|

Accidental leak IDs over 30,000 ‘anonymous’ 2channel users

by Akky Akimoto

Japan’s most popular online bulletin-board service, 2channel (pronounced ni-chaneru), recently experienced what is probably the biggest problem in its 14-year history when its promise to keep users’ anonymity was severely broken by an information breach.

2channel was founded by Hiroyuki Nishimura in 1999. It rapidly gained popularity by offering anonymity and has become one of the most popular websites on the Japanese Web. What made 2channel special and successful was it supported anonymous posting. In that realm Japanese were free from the social roles and pressures expected of them in daily life, so could express unbiased opinions, even to the point of being antisocial.

On Aug. 26, it was reported in the media that user information had been leaked from 2channel’s Viewer service.

2channel Viewer is a membership service that costs ¥3,600 annually, and gives users privileges that regular 2channel users do not get — such as full access to 2channel’s massive archives, which usually become unavailable after the discussion thread hits 1,000 comments. Paid users can also post comments even when the boards/threads/connections are regulated for regular visitors. The service is popular with heavy users of 2channel.

The leaked info included credit card numbers and matching security codes — which are not meant to be stored on merchant’s server but for some reason were in this case. The leaked security codes mean that the hackers could make purchases anywhere online. That sounds bad enough, but for some users, worse things about them were leaked.

Credit cards can easily be stopped, and 2channel may have to pay damages if it’s found that it kept data insecurely. The bigger issue here is that the leaked data included a long list revealing which member posted each comment — something that, of course, is supposed to be anonymous. The good news is that the user-and-comment matching leak only went back one month, but that was enough to be a problem for some unlucky users. Their anonymous comments were suddenly linked to the poster’s real name and email address.

The novelist Hikaru Sugii (known for his youth fiction or “light novels”) was one who was caught red-faced and had to apologize on his blog, after it was leaked he’d made several posts smearing people on 2channel. He did not describe what the smears were, but they had already been identified on the Web: Anonymously he had slagged off his close-buddy novelists and a publisher — using such terms as “crap generator,” “compulsive liar,” “mental illness” and so on — while overly praising himself and his novels.

In another case, a popular blogger of 2channel summaries, shut down his blog after confessing he had been trolling several threads.

The leaked list also included a good number of email addresses containing company domain names. Many major newspapers and TV stations were on the list. It’s likely that some of this can be put down to researching past logs when 2channel -related crimes occur, but there are also comments that are obviously not journalistic research. Under the protection of anonymity, many users on company accounts also posted recommendations of their products while harshly criticizing their competitors.

The real names of both a college assistant professor and a junior high school teacher who had revealed some kind of sexual obsessions were also identified — which is bound to make their first class in the autumn semester rather awkward, if they still have their jobs.

Conservative LDP member Satsuki Katayama posted an angry tweet on Twitter when Net users pointed out that a 2channel user that shared her name had an address linked to a building in the government offices in Nagatacho, Tokyo. Her tweet implied that the romanization of the leaked name (Satuki) is different to what she uses and that the spelling was done by someone “foreign.” She was later shamed by people who pointed out that her website often uses that spelling.

Anonymity is perceived as the greatest characteristic of 2channel; however, it does not mean unlimited freedom of speech. Making a death threat, for example, is sure to result in arrest. When someone posts a death threat, watchers inform the police who then gain the poster’s identity from 2channel and the Internet connection provider. Death threats on Twitter or Facebook rarely lead to arrest, but on 2channel arrest is likely.

Because of this, rather than death threats, intimidation on 2channel tends to rely on vulgar words, stealth marketing, discrimination and hate speech. For such antisocial posters, 2channel has been a safe place to spread their views.

The recent revelations of Internet eavesdropping by the U.S. National Security Agency appear not to have been of much concern to the average Japanese person — the thinking being that even if the U.S. government can technically grab and read your messages, why would they single you out? The language barrier also makes it inconvenient. It is not a practical threat of your privacy.

The 2channel leaks, on the other hand, will lead to huge privacy concerns, for both trolls and their victims. These 30,000-odd paid users whose information was leaked are the most active anonymous commentators on the Japanese Web. If these people learn a lesson from the leaks — that there is no such thing as perfect anonymity on the Web — then maybe the antisocial behavior that is so prevalent on 2channel will be toned down from now on. Lets hope so.

Akky Akimoto writes for Asiajin.com, an English/Spanish blog on the Japanese Web scene. His Twitter account @akky is followed by 120,000 users.