Tag Archives: sources

Research: regional publishers may be risking their sources and their brands

Whistle with spikes

Journalists say sources are less willing to talk because they are afraid of employers. Image by Terry Border

Local journalists don’t know how to protect their social media accounts, or the law regarding sources, and they don’t know what their employers are doing about online security.

That’s the upshot of research that I conducted with dozens of reporters around the UK – and it’s so important I’ve organised an event to tackle it.

Here are some of the key findings…

Journalists could be compromising colleagues – but they don’t think security affects them

Over the past year it’s been revealed that UK police forces have been accessing regional journalists’ communications, and at least one local authority has used its powers to spy on journalists meeting an employee: security isn’t just about GCHQ and Edward Snowden.

Social media accounts that have been hacked in the past few years include those reporting on subjects as innocuous as entertainment and the weather, while commercial organisations including Microsoft and Vodafone have hacked journalists’ communications when they wrote about them. This week a journalist was found guilty of helping hackers access a newspaper CMS, causing almost $1m in damage.

But local journalists’ and editors’ perception of the issue is that security is “another planet”, there’s no strategy for protecting branded social media accounts, and it is assumed reporters who routinely need to protect their sources are “usually pretty conversant with that kind of issue”.

Unfortunately, on the whole they are not. More than one experienced crime reporter that I spoke to operated on the basis that police requests to access their sources would come through the newspaper. “They’ve never taken action to gain that information from me,” one said.

But the key thing that I’ve discovered is that networked working practices in modern newsrooms mean that information regarding sensitive stories can still be accessed through communications with colleagues who do not consider security to affect them.

1 in 5 lack even basic password security

Despite feeling that security issues did not affect them, around half of journalists had made some changes to their behaviour online in the past year.

But a significant proportion of journalists were not even using different passwords for different accounts – one of the most basic security practices.

22% of journalists do not use different passwords for different accounts


16% of journalists did not do any of the following: use different passwords, clear their browser history, turn off cookies, turn off geolocation or use enhanced privacy settings on social media.

What are publishers doing about information security?

Despite hundreds of journalists and many editors signing Press Gazette’s Save Our Sources petition last year, there is no indication of leadership or communication from the top on the issue of source protection.

Journalists overwhelmingly said that they did not know what their organisation was doing about internet security. But perhaps more importantly, editors did not know either. “I should know the answer to that,” said one, “and it’s worrying that I don’t.”

88% of journalists do not know what their employers are doing regarding security

31% of journalists said their employer was doing enough to protect employees and sources


Strangely, even though only 4% of respondents said that their employers had taken steps in the last 12 months on the issue, almost a third of respondents made the leap of faith to say that their employers were “doing enough”.

Newsroom processes aren’t set up for modern law and technology

One thing became very clear: newsrooms and work processes are still set up for an analogue world where protecting sources is a reactive process. Discussions about sensitive sources focus on a potential legal defence if approached directly. No processes are in place to anticipate or prevent sources’ identities being accessed indirectly.

Likewise IT policies focus on protecting email – but there is little consideration to securing social media accounts.

And journalists felt unable to advise sources who were unwilling to talk because of workplace surveillance and contracts with ‘gagging’ clauses.

What I’m doing about it

I’ve organised an event to try to begin to address these issues, with people who have been directly affected, experts on law (including employment law) and people who can advise on the technical side. It’s in Salford at BBC in Media City on Friday November 6 – you can sign up here.

Protecting whistleblowers, anonymity – and Daniel Ellsberg. Day 2 of the Logan Symposium

In a guest post for the Online Journalism Blog, Natalie Leal reports on Day 2 of the Logan Symposium on secrecy, surveillance and censorship. You can find a post about Day 1 here.

The surprise of the Logan Symposium‘s second day was the appearance of Pentagon Papers whistleblower Daniel Ellsberg, who leaked those documents in 1971. “Secrets are not kept so much by technical means but by people,” he said. Continue reading

Four examples of different threat models

My post on threat models for journalists is quite lengthy, so I thought I’d put the sample threat models from that in their own, separate post. Here they are – note that these are very simple, sketchy threat models and you would want to expand on these. But hopefully they provide a starting point.

What info do you want to keep? Passwords. Why might someone want it? To spam. What can they do? Guess password, phishing. What might happen? Damage to brand, trust.

A basic threat model for anyone with access to a key social media account – or colleagues who do.

What info do you want to keep? Communication with sources. Why might someone want it? To prevent publicaiton, smear. What can they do? Guess/hack password, phishing, legal avenues. What might happen? Story killed, credibility, trust.

This is an example of a threat model for anyone who deals with protestors, complainants, or others who might be targets of others

What info do you want to keep? Identity/location of sources. Why might someone want it? To intimidate, attack, smear. What can they do? Guess/hack password, phishing, metadata, mobile trail, more. What might happen? Source attacked, imprisoned, trust.

When dealing with whistleblowers, leaks, or sources in oppressive regimes, you need to protect identity and location. Here’s a sample threat model for that.

What info? Documents. Why? To prevent publication, identify sources. What can they do? Guess, hack, phish passwords for cloud services. Legal avenues etc. What might happen? Story killed, credibility damaged, sources don't trust.

When working with documents, you may need to prevent others getting access to them. Here’s a sample threat model for that.

A lesson from Superstorm Sandy: How to find sources using social media

By Ian Silvera

In a world where an extraordinary amount of people own smartphones, it’s easier than ever to connect instantaneously with those affected by significant news events wherever you happen to be based. But what tools can help reporters find those affected?

Simple searches on Twitter or Facebook may present too many ‘junk leads’ to wade through. Tools like TweetDeck are better, but what if you were able to find social media users more quickly through geolocation? Surely that would be a much more efficient method?

There are numerous websites out there that offer this functionality.

Continue reading

Dispatches’ Watching the Detectives: why journalists should be worried about the Communications Data Bill

Consider these two unrelated events:

  1. A bill is proposed to record every contact (and possibly search) made by every UK citizen, to be available to law enforcement agencies and stored by communication service providers
  2. An inquiry into press standards and a leaked Home Office report both uncover the ease with which private investigators can access personal records through law enforcement and other agencies

I’m worried about 1. because of 2. And tonight’s Dispatches: Watching the Detectives does a particularly good job of illustrating why. It is “the ease and extent to which the unregulated private investigation industry is willing to acquire personal data for a price” – not just from the police services, but the health services, benefits system, and other bodies, including commercial ones such as communications service providers (for an illustration of the data security of private companies, witness the Information Commissioner’s Office targeting them after a series of data protection breaches).

If you’re a journalist, student journalist or blogger with any interest in protecting your sources, you should be watching the Communications Data Bill closely and understanding how it affects your job.

In the meantime, it’s also worth developing some good habits to protect your stories and your sources against unwanted snooping. More on my Delicious bookmarks under ‘security’.

Going ‘web-first’ – extract from Magazine Editing (3rd ed.)

In the final of three extracts from the 3rd edition of Magazine Editingpublished by Routledge, I talk about the tension between publishing first online, or holding material back for print. 

Magazine editors worry about topicality. Stories they send to press on Monday may be out of date by the time the magazine appears on Wednesday or Friday. It is no consolation to know that similar doubts affect the editors of daily newspapers, fated to follow in the wake of television. The print media must play to their strengths. Even a weekly magazine cannot stay on top of a breaking story of national significance. By the time it has appeared, things will have moved on and its readers will have seen more recent material online, on television and radio, or in their daily newspapers.

The internet, however, levels the playing field. TV, radio and newspapers all increasingly begin their reporting online. This is called a ‘Web first’ strategy and has its advantages and disadvantages. Clearly the major advantage is ‘owning’ the story. If you are the first to report it online then you are likely to dominate the search engine results when people look for that story. This in turn is likely to drive readers – and potential subscribers – to your main product (whether that is print or online).

The major fear that publishers have with ‘Web first’ strategies is losing their exclusives to rivals. This, however, is to misunderstand the complexities of multi-platform publishing which should involve playing to the strengths of each medium you publish in. Some publishers, for example, will supply video interviews to broadcasters (and online) just ahead of the publication of the print version of their story. This helps attract interest from people who might not normally buy your publication, without ‘giving away’ the print version of the story itself.

A good example of how not to do this comes from Rolling Stone magazine’s profile of top US commander Gen. Stanley McChrystal. The general was quoted making negative remarks about the vice president and key members of the US cabinet and the publication of these remarks in print led to his dismissal.

The dismissal, of course, increased interest in – and awareness of – the profile piece substantially – but the magazine failed to react to this interest on its website. As the website Talking Points Memo reported in a piece entitled ‘How Rolling Stone Won The News Cycle And Lost The Story’:

“Rolling Stone didn’t even bother putting [the story] online before they rolled it out [in print]. In fact, despite the fact that everyone else’s website led the profile, Rolling Stone’s site led with Lady Gaga … all day and didn’t even put the story online until 11:00.”

Nieman Journalism Lab explained why this cost them:

“The story made its way across the web anyway. Politico posted a PDF of the story and the Associated Press ran a thorough summary. Rolling Stone didn’t get much in the way of traffic out of it … After the piece ran [on Rolling Stone’s website], it started picking up incoming links, presumably driving tremendous traffic to the site. I checked in on the story today, exactly 24 hours later, to find that, despite the story completely dominating the news cycle — TV, blogosphere, Twitter, newspapers — only 16 comments had been posted to the story.

“Why? Of course the late posting was a factor. National security reporter Spencer Ackerman’s first [blog] post on the general’s apology, which went up several hours before Rolling Stone published, attracted 47 comments on his personal blog. Politico’s defense reporter Laura Rozen’s blog post on the AP’s summary of the story, which went up at 10:46 p.m. the night before the story appeared, has about twice as many comments as the Rolling Stone story itself. Twitter was buzzing with comments all day. There was nowhere to discuss at Rolling Stone, so the conversation naturally happened elsewhere.”

Another approach is to play to the community-based strengths of online publishing, by seeding an online debate with the main points of your exclusive, and using the best parts of that online discussion to flesh out the publication in print of your full exclusive.

In other words, do not fall into the trap of overvaluing the ‘exclusive’ at the expense of actual readers. If your objective is to attract the largest number of readers – online and in print – then be strategic in how you publish different parts of your story across different platforms. Can you involve online users at an early stage? Can you produce video or audio that bloggers and broadcasters might want to distribute? How can you give it the richest treatment in print that could not be duplicated in a broadcast or web treatment? And, once published, how can you ensure that discussion of the exclusive takes place on – or directs traffic to – your site (or indeed, where your revenue is coming from, which may include adverts embedded in media on other sites)? All of these elements require thought at the outset of any newsgathering operation.

A magazine has its own strengths it should play to. Instead of trailing behind newspapers and television – whose space and time is more limited, and news cycle more tempestuous – it can provide analytical coverage, based on its trusted relationships within the industry and in-house expertise. It can also focus its treatment more specifically than the mass media will – as a newspaper with a broader audience will not be able to assume much prior knowledge on their part.

Some editors, usually of weekly magazines, take the view that monthlies shouldn’t try to compete in the news area. They should simply use the space for something else. This is defeatist, and overlooks the role of the website in providing news updates as they occur. The slower pace of a monthly should mean that it can unearth and research genuinely exclusive stories. That way it will lead everybody else, which is good for morale and sales. It can certainly go deeper, using the sources it has had time to cultivate.

If you are going to do news in a monthly, you must consider the issue of the exclusivity of your stories and whether you wish to lead with the story in print or online. Given the increasing ability of sources to publish themselves (via a company or individual blog, for example – or even Facebook), or the likelihood that someone else might do the same, obtaining cooperation and silence while you wait for the next monthly print run to roll around is becoming increasingly difficult.

Ultimately you must ask yourself where the value lies: in the exclusivity, or in the treatment and distribution of that information? Do people buy your magazine purely for the exclusive news – or largely for other content? Is it better to publish part of the exclusive online, establishing ‘ownership’ of it and promoting further revelations or analysis in print? (While also attracting new readers who come across your publication when a link is sent to them)

Publishing a part of an exclusive online – and holding the remainder back for print publication – is a strategy often adopted by publishers. Your own decision will depend in large part upon where your funding comes from, where you are trying to attract it, what sort of people read your publication, and how.

More and more publishers are going for this ‘web-first’ strategy, playing to the strengths of each medium: speed, findability and social distribution online; and analysis and depth in print. It can also increase the life of a story from a single issue to a couple of weeks online, through printing, and back online with further reaction.

Building a relationship with sources often rests on the authority of your magazine and yourself, and the serious treatment you can give to their story. They will have to balance that against the control that they will have if they publish the story themselves, online. One factor that may be worth raising is that ‘exclusivity’ often attracts more interest from those who missed the exclusive, than a source-published story which all journalists can see at the same time. The founder of Wikileaks understood this when breaking the various ‘Warlogs’ stories – instead of publishing the logs online as they had with previous leaks, the organisation partnered with individual news organisations in three different countries, attracting wider coverage of the documents not just in those newspapers but also in jealous rivals.

The bulk of your coverage will not be exclusive. Use the focusing power of news design to achieve the right balance. You can give great prominence and projection to your exclusive stories, while covering the stuff most readers may have seen in a round-up box or column of news ‘briefs’.

Aside from the news that makes the printed magazine, a monthly news team tends to produce a continuously updated news page as part of the website. This may include one or more individual, team, or subject-based blogs, and a daily or weekly e-mail update.

Your own news feeds may be syndicated to other news sites and blogs, adding to your publication’s reach. Typically a magazine website’s news section will have an RSS feed of its latest stories; increasingly, they will have a number of RSS feeds for news about different parts of their field.

RSS feeds have enormous flexibility and potential for various uses. If someone uses an RSS reader on their computer or phone, they can read your feeds there; if they publish a blog they can ‘pull’ your feed to show your latest headlines (when clicked, the user will be taken to your site). You can also use RSS feeds to cross-publish your latest headlines to a Twitter account, a Facebook page, and various other places.

RSS feeds can be full (showing the entire story) or partial (showing only a first paragraph – the user then has to click through to the full story on your site – although this introduces an extra step that can reduce readership and create a frustrating user experience), and they can include advertising and multimedia. They are, in effect, one of the delivery vans of internet distribution.