Individual versus Organizational Computer Security and Privacy Concerns in Journalism

Abstract

A free and open press is a critical piece of the civil-society infrastructure that supports both established and emerging democracies. However, as the professional activities of reporting and publishing are increasingly conducted by digital means, computer security and privacy risks threaten free and independent journalism around the globe. Through interviews with 15 practicing journalists and 14 organizational stakeholders (supervising editors and technologists), we reveal the distinct-and sometimes conflicting-computer security concerns and priorities of different stakeholder groups within journalistic institutions, as well as unique issues in journalism compared to other types of organizations. As these concerns have not been deeply studied by those designing computer security practices or technologies that may benefit journalism, this research offers insight into some of the practical and cultural constraints that can limit the computer security and privacy practices of the journalism community as a whole. Based on these findings, we suggest paths for future research and development that can bridge these gaps through new tools and practices.

On Enforcing the Digital Immunity of a Large Humanitarian Organization

“…We find that the ability of humanitarian field workers to carry out their mandate hinges on numerous operational and legal factors such as developing capacity by training local workers, operating in local, untrusted facilities, and negotiating and maintaining bilateral agreements with local authorities. These factors tend to differ from other at-risk groups such as political dissidents [23], [22], [27], [15], [26] and journalists [29], [30], [24] whose activities can be carried out individually, or in small groups, with no or little support from authorities. As a result, whereas journalists generally depend on their own security practices and that of their sources, humanitarian workers must consider a multitude of other factors such as the engagement, acceptance, and trustworthiness of the local actors and infrastructure, the confidentiality of their physical location, and the specific Privileges and Immunities (P&I) recognized in their delegation's bilateral agreement.…”

“…For simplicity, we exclude assessment and registration steps that take place prior to collection, and optional steps such as patient transportation. In contrast with data flows resulting from traditional journalist work involving one journalist communicating with one anonymous source [29], [30], [24], the ICRC data flows involve several field workers: those are subject to the operational and legal factors discussed in Section IV-A and they often remain vulnerable throughout the steps of humanitarian action.…”

“…In this respect, humanitarian action is more akin to journalism for large media outlets. But, unlike journalism, where one anonymous source generally communicates with one or a few journalists [29], [30], [24], the scale and multidisciplinary nature of humanitarian action often results in engagement among numerous parties, each with its own area of expertise. Although large collaborations with more than one hundred journalists do exist (e.g., Panama Papers), they tend to not involve anonymous sources and to take place after whistleblowing has occurred [31].…”

Double-edged knife: practices and perceptions of technology and digital security among Mexican journalists in violent contexts

“…However, not every journalist is aware of digital threats or the defensive techniques that can be applied, as very often many of them use technology without taking special care, or they do not know how to use it properly (Sierra 2013;McGregor, Roesner, and Caine 2016;Suraj and Olayele 2017). For example, respondents in a survey of journalists conducted in the same context as this research (Sierra 2013) rated their skills mostly as nil/poor in the following areas: data encryption, anonymous internet browsing, secure data backup, secure destruction of information, and the use of virtual private networks (VPN); while they rated their skills mostly as acceptable/excellent only in secure password creation.…”

“…In spite of the wide array of topics studied, surprisingly little attention has been paid to news workers' digital security. Apart from a limited number of studies that specifically analyze it (McGregor et al 2015;McGregor, Roesner, and Caine 2016;Suraj and Olaleye 2017), most of the academic literature on aggressions against journalists that acknowledges the topic does not offer in-depth discussions of journalists' digital security (e.g. Lisosky and Henrichsen 2011;Islas, Gutiérrez, and Arribas 2018).…”