Lost USB with 460k city residents’ personal data found
www3.nhk.or.jp
www3.nhk.or.jp
Reporter: Wasn't the password something insecure like a four-digit number?
Officer: No, it's a 13-letter alphanumeric password.
Reporter: But if it was totally random wasn't it hard to use?
Officer: It's a meaningful English word, followed by a meaningful four-digit number, so it's quite easy to memorize.
Reporter: By an English word, you mean something like _password_?
Officer: It's not a simple word. It's a word and a number that are related to the City of Amagasaki.
Reporter: Do you use a capital letter?
Officer: It's grammatically correct, as only the first letter is capital.
For god's sake, if you just lost a USB stick with the whole city's personal data, don't spell out how you chose your password!!!
In contrast, Korea seemed like it was on a different timeline with the massive digitization and broadband internet movement in the early 2000s.
With a dwindling population, Korea seems more flexible/apt at dealing with the future. There is also a much larger awareness/movement to multiculturalism whereas Japan seems unwilling to deal with the looming crisis.
I've lived in Japan for the last 10 years, in no way does it seem "stuck in late 90s". And this single incident in no way demonstrates this.
For some reason it's culturally acceptable to make these kinds of comments about Japan in English language forums. But I don't really understand why... Japan is no doubt very different from other countries in various respects. But it doesn't seem helpful to say essentially "we are 30 years ahead of Japan".
You could if you wanted say "wow the US/UK are stuck in the 1990s" because copper broadband is still common in the US/UK. In Japan you often have 4G fiber to the home in rural locations, and 10G connections available in some locations... it's not a super helpful comment though, because countries are complex and you can't point to single issues and make general statements about the countries stage of development.
This doesn't have to imply anything more than that, just like the prevalence of copper broadband doesn't say much more about the US than the fact that the US has some pretty antiquated broadband technology. You can argue about "coulds" and "shoulds", but it's always more complicated than that.
My personal experience in this space is specifically related to "RPA / Robotic Process Automation". There is significant RPA demand (and growing) in Japan due to the significant number of old systems that have never been modernized, preventing traditional forms of API-centric automation from happening. I learned about this when consulting for an RPA product team, and was surprised that a disproportionately large percentage of their prospective customers were in the Japanese market.
I won't claim that Japan is "stuck in the 90s", but there are certainly some categories in which there seems to be a cultural tendency towards caution / away from modernization for the sake of it. This isn't inherently good or bad, just interesting. It's part of what's fueling the RPA hype cycle, which is arguably just a different path to modernization than the one many other companies followed. Acknowledging this doesn't have to be disparaging.
> For some reason it's culturally acceptable to make these kinds of comments about Japan in English language forums. But I don't really understand why... Japan is no doubt very different from other countries in various respects. But it doesn't seem helpful to say essentially "we are 30 years ahead of Japan".
Examining the rate of progress and current state of things doesn't automatically have to imply there was intent to disparage or conclude anything negative.
I realize that some people will do just that, but I'm just trying to say that not all discussion is coming from this place - I personally find the RPA thing fascinating, and it helped me better understand the nature of the problems some companies are trying to solve, and why those problems are more challenging in the Japanese market than others.
Was Japan early to adopt technology in the 90's? If so, maybe what we're seeing is that modernization effort left them somewhat stuck at that level in some industries, just like it sometimes feels like the U.S. is stuck a decade or two or three behind in some industries based on the last time the majority of it retooled and modernized. If so, maybe we'll see another modernization effort soon.
In some respects this is just like buying a brand new top of the line TV with all the bells and whistles, and then skipping the next 2-3 cycles of innovation trends until the current TV seems like it's just not cutting it anymore. That seems to be a natural cycle for a lot of things.
https://41j.com/blog/2022/05/startups-and-japan/
But when people make broad statements based on single events it doesn't come off as a thoughtful comparison but something else entirely...
It's mostly because Japan is bad at web technology and APIs though. They also love gratuitous complexity; you've seen their websites and how every page is covered in stuff, but the URLs themselves are less like "youtube.com" and more like "blahblahblah.bsd.unix.nicovideo.jp/several/tech/buzzwords.jsp".
Asking because I had a bank account for almost a decade now, and I only had to use the checkbook twice, and it was pretty niche use-cases. I still have the same checkbook that I got back then, and I think I won't be able to go through the entirety of it even in multiple lifetimes.
Cannot comment on how widespread the usage of fax in Japan (since I haven't lived there myself), but, from what I heard from other people, you pretty much need to have access to a fax machine.
It's more fair to compare them to other gaming companies.
I respect the honesty but wow, I can't believe any company would spell it out that literally.
Staggering to a bench and sleeping it off is just, normal. No one is going to pick your pocket, so why not?
I can't fathom this. I cannot imagine a world in which passed out drunk guy doesn't get audited in his sleep.
I couldn’t be farther from the reality. Japanese people are so kind and welcoming, and their cities and towns are beautiful, safe, and clean. Just a simple hello led to some amazing conversations, and I felt as if I was living at the edge of the future because we talked by passing our phones to each other. Google translate enabled us to have real time conversations and get to know about each other.
I met an old man who gave me my Japanese name and dropped some wisdom. A businessman and I shared our thoughts on life and family over a late night off the map hole in the wall type of seafood ramen place. Ran into some people at a bar who happened to work in the same industry as me and we shared stories over beers. When I missed my bus in a remote town, a family reopened their restaurant and cooked a meal for me.
I was there for only a few weeks, and I wish I could move permanently to Japan. If any Japanese company or entrepreneur wants to hire me as a software engineer manager or as a co-founder, hit me up!
My immediate guess, based upon dealing with people not Japanese specifically: Japanese culture welcomes outsiders who respect the culture. But once you try to get deep into the fabric of the community (buy property, marry a local, etc.) there is a strong invisible wall of which you were not aware.
Most cultures seem to have different ideas of where and how boundaries are created to push away outsiders. The notoriously cold Germans are initially very cold, but once you're on the inside there is complete trust. Meanwhile, the flaky southern California "let's do lunch" thing is an endless series of weak onion-like translucent boundaries and you never can get to the core of things.
The only "you don't belong here" vibe is from the constant "microaggressions" from being a visible minority - people will see your face and assume you don't speak Japanese, can't use chopsticks, etc etc, but those don't come from malice but rather ignorance. Once I open my mouth and speak Japanese all that mostly goes away.
I'm married to a local, have plenty of friends who are married and own property or businesses, no problems of any sort. Get along well with neighbors, business partners, hobby circles.
The biggest barrier will be work and business culture, where Japanese will have strict requirements on cultural integration (can't be rude to a client or make them lose faith in your company) and have higher requirements on dedication to work (over health and family) than westerners and that's where I've seen all the friction.
edit: I want to clarify that this is the experience of a white westerner. I hear things are very different for people from other parts of Asia (SE Asia/China)
A friend left an iPad on a flight. That was shipped back to him as well, albeit with a dick drawn on the screen in sharpie.
Of course I'd return a wallet as-is as well without dipping in the cash (though I would count it and register the amount on the form when submitting it to the authorities to avoid any 'mislaying') but I've never found one with any in it. Most of the 'lost property' I find here is just discarded by the pickpockets.
Also, when there's identifiable information in the wallet I would contact the person on Facebook or LinkedIn if possible.
PS the misguided part is that pickpockets get only a fine for thefts below 400€. Even if it's the 5000th time.
But when you live there you learn about the underlying racism.
If you could pass as Japanese, because you are of east Asian descent, you will be fully expected to be completely fluent in the language and culture. If you aren't then you must be extremely dumb, because you are Asian after all. Any insight you might have coming from a western country is disregarded, because why would you know anything the collective society doesn't already know. When I was switching from teaching English to a tech job, I recommended a childhood friend I grew up with in America to take over my position. He was making far less teaching at a much worse eikaiwa school. In Japan, you include a picture with your resume, and when my boss saw that he was Filipino American, he outright said they would prefer someone who looks American and went with a previous coworker I had told him was awful.
If you aren't obviously east Asian you get the opposite treatment. You'll constantly be complimented on your ability to do basic things like pick up food with chopsticks and the ability to say hello. If you can have a conversation, there will be constant "compliments" on it. It gets annoying very quickly.
But when it rears its ugly head the worse is when you try to do anything real in the country a tourists wouldn't normally do. Lots of people in Tokyo bike to various places, but when I studied there we were warned to either buy a bicycle and make sure its registered or just never ride. Borrowing a friends bicycle was outright forbidden. At some point you will be stopped by the police and if you can't prove you own the bike or have permission to ride it, you will be taken in until they figure out the owner. The few students who did get bikes were stopped atleast once every couple weeks.
Depending on perspective the racism can be considered light atleast. Black and brown friends usually would say the annoyances were atleast obvious and evenly applied. The racist landlord will tell you up front that hes going to increase the monthly rent on the apartment you're trying to rent because he "had problems with foreigners" before and you don't have a song and dance with a racist person that really doesn't want to rent to you finding constant issues with your application until you give up. You can quickly scout around to find someone who agrees not to do that or atleast less so. Certain banks will outright deny certain services to foreigners, but if you know the right banks you can get a credit card. The police will bother you, but if you have your gaijin papers they aren't going to beat you or make up charges. For white friends it was usually extremely shocking that such things existed at all and usually were the most vocal about the societal racism they were experiencing for the first time in their lives. But I think it made them more sympathetic generally to people from their home countries.
Despite all of that, I loved my years in Japan. A lot of the smaller annoyances usually go away once you actually get to know people and explain the issues you're having. One girlfriend even took it on herself to explain to new friends how condescending it was to say I can use chopsticks so well after living in the country for multiple years. Often times its ignorance not malice and people understand. But there are definitely issues you will have if you're a foreigner and you move to Japan.
Americans find a lot of things like this incomprehensible and annoying, but if you're British you'll be right at home. Japanese people are just Asian English people.
(This also explains why they're train otakus, the way other countries only like their nerdier TV shows, and the occasional colonization.)
That's hilarious. I don't know many English or Japanese people, but all of my stereotypes of both have way more overlap than I thought.
Maybe it's something in the tea.
I've not before seen this word used to substitute for being checked over for being robbed.
One example are the notoriously expensive bars in Roppongi, at night there will be touts in the streets trying to convince tourists to join them for a night of drinking. They'll then go to the bar that hired those touts where, after a night of drinking, the tourists will be presented with a bill that's the equivalent of getting robbed.
The line for "acceptable robbery" was "no physical violence" + "someone consensually gives me their money."
Which is still possible (and easily doable if that mark is drunk), but is substantially different from American (and European?) style physical robbery.
Long and short, don't let someone on the street talk you into going into a bar or tea shop or whatever, and especially don't follow them to a second location.
People love to point at the U.S and its gun crimes as a direct result of the country's gun laws in particular, but overall, when certain very specific factors, population areas and very specific geographic regions are excluded, much of the country where guns of all kinds are easily available is barely more violent than your typical Western European country. The school shootings that people refer to are awful things, but statistically, they don't move any needle so much as an iota. They do however get enormous amounts of media attention. Other countries with very strict gun laws also have mass shootings and mass killings, both with guns and without guns, but again, less media focus because it doesn't fit certain narratives about the U.S being violent as hell because of gun posession.
Tongue in cheek aside, it's incredibly stupid to make sweeping, broad, categorical judgments of certain things because of isolated, exceedingly rare incidents. It's even dumber to make broad, sweeping laws around emotional reactions such as yours to such events.
Every school shooting is a grotesque tragedy, but means of fighting them exist that don't require gun ownership to be banned for the millions of people who not only peacefully use guns but also in some cases need them for an assortment of reasons. "What about the children?" has rarely been a good or honest argument for anything, particularly for badly considered laws pushed forth by bouts of moral indignation and self-righteousness.
Even among rabid USA fans like me, American prestige is currently falling like a brick.
Do you have an article or graph (per capita or absolute) of deaths comparing the two countries you could point to for more info?
I'm told that in northern Europe you could leave your laptops or whatever in semi-public places (like, cafès I suppose), and if you come back after a few hours it would still be there.
Can northern Europeans confirm or deny this?
You can usually ask someone to keep an eye out while you go to the restroom/refill coffee and most people are happy to help, but you need your due diligence
Where it is not true is in large cities. Small cities and rural areas are one of the safest places on Earth as long as you don't get nibbled by a moose or overrun by ants.
Where I'm at when people (like, taxi drivers) do bother to return lost-and-found wallets, it's newsworthy enough to make its way to the newspaper.
That should tell you the status quo here.
When a company does a standard "we take your privacy very seriously" non-response right after demonstrating that they do not, in fact, take it very seriously, it makes it sound like they're not willing to acknowledge the problem at all.
I think it’s more that 80% of all company employees can symphatize. The situation isn’t all that uncommon (falling asleep on the street and misplacing your stuff somewhere). The fact that this person had a USB stick with the data of ~450k people on was.
The transparency of the entire event, end to end, becomes a "ho hum, thanks for telling me, i guess" sort of story. Which is, I suppose, why it's on HN.
I mean, "guy loses usb with data, finds usb with data" used to happen to me twice on Thursday back when usb was a thing. It was hardly front page news.
"Nationwide cybersecurity attack performed by state level actors using novel techniques"
That explains the daily mass protests I see on TV in Shanghai and Beijing about slave labor. Or all the discussion about the Tiananmen Square protests. Or all those T-Shirt vendors with shirts that have the Tank Guy pic or Free Hong Kong slogans.
> one of the few things I liked about China as well, which is similar int his aspect, people have no problem to say harsh truth (unless it's politics)
Some of the people who live there would disagree with your assessment.
What a hearty laugh this gave me early in the morning, thank you.
I stand corrected.
Edited for clarity
It can happen to Americans as well, as evidenced by an Apple engineer leaving an iPhone prototype at a bar after his birthday.
> "I underestimated how good German beer is," he typed into the next-generation iPhone 4
I don't know why you bring a USB stick with half a million people's data with you to the bar. Why is that even leaving the office?
I bring this up not to talk about differences between Americans and Japanese (boring, I think they are probably exagerated), but becuase these are different "threat models". You handle the "USB stick with company data" on it "threat" by training people... not to just stick sensitive data in their pocket as they go about their business? It should be on a USB stick for as little time as possible and that USB stick should be treated like it's worth a fortune (because it is). There's no reason you should be carrying that thing with you to the bar in the first place.
The iPhone case... eh, if you ask people to carry a device along with them in their daily lives, it's inevitable that someone will forget one someplace at some point. Maybe some kind of proximity alarm that beeps if you walk away from it?
[1] https://en.wikipedia.org/wiki/Evil_maid_attack
[2] https://en.wikipedia.org/wiki/Face_(sociological_concept)
But if Apple actually wanted media outlets to cover it, having law enforcement seize and search the property of the editor that broke the story, and then banning the media outlet that broke it from WWDC... doesn't seem like the way to encourage anyone to cover it next time there's a leak, if you're actually hoping for coverage of secretly orchestrated leaks. https://www.pcmag.com/archive/gizmodo-banned-from-wwdc-25149...
For the iPhone 4? Absolutely not, the only other model which changed iPhone as much as the 4 was the X, Steve was still alive for the 4 and there is absolutely no way he would have approved just leaving it in a bar for hype.
Steve Jobs wanted to be the person who showed that to the world. Remember the first MacBook Air? Steve lived for that moment.
"...More than 120 USB memory sticks, some containing secret information, have been lost or stolen from the Ministry of Defence since 2004, it was reported earlier this year....Some 26 of those disappeared this year == including three which contained information classified as “secret”, and 19 which were “restricted”...."
"UK Ministry of Defense Loses Memory Stick with Military Secrets" (2008): https://www.schneier.com/blog/archives/2008/09/uk_ministry_o...
[1] https://www.cnet.com/tech/tech-industry/apple-loses-another-...
> The company explained that the employee had drinks after work and later fell asleep on the street, but when he woke up he realized that he had lost the bag containing the USB.
My premise was going to be that perhaps this isn't the company you'd trust with the residents' subsidies but clearly I misunderstand the cultural aspect to this story. The other thing I didn't get is that the employee who "lost" the bag filed a police report for theft. If you're passed-out-drunk, how would you even know it was a theft?
Edit: An eye opening video on how well this works https://www3.nhk.or.jp/nhkworld/en/ondemand/video/9999897/
Fall asleep thinking you are carrying bag. Wake up when slightly less drunk. No find bag. Freak out. Rush to report bag as stolen.
Later go back the all the bars in town (forgot where you went), and find the one where you left your bag behind.
From 2020: “With an inner-city population fast approaching 14 million people, millions of items go missing here each year. But a staggering number of them find their way home. In 2018, over 545,000 ID cards were returned to their owners by Tokyo Metropolitan Police – 73% of the total number of lost IDs. Likewise, 130,000 mobile phones (83%) and 240,000 wallets (65%) found their way back. Often these items were returned the same day.”
Source: https://www.bbc.com/future/article/20200114-why-japan-is-so-...
> A group of 13 research assistants (11 men and 2 women) were recruited for a trip around the world. They traveled to 355 major cities across 40 countries. In each city, they visited banks, theaters, hotels, police stations, and other public spaces and turned in a “lost wallet,” which they claimed to have found on the street, to a nearby employee.
https://gizmodo.com/researchers-lost-17-000-wallets-in-hundr...
I also wonder if this is more the result of a homogenous society. Since everyone is expected to know the rules and the cost of going against it is known. ex) ijime culture in japan
The issue with finding lost items is that people would usually leave them at the police station, if you're familiar with the NYC police department you would know they are one of the most corrupt and overbudgeted forces in the world.
For some reason theyre not returning lost items to people or actually interested in doing so.
They're really good at standing around and parking illegally though.
I learned about this when the police pulled me over to return the wallet.
Freaking Sicily!
Oh, Japan...
Many people on the internet guessed what the password probably was (city name + year).
When I asked why our personal information was stored on a laptop I was told that I was being "unhelpful".
Thankfully not long after the company was acquired and they fired everyone who wasn't directly making products or customer facing or a direct manager of a customer facing or product development employee. It was a pretty stark layoff.
I later ran into the new CEO who was super personable and we were chatting and I asked about the acquisition. "We wanted the products, we wanted the support team and engineers, but we knew we didn't want any of the rest, they were not smart people." I liked that guy.
Call me cynical, but I'd say that sentence translates to "someone at HR wanted a new laptop".
Shows news is best sourced from multiple sources for the full picture.
The data was encrypted and protected with a password, according to the city.
The city name is Amagasaki. Everyone on Twitter is guessing the password was "Amagasaki2022"
But … while it’s possible, I think we all know they probably just stored it as plaintext :-D
It’s kind of like a TOTP code for noobs (not even remotely as good as TOTP but something your gran could still manage understand).
The services I know which do this will have an additional password for online stuff which is different to the aforementioned and does have to be supplied in full. Thus, you’d hope, is hashed and salted etc. However you don’t supply that password when making phone calls. Sometimes you even have to supply both pieces of information when logging in online.
It's a useful vector for things like malware because an intermediate scanning service can't examine the attachment without having both emails. If there's a concern about some PII or whatever being intercepted in transit, it should help with that too.
I gave up on PGP, and most of my clients and I don't have an e2e encrypted chat or password manager service in common.
But at least I tell them to use a "burn after reading" post on an encrypted pastebin like 0bin.net for the secrets thing to send me.
It adds almost no complexity, best case scenario, you increase the security against bots since they would need to parse the link, visit the paste, trigger the Burn After Reading feature, interpret JS, extract the password and use it. That's already a pretty specific bot.
Most interceptions, even human, will be detected thanks to the burn after reading. And the password is never stored in the pastebin db since it's encrypted client side.
Worst case scenario, it's the same than a plain text email. Not much to loose.
It's easy to teach. Requires no install, little skill or tech, works in most corporate setup.
It's not good security. But it's better than abysmal security.
It's pretty clear in my travels that there's good and bad in pretty much every culture and every country, and that you should focus and celebrate the good while being highly aware of the flip side of things that might be an issue if you are blind to that.
Incident response always ends on "lessons learned" and it's rarely productive to hide the facts due to political embarrassment. Earliest disclosure also mitigates against much bigger liabilities as a consequence of a leak.
> management above should be fired and prosecuted.
And be immediately replaced by management with the same level of understanding and responsibility.
> Haven’t these fools realized...
No. And this is the key point. The biggest thing by FAR in cybersecurity is education. Ordinary people do not have any working model of the threat landscape and basic operational security because they foolishly, blindly trust technology and services providers.
We literally need a second digital literacy revolution. One that undoes a lot of the naive and trusting enthusiasm for digitalisation that we inculcated in the 80s and 90s. Unfortunately that goes against the grain of almost every policy that's active out there today.
For all the talk about the USB and the handling of data, I so wish it had sparked some conversation about the drinking problem in Japan, but nope, not one bit about that. But you'll regularly hear how dangerous and evil Marijuana is...
It seems that exactly the same happens here and there each a few years.
If they even were encouraging people to try possible passwords, well... nobody is so dumb. My bet would be that the USB has been hidden in a safe place for some hours but knowing all the time where was.
[1] "Tokyo police lose 2 floppy disks containing info on public housing applicants" - https://news.ycombinator.com/item?id=29738298
My cynicism will live to fight another day though!