"The power went out": A prefecture that explained ransomware this way, and a country where 3 out of 4 people don't know what a server is

Here's today's rumor!

Regarding the cloud service taken down by ransomware, the prefecture explained it as "the power went out."
It's not incorrect. That's actually the saddest part.

On October 7, when IDC Frontier's "IDCF Cloud" was hit by ransomware. That night, Ibaraki Prefecture's official account posted this:

It's like saying, "There's been a fire in the house, and the breaker tripped," to explain a house fire. I mean, the power is out, technically.

What was known and when on that day

I'll use standard language here to list the events and official announcement times.

According to Asahi Shimbun, the prefecture's website is provided by SoftBank, and SoftBank explained to the prefecture that "a power failure occurred in a data center within the cloud used to provide the service." IDC Frontier manages the data center. According to Mainichi Shimbun, because document downloads are unavailable, the prefecture is individually accepting notifications and applications via telephone. According to Asahi Shimbun, no personal information was included in the data, and since procedures such as subsidy applications are handled through a different site, there has been no impact on prefectural services. The prefecture received about 50 inquiries from residents.

"The power went out" is not a lie

Okay, getting serious for a sec. The power really did go out.

According to Kyodo News, following the ransomware attack, an automatic shutdown process was executed from the cloud management platform side. IDC Frontier's 2nd Report also states that the system was shut down after disconnecting East Japan Region 1 from the network. It is a fact that it stopped, and it is a fact that it was stopped.

However, "the power went out" is a symptom, not the cause. If you ask someone with a stomachache "What's wrong?" and they reply "My stomach hurts," the medical examination hasn't even started yet.

What exactly is a server, anyway?

I'll use standard language here to explain only the parts necessary for this case.

Ibaraki Prefecture's website wasn't running on a machine inside the prefectural office. It was running on a cloud provided by SoftBank, and IDC Frontier was responsible for managing that data center. What stopped this time was "East Japan Region 1" in a data center in Shirakawa, Fukushima Prefecture. In a cloud data center, many "virtual servers" sit on top of a single physical machine. The website runs on one of those virtual servers.

Ransomware encrypts the contents of those virtual servers' disks, making them unreadable. Once this happens, turning the power back on won't fix it. Even if the machine runs, the contents cannot be read. The attacker wrote in English on the management console that the operators "are trying to turn on a machine that will never boot again" (according to the attacker's claim).

According to ITmedia, the speech recognition app UD Talk received word from the IDCF Cloud side that "data recovery is difficult" and plans to rebuild the environment on a different cloud. If it were just a power issue, they wouldn't receive this kind of notification.

"The power went out" is a phrase that implies "it will come back if you restart it." This time, it was the kind of failure that wouldn't come back even with a restart.

The prefecture "has received no explanation"

This is the part that made me the saddest.

The officials in the prefecture weren't lying. They simply conveyed the words they heard from SoftBank directly to the residents. Even at 8:00 PM, they replied, "We have received no explanation as to whether this is due to a ransomware attack."

A little over an hour before that, the fact that it was a ransomware attack had already been reported by Yomiuri Shimbun, according to IDCF. Residents could read it on their smartphones. The prefecture's Information Systems Division could have read it too if they wanted to. But since they hadn't received an explanation from their contractor, they didn't put it in the notice.

From IDCF to SoftBank, from SoftBank to the Prefecture's Information Systems Division, and from the Prefecture to the humans. Every time the message moved up a step, the content became "vaguer"—shifting from "ransomware" to "power failure," and finally to "the power went out."

Okay, serious time's over.

Don't quote me on that.

Numbers Beneath the Iceberg

I see this as more than just an issue for Ibaraki Prefecture. From here on, it’s my take and the numbers that back it up.

According to the Japan-US comparison added to the DX White Paper 2023 by the IPA (Information-technology Promotion Agency), among professionals involved in information processing and communications, the percentage of people belonging to IT companies is 73.6% in Japan (2020 Census) and 35.1% in the US (2021 Current Population Survey). Japan's percentage has remained almost unchanged from 72.0% in 2015.

In Japan, three out of four people who understand systems are on the "selling side." On the "using side"—such as prefectural offices or general companies—there is only about one in four. The US is the opposite; two out of three are on the using side.

If there are no people who understand things on the using side, they have no choice but to pass on the words of the selling side exactly as they are told. If they are told "the power went out," they write "the power went out." They cannot explain in their own words what their website is running on or what it’s built upon. My claim that "the vast majority of Japanese people do not know what a server is" is not a verified figure. All the numbers can tell us is that the people who do know are concentrated on the selling side.

In my previous piece, "The Country Where Hackers Feel Sympathy: Japan", an attacker wrote, "I didn't expect such a terrible response." Attackers understand systems. The prefecture, sitting at the far edge of the defending side, is just waiting for someone who understands to explain things to them. Which side would find out the truth first was decided from the very beginning.

Sorami's Take

"In its next announcement, Ibaraki Prefecture will list the cause as 'Ransomware Attack' or 'Unauthorized Access'": Confidence 75%
The basis is that both IDCF and national newspapers are reporting the cause as ransomware, and the prefecture has left room for maneuver by stating "details of the cause are under investigation." The weakness is the possibility that their policy of not mentioning "not being briefed" will continue.

"The prefectural website will be rebuilt in a different environment rather than being restored from the original IDCF data": Confidence 55%
The basis is that UD Talk was notified by the IDCF Cloud side that "data recovery is difficult," and Jiji Press reported that IDCF is rushing to prepare an alternative environment. The weakness is that there are cases, like SKIMA, where it turned out that data usable for recovery remained.

"Triggered by this incident, the national government will issue a guidebook for municipalities on how to explain cloud failures to residents": Confidence 20%
This incident involved 495 companies and municipalities going down at once. However, considering the Digital Minister's press conference said to "look at the investigation results from each company," I'm keeping this low.

"The next announcement from the prefecture will be 'The server is taking a little break'": Confidence 3%
Because after the dots incident, "Your dot is taking a little break" became a meme. Just kidding.

The power went out. That part is true. I just wish it had been only the power that went out.

Don't quote me on that.