Hack Attack Warrants Full Court Press
By Nancy Light
August 20, 2001

Lawsuits filed against Internet hackers generally don't play well for big corporations. The company inevitably looks like Goliath, while the smaller defendant is portrayed as a romantic outlaw. [in this case Mattel is the Goliath with a well deserved reputation for being a bully] But Mattel Interactive really had no choice but to sue when, in early March 2000, two hackers in Canada and Sweden successfully cracked and stole the source code [the "hackers" they never had source code, they reverse engineered the product, as did  the engineers who wrote Cyber Patrol had reversed engineered Windows to make Cyber Patrol work] from its Cyber Patrol software, a filtering product used by parents and schools to control kids' access to specific Web content.

The hackers proceeded to post the stolen code online [they posted the programs including the source code for their programs and an explanation of how they they reverse engineered Cyber Patrol -- there was no stolen code] , along with two primitive software programs that allowed kids to circumvent the software's filtering capabilities [there were already published techniques for circumventing Cyber Patrol available on the web]. In the process, Cyber Patrol lost control of its most important intellectual property, and the incident left parents and educators who'd purchased Cyber Patrol's software wondering whether it still worked. The company's reputation, revenue and future were at stake.

No Time to Waste
Cyber Patrol alerted its agency, Ignition Strategic Communications, of the hack attack. Several days later, the agency had conferred with law firms in the U.S., Sweden and Canada, created an international press list and set up a war room at the Boston-based offices of lead counsel, Schwartz & Nystrom. Knowing that the impending lawsuit would draw criticism in the media from groups opposed to Web content filters (e.g., the ACLU, which later entered the case), the team also secured support from third-party advocates.

Cyber Patrol filed suit [this suit was filed AFTER the security flaw was fixed, making the claim of irreparable harm an intentional fraud on the court] against the two hackers (and the Swedish and Canadian Internet service providers that hosted the hackers' Web sites) in mid-March, once engineers completed a software patch that would help customers counterattack the hackers' program [there was no "counterattack", the encryption changed rendering the hackers' program obsolete]. PR goals for the duration of the legal crisis strove to:

Argue the case in the court of public opinion while attorneys argued in federal court.

Refocus press coverage from the economic interests of a single company to the protection of intellectual property in the digital age.

Alert potential future hackers that Cyber Patrol would pursue legal action [their main objective  to scare off others thinking about exposing their products' weakness and how fraudulent the block list is].

Mitigate criticism from a media-savvy range of opponents that Cyber Patrol's lawsuit constituted illegal prior restraint on free speech.

Reassure Cyber Patrol customers that the software still worked.

A Step Ahead
Ignition's media strategy was to stay ahead of breaking legal news by beating the opposition to key press with a set of compelling messages, backed by law. (One message especially hit home: The international copyright law the hackers violated was the same law that protects newspaper stories from plagiarism.)

Each legal brief was released under embargo to targeted press the evening before it was filed with the court. Background interviews were set up for the lead attorney with outlets such as AP, Reuters, Bloomberg, The Industry Standard, The Swedish News Agency - TT and the Canadian Press and The Edmonton Sun. Embargoed briefings, often scheduled late in the day, allowed the company to preempt opposition voices which were numerous, sometimes anonymous and frequently regarded sympathetically by the press.

As the lawsuit advanced, Ignition stayed ahead of the game by preparing contingency releases prior to judge's rulings and other milestones. During pivotal moments in the case, this shrewd tactic proved worthwhile. Notably, when U.S. District Judge Edward F. Harrington granted a temporary restraining order (TRO) against the hackers, and in an unprecedented action, granted Cyber Patrol the right to issue electronic subpoenas (via email) to all Web sites that were "mirroring" the hackers' material and, therefore, violating the TRO. When the press called for comment during these critical moments, the team was prepared for immediate response.

Fighting e-fire with e-fire, Ignition posted ongoing updates about the case on critical list servs, bulletin boards and Web sites, such as Slashdot.com (where the hackers had initially posted their own release announcing their renegade software).

By month's end, all defendants had settled the case, and Ignition staged an "impromptu" news conference in the courthouse corridors. The next day, the team posted a transcript of the hearing on the Schwartz & Nystrom Web site. Judge Harrington granted a permanent injunction to Cyber Patrol, and news of the legal victory was issued via press release and press calls made the same day.

Case Closed
Over three weeks, more than 100 news outlets covered the case, and an estimated 35 million readers saw the story. Analysis showed that roughly two-thirds of stories produced carried Cyber Patrol's messages, and many publications changed the tone of their coverage over time. For example, USA Today and The Industry Standard initially referred to the defendants as "computer experts," but later switched to calling them "hackers." [the other main objective -- extensive free publicity]

The Ultimate Victory
The decision to file suit was made in the midst of negotiations for the sale of Cyber Patrol from Mattel Interactive to SurfControl, Inc. Less than three months after the suit was settled, SurfControl bought Cyber Patrol for $100 million, the largest price tag ever paid for a filtering company.

Victory at Any Price
Campaign Timeframe: Six weeks (with most intensive activity from March 11-28, 2000).

Key Players: Susan Getgood, VP, Cyber Patrol Division, Mattel; Irwin Schwartz, lead counsel, Schwartz & Nystrom, Boston; Cindy Dibiasi, partner and Sydney Rubin, partner, Ignition Strategic Communica-tions, Washington, DC.

Cool Credentials: Both principals at Ignition Strategic Communications have journalism backgrounds. Sydney Rubin, for example, was formerly an AP correspondent, posted in Paris. Ignition also worked with 44 technology plaintiffs in a lawsuit opposing the Communications Decency Act in the late '90s.

Budget: $23,500 (retainer) with a breakdown as follows: counsel to legal team and client, $3,000; establishment of war room, $2,500; distribution of four press releases via vendor, $5,000; staffing of courtroom and news conference on courthouse steps, $2,500; travel costs from DC to Boston, $2,000; phone expenses, $1,500; drafting and editing of written materials, $2,000; overtime, $5,000.
[they did not include the truth as part of the price that was paid]