down.
“Absolutely not.” he briskly walked back to his computer.
“You lay a hand on even a fraction of her quills, and Sonic’ll have your head. I’m not going to be responsible for that kind of revenge plotting. You haven’t seen him when he’s upset.” Eggman looked indirectly over his shoulder, that last line as if he knew first hand how dangerous that could be.
“Typical of a king.” he rolled his eyes at Eggman’s response, as if having little to no real worry about any of that.
“It’s best to play it off as a game. Deliver her back or use her. I don’t care which. But don’t think I’ll leave you an Eve to your Dark Eden.”
“There’d be no Eden without Eve…”
He didn’t look pleased by that response, before turning back to Amy.
“The answers no.” He stated very firmly, folding his arms, and then turning back to his work. “Now, scat along, will you? I’ve a very busy tyrant.”
“Then… perhaps I won’t be so… willing to assist you anymore.”
“Excuse me-EEE?!?!?” Eggman leaned back as a metallic shard was thrown to hook a side of his mustache against the computer screen, causing the screen to crack and show grey streaks of lines as if offline.
Eggman tugged a moment, before ripping the shard out, and looking it over.
“…You make a good point,… Synchro…” he gripped the metallic shard, and turned back to him, a deadly bargain afoot as at first Synchro looked serious, before smiling friendly back to the Doctor.
“I could use a man with your… unique… metal bending talents.”
“Oh, go on.” he rolled his head, as if adoring the praise. “I live to please~” he bowed deeply, but clearly, it was all for show.
“..Heh… good.” Eggman threw the metallic piece down, slamming it with his fist into the ground, and then pointing directly up at Synchro.
“I want no part of your scheming, Synchro. But you can tease the girl all you want. But there better not be even a scratch on her head by the time Sonic comes to get her. Understood?”
Synchro raised a mocking eyebrow, “You seem to say that as if suggesting I’ll give her back.”
“Not. One. Hair.” Eggman wagged the finger closer and closer to his face, before the two turned to see Amy slowly coming too.
“Take her away from here. Do what you will but Orbot and Cubot will see to the girl.”
“Ah. Supervisors?” Synchro looked to them. “Well, things are just going to seem awkward for you third and forth wheel.” he kid, as the two quickly scurried to Amy, having processed their new commands.
He turned his head, and seemed to eyed them very closely… as if figuring out how to get rid of them later.
“Synchro.”
He turned his head back to Eggman. “My liege~” he faked another proper bow.
Eggman stared back at him over his shoulder, leaning down with his hands supporting him on the control panel, before clicking something to get his cameras and sights back online.
“…Don’t abuse her. I won’t forgive defying me.”
“Defiling? What was that? Doctor! I’m surprised you would suppose…” he smirked, lifting an acted hand to his ear as if just playing the role.
“I need to hear it. You won’t harm the girl.”
“…I may just do that. But I won’t kill her.”
Eggman turned his head back to him, growing angrily.
“… I’ll only touch what can be seen~” he winked and held up a finger, before drawing an ‘X’ over his heart. “Promise, good tyrant. Promise.”
“…See that he does.” Eggman turned to his robots, who worried they didn’t know how to stop him.
The two dragged Amy off, hauling her onto a hover cart, as Synchro turned around and looked down at her.
“Even protected by a supposed evil overlord. Tell me, queeny. Have you reformed the world?”
His mocking laughs trailed into Amy’s ears as she twitched her eyes, attempting to try and wake up… as the light faded…
And she was dragged off into an unknown location.
“Son-” she barely could speak out, as he looked out, and placed a finger over his mouth, smirking. “-ic…” he placed something over her mouth.
“Shh…” he cooed, ever so softly, before the gas knocked her out again. “There’ll be no talk of such things.” he looked to the robots.
They quickly turned forward, pulling the hover craft along.
He crooked his smile even further before looking ahead.
“Now it’s my time to assert the throne. I’ll steal your queen. I’ll overthrow the overthrower. I’ll kill this world’s hero. And all the while I shall I make this world… My world…”
Orbot and Cubot, once out of distance from Eggman, were suddenly cringing as their beings were combined and reorganized into a chest armor and gun, and then a nice metallic crown on his head.
“Heh. Such trusting fools.” he laughed as he kicked Amy’s craft down an air shoot, and jumped on it.
Taking her far away, he looked back to see a blue blur charging Eggman’s tower.
“….She’s not there~” he whispered manically, and let his wicked laugh carry in the winds…
(Don’t worry, she’ll be okay :) I hope you don’t mind… I focused more on Amy in danger and trying to reform him than I did Sonic saving her. It’s clear he will, but I wanted to show off a villain who was interested in Amy. It makes it even more sinister when he flirts with her! Don’t you think?)
(Part 2 x)
112 notes · View notes
the-end-of-art · 8 years ago
Text
Beautiful differences
Christianity and Culture                                 by Emily Lau The Columbia Crown & Cross, Augustine Collective
As a Chinese-Korean-American Christian, I often find myself straddling an interesting and sometimes challenging combination of identities. As a Christian, I believe that my ultimate identity is as a child of God, but I also cannot deny my cultural identities that stretch back to folk religions in Asia. How can I preserve my cultural heritage – steeped in ancestral worship, astrology, and polytheism – when it sometimes conflicts with my spiritual beliefs? Must I shed the traditions of my ancestors to embrace Christianity completely? And although Western culture has embraced Christianity longer, is it necessarily free of pagan influences and of its own pagan origins?
To tackle these questions, I first look back to Christianity’s spread across the globe. The history of its encounters with traditional or indigenous cultures is fraught with violence and injustice. Many people today associate Christianity with colonialism and interpret the Great Commission 1 as an excuse for Western imperialism. The Crusades propagated Christianity through military force and coercion during the Middle Ages. Missionaries, such as Diego de Landa who is responsible for burning most of Mayan literature, 2 have often destroyed our records of unique cultures in the name of religion. Unfortunately, the account of these forceful and imperialistic missionaries often overshadow the positive social work of missionaries, such as Mother Theresa, who are testimonies to love and sacrifice.
Yet as much as one might want to defend all cultural traditions, some customs run counter to modern-day Western society’s code of ethics. Customs such as suttee – a form of widow suicide practiced in the Indian subcontinent – 3 child sacrifice, female “circumcision,” and cannibalism, are just some of the polemical practices that repeatedly find their way into discussions about cultural relativism. Oftentimes, one is hesitant to go against any native custom for fear of appearing culturally ignorant, intolerant, or insensitive. Even if a particular practice goes against one’s moral sensibilities, the risk of seeming politically incorrect may silence the opposition. To what extent then, can cultural relativism justify actions? Can it wholly eliminate the boundaries between right and wrong?
Now I enter into the quagmire wherein lies the debate between moral relativism versus moral universalism. Roughly, moral relativism maintains that every individual lives by a different moral code depending on his or her culture and background, while moral universalism posits that there is a notion of right and wrong that applies to everyone. 4 The danger in the case of extreme moral relativism is the ability to justify almost anything. On the other hand, the danger in the case of extreme moral universalism is believing that one’s rigid standard of morals is the universal standard. The crux of the matter is that moral understanding and systems of beliefs oftentimes seem inextricably tied to one’s culture and upbringing. Therefore, to impose one’s moral standards is to impose one’s culture. Is it then possible to tease apart culture and religion, or rather, faith?
Some Christians have seemingly found ways to separate their more innocuous cultural customs from their original spiritual context. They repurpose traditional practices by imbuing them with new meaning that aligns with Christianity. Dr. Cheryl Bear Barnetson, part of the Nadleh Whut’en First Nation community in British Columbia and faculty at Regent College, 5 speaks out on how aboriginal peoples can continue practicing some of their native customs in the new context of Christianity. 6 For instance, she incorporates the use of traditional hand-drums and derives new chants that sonically resemble those of her ancestors but with Christian sentiments for her church services. 7 Yet a First Nations advocate and leader, Daniel Justice, criticizes this type of appropriation because he claims it reduces their customs to a superficial level. 8 He argues, “Sitting in a circle, passing around a talking stick or using an eagle feather – none of these are superficial in and of themselves, but when they’re completely dislocated from cultural and religious contexts that they are meaningful to, they just become props.” 9 Barnetson and Justice’s disagreement exemplifies the debate over whether cultural customs retain significance apart from their original spiritual context. If Barnetson views culture as a vessel that stores spiritual meaning, Justice would argue that the value of the vessel resides in its original contents. Draining the contents would mean reducing the vessel to a worthless hollow shell. Considering the grievous history between the indigenous peoples of North America and Western settlers from Europe who destroyed much of their native cultures (although many Christian missionaries did defend the rights of the Natives peoples), 10 it would seem criminal today to overwrite their beliefs with Western culture that includes Christian beliefs.
Yet before I enter into the debate between Barnetson and Justice, I must first make a brief detour to address a great deception that lurks in the background when discussing Western culture and Christianity: that Western beliefs are synonymous with Christian beliefs. The spirit that pervades the U.S., a leader of modern Western culture today, is not necessarily one of Christianity, but rather often one of consumerism, narcissism, and materialism that flies directly in the face of Jesus’ teaching on humility. The religion of Christianity inevitably has earthy roots that relate back to a historic culture, but the values of the faith do not come from humans; they come from God. The Bible weighs in on the debate between moral relativism and moral universalism in Romans when Paul writes:
For it is not the hearers of the law who are righteous before God, but the doers of the law who will be justified. For when Gentiles, who do not have the law, by nature do what the law requires, they are a law to themselves, even though they do not have the law. They show that the work of the law is written on their hearts, while their conscience also bears witness, and their conflicting thoughts accuse or even excuse them on that day when, according to my gospel, God judges the secrets of men by Christ Jesus. 11
Jesus commands missionary work to spread the news of gospel, but God also implants a discerning “conscience” into every person, whether or not he or she ever hears of Christianity. Since the “law is written on [our] hearts,” everyone is responsible for knowing and doing what is right. The Bible takes the side of moral universalism.
Now I return to the prior debate between Barnetson and Justice. Justice makes a valid point that customs and traditions become superficial when stripped of their original meaning and purpose. But as a Christian, I believe that humans were originally made in the image of God to serve and worship him. Thus, through the deviation of our worship, we have taken ourselves out from our original context. We must then let go of those traditions that contradict Biblical principles and repurpose our worship back to God as Barneston suggests. Yet even though God asserts that there is one moral code that applies to all humans, he is also the creator of the world’s diverse people groups. In Acts, Luke writes:
The God who made the world and everything in it, being Lord of heaven and earth, does not live in temples made by man, nor is he served by human hands, as though he needed anything, since he himself gives to all mankind life and breath and everything. And he made from one man every nation of mankind to live on all the face of the earth, having determined allotted periods and the boundaries of their dwelling place, that they should seek God, and perhaps feel their way toward him and find him. 12
God does not force people to change, but creates them with the ability to discern right from wrong and with the desire to “seek him” on their own and in “their way.” Our fallen state has corrupted our cultures and continues to affect our ability to create culture today. There is no one culture that is devoid of sin and there is no one culture that is superior to another. But God has provided us with beautiful differences in appearance, language, and traditions that we can use to worship him. God’s love is not bound by geography, language, or ethnicity, and therefore neither is his salvation. Jesus’s death and resurrection offers us salvation, and we can therefore approach culture with a new, Christ-centered perspective. Together, our diverse backgrounds and origins can better reflect the image of God, and we can express our faith through a variety of ways that our differences afford us.
Taking the discussion back to a personal and practical level, I can honor my elders, but not worship them. I can celebrate the Lunar New Year as another time to reflect on what God has done in my life and rededicate myself to him. I believe that it is important to understand our cultures and remember from where we came. As Christians, we are all striving for likeness in Christ, but we should understand that the desired homogeneity is of a spiritual kind and not necessarily a cultural one. With this understanding, I can appreciate my heritage as a part of myself that God created and celebrates.
(Footnotes: http://augustinecollective.org/christianity-and-culture/)
2 notes · View notes
gw-thesis · 6 years ago
Text
ABOUT PUNK
Punk is an assault on prevailing canons of beauty. Punk songs are often out of tune, off key, incompetently played, and poorly recorded. Punk fashion can be shabby (a tattered shirt) or grotesque (a safety pin in the cheek). Punk is a celebration of ugliness and discord. Punk rockers regard these features as good precisely because others regard them as bad. 
The anti‐aesthetic aesthetic of punk has been compared to other movements in the history of art. Most notably, it has been compared to dada (Marcus 1989). Like punk, dada rejected prevailing norms and denounced beauty. Dada photomontage anticipates punk album art, and dada periodicals anticipate punk fanzines. Members of the dada movement also wore outrageous clothing
[https://doi.org/10.1111/phc3.12145]
“Conservative religious critics may have denounced heavy metal, but Christian musicians believed the genre’s theatrics and use of sacred symbols presented an opportunity to engage in a dialogue with popular culture. In the mid‐1980s, despite criticism from religious conservatives such as Jimmy Swaggart, Christian artists sought to appropriate the genre’s cultural and sonic power in a genre that became known as ‘white metal’. Within the genre, bands such as Stryper (Salvation Through Redemption Yielding Peace and Everlasting Righteousness), Barren Cross, and Bloodgood sought to offer a ‘Christian’ view of metal in interviews, lyrics, liner notes, album art, music videos, and live performances. As metal acts like Ozzy Osbourne, AC/DC, and Judas Priest were perceived as promoting suicide in songs, bands such as Empty Tomb and Bloodgood recorded songs counseling depressed individuals to seek salvation and redemption. Other bands recorded songs articulating Christian views on topics such as abortion (Barren Cross’‘Killers of the Unborn’), evolution (One Bad Pig’s song ‘Let’s Be Frank’), cults (Barren Cross’ song ‘Cultic Regimes’), gay rights (Torn Flesh’s ‘Gay Rights?’) and abstinence/premarital sex (Lust Control’s ‘Virginity Disease’). Furthermore, Christian metal bands sought – with varying degrees of success – to cultivate secular audiences, often by playing with secular bands or in secular clubs, in order to proselytize among nonbelievers. In both their message and their goals, white metal represented a cultural complement to the work of Christian political activists who sought to reform American culture throughout the 1980s and 1990s (Luhr, pp. 111–53).”
“As heavy metal music became a global commodity, its symbolic and sonic universe proved accessible to an overseas audience looking for a means to express religious and political dissent...More recently, as sociologists have broadened the definition of religion to include ‘cultural religion’, Robin Sylvan (2002) and Jeffrey Jensen Arnett (1996) have suggested that heavy metal functioned as a traditional religion by providing social support and a value system for fans who were largely alienated from institutionalized religion...In general, heavy metal’s fans were white, male, blue‐collar teenagers who viewed themselves as outsiders and embraced the genre for its ability to address the darkest aspects of contemporary life”
“Nevertheless, journalists and scholars have examined religious traditions that have influenced punk and ways that punks have infused their beliefs into major religious traditions. They have also explored how punk attitudes functioned as a belief system outside of organized religion...Over time, some punks began to redefine the attitude of ‘negation’, creating an ethic of community responsibility and positive action that closely resembled a religious worldview. A few younger bands, especially Washington D.C.’s Minor Threat, espoused a ‘clean living’ ideology that included ‘abstaining from alcohol, tobacco, illegal drugs, and promiscuous sex’ (Haenfler, p. 8). In this case, deviance derived from refusing to engage in what had become normative punk behavior. Straight edge, as it became known, drew its inspiration in part from a 1981 Minor Threat song, ‘Out of Step’, in which Ian MacKaye declared, ‘I Don’t Drink, Don’t Smoke, Don’t Fuck—At least I can fucking think!’ (cited in Haenfler, p. 9)...Straight edge grew as a subgenre (and, as will be shown, a subculture) in the 1980s and 1990s. While often linked to the ‘positive’ punk scene, ‘hardline straight edge’ bands such as Earth Crisis and Vegan Reich (which included a Muslim member, Sean Muttaqi) became known for strident demands for animal rights and environmentalism (Wood 2006, p. 47). These bands’ strict belief system has drawn comparisons to Christian bands who stress abstinence and a pro‐life message.″
“No Christian punk band has reached the public consciousness to the degree of heavy metal’s Stryper, but Christian punks found that the genre’s righteous sense of alienation appealed to their sense of dispossession from mainstream American society...As historian R. Laurence Moore has suggested evangelicals’ sense of alienation from dominant culture has allowed them to approach American life as disfranchised populists (Moore 1986), a tradition that fits within the tradition of apocalyptic prophecy dating to the creation of the Book of Daniel circa 165 B.C (Cohn 1970, pp. 20–23). Strong sentiments of outsiderdom gave rise to a thriving Christian punk subculture starting in the late 1980s and continuing to the present day. One obvious piece of evidence of this subculture was the array of fan magazines – that is, amateur magazines, or zines, created by fans in the ‘do‐it‐yourself’ (DIY) style – that appeared on the Christian youth scene. With titles such as Take a Stand, Baptized Rebellion, Radically Saved, Different Drummer, and Thieves and Prostitutes, the magazines were usually written by and for young believers interested in Christian music.”
“Christian zines embraced ‘otherness’ as a signifier of moral righteousness. Luhr has shown how young believers linked punk and Christianity through their requirements for ‘a radical reorientation of the self through nonconformity’; an editor for Thieves and Prostitutes, a Christian zine, even argued, ‘if Jesus were here today…punks would be just the people he would hang‐out with and make disciples of’ (96–7). By highlighting the similarities between Jesus and contemporary punks, the editor hoped to show how Christianity and punk could revitalize one another.”
“Both [Christianity and Islam] began in tremendous bursts of truth and vitality but seem to have lost something along the way—the energy, perhaps, that comes with knowing the world has never seen such positive force and fury and never would again. Both have suffered from sell‐outs and hypocrites, but also from true believers whose devotion had crippled their creative drive. Both are viewed by outsiders as unified, cohesive communities when nothing can be further from the truth. (7)”
“Punk rock means deliberately bad music, deliberately bad clothing, deliberately bad language and deliberately bad behavior. Means shooting yourself in the foot when it comes to every expectation society will ever have for you but still standing tall about it, loving who you are and somehow forging a shared community with all the other fuck‐ups.”
“As with discussions of metal as a subculture, scholars and journalists interested in the intersection of religion and punk have focused on how the genre functions as a religion through punk’s spectrum of moral codes, rituals for expression, and participatory communal activities...straight edge had no institutional core or formal rules; it merely offered a set of fundamental values, which included ‘positivity/clean living... Although ‘clean living’ most obviously meant abstinence from drug, alcohol, and tobacco use as well as casual sex, ‘positive living’ included such values as ‘questioning and resisting society’s norms, having a positive outlook on life, being an individual, treating people with respect and dignity, and taking action to make the world a better place’ (Haenfler, p. 35).”
[https://onlinelibrary.wiley.com/doi/10.1111/j.1749-8171.2010.00221.x]
0 notes
lore-of-mobius · 3 months ago
Text
Sonic Has Been Mischaracterized In The IDW Comics Part 3
Part 2
This finally part is about the preachiness of Sonic and how this is out of character for him.
Sonic as I and many other people have noticed is pretty similar to Goku. Not necessarily caring about heroism alongside the battle shonen adventure.
Soooooo......
Sonic like Goku in that way as he does spare Metal in this case on wanting to fight him again, even more evident in the Japanese version. "If you wanna settle the score, you can come back as often as you want."
Which in contrast to his reasoning for letting Metal go in the comics, so he can have the choice to live how he wants. Because he doesn't want to"take away someone's freedom" in the paradox of tolerance.
Someone that goes into it well is ALtheBoi in the video The Soul of Sonic Stories.
Basically Sonic doesn't learn about friendship or to better listen to his friends. That Sonic isn't really the one that goes on a character arc but those around him as they are inspired and his unbreakable spirit to undergo change as he always keeps a smile on his face.
On top of that Sonic at this point knows Eggman is never going to change and expecting him to is well dumb. That "you and I are same in the way that we have our own styles that we won't change. Yours is filled with evil and mine is not. There is no way I can lose!"
Like Bill Cipher, Eggman doesn't want your sympathy.
Sonic is also not going to stop and start monologuing to some fox bullies saying "don't do that," but rather lead by example. On top of not feeling upset if say Tails get captured but rather running in full steam right away as "his anger explodes with surprising consequences."
Or how instead of trying to talk to and rationalize with Shadow they first me Sonic is ready to throw hands.
In other words Sonic isn't expecting Metal to change for the better, he doesn't think Eggman is ever going to change.
And he especially isn't gonna to compare Shadow when he was manipulated by Gerald to Dr. Eggman.
Tumblr media Tumblr media Tumblr media Tumblr media Tumblr media Tumblr media Tumblr media Tumblr media Tumblr media Tumblr media Tumblr media Tumblr media
9 notes · View notes
simonconsultancypage · 6 years ago
Text
Guest Post: What the Capital One Hack Means for Board of Directors
John Reed Stark
The news of the recent massive data breach at Capital One made the front pages of the business sections of newspapers across the country. The hack has drawn attention not just because of the magnitude of the hack, but also because the hackers apparently managed to steal data from The Cloud. The Capital Data breach represents a “wake-up call” for boards of directors, according to the following guest post from John Reed Stark. John is President of John Reed Stark Consulting and former Chief of the SEC’s Office of Internet Enforcement. A version of this article originally appeared on Securities Docket. My thanks to John for allowing me to publish his article on this site. I welcome guest post submissions from responsible authors on topics of interest to this blog’s readers. Please contact me directly if you would like to submit a guest post. Here is John’s article.
*********************************
Another day, another data breach. This time at Capital One, the fifth largest credit card issuer in the United States.
Specifically, on July 29, 2019, FBI agents arrested Paige A. Thompson on suspicion of downloading nearly 30 GB of 100 million Capital One Financial Corp credit applications from a rented cloud data server. The FBI says Capital One learned about the theft from a July 17, 2019, email stating that some of its leaked data was being stored for public view on the software development platform Github. That Github account was for a user named “Netcrave,” which includes the resume and name of Paige A. Thompson. According to the FBI, Thompson also used a public Meetup group under the alias “erratic,” where she invited others to join a Slack channel named “Netcrave Communications.” 
KrebsOnSecurity, actually entered the open Netcrave Slack channel on July 30, 2019, and  reviewed a June 27, 2019 commentary Thompson, which listed various databases she found by hacking into improperly secured Amazon cloud accounts, suggesting that Thompson may also have exfiltrated tens of gigabytes of data belonging to other major corporations.
Ironically, Capital One is considered by many to be a digital banking pioneer and one of the more cyber-savvy companies in the world, evidencing how even the most technologically mature organizations are struggling to manage the rising force of third-party cyber-risk.
Make no mistake: vendors, partners, business associates, and other third parties whose outsourced operations become integrated within a company, can pose a challenging and existential cybersecurity threat to operations. Yet despite increased regulatory scrutiny; growing virtual threats at a global, national and state level; and a riskier business environment, most experts would attest that the relative maturity level of vendor risk management programs is still lacking. For example, CrowdStrike’s 2018 report “Securing the Supply Chain” states:
“Although almost 90 percent of the respondents believe they are at risk for supply chain attack, companies are still slow to detect, remediate and respond to threats.”
Undoubtedly, upon learning of the Capital One hack, corporate board members across the U.S. are likely struck by one immediate thought (there but for the grace of God go I) and one immediate question (What should I do now?).
This article tackles the issue of third party digital risk management head-on, by offering a useful and comprehensive strategical framework for boards of directors to undertake intelligent, thoughtful, and appropriate supervision of a company’s vendor-related cybersecurity risks, especially those risks relating to cloud computing services.
Vendors and Cybersecurity
Companies today rely on a broad range of third party vendors to support core business functions, which typically entails granting these third-party entities access to a company’s data and its internal systems. This digital interconnectivity between vendor and customer creates an inherent risk as cybersecurity shortcomings of third-party vendors have become the go-to-attack vector for cybercriminals. In fact, PWC reports that 63% of all cyber-attacks could be traced either directly or indirectly to third parties.
Vendor’s often maintain less stringent security protocols, raise fewer suspicions and allow for easier identity masking — providing ideal points of entry for attackers looking to leverage unauthorized access. For example, in the Target breach, attackers began by using malware to steal credentials from the air conditioning subcontractor, and from there had access to Target’s vendor-dedicated web services. In the JP Morgan data breach, the cyber-attack infiltrated J.P. Morgan’s Corporate Challenge online platform run by an outside website vendor.
Some other recent examples illustrate how varied and almost epidemic cyber-attacks vis-a-vis third party vendors have become, including:
AMCA (Billing Vendor).  Billing services vendor American Medical Collections Agency (AMCA) was hacked for eight months between August 1, 2018 and March 30, 2019, impacting more than 25 million patients. At least six covered entities have come forward to report their patient data was compromised by the AMCA hack, including 7.7 million LabCorp patients, 12 million Quest Diagnostics patients and 422,000 BioReference patients. Unable to manage the financial impact of the data breach, AMCA has now filed for Chapter 11 bankruptcy;
Applebee’s (Point of Sale Vendor). The Applebee’s restaurant chains reported point-of-sale data breaches that resided on a third-party system and exposed payment card information at some of the chain’s corporate and franchised locations, possibly affecting all of its167 locations. The exfiltrated information included cardholder name, credit/debit card number, expiration date, cardholder verification value, and service code. Similar breaches of payment systems occurred at fast food chains Sonic Drive-In, Arby’s, and Chipotle, and stores Forever 21, Whole Foods, Kmart, and Brooks Brothers; and
BestBuy, Sears, Kmart, Delta (Chat Vendor).  These three vastly different companies had one characteristic in common – they all used [24]7.ai, a chat and customer services vendor for many brand names, which was hacked via malware, compromising credit card information, addresses, CVV numbers, card expiration dates and other personal data across multiple customer groups.
Boards and Cybersecurity
Every board now knows it’s company will fall victim to a cyber-attack, and even worse, that the board of directors will need to clean up the mess and superintend the fallout. Yet cyber-attacks can be extraordinarily complicated and, once identified, demand a host of costly responses.
Consider the Capital One data breach. When a cyber-attack involves a third party vendor of any sort, a myriad of tasks immediately emerge, including:
Digital forensic preservation and investigation;
Fulfillment of state and federal compliance obligations;
Responding to potential litigation with third parties;
Class action defense (within 24 hours of the Capital One announcement, plaintiffs had already filed a bevy of class suits against Capital One);
Engagement with law enforcement (the FBI is already investigating other possible data breaches related to Capital One);
State regulatory response (New York Attorney General Letitia James announced that her office immediately opened an investigation into the Capital One incident stating, “Safeguards were missing that allowed for the illegal access of consumers’ names, Social Security numbers, dates of birth, addresses, and other highly sensitive, personal information.”);
Provision of credit monitoring and identity protection;
Managing of insurance claims;
Public relations planning; and
So many other anticipated and unanticipated breach-related tasks such as briefing customers, partners, employees, affiliates, insurance carriers, and a range of other interested parties.
And besides the more predictable workflow, Capital One will become exposed to other, even more intangible costs as well, including temporary, or even, permanent reputational and brand damage; loss of productivity; extended management drag; and a negative impact on employee morale and overall business performance.
Given the explosive growth of outsourced technology services and the increasingly intimate cyber-integration and relationship of companies and third party vendors, boards need to monitor and challenge their third-party exposure and insure the proper implementation of safeguards and processes to reduce their vulnerability.
Boards, Vendors and Data Breaches
Outsourcing of services such as information technology (IT), payroll, accounting, pension, and other financial services, has become increasingly common for today’s corporations, and raises particularly challenging cybersecurity concerns. For instance, the Trustwave 2018 Global Security Report (GSR) found a marked increase of 9.5% in compromises targeting businesses that provide IT services. In stark contrast, service provider compromises did not even register in the 2016 GSR statistics.
Given this sudden explosion of IT-related vendors, boards of directors should probe the practices and procedures of their respective companies with respect to the cybersecurity of their vendors. Most importantly, boards should understand that data security incidents involving companies and their vendors are a “two way street.” In other words, given that cyber-attackers will often traverse across a company’s network and into the networks of its vendors or vice versa, cyber-attacks can often result in disputes as to the culpability for an attack.
Along these lines, boards should confirm that their respective company’s carefully manage vendor access to its networks, customer data or other sensitive information, by inquiring whether their respective companies:
Have high standards for their vendors, mandating for instance that vendors: have been in business for a reasonable amount of time; have earned certain data security and government compliance certifications (such as PCI, HIPAA and SOX); have annual third party risk and security assessments (which the company can review); make proper use of encryption; use the latest methodology and technology to protect and control access to data and ensure that it meets current security trends and regulations; use two-factor authentication; maintain good password management; have strong cybersecurity training practices; have incident response plans, disaster recovery plans, table-top cyber-attack exercises and place limitations on daily ingress or egress of data;
Place vendors into different risk categories based on the nature and quantity of company information to which they have access (such as personally identifiable data (PII), payment card information (PCI) or protected health information (PHI)).  For example, if a vendor has access to PII or to PHI, then a data breach at the vendor would impact the company substantially. But If the vendor only accesses publicly available information, a data breach would have far less of an impact;
Map data-flow by assigning data custodians, implementing system controls, enforcing security policies and executing strict data handling procedures and auditing;
Research whether vendors have experienced data security incidents in the past and how those incidents were handled;
Consider constructing an interactive vendor portal for sharing knowledge and a hotline to answer and report issues;
Insure that vendors maintain proper incident-response protocols (e.g. who is the responsible party within the organization to notify when a vendor experiences a data security incident? What is the notification procedure?  What is the anticipated timeline?);
Consider physical site visits to assess vendor cybersecurity first-hand;
Have contractual agreements with vendors that cover audit rights, cooperation rights and other relationship-based based demarcation definitions;
Insure that vendors adhere to all applicable laws, especially those relating to data privacy, such as the General Data Protection Regulation (GDPR), Privacy Shield Framework, and the new California Consumer Privacy Act (CCPA);
Conduct due diligence on vendors to assess their security and privacy practices as part of a procurement process and throughout the ongoing vendor relationship. This means establishing via written agreements and ongoing supervision, formal vendor management programs that assess risk and identify potential cybersecurity concerns prior to engaging in a business relationship;
Include robust privacy and data security clauses in contracts with vendors, including strict and broad data security incident notification provisions;
Maintain a register of all vendors and the types of personal, sensitive of confidential information the vendors accesses, stores, shares, transfers, etc.;
Engage in annual third party cybersecurity audits and assessments;
Check references of vendors, and establish clear “data out” procedures if the company wants to terminate its relationship with a vendor;
Review not just how sensitive data will be stored, but also how it will be handled when a vendor relationship ends (because former vendor relationships can create even greater risk to an organizations than existing ones); and
Create contractually defined practical and realistic appropriate remediation protocols.
If vendors conduct remote maintenance of a company’s networks and devices, in the event of a cyber-attack, the company may want to confirm it can obtain copies of any relevant logs, as well as access the third-party system to scan for IOCs.
Boards should also probe the company/vendor communication lines and make sure they are established and thoughtfully staffed and structured, incorporating all of the legal implications of communications. One simple inculpatory miscommunication from the company’s IT department to a vendor (e.g. “I think we screwed up and missed a patch.”) can trigger calamitous legal liabilities.
Boards should also probe whether a company’s vendors have cyber insurance coverage and/or agreements that require the vendor to defend and indemnify the company for legal liability arising from any release or disclosure of the information resulting from the cybersecurity failure of the vendor. Similarly, boards should probe how vendors will deal with government requests or subpoenas that involve data of the company. For instance, will the company be notified and will the company be offered an opportunity to contest any subpoena (and who will pay for any resulting litigation against the government pertaining to the subpoena’s enforcement.)
For boards, the appropriate level of cybersecurity due diligence for vendors is bespoke. Consider the New York State Department of Financial Services (NYDFS) Cybersecurity requirements for financial services firms, one of the more onerous state cyber-regulatory regimes in the country, which lays out more general requirements than specific ones.
For example, per the NYDFS, all third party service providers are not specifically required to implement multi-factor authentication and encryption. Rather, New York financial firms must engage “in a risk assessment regarding the appropriate controls for third party service providers based on the individual facts and circumstances presented and does not create a one-size-fits-all solution.”
When a Vendor Suffers a Data Breach
With respect to data security incidents, a board should focus its lens on two distinct perspectives:
What happens if there is a data security incident at a vendor which impacts the company; and
What happens if there is a data security incident at the company that impacts a vendor.
Under either scenario, much of the communication and cooperation between a vendor and a company will be dictated by the contractual terms governing their relationship.
Along these lines, boards should also confirm that their respective companies have contractual language establishing the company’s rights when a cyber-attack occurs involving a vendor, which can range from notification, to on-site inspections, to the option of an independent risk and security assessment/audit of the vendor (at the vendor’s, and not the company’s, expense).
Specifically, in the event of a data security incident at a vendor, contracts should explicitly allow for the company to know all relevant facts relating to the cyber-attack, especially:
Whether their data has potentially been compromised;
Whether services will experience any disruption;
The nature of remediation efforts;
Whether there are any official or unofficial findings of any investigation; or
Whether there is any other information that can impact their operations or reputation.
On the other hand, when a company discovers a data security incident, vendors might make requests to the company, such as seeking images of malware and indicators of compromise (IOCs) or wanting to visit the company and inspect the company with its own investigation team. Vendors may ask for weekly or even daily briefings and may demand attestations in writing with respect to any findings pertaining to their data. Boards should also probe these requirements, obligations, protocols, etc. – to insure that these communications lines are contractually defined, controlled and properly modulated.
Spotlight: Cloud Storage Vendors
Whether AWS will be held at all responsible for Thompson’s alleged cyber-attack upon Capital One remains to be seen. AWS emphatically denies any culpability, issuing a statement asserting:
“AWS was not compromised in any way and functioned as designed . . . The perpetrator gained access through a misconfiguration of the web application and not the underlying cloud-based infrastructure. As Capital One explained clearly in its disclosure, this type of vulnerability is not specific to the cloud.”
AWS might have a good point. First, according to the Capital One news release announcing incident, the firewall configuration vulnerability that Thompson exploited is “a specific configuration vulnerability in our infrastructure . . . not specific to the cloud.” Capital One even touts the cloud as helping with its incident response, stating:
“The speed with which we were able to diagnose and fix this vulnerability, and determine its impact, was enabled by our cloud operating model.”
Second, the outcome will center around the contractual arrangement between AWS and Capital One, and AWS’s notoriously detailed contracts tend to favor AWS (according to Gartner, AWS has a 47.8% market share of the cloud computing space). Third, users like Capital One typically maintain full control over any applications they build on top of AWS.
On the other hand, there is a wildcard thrown into the liability calculus that could become a problem for AWS: Thompson is a former AWS employee who worked in the company’s S3 cloud storage technology group, and is suspected of exfiltrating data from other possible AWS customers. As more information is stored in the cloud, staff system engineers like Thompson, trained to become experts using these cloud systems, could become a threat to other companies. If it’s established that Thompson somehow used proprietary AWS information in order to carry out her hack into Capital One, or perhaps that AWS should have done more to alert Capital One about server configuration vulnerabilities or errors, liability could shift to AWS.
Interestingly, AWS considers Capital One to be a prized customer. In fact, Capital One’s CIO Rob Alexander gushed ad nauseum over AWS at a 2015 Las Vegas AWS conference. AWS even showcases the interconnectivity of its Capital One relationship on the AWS website, stating:
“Capital One is using AWS as a central part of its technology strategy. As a result, the bank plans to reduce its data center footprint from eight to three by 2018. Capital One is one of the nation’s largest banks and offers credit cards, checking and savings accounts, auto loans, rewards, and online banking services for consumers and businesses. It is using or experimenting with nearly every AWS service to develop, test, build, and run its most critical workloads, including its new flagship mobile-banking application. Capital One selected AWS for its security model and for the ability to provision infrastructure on the fly, the elasticity to handle purchasing demands at peak times, its high availability, and its pace of innovation.” 
Under any circumstance, whether AWS shoulders any of the liability for the Capital One breach, the incident should still serve as a wake-up call for the bet-the-company cybersecurity risks associated with utilizing cloud computing services, and highlights the importance of knowing who becomes liable in the event of a cloud-related data security incident.
Cloud Services and Cybersecurity
More companies, from government to manufacturing to retail, are becoming increasingly comfortable about moving their data to the cloud. Why? Because cloud platforms coordinate globally based integration of networks and enable new, highly complex business models, dramatic cost savings, exponential scalability, increased mobility and easier collaboration.
Indeed, the global public cloud computing market is set to reach $258 billion in 2019, with an average of about one third of companies’ IT budget going to cloud services. Banks in particular are forecast to spend more than $53 billion on public cloud infrastructure and data services, up from $24.3 billion in 2018. But all of this growth is not without risk.
When a company stores critical or confidential information in the cloud, that information is essentially stored off-site, possibly in another country. Along these lines, boards should confirm that  their respective companies are using cloud providers that can reasonably protect and provide assurances on overall data security.
Specifically, boards should probe a company’s cloud-related practices, especially an assessment of any enterprise-grade security systems and analytics, a determination of the attack vectors, and a review of data security measures. Important questions include:
Whether the cloud data is encrypted (in transition and in motion);
Who holds the encryption keys for cloud data;
Whether the cloud data is subject to search and seizure (both domestically and internationally);
The nature of data protections used by the cloud firm;
How transparent the cloud providers’ own security systems are;
What access can the company get to the cloud provider’s data center and personnel to ensure the security system is in place and functioning and make sure it can undertake a risk assessment and design a response plan;
Whether company customers have given approval for cloud storage of their data;
What the cloud servicers’ responsibilities are to update their security systems as technology and cyber-attack sophistication evolves;
How the cloud providers continuously monitor, detect, and respond to security incidents;
What cloud logging exists and how long logs are maintained;
How and when cloud data is destroyed;
Whether cloud data could be subject to a litigation hold and what technologies allow for the cloud data’s perusal;
What happens when a cloud company receives a subpoena or other request or is subjected to a search warrant from any government that involves the company’s data;
What auditing is permitted of the security capabilities of the cloud company;
What regulatory and privacy requirements apply to the PII, PHI, personal financial information, or other customer data within the cloud data;
Whether the cloud firm and the company have any indemnification agreements or evidence of cyber insurance;
Whether the company’s insurance policies cover losses from activities undertaken by the cloud service providers in the event of a cyber-attack;
What types of pen testing are undertaken by the cloud firm; and
What the specific details and efficacy of security policies and procedures of the cloud firm are.
Boards should also confirm that a company has a comprehensive means to prevent sensitive data from being uploaded to the cloud for inappropriate sharing, and the requisite visibility and access to detect anomalies, conduct further investigation and launch quick and decisive remedial action.
Along these lines, questions should cover technologies used to prevent the unauthorized use of cloud applications by employees; internal controls regarding any cloud applications used by employees; an incident response plan for handling an attack on any cloud application; and employee training concerning use of cloud applications.
Cloud-Based Filing Services
Cloud-based file-sharing services, such as Dropbox, Google Drive, Box, and others, are another way confidential information leaks out of a company – and have become an increasingly popular way to store, back-up, transfer and temporarily warehouse large data files.
Such cloud services often are used through personal accounts, despite many large companies prohibiting, as a matter of policy, the use of such services for these purposes. Some companies also block access to such services from the company’s systems (such as desktops, laptops, tablets, phones, etc.) with effective security controls, while other companies are less sophisticated or simply resist the notion of becoming the automated “data nanny” for their employees.
Boards should probe the company’s policies, practices and procedures regarding cloud-sharing services used by employees and confirm that the company maintains adequate and appropriate cybersecurity for the myriad of enterprise and personal cloud-service applications.
Looking Ahead
As companies expand, they must inevitably trust critical business operations to third parties for specialty services, especially those relating to technology. But while the influx of third party fintech, including cloud computing, can benefit companies exponentially, their integration also triggers additional costs and risks. By expanding and complicating digital ecosystems, IT outsourcing can increase vulnerabilities and weaknesses, thereby creating dramatic bet-the-company threats relating to cybersecurity and data management. Capital One is clearly learning this lesson the hard way.
For corporate directors, who have a fiduciary duty to understand and oversee cybersecurity, yet often have little if any, cybersecurity experience, there is no need to feel insecure. Given that just one successful attack can irreparably damage a company built on 100 years of excellence and hard work, who can blame board members for lacking confidence in how they are monitoring cybersecurity risk, both within the organization and especially among vendors. But cybersecurity engagement for boards does not mean that board members must obtain computer science degrees or personally supervise firewall implementation and intrusion detection system rollouts.
Responsible boards of directors can begin by becoming more preemptive in evaluating cybersecurity vendor risk exposure, and endeavor to elevate cybersecurity from an ancillary IT concern to a core enterprise-wide risk management item, at the top of a board’s oversight agenda. Indeed, a recent Protiviti study shows that higher levels of board engagement with vendor risk management often leads to sufficient resource allocations to those programs. And, as might be expected, lower board engagement is often a characteristic of underperforming vendor risk management programs.
Good cybersecurity hygiene is good for business, it evidences discipline, maturity, integrity, dependability, reliability, trustworthiness and a whole lot more. By approaching cyber-risks of vendors with vigorous, skeptical, intelligent, independent and methodical administration and inquiry, boards will not just insure that company data is appropriately secure, boards will also make their companies more prosperous. My dad always preached that if you want success, start with your health. The same definitely goes for cybersecurity.
__________________________
John Reed Stark is president of John Reed Stark Consulting LLC, a data breach response and digital compliance firm. Formerly, Mr. Stark served for almost 20 years in the Enforcement Division of the U.S. Securities and Exchange Commission, the last 11 of which as Chief of its Office of Internet Enforcement. He currently teaches a cyber-law course as a Senior Lecturing Fellow at Duke Law School. Mr. Stark also worked for 15 years as an Adjunct Professor of Law at the Georgetown University Law Center, where he taught several courses on the juxtaposition of law, technology and crime, and for five years as managing director of global data breach response firm, Stroz Friedberg, including three years heading its Washington, D.C. office. Mr. Stark is the author of “The Cybersecurity Due Diligence Handbook.”
    The post Guest Post: What the Capital One Hack Means for Board of Directors appeared first on The D&O Diary.
Guest Post: What the Capital One Hack Means for Board of Directors published first on http://simonconsultancypage.tumblr.com/
0 notes
lawfultruth · 6 years ago
Text
Guest Post: What the Capital One Hack Means for Board of Directors
John Reed Stark
The news of the recent massive data breach at Capital One made the front pages of the business sections of newspapers across the country. The hack has drawn attention not just because of the magnitude of the hack, but also because the hackers apparently managed to steal data from The Cloud. The Capital Data breach represents a “wake-up call” for boards of directors, according to the following guest post from John Reed Stark. John is President of John Reed Stark Consulting and former Chief of the SEC’s Office of Internet Enforcement. A version of this article originally appeared on Securities Docket. My thanks to John for allowing me to publish his article on this site. I welcome guest post submissions from responsible authors on topics of interest to this blog’s readers. Please contact me directly if you would like to submit a guest post. Here is John’s article.
*********************************
Another day, another data breach. This time at Capital One, the fifth largest credit card issuer in the United States.
Specifically, on July 29, 2019, FBI agents arrested Paige A. Thompson on suspicion of downloading nearly 30 GB of 100 million Capital One Financial Corp credit applications from a rented cloud data server. The FBI says Capital One learned about the theft from a July 17, 2019, email stating that some of its leaked data was being stored for public view on the software development platform Github. That Github account was for a user named “Netcrave,” which includes the resume and name of Paige A. Thompson. According to the FBI, Thompson also used a public Meetup group under the alias “erratic,” where she invited others to join a Slack channel named “Netcrave Communications.” 
KrebsOnSecurity, actually entered the open Netcrave Slack channel on July 30, 2019, and  reviewed a June 27, 2019 commentary Thompson, which listed various databases she found by hacking into improperly secured Amazon cloud accounts, suggesting that Thompson may also have exfiltrated tens of gigabytes of data belonging to other major corporations.
Ironically, Capital One is considered by many to be a digital banking pioneer and one of the more cyber-savvy companies in the world, evidencing how even the most technologically mature organizations are struggling to manage the rising force of third-party cyber-risk.
Make no mistake: vendors, partners, business associates, and other third parties whose outsourced operations become integrated within a company, can pose a challenging and existential cybersecurity threat to operations. Yet despite increased regulatory scrutiny; growing virtual threats at a global, national and state level; and a riskier business environment, most experts would attest that the relative maturity level of vendor risk management programs is still lacking. For example, CrowdStrike’s 2018 report “Securing the Supply Chain” states:
“Although almost 90 percent of the respondents believe they are at risk for supply chain attack, companies are still slow to detect, remediate and respond to threats.”
Undoubtedly, upon learning of the Capital One hack, corporate board members across the U.S. are likely struck by one immediate thought (there but for the grace of God go I) and one immediate question (What should I do now?).
This article tackles the issue of third party digital risk management head-on, by offering a useful and comprehensive strategical framework for boards of directors to undertake intelligent, thoughtful, and appropriate supervision of a company’s vendor-related cybersecurity risks, especially those risks relating to cloud computing services.
Vendors and Cybersecurity
Companies today rely on a broad range of third party vendors to support core business functions, which typically entails granting these third-party entities access to a company’s data and its internal systems. This digital interconnectivity between vendor and customer creates an inherent risk as cybersecurity shortcomings of third-party vendors have become the go-to-attack vector for cybercriminals. In fact, PWC reports that 63% of all cyber-attacks could be traced either directly or indirectly to third parties.
Vendor’s often maintain less stringent security protocols, raise fewer suspicions and allow for easier identity masking — providing ideal points of entry for attackers looking to leverage unauthorized access. For example, in the Target breach, attackers began by using malware to steal credentials from the air conditioning subcontractor, and from there had access to Target’s vendor-dedicated web services. In the JP Morgan data breach, the cyber-attack infiltrated J.P. Morgan’s Corporate Challenge online platform run by an outside website vendor.
Some other recent examples illustrate how varied and almost epidemic cyber-attacks vis-a-vis third party vendors have become, including:
AMCA (Billing Vendor).  Billing services vendor American Medical Collections Agency (AMCA) was hacked for eight months between August 1, 2018 and March 30, 2019, impacting more than 25 million patients. At least six covered entities have come forward to report their patient data was compromised by the AMCA hack, including 7.7 million LabCorp patients, 12 million Quest Diagnostics patients and 422,000 BioReference patients. Unable to manage the financial impact of the data breach, AMCA has now filed for Chapter 11 bankruptcy;
Applebee’s (Point of Sale Vendor). The Applebee’s restaurant chains reported point-of-sale data breaches that resided on a third-party system and exposed payment card information at some of the chain’s corporate and franchised locations, possibly affecting all of its167 locations. The exfiltrated information included cardholder name, credit/debit card number, expiration date, cardholder verification value, and service code. Similar breaches of payment systems occurred at fast food chains Sonic Drive-In, Arby’s, and Chipotle, and stores Forever 21, Whole Foods, Kmart, and Brooks Brothers; and
BestBuy, Sears, Kmart, Delta (Chat Vendor).  These three vastly different companies had one characteristic in common – they all used [24]7.ai, a chat and customer services vendor for many brand names, which was hacked via malware, compromising credit card information, addresses, CVV numbers, card expiration dates and other personal data across multiple customer groups.
Boards and Cybersecurity
Every board now knows it’s company will fall victim to a cyber-attack, and even worse, that the board of directors will need to clean up the mess and superintend the fallout. Yet cyber-attacks can be extraordinarily complicated and, once identified, demand a host of costly responses.
Consider the Capital One data breach. When a cyber-attack involves a third party vendor of any sort, a myriad of tasks immediately emerge, including:
Digital forensic preservation and investigation;
Fulfillment of state and federal compliance obligations;
Responding to potential litigation with third parties;
Class action defense (within 24 hours of the Capital One announcement, plaintiffs had already filed a bevy of class suits against Capital One);
Engagement with law enforcement (the FBI is already investigating other possible data breaches related to Capital One);
State regulatory response (New York Attorney General Letitia James announced that her office immediately opened an investigation into the Capital One incident stating, “Safeguards were missing that allowed for the illegal access of consumers’ names, Social Security numbers, dates of birth, addresses, and other highly sensitive, personal information.”);
Provision of credit monitoring and identity protection;
Managing of insurance claims;
Public relations planning; and
So many other anticipated and unanticipated breach-related tasks such as briefing customers, partners, employees, affiliates, insurance carriers, and a range of other interested parties.
And besides the more predictable workflow, Capital One will become exposed to other, even more intangible costs as well, including temporary, or even, permanent reputational and brand damage; loss of productivity; extended management drag; and a negative impact on employee morale and overall business performance.
Given the explosive growth of outsourced technology services and the increasingly intimate cyber-integration and relationship of companies and third party vendors, boards need to monitor and challenge their third-party exposure and insure the proper implementation of safeguards and processes to reduce their vulnerability.
Boards, Vendors and Data Breaches
Outsourcing of services such as information technology (IT), payroll, accounting, pension, and other financial services, has become increasingly common for today’s corporations, and raises particularly challenging cybersecurity concerns. For instance, the Trustwave 2018 Global Security Report (GSR) found a marked increase of 9.5% in compromises targeting businesses that provide IT services. In stark contrast, service provider compromises did not even register in the 2016 GSR statistics.
Given this sudden explosion of IT-related vendors, boards of directors should probe the practices and procedures of their respective companies with respect to the cybersecurity of their vendors. Most importantly, boards should understand that data security incidents involving companies and their vendors are a “two way street.” In other words, given that cyber-attackers will often traverse across a company’s network and into the networks of its vendors or vice versa, cyber-attacks can often result in disputes as to the culpability for an attack.
Along these lines, boards should confirm that their respective company’s carefully manage vendor access to its networks, customer data or other sensitive information, by inquiring whether their respective companies:
Have high standards for their vendors, mandating for instance that vendors: have been in business for a reasonable amount of time; have earned certain data security and government compliance certifications (such as PCI, HIPAA and SOX); have annual third party risk and security assessments (which the company can review); make proper use of encryption; use the latest methodology and technology to protect and control access to data and ensure that it meets current security trends and regulations; use two-factor authentication; maintain good password management; have strong cybersecurity training practices; have incident response plans, disaster recovery plans, table-top cyber-attack exercises and place limitations on daily ingress or egress of data;
Place vendors into different risk categories based on the nature and quantity of company information to which they have access (such as personally identifiable data (PII), payment card information (PCI) or protected health information (PHI)).  For example, if a vendor has access to PII or to PHI, then a data breach at the vendor would impact the company substantially. But If the vendor only accesses publicly available information, a data breach would have far less of an impact;
Map data-flow by assigning data custodians, implementing system controls, enforcing security policies and executing strict data handling procedures and auditing;
Research whether vendors have experienced data security incidents in the past and how those incidents were handled;
Consider constructing an interactive vendor portal for sharing knowledge and a hotline to answer and report issues;
Insure that vendors maintain proper incident-response protocols (e.g. who is the responsible party within the organization to notify when a vendor experiences a data security incident? What is the notification procedure?  What is the anticipated timeline?);
Consider physical site visits to assess vendor cybersecurity first-hand;
Have contractual agreements with vendors that cover audit rights, cooperation rights and other relationship-based based demarcation definitions;
Insure that vendors adhere to all applicable laws, especially those relating to data privacy, such as the General Data Protection Regulation (GDPR), Privacy Shield Framework, and the new California Consumer Privacy Act (CCPA);
Conduct due diligence on vendors to assess their security and privacy practices as part of a procurement process and throughout the ongoing vendor relationship. This means establishing via written agreements and ongoing supervision, formal vendor management programs that assess risk and identify potential cybersecurity concerns prior to engaging in a business relationship;
Include robust privacy and data security clauses in contracts with vendors, including strict and broad data security incident notification provisions;
Maintain a register of all vendors and the types of personal, sensitive of confidential information the vendors accesses, stores, shares, transfers, etc.;
Engage in annual third party cybersecurity audits and assessments;
Check references of vendors, and establish clear “data out” procedures if the company wants to terminate its relationship with a vendor;
Review not just how sensitive data will be stored, but also how it will be handled when a vendor relationship ends (because former vendor relationships can create even greater risk to an organizations than existing ones); and
Create contractually defined practical and realistic appropriate remediation protocols.
If vendors conduct remote maintenance of a company’s networks and devices, in the event of a cyber-attack, the company may want to confirm it can obtain copies of any relevant logs, as well as access the third-party system to scan for IOCs.
Boards should also probe the company/vendor communication lines and make sure they are established and thoughtfully staffed and structured, incorporating all of the legal implications of communications. One simple inculpatory miscommunication from the company’s IT department to a vendor (e.g. “I think we screwed up and missed a patch.”) can trigger calamitous legal liabilities.
Boards should also probe whether a company’s vendors have cyber insurance coverage and/or agreements that require the vendor to defend and indemnify the company for legal liability arising from any release or disclosure of the information resulting from the cybersecurity failure of the vendor. Similarly, boards should probe how vendors will deal with government requests or subpoenas that involve data of the company. For instance, will the company be notified and will the company be offered an opportunity to contest any subpoena (and who will pay for any resulting litigation against the government pertaining to the subpoena’s enforcement.)
For boards, the appropriate level of cybersecurity due diligence for vendors is bespoke. Consider the New York State Department of Financial Services (NYDFS) Cybersecurity requirements for financial services firms, one of the more onerous state cyber-regulatory regimes in the country, which lays out more general requirements than specific ones.
For example, per the NYDFS, all third party service providers are not specifically required to implement multi-factor authentication and encryption. Rather, New York financial firms must engage “in a risk assessment regarding the appropriate controls for third party service providers based on the individual facts and circumstances presented and does not create a one-size-fits-all solution.”
When a Vendor Suffers a Data Breach
With respect to data security incidents, a board should focus its lens on two distinct perspectives:
What happens if there is a data security incident at a vendor which impacts the company; and
What happens if there is a data security incident at the company that impacts a vendor.
Under either scenario, much of the communication and cooperation between a vendor and a company will be dictated by the contractual terms governing their relationship.
Along these lines, boards should also confirm that their respective companies have contractual language establishing the company’s rights when a cyber-attack occurs involving a vendor, which can range from notification, to on-site inspections, to the option of an independent risk and security assessment/audit of the vendor (at the vendor’s, and not the company’s, expense).
Specifically, in the event of a data security incident at a vendor, contracts should explicitly allow for the company to know all relevant facts relating to the cyber-attack, especially:
Whether their data has potentially been compromised;
Whether services will experience any disruption;
The nature of remediation efforts;
Whether there are any official or unofficial findings of any investigation; or
Whether there is any other information that can impact their operations or reputation.
On the other hand, when a company discovers a data security incident, vendors might make requests to the company, such as seeking images of malware and indicators of compromise (IOCs) or wanting to visit the company and inspect the company with its own investigation team. Vendors may ask for weekly or even daily briefings and may demand attestations in writing with respect to any findings pertaining to their data. Boards should also probe these requirements, obligations, protocols, etc. – to insure that these communications lines are contractually defined, controlled and properly modulated.
Spotlight: Cloud Storage Vendors
Whether AWS will be held at all responsible for Thompson’s alleged cyber-attack upon Capital One remains to be seen. AWS emphatically denies any culpability, issuing a statement asserting:
“AWS was not compromised in any way and functioned as designed . . . The perpetrator gained access through a misconfiguration of the web application and not the underlying cloud-based infrastructure. As Capital One explained clearly in its disclosure, this type of vulnerability is not specific to the cloud.”
AWS might have a good point. First, according to the Capital One news release announcing incident, the firewall configuration vulnerability that Thompson exploited is “a specific configuration vulnerability in our infrastructure . . . not specific to the cloud.” Capital One even touts the cloud as helping with its incident response, stating:
“The speed with which we were able to diagnose and fix this vulnerability, and determine its impact, was enabled by our cloud operating model.”
Second, the outcome will center around the contractual arrangement between AWS and Capital One, and AWS’s notoriously detailed contracts tend to favor AWS (according to Gartner, AWS has a 47.8% market share of the cloud computing space). Third, users like Capital One typically maintain full control over any applications they build on top of AWS.
On the other hand, there is a wildcard thrown into the liability calculus that could become a problem for AWS: Thompson is a former AWS employee who worked in the company’s S3 cloud storage technology group, and is suspected of exfiltrating data from other possible AWS customers. As more information is stored in the cloud, staff system engineers like Thompson, trained to become experts using these cloud systems, could become a threat to other companies. If it’s established that Thompson somehow used proprietary AWS information in order to carry out her hack into Capital One, or perhaps that AWS should have done more to alert Capital One about server configuration vulnerabilities or errors, liability could shift to AWS.
Interestingly, AWS considers Capital One to be a prized customer. In fact, Capital One’s CIO Rob Alexander gushed ad nauseum over AWS at a 2015 Las Vegas AWS conference. AWS even showcases the interconnectivity of its Capital One relationship on the AWS website, stating:
“Capital One is using AWS as a central part of its technology strategy. As a result, the bank plans to reduce its data center footprint from eight to three by 2018. Capital One is one of the nation’s largest banks and offers credit cards, checking and savings accounts, auto loans, rewards, and online banking services for consumers and businesses. It is using or experimenting with nearly every AWS service to develop, test, build, and run its most critical workloads, including its new flagship mobile-banking application. Capital One selected AWS for its security model and for the ability to provision infrastructure on the fly, the elasticity to handle purchasing demands at peak times, its high availability, and its pace of innovation.” 
Under any circumstance, whether AWS shoulders any of the liability for the Capital One breach, the incident should still serve as a wake-up call for the bet-the-company cybersecurity risks associated with utilizing cloud computing services, and highlights the importance of knowing who becomes liable in the event of a cloud-related data security incident.
Cloud Services and Cybersecurity
More companies, from government to manufacturing to retail, are becoming increasingly comfortable about moving their data to the cloud. Why? Because cloud platforms coordinate globally based integration of networks and enable new, highly complex business models, dramatic cost savings, exponential scalability, increased mobility and easier collaboration.
Indeed, the global public cloud computing market is set to reach $258 billion in 2019, with an average of about one third of companies’ IT budget going to cloud services. Banks in particular are forecast to spend more than $53 billion on public cloud infrastructure and data services, up from $24.3 billion in 2018. But all of this growth is not without risk.
When a company stores critical or confidential information in the cloud, that information is essentially stored off-site, possibly in another country. Along these lines, boards should confirm that  their respective companies are using cloud providers that can reasonably protect and provide assurances on overall data security.
Specifically, boards should probe a company’s cloud-related practices, especially an assessment of any enterprise-grade security systems and analytics, a determination of the attack vectors, and a review of data security measures. Important questions include:
Whether the cloud data is encrypted (in transition and in motion);
Who holds the encryption keys for cloud data;
Whether the cloud data is subject to search and seizure (both domestically and internationally);
The nature of data protections used by the cloud firm;
How transparent the cloud providers’ own security systems are;
What access can the company get to the cloud provider’s data center and personnel to ensure the security system is in place and functioning and make sure it can undertake a risk assessment and design a response plan;
Whether company customers have given approval for cloud storage of their data;
What the cloud servicers’ responsibilities are to update their security systems as technology and cyber-attack sophistication evolves;
How the cloud providers continuously monitor, detect, and respond to security incidents;
What cloud logging exists and how long logs are maintained;
How and when cloud data is destroyed;
Whether cloud data could be subject to a litigation hold and what technologies allow for the cloud data’s perusal;
What happens when a cloud company receives a subpoena or other request or is subjected to a search warrant from any government that involves the company’s data;
What auditing is permitted of the security capabilities of the cloud company;
What regulatory and privacy requirements apply to the PII, PHI, personal financial information, or other customer data within the cloud data;
Whether the cloud firm and the company have any indemnification agreements or evidence of cyber insurance;
Whether the company’s insurance policies cover losses from activities undertaken by the cloud service providers in the event of a cyber-attack;
What types of pen testing are undertaken by the cloud firm; and
What the specific details and efficacy of security policies and procedures of the cloud firm are.
Boards should also confirm that a company has a comprehensive means to prevent sensitive data from being uploaded to the cloud for inappropriate sharing, and the requisite visibility and access to detect anomalies, conduct further investigation and launch quick and decisive remedial action.
Along these lines, questions should cover technologies used to prevent the unauthorized use of cloud applications by employees; internal controls regarding any cloud applications used by employees; an incident response plan for handling an attack on any cloud application; and employee training concerning use of cloud applications.
Cloud-Based Filing Services
Cloud-based file-sharing services, such as Dropbox, Google Drive, Box, and others, are another way confidential information leaks out of a company – and have become an increasingly popular way to store, back-up, transfer and temporarily warehouse large data files.
Such cloud services often are used through personal accounts, despite many large companies prohibiting, as a matter of policy, the use of such services for these purposes. Some companies also block access to such services from the company’s systems (such as desktops, laptops, tablets, phones, etc.) with effective security controls, while other companies are less sophisticated or simply resist the notion of becoming the automated “data nanny” for their employees.
Boards should probe the company’s policies, practices and procedures regarding cloud-sharing services used by employees and confirm that the company maintains adequate and appropriate cybersecurity for the myriad of enterprise and personal cloud-service applications.
Looking Ahead
As companies expand, they must inevitably trust critical business operations to third parties for specialty services, especially those relating to technology. But while the influx of third party fintech, including cloud computing, can benefit companies exponentially, their integration also triggers additional costs and risks. By expanding and complicating digital ecosystems, IT outsourcing can increase vulnerabilities and weaknesses, thereby creating dramatic bet-the-company threats relating to cybersecurity and data management. Capital One is clearly learning this lesson the hard way.
For corporate directors, who have a fiduciary duty to understand and oversee cybersecurity, yet often have little if any, cybersecurity experience, there is no need to feel insecure. Given that just one successful attack can irreparably damage a company built on 100 years of excellence and hard work, who can blame board members for lacking confidence in how they are monitoring cybersecurity risk, both within the organization and especially among vendors. But cybersecurity engagement for boards does not mean that board members must obtain computer science degrees or personally supervise firewall implementation and intrusion detection system rollouts.
Responsible boards of directors can begin by becoming more preemptive in evaluating cybersecurity vendor risk exposure, and endeavor to elevate cybersecurity from an ancillary IT concern to a core enterprise-wide risk management item, at the top of a board’s oversight agenda. Indeed, a recent Protiviti study shows that higher levels of board engagement with vendor risk management often leads to sufficient resource allocations to those programs. And, as might be expected, lower board engagement is often a characteristic of underperforming vendor risk management programs.
Good cybersecurity hygiene is good for business, it evidences discipline, maturity, integrity, dependability, reliability, trustworthiness and a whole lot more. By approaching cyber-risks of vendors with vigorous, skeptical, intelligent, independent and methodical administration and inquiry, boards will not just insure that company data is appropriately secure, boards will also make their companies more prosperous. My dad always preached that if you want success, start with your health. The same definitely goes for cybersecurity.
__________________________
John Reed Stark is president of John Reed Stark Consulting LLC, a data breach response and digital compliance firm. Formerly, Mr. Stark served for almost 20 years in the Enforcement Division of the U.S. Securities and Exchange Commission, the last 11 of which as Chief of its Office of Internet Enforcement. He currently teaches a cyber-law course as a Senior Lecturing Fellow at Duke Law School. Mr. Stark also worked for 15 years as an Adjunct Professor of Law at the Georgetown University Law Center, where he taught several courses on the juxtaposition of law, technology and crime, and for five years as managing director of global data breach response firm, Stroz Friedberg, including three years heading its Washington, D.C. office. Mr. Stark is the author of “The Cybersecurity Due Diligence Handbook.”
    The post Guest Post: What the Capital One Hack Means for Board of Directors appeared first on The D&O Diary.
Guest Post: What the Capital One Hack Means for Board of Directors syndicated from https://ronenkurzfeldweb.wordpress.com/
0 notes
golicit · 6 years ago
Text
Guest Post: What the Capital One Hack Means for Board of Directors
John Reed Stark
The news of the recent massive data breach at Capital One made the front pages of the business sections of newspapers across the country. The hack has drawn attention not just because of the magnitude of the hack, but also because the hackers apparently managed to steal data from The Cloud. The Capital Data breach represents a “wake-up call” for boards of directors, according to the following guest post from John Reed Stark. John is President of John Reed Stark Consulting and former Chief of the SEC’s Office of Internet Enforcement. A version of this article originally appeared on Securities Docket. My thanks to John for allowing me to publish his article on this site. I welcome guest post submissions from responsible authors on topics of interest to this blog’s readers. Please contact me directly if you would like to submit a guest post. Here is John’s article.
*********************************
Another day, another data breach. This time at Capital One, the fifth largest credit card issuer in the United States.
Specifically, on July 29, 2019, FBI agents arrested Paige A. Thompson on suspicion of downloading nearly 30 GB of 100 million Capital One Financial Corp credit applications from a rented cloud data server. The FBI says Capital One learned about the theft from a July 17, 2019, email stating that some of its leaked data was being stored for public view on the software development platform Github. That Github account was for a user named “Netcrave,” which includes the resume and name of Paige A. Thompson. According to the FBI, Thompson also used a public Meetup group under the alias “erratic,” where she invited others to join a Slack channel named “Netcrave Communications.” 
KrebsOnSecurity, actually entered the open Netcrave Slack channel on July 30, 2019, and  reviewed a June 27, 2019 commentary Thompson, which listed various databases she found by hacking into improperly secured Amazon cloud accounts, suggesting that Thompson may also have exfiltrated tens of gigabytes of data belonging to other major corporations.
Ironically, Capital One is considered by many to be a digital banking pioneer and one of the more cyber-savvy companies in the world, evidencing how even the most technologically mature organizations are struggling to manage the rising force of third-party cyber-risk.
Make no mistake: vendors, partners, business associates, and other third parties whose outsourced operations become integrated within a company, can pose a challenging and existential cybersecurity threat to operations. Yet despite increased regulatory scrutiny; growing virtual threats at a global, national and state level; and a riskier business environment, most experts would attest that the relative maturity level of vendor risk management programs is still lacking. For example, CrowdStrike’s 2018 report “Securing the Supply Chain” states:
“Although almost 90 percent of the respondents believe they are at risk for supply chain attack, companies are still slow to detect, remediate and respond to threats.”
Undoubtedly, upon learning of the Capital One hack, corporate board members across the U.S. are likely struck by one immediate thought (there but for the grace of God go I) and one immediate question (What should I do now?).
This article tackles the issue of third party digital risk management head-on, by offering a useful and comprehensive strategical framework for boards of directors to undertake intelligent, thoughtful, and appropriate supervision of a company’s vendor-related cybersecurity risks, especially those risks relating to cloud computing services.
Vendors and Cybersecurity
Companies today rely on a broad range of third party vendors to support core business functions, which typically entails granting these third-party entities access to a company’s data and its internal systems. This digital interconnectivity between vendor and customer creates an inherent risk as cybersecurity shortcomings of third-party vendors have become the go-to-attack vector for cybercriminals. In fact, PWC reports that 63% of all cyber-attacks could be traced either directly or indirectly to third parties.
Vendor’s often maintain less stringent security protocols, raise fewer suspicions and allow for easier identity masking — providing ideal points of entry for attackers looking to leverage unauthorized access. For example, in the Target breach, attackers began by using malware to steal credentials from the air conditioning subcontractor, and from there had access to Target’s vendor-dedicated web services. In the JP Morgan data breach, the cyber-attack infiltrated J.P. Morgan’s Corporate Challenge online platform run by an outside website vendor.
Some other recent examples illustrate how varied and almost epidemic cyber-attacks vis-a-vis third party vendors have become, including:
AMCA (Billing Vendor).  Billing services vendor American Medical Collections Agency (AMCA) was hacked for eight months between August 1, 2018 and March 30, 2019, impacting more than 25 million patients. At least six covered entities have come forward to report their patient data was compromised by the AMCA hack, including 7.7 million LabCorp patients, 12 million Quest Diagnostics patients and 422,000 BioReference patients. Unable to manage the financial impact of the data breach, AMCA has now filed for Chapter 11 bankruptcy;
Applebee’s (Point of Sale Vendor). The Applebee’s restaurant chains reported point-of-sale data breaches that resided on a third-party system and exposed payment card information at some of the chain’s corporate and franchised locations, possibly affecting all of its167 locations. The exfiltrated information included cardholder name, credit/debit card number, expiration date, cardholder verification value, and service code. Similar breaches of payment systems occurred at fast food chains Sonic Drive-In, Arby’s, and Chipotle, and stores Forever 21, Whole Foods, Kmart, and Brooks Brothers; and
BestBuy, Sears, Kmart, Delta (Chat Vendor).  These three vastly different companies had one characteristic in common – they all used [24]7.ai, a chat and customer services vendor for many brand names, which was hacked via malware, compromising credit card information, addresses, CVV numbers, card expiration dates and other personal data across multiple customer groups.
Boards and Cybersecurity
Every board now knows it’s company will fall victim to a cyber-attack, and even worse, that the board of directors will need to clean up the mess and superintend the fallout. Yet cyber-attacks can be extraordinarily complicated and, once identified, demand a host of costly responses.
Consider the Capital One data breach. When a cyber-attack involves a third party vendor of any sort, a myriad of tasks immediately emerge, including:
Digital forensic preservation and investigation;
Fulfillment of state and federal compliance obligations;
Responding to potential litigation with third parties;
Class action defense (within 24 hours of the Capital One announcement, plaintiffs had already filed a bevy of class suits against Capital One);
Engagement with law enforcement (the FBI is already investigating other possible data breaches related to Capital One);
State regulatory response (New York Attorney General Letitia James announced that her office immediately opened an investigation into the Capital One incident stating, “Safeguards were missing that allowed for the illegal access of consumers’ names, Social Security numbers, dates of birth, addresses, and other highly sensitive, personal information.”);
Provision of credit monitoring and identity protection;
Managing of insurance claims;
Public relations planning; and
So many other anticipated and unanticipated breach-related tasks such as briefing customers, partners, employees, affiliates, insurance carriers, and a range of other interested parties.
And besides the more predictable workflow, Capital One will become exposed to other, even more intangible costs as well, including temporary, or even, permanent reputational and brand damage; loss of productivity; extended management drag; and a negative impact on employee morale and overall business performance.
Given the explosive growth of outsourced technology services and the increasingly intimate cyber-integration and relationship of companies and third party vendors, boards need to monitor and challenge their third-party exposure and insure the proper implementation of safeguards and processes to reduce their vulnerability.
Boards, Vendors and Data Breaches
Outsourcing of services such as information technology (IT), payroll, accounting, pension, and other financial services, has become increasingly common for today’s corporations, and raises particularly challenging cybersecurity concerns. For instance, the Trustwave 2018 Global Security Report (GSR) found a marked increase of 9.5% in compromises targeting businesses that provide IT services. In stark contrast, service provider compromises did not even register in the 2016 GSR statistics.
Given this sudden explosion of IT-related vendors, boards of directors should probe the practices and procedures of their respective companies with respect to the cybersecurity of their vendors. Most importantly, boards should understand that data security incidents involving companies and their vendors are a “two way street.” In other words, given that cyber-attackers will often traverse across a company’s network and into the networks of its vendors or vice versa, cyber-attacks can often result in disputes as to the culpability for an attack.
Along these lines, boards should confirm that their respective company’s carefully manage vendor access to its networks, customer data or other sensitive information, by inquiring whether their respective companies:
Have high standards for their vendors, mandating for instance that vendors: have been in business for a reasonable amount of time; have earned certain data security and government compliance certifications (such as PCI, HIPAA and SOX); have annual third party risk and security assessments (which the company can review); make proper use of encryption; use the latest methodology and technology to protect and control access to data and ensure that it meets current security trends and regulations; use two-factor authentication; maintain good password management; have strong cybersecurity training practices; have incident response plans, disaster recovery plans, table-top cyber-attack exercises and place limitations on daily ingress or egress of data;
Place vendors into different risk categories based on the nature and quantity of company information to which they have access (such as personally identifiable data (PII), payment card information (PCI) or protected health information (PHI)).  For example, if a vendor has access to PII or to PHI, then a data breach at the vendor would impact the company substantially. But If the vendor only accesses publicly available information, a data breach would have far less of an impact;
Map data-flow by assigning data custodians, implementing system controls, enforcing security policies and executing strict data handling procedures and auditing;
Research whether vendors have experienced data security incidents in the past and how those incidents were handled;
Consider constructing an interactive vendor portal for sharing knowledge and a hotline to answer and report issues;
Insure that vendors maintain proper incident-response protocols (e.g. who is the responsible party within the organization to notify when a vendor experiences a data security incident? What is the notification procedure?  What is the anticipated timeline?);
Consider physical site visits to assess vendor cybersecurity first-hand;
Have contractual agreements with vendors that cover audit rights, cooperation rights and other relationship-based based demarcation definitions;
Insure that vendors adhere to all applicable laws, especially those relating to data privacy, such as the General Data Protection Regulation (GDPR), Privacy Shield Framework, and the new California Consumer Privacy Act (CCPA);
Conduct due diligence on vendors to assess their security and privacy practices as part of a procurement process and throughout the ongoing vendor relationship. This means establishing via written agreements and ongoing supervision, formal vendor management programs that assess risk and identify potential cybersecurity concerns prior to engaging in a business relationship;
Include robust privacy and data security clauses in contracts with vendors, including strict and broad data security incident notification provisions;
Maintain a register of all vendors and the types of personal, sensitive of confidential information the vendors accesses, stores, shares, transfers, etc.;
Engage in annual third party cybersecurity audits and assessments;
Check references of vendors, and establish clear “data out” procedures if the company wants to terminate its relationship with a vendor;
Review not just how sensitive data will be stored, but also how it will be handled when a vendor relationship ends (because former vendor relationships can create even greater risk to an organizations than existing ones); and
Create contractually defined practical and realistic appropriate remediation protocols.
If vendors conduct remote maintenance of a company’s networks and devices, in the event of a cyber-attack, the company may want to confirm it can obtain copies of any relevant logs, as well as access the third-party system to scan for IOCs.
Boards should also probe the company/vendor communication lines and make sure they are established and thoughtfully staffed and structured, incorporating all of the legal implications of communications. One simple inculpatory miscommunication from the company’s IT department to a vendor (e.g. “I think we screwed up and missed a patch.”) can trigger calamitous legal liabilities.
Boards should also probe whether a company’s vendors have cyber insurance coverage and/or agreements that require the vendor to defend and indemnify the company for legal liability arising from any release or disclosure of the information resulting from the cybersecurity failure of the vendor. Similarly, boards should probe how vendors will deal with government requests or subpoenas that involve data of the company. For instance, will the company be notified and will the company be offered an opportunity to contest any subpoena (and who will pay for any resulting litigation against the government pertaining to the subpoena’s enforcement.)
For boards, the appropriate level of cybersecurity due diligence for vendors is bespoke. Consider the New York State Department of Financial Services (NYDFS) Cybersecurity requirements for financial services firms, one of the more onerous state cyber-regulatory regimes in the country, which lays out more general requirements than specific ones.
For example, per the NYDFS, all third party service providers are not specifically required to implement multi-factor authentication and encryption. Rather, New York financial firms must engage “in a risk assessment regarding the appropriate controls for third party service providers based on the individual facts and circumstances presented and does not create a one-size-fits-all solution.”
When a Vendor Suffers a Data Breach
With respect to data security incidents, a board should focus its lens on two distinct perspectives:
What happens if there is a data security incident at a vendor which impacts the company; and
What happens if there is a data security incident at the company that impacts a vendor.
Under either scenario, much of the communication and cooperation between a vendor and a company will be dictated by the contractual terms governing their relationship.
Along these lines, boards should also confirm that their respective companies have contractual language establishing the company’s rights when a cyber-attack occurs involving a vendor, which can range from notification, to on-site inspections, to the option of an independent risk and security assessment/audit of the vendor (at the vendor’s, and not the company’s, expense).
Specifically, in the event of a data security incident at a vendor, contracts should explicitly allow for the company to know all relevant facts relating to the cyber-attack, especially:
Whether their data has potentially been compromised;
Whether services will experience any disruption;
The nature of remediation efforts;
Whether there are any official or unofficial findings of any investigation; or
Whether there is any other information that can impact their operations or reputation.
On the other hand, when a company discovers a data security incident, vendors might make requests to the company, such as seeking images of malware and indicators of compromise (IOCs) or wanting to visit the company and inspect the company with its own investigation team. Vendors may ask for weekly or even daily briefings and may demand attestations in writing with respect to any findings pertaining to their data. Boards should also probe these requirements, obligations, protocols, etc. – to insure that these communications lines are contractually defined, controlled and properly modulated.
Spotlight: Cloud Storage Vendors
Whether AWS will be held at all responsible for Thompson’s alleged cyber-attack upon Capital One remains to be seen. AWS emphatically denies any culpability, issuing a statement asserting:
“AWS was not compromised in any way and functioned as designed . . . The perpetrator gained access through a misconfiguration of the web application and not the underlying cloud-based infrastructure. As Capital One explained clearly in its disclosure, this type of vulnerability is not specific to the cloud.”
AWS might have a good point. First, according to the Capital One news release announcing incident, the firewall configuration vulnerability that Thompson exploited is “a specific configuration vulnerability in our infrastructure . . . not specific to the cloud.” Capital One even touts the cloud as helping with its incident response, stating:
“The speed with which we were able to diagnose and fix this vulnerability, and determine its impact, was enabled by our cloud operating model.”
Second, the outcome will center around the contractual arrangement between AWS and Capital One, and AWS’s notoriously detailed contracts tend to favor AWS (according to Gartner, AWS has a 47.8% market share of the cloud computing space). Third, users like Capital One typically maintain full control over any applications they build on top of AWS.
On the other hand, there is a wildcard thrown into the liability calculus that could become a problem for AWS: Thompson is a former AWS employee who worked in the company’s S3 cloud storage technology group, and is suspected of exfiltrating data from other possible AWS customers. As more information is stored in the cloud, staff system engineers like Thompson, trained to become experts using these cloud systems, could become a threat to other companies. If it’s established that Thompson somehow used proprietary AWS information in order to carry out her hack into Capital One, or perhaps that AWS should have done more to alert Capital One about server configuration vulnerabilities or errors, liability could shift to AWS.
Interestingly, AWS considers Capital One to be a prized customer. In fact, Capital One’s CIO Rob Alexander gushed ad nauseum over AWS at a 2015 Las Vegas AWS conference. AWS even showcases the interconnectivity of its Capital One relationship on the AWS website, stating:
“Capital One is using AWS as a central part of its technology strategy. As a result, the bank plans to reduce its data center footprint from eight to three by 2018. Capital One is one of the nation’s largest banks and offers credit cards, checking and savings accounts, auto loans, rewards, and online banking services for consumers and businesses. It is using or experimenting with nearly every AWS service to develop, test, build, and run its most critical workloads, including its new flagship mobile-banking application. Capital One selected AWS for its security model and for the ability to provision infrastructure on the fly, the elasticity to handle purchasing demands at peak times, its high availability, and its pace of innovation.” 
Under any circumstance, whether AWS shoulders any of the liability for the Capital One breach, the incident should still serve as a wake-up call for the bet-the-company cybersecurity risks associated with utilizing cloud computing services, and highlights the importance of knowing who becomes liable in the event of a cloud-related data security incident.
Cloud Services and Cybersecurity
More companies, from government to manufacturing to retail, are becoming increasingly comfortable about moving their data to the cloud. Why? Because cloud platforms coordinate globally based integration of networks and enable new, highly complex business models, dramatic cost savings, exponential scalability, increased mobility and easier collaboration.
Indeed, the global public cloud computing market is set to reach $258 billion in 2019, with an average of about one third of companies’ IT budget going to cloud services. Banks in particular are forecast to spend more than $53 billion on public cloud infrastructure and data services, up from $24.3 billion in 2018. But all of this growth is not without risk.
When a company stores critical or confidential information in the cloud, that information is essentially stored off-site, possibly in another country. Along these lines, boards should confirm that  their respective companies are using cloud providers that can reasonably protect and provide assurances on overall data security.
Specifically, boards should probe a company’s cloud-related practices, especially an assessment of any enterprise-grade security systems and analytics, a determination of the attack vectors, and a review of data security measures. Important questions include:
Whether the cloud data is encrypted (in transition and in motion);
Who holds the encryption keys for cloud data;
Whether the cloud data is subject to search and seizure (both domestically and internationally);
The nature of data protections used by the cloud firm;
How transparent the cloud providers’ own security systems are;
What access can the company get to the cloud provider’s data center and personnel to ensure the security system is in place and functioning and make sure it can undertake a risk assessment and design a response plan;
Whether company customers have given approval for cloud storage of their data;
What the cloud servicers’ responsibilities are to update their security systems as technology and cyber-attack sophistication evolves;
How the cloud providers continuously monitor, detect, and respond to security incidents;
What cloud logging exists and how long logs are maintained;
How and when cloud data is destroyed;
Whether cloud data could be subject to a litigation hold and what technologies allow for the cloud data’s perusal;
What happens when a cloud company receives a subpoena or other request or is subjected to a search warrant from any government that involves the company’s data;
What auditing is permitted of the security capabilities of the cloud company;
What regulatory and privacy requirements apply to the PII, PHI, personal financial information, or other customer data within the cloud data;
Whether the cloud firm and the company have any indemnification agreements or evidence of cyber insurance;
Whether the company’s insurance policies cover losses from activities undertaken by the cloud service providers in the event of a cyber-attack;
What types of pen testing are undertaken by the cloud firm; and
What the specific details and efficacy of security policies and procedures of the cloud firm are.
Boards should also confirm that a company has a comprehensive means to prevent sensitive data from being uploaded to the cloud for inappropriate sharing, and the requisite visibility and access to detect anomalies, conduct further investigation and launch quick and decisive remedial action.
Along these lines, questions should cover technologies used to prevent the unauthorized use of cloud applications by employees; internal controls regarding any cloud applications used by employees; an incident response plan for handling an attack on any cloud application; and employee training concerning use of cloud applications.
Cloud-Based Filing Services
Cloud-based file-sharing services, such as Dropbox, Google Drive, Box, and others, are another way confidential information leaks out of a company – and have become an increasingly popular way to store, back-up, transfer and temporarily warehouse large data files.
Such cloud services often are used through personal accounts, despite many large companies prohibiting, as a matter of policy, the use of such services for these purposes. Some companies also block access to such services from the company’s systems (such as desktops, laptops, tablets, phones, etc.) with effective security controls, while other companies are less sophisticated or simply resist the notion of becoming the automated “data nanny” for their employees.
Boards should probe the company’s policies, practices and procedures regarding cloud-sharing services used by employees and confirm that the company maintains adequate and appropriate cybersecurity for the myriad of enterprise and personal cloud-service applications.
Looking Ahead
As companies expand, they must inevitably trust critical business operations to third parties for specialty services, especially those relating to technology. But while the influx of third party fintech, including cloud computing, can benefit companies exponentially, their integration also triggers additional costs and risks. By expanding and complicating digital ecosystems, IT outsourcing can increase vulnerabilities and weaknesses, thereby creating dramatic bet-the-company threats relating to cybersecurity and data management. Capital One is clearly learning this lesson the hard way.
For corporate directors, who have a fiduciary duty to understand and oversee cybersecurity, yet often have little if any, cybersecurity experience, there is no need to feel insecure. Given that just one successful attack can irreparably damage a company built on 100 years of excellence and hard work, who can blame board members for lacking confidence in how they are monitoring cybersecurity risk, both within the organization and especially among vendors. But cybersecurity engagement for boards does not mean that board members must obtain computer science degrees or personally supervise firewall implementation and intrusion detection system rollouts.
Responsible boards of directors can begin by becoming more preemptive in evaluating cybersecurity vendor risk exposure, and endeavor to elevate cybersecurity from an ancillary IT concern to a core enterprise-wide risk management item, at the top of a board’s oversight agenda. Indeed, a recent Protiviti study shows that higher levels of board engagement with vendor risk management often leads to sufficient resource allocations to those programs. And, as might be expected, lower board engagement is often a characteristic of underperforming vendor risk management programs.
Good cybersecurity hygiene is good for business, it evidences discipline, maturity, integrity, dependability, reliability, trustworthiness and a whole lot more. By approaching cyber-risks of vendors with vigorous, skeptical, intelligent, independent and methodical administration and inquiry, boards will not just insure that company data is appropriately secure, boards will also make their companies more prosperous. My dad always preached that if you want success, start with your health. The same definitely goes for cybersecurity.
__________________________
John Reed Stark is president of John Reed Stark Consulting LLC, a data breach response and digital compliance firm. Formerly, Mr. Stark served for almost 20 years in the Enforcement Division of the U.S. Securities and Exchange Commission, the last 11 of which as Chief of its Office of Internet Enforcement. He currently teaches a cyber-law course as a Senior Lecturing Fellow at Duke Law School. Mr. Stark also worked for 15 years as an Adjunct Professor of Law at the Georgetown University Law Center, where he taught several courses on the juxtaposition of law, technology and crime, and for five years as managing director of global data breach response firm, Stroz Friedberg, including three years heading its Washington, D.C. office. Mr. Stark is the author of “The Cybersecurity Due Diligence Handbook.”
    The post Guest Post: What the Capital One Hack Means for Board of Directors appeared first on The D&O Diary.
Guest Post: What the Capital One Hack Means for Board of Directors published first on
0 notes
script101 · 8 years ago
Text
Worst Case Scenario (or "One by one I've watched illusions shattered")
THERE ARE NO SPOILERS. I HAVEN’T EVEN SEEN THE TRAILER. I shouldn’t have put the next episode’s title in the header. That was idiotic. I’m sorry.
I really was going to write off “Lie of the Land” as an aberration.
I got a refund from iTunes (a surprise!) no questions asked.
Twelve has been my favorite Doctor.
I had thoroughly enjoyed every episode until “Lie”. Even though I hadn’t bought “Knock Knock” I didn’t dislike it.
I thought “Extremis” was brilliant.
I liked Pyramid and expected that the problems others had noted in it would be plot points that would have been addressed and resolved in part three. For example, “they needed to be loved” but they clearly weren’t. No problem. They just took that emotion and laundered it towards themselves. The combination lock that didn’t look like anything I’d ever seen, had no indentations for numbers and no Braille markings? No problem. It was a trap. They were intentionally trying to catch a Time Lord. The monks had set a “vanity trap” and Twelve walked right into it. The lock? “Perception filter” The implausibly of the sonic NOT simply opening the door? No problem. See above: it was a trap specifically designed for Twelve. The reason the earth was at its weakest at that particular moment? Duh! It’s protector was afraid to tell anyone he was blind and was still in completely denial of his injury. That would have been moving. Having Bill or Nardole call him out on his inability to trust others and ask why? Cut to the final scene of him and Missy in the prison vault.
Easy peasy.
BUT Toby Whithouse instead wrote intellectually and viscerally offensive garbage.
No problem, as I said, just pretend it never happened.
EXCEPT NOW I CAN’T.
TWELVE’S ABUSE AND MANIPULATION OF BILL IN “LIE” IS CLEARLY A DIRECT PARALLEL TO THE MASTER’S ABUSE AND MANIPULATION OF BILL IN “WORLD ENOUGH AND TIME”
And the events of the last episode are central to the events in the one airing this weekend.
_______
I just read Whovian Feminism’s review of “Lie of the Land”.
I disagree with most of it.
I DO blame the writer, Toby Whithouse. Why? Because if you need non-stop narration from multiple characters, your script sucks. There’s no way around it. If you are writing human characters and those humans do not act or react like humans, your script sucks.
I maintain that the director, Wayne Yip, made every wrong choice possible. Did ya’ not palpably feel the tension caused by the janitor waving the gun around “World Enough and Time” as opposed to the gun being aimed in “Lie” when we KNEW that we were in the room where the “regeneration from the preseason promos” was going to happen?
I am glad that Whovian Feminism noted the cruelty of Twelve intentionally making Bill shoot him, but I’m disappointed that they let the character (and the writer) off so easily.
I had been using the word “Evil” since the Doctor is an imaginary alien from an imaginary planet. I wasn’t keen to “diagnose” him as a psychopath since I have no idea if this fictional species has an orbital prefrontal cortex.
But, since budget means the inhabitants of Earth and the inhabitants of Gallifrey look exactly the same, and since “kin selection” is a real phenomena that (among other things) causes people to feel naturally inclined to protect those who look similar to them, and since Robert Hare has described psychopaths “interspecies predators” who are lacking the moral compass that all but DEFINES humanity, I’m not saying “Evil” anymore.
Maybe Twelve suffered brain damage in “Oxygen”, maybe not, but as of “Lie of the Land” and every episode that followed, Twelve has been a psychopath.
Twelve is no better than the master.
(You might want an “air sickness bag” handy. I’m not kidding.)
I really was going to drop this and just pretend “Lie of the Land” never happened, I WANTED to, but “World Enough and Time” has made it impossible, because the way the Doctor cruelly manipulated Bill for his own comfort and lolz after insinuating himself into her life as a parental figure is directly paralleled with how the Master cruelly manipulated Bill for his own usage and lolz after insinuating himself into her life as a parental figure.
_______
It truly is remarkable how “Lie” managed to push every button it could have pushed.
I’m against the death penalty (I’m sure that was obvious) in all but one instance: treason.
I refuse to give them credit for the reference they were trying to make, but since The Doctor had been given the (laughably absurd) status of “President” of the earth, he was guilty of High Treason (pffft I’d have to make up a term to accurately describe the extent of what he did while under absolutely no duress!).
Twelve specifically had accepted the title of President, and he had accepted the responsibility of protecting the earth. Twelve did not just fail to protect the humans he had agreed to protect for SIX FULL MONTHS (and there was no hint at any mitigating motive despite non-stop narration; awful writing), Twelve actively aided and abetted a malevolent occupation of the planet.
Gaslighting is not funny.
No person should be toyed with to force them into the horrible corner of being judge, jury, and executioner. But this is what Twelve did to Bill. This was his INTENT. “Designed and directed”. Intentionally.
(And yes, Bill was indeed Twelve’s toy in a game for the lolz. We saw the laughing and were explicitly told it was a test. Compare and contrast with the Master’s treatment of Bill in “World Enough and Time”. The only difference is that Twelve is given a free pass for his sin.
Consider the circumstances. Bill had endured six months of extreme emotional duress, we saw she was so far over the edge that she was able to turn on waking daytime hallucinations of her mother with less effort than required to turn on a light, she was the victim of active gas lighting by Twelve because of his propaganda commercials, and this ALL culminated in her being terrorized with the promise of betrayal by Twelve in the white office (he called for armed guards the moment she entered, he pretended to phone the nightmarish monks, and he announced to the room that she was trying to speak to him in code). Each act was terrorizing. Each act was a betrayal. Each act was a knife in the heart that we saw vaporized in “World Enough and Time.”
Because of this, because of the extreme emotional duress Twelve inflicted upon her for absolutely no reason at all, Bill is, in my eyes, NOT guilty of the 1st Degree Murder she believed she was committing. He had committed unthinkable treason, intended to continue his treason, and she knew he could erase people’s memories and that the monks were brainwashing people. She was forced to shoot to kill. Twelve WANTED HER TO. For the lolz.
That crap was inexcusable! Ya know what else was inexcusable? The fact that everything individually and combined was horrifically traumatic but Whithouse’s lazy script couldn’t be bothered to address this.
By giving Twelve a free pass, by having him not recognize and apologize profusely for the psychological torture he inflicted on Bill by manipulating her to serve his own ends in “Lie”, Whithouse made Twelve no better than the Master when he in turn manipulated Bill to serve his own ends in “World Enough”. They would have remained directly related, but Toby Whithouse’s shitty script and Wayne Yip’s shitty directing had the gall to simply try to PRETEND that aiming a gun at someone you love and shooting that person FOUR ::coughFOURcough:: times with the intent to kill that person wouldn’t be deeply traumatizing.
Bill should have had a meltdown. A male character would have had a meltdown too. Because that is what a normal human reaction would be after willfully murdering someone they had loved.
Instead they showed Bill get angry at Nardole (nope, sorry: the audience was explicitly told in “Smile” that “dry brains” thought differently than “wet brains”).
Whithouse lazily tried to distract viewers from the fallout of The Doctor’s disgusting abuse and manipulation Bill with a cheap joke (oh my! Swearing! On my tv machine! How fucking shocking! Oh my, I feel the vapors coming on! Where oh where is my fainting couch?)
Immediately after Bill shot him, she should have had a breakdown.
Before anyone says that I hit the nail on the head and maybe that is the reason for the title of the next episode: yes, maybe we WERE supposed to see a parallel between the despicable actions of the Doctor and the despicable actions of the Master, but I want to point out that THAT DOES NOT MEAN THERE IS POTENTIALLY A DRAMATIC EXCUSE FOR TWELVE TO HAVE NOT CORRECTLY REALIZED THAT THE SPECIFIC DETAILS OF WHAT HE HAD ORCHESTRATED IN THAT ROOM WERE HORRIFICALLY CRUEL AND WRONG….
•while ALSO failing to realize that it was part of a larger pattern of behavior. •while STILL having Twelve not grasp that everything that happened was his fault (how about: The earth was at its weakest at that moment because its alien hero who promised to protect it was too scared to tell anyone he was blind?). •Twelve could have realized IN THE WHITE OFFICE how badly he had hurt Bill while STILL arrogantly claiming personal credit for what Bill did at the end of “Lie” that drowned out the Monks brainwashing. •Twelve could have been completely genuinely sorry for terrorizing Bill in the White Room, could have painfully regretted it, and then STILL made the mistake of hounding Bill and Nardole into the idiotic “Test” of Missy that (appears to have) destroyed Bill.
Indeed, if Twelve HAD been horrified by how terribly he had hurt Bill in “Lie”, if had truly regretted what he had done and apologized and reassured he that she had done nothing wrong (even without recognizing the larger picture of his own arrogance and recklessness), “World Enough and Time” would have worked BETTER. Why? Because without an apology and sincere regret from Twelve after he goading her into firing that gun with the intent to kill him, there is currently no plausible reason why any human would ever trust, let alone be anywhere near, The Doctor again. Male or female, THERE IS NO HUMAN WHO WOULD EVER TRUST HIM AGAIN.
Why does Bill still trust or even still care about the Doctor? Why isn’t she flat out terrified of him? There is no human who wouldn’t have gone home to their foster mom, said, “you were right about that professor”, packed their bags, and attempted to get as far away from him as possible. If her foster mom did as any one would and attempted to go to the University to scream at him and demand to know what he did to frighten her foster daughter so terribly, Bill would only need to say WHAT SHE HAS KNOWN since “Thin Ice”: THE DOCTOR HAS KILLED PEOPLE.
Without Twelve sincerely apologizing for what he did in “Lie” PLEASE explain, in terms of plausible human behavior, why Bill is still spending time with The Doctor?
The ONLY REASON SHE WENT ALONG FOR MISSY’S “TEST” WAS BECAUSE SHE CARED ABOUT TWELVE.
THE ONLY REASON BILL CARED ABOUT TWELVE IS BECAUSE SHE TRUSTED HIM MORE THAN SHE TRUSTED HER OWN INTUITION THAT THIS TEST WAS A BAD IDEA.
For “World Enough and Time” to be plausible without pretending “Lie of the Land” never happened, we needed an apology that was never given.
“Lie of the Land” was shit. The script was shit. The directing was shit. The premise was shit. The episode was shit.
And having seen “World Enough and Time”, I now believe “Lie of the Land” wasn’t simply a bad episode that I can forget and ignore, it was poorly executed deliberate foreshadowing.
Deliberate foreshadowing that unfortunately has no plausible human motivation allowing it to ring true.
Twelve is a psychopath. He crossed The Moral Event Horizon and I can’t just pretend it never happened.
Twelve was my favorite by a mile. Now? I’m disgusted.
It IS possible for them to write themselves out of the 6 foot hole they dug for this character and the entire show. But if I can’t simply write off “Lie of the Land” as no more than a lousy episode with a crappy script that was directed with less artistry than a cell phone video??? All I can say is that Steven Moffat and Rachel Talalay will have needed to have written and directed something capable of fixing this in 50 minutes minus opening and closing music. They will need to have written something far better than I can imagine.
It’s possible.
I hope that they can salvage this. Honestly and with tremendous sadness. I really really do.
0 notes
lore-of-mobius · 11 months ago
Text
Addressing Sonic's Moral Code Part 1
So thanks in part to the IDW Sonic Comics, Sonic has been given a moral code that's up there with Batman's, Superman's, and Spiderman's no killing moral codes. From here people have criticized Sonic's code to not kill his villains or at least incarnate them, calling into question him wanting freedom for everyone to live how they want. Mainly targeting him wanting to stop those from prevent others from living how they want while seeking to reform them or as some people say it forcing his ideals on to them or trying to force them to change.
From here people bring up Sonic letting Eggman and Metal Sonic go only for it to result in the Metal Virus. Or the entire back and forth with Surge. Even with characters in universe like Shadow and Espio questioning why Sonic doesn't kill or at least detain Eggman or at the time Mr. Tinker. Sonic's stance seems restorative justice as opposed to the more primitive corporal punishment and to an extent carceral punishment. Even though Sonic's representation of it isn't the best.
Regardless let's address Surge first, many people expect Sonic to just kill Surge. But it does ignore the fact Surge is someone new to Sonic he hasn't really interacted with before, Surge's trauma, and the fact Sonic and Tails do seemingly to be genuinely trying to help. But misunderstandings and plot get in the way of progress there, and Surge has to return again to be another IDW villain. But in all the characters accuse Sonic of trying to prove his way is right and just wants to use them again with all the misunderstanding having happen, and Sonic never once giving the indication he to trying to prove his way is right. With all that being said it doesn't make sense for Sonic to kill Surge, she isn't on the level of Eggman. Speaking of which many people have brought up the Joker and have compared him to Eggman in all this, though I'd argue there is form of a difference between those 2. So some people might say take her to prison. Something like that wouldn't fix the issues at hand as we all should know. Also, let's be honest the Jokers of the world are the one dealing out corporal punishment and carceral punishment. With that being said it is still possible for Surge and Kit to eventually be redeemed, they don't fall under the same restrictions as Eggman does, which I'll talk about in the next part.
Part 2
Tumblr media Tumblr media Tumblr media
25 notes · View notes