Protecting Journalists Online

Our guest this week is Anjuli Shere. She’s an analyst, writer, and researcher, currently pursuing a doctorate in Cyber Security at the University of Oxford. Anjuli’s research centers on emerging threats to journalists from new internet-connected technologies. She is creating a framework for news organizations and journalists in democratic countries to improve the protection of their staff and sources against threats from the Internet of Things.

This podcast was produced in partnership with the CyberWire.

Dave Bittner: Hello everyone, and welcome to episode 205 of the Recorded Future podcast. I'm Dave Bittner from The CyberWire. Our guest this week is Anjali Shah. She's an analyst, writer, and researcher, currently pursuing a doctorate in cybersecurity at the University of Oxford. Anjali's research centers on emerging threats to journalists from new internet connected technologies. She's creating a framework for news organizations and journalists in democratic countries to improve the protection of their staff and sources against threats from the internet of things. Stay with us.

Anjali Shah: I started my professional journey, the very beginning of it, when I was 16 and I wanted to work for a private investigative agency. And I found one that was willing to take me on, and from there then went back into academia and studied politics and international relations at Nottingham, and then science and international security at Kings. And then eventually ended up pursuing this doctorate in cybersecurity at the University of Oxford, where I look at emerging threats to journalists from the consumer internet of things. So novel internet connected or networked technologies.

Dave Bittner: I have to ask about what you mentioned about your early interest in being a private investigator. I mean, is that something that throughout your childhood you'd had an interest in?

Anjali Shah: Yes. So I actually probably should have mentioned this when I was talking to you about what my professional journey has been. So I worked as a private investigator when I was in my late teens. And then I more recently for the last three years have worked as an intelligence analyst on a fugitive simulation called Hunted, which is very cool and quite similar. But yes, so the short answer is I was interested in security and also in journalism from a very young age. And I was fascinated by fictional reporters like Lois Lane and by stories about organized crime and government corruption. And also by children's books like Nancy Drew or the Box Car Kids or Trixie Belden, people who were curious, and it got them into trouble, but it also got them out of trouble.

Anjali Shah: And so then when I was older, I was able to write for outlets like the New Statesman, but not as an investigative analyst or investigative journalist, just as a science writer. And I also worked as this intelligence analyst in the fugitive simulation Hunted. And by the time I came to Oxford, it was just really ingrained in me that I wanted to protect people who did that kind of work, as well as occasionally dabbling in it myself.

Dave Bittner: Well, I know much of your research centers on some of the threats to journalists around the world. I wanted to start off getting your sense of where we stand in terms of journalism around the world and the protections that journalists have. I suspect, I mean, there's a wide spectrum depending on the part of the world we're talking about, yes?

Anjali Shah: Absolutely. And I predominantly look at democratic countries, because I believe that journalism and journalistic security is a prerequisite for national security. If we don't safeguard national values like a free press or free speech, then we start slipping into the kind of territory that's occupied by authoritarian countries, and their press freedom protections are obviously much less if they exist at all. That's the main reason why I chose to look at democratic countries. But even within the spread of countries that I'm looking at, Taiwan, Australia, the UK, and the US, there are massive differences in how they treat journalists, how the government is able to interact with journalists, what kind of protections legally and through policy exist. And then also just simpler things like what kind of structures exist within the news media in each country for sharing threat intelligence and for communicating what kinds of problems might arise in the future.

Dave Bittner: Can we go into some of the details there? I mean, what are some of the differences between the different nations that you look at?

Anjali Shah: Sure. So in Taiwan, what really struck me was that because of the history of martial law, the government is very hands off with the media industry. They don't want to be seen as interfering in journalistic freedoms at all, and that includes opposition parties. They have no desire to look as though they are sliding into authoritarianism in that way. In America, by contrast, there has been this recent erosion mandated by the previous government of journalistic protections and of funding to journalistic outlets.

What's interesting to me is that even though both of those countries have taken a really different approach to the media, similar problems have cropped up as a result of both of those approaches. And one massive one is this increasing sensationalization of news, which I think is a result of big conglomerates owning lots and lots of media outlets, so you end up with monopolies. And because there's this disparity between the resources available to independent journalistic outlets and the ones available to massive, usually quite politically partisan media organizations, the way that the news is communicated becomes news in itself, which journalists are very adverse to. They don't like being the subject of their own reporting. Which is why actually security for journalists is so difficult to implement.

Dave Bittner: Yeah, it strikes me that one of the things that we've seen, and I'm really interested to know if you agree with me here, that we've seen organizations take advantage of what you describe in journalists, particularly here in the United States, where we'll often hear about journalists falling into a trap of both sides-ism, because if they don't, then they will be accused of bias or things like that. And so I guess what I'm getting at is my sense is that some of what we had perhaps previously thought of as being strengths in our system are being taken advantage of by folks who may be looking to spread their message in a different sort of way. Do you think I'm onto something there?

Anjali Shah: No, I think that's absolutely true. And part of the difficulty in protecting journalists is that the protections that are established rely on really old law. And some of the ways in which adversaries are trying to erode those protections is by manipulating the old law or our understandings of what traditional journalism is, and using that against modern journalism, which is more of an activity, it's an act of reporting, trying to provide independent news, rather than a specific person who is accredited by the government, right? That comes with its own problems if the government gets to choose who a journalist is. And so you do see lots of news organizations, like you said, falling into the trap of either becoming very partisan in all their reporting, or trying to avoid that, trying to avoid being labeled as activists, and so engaging in what about-ism or engaging in both sides-ism. And that obfuscates, I think, the legitimate concerns that might arise from the truth that they're reporting on.

Dave Bittner: What about the changes we've seen in the velocity of reporting? I think back to the days when I was growing up as a child, the main sources of news were the daily newspaper and the evening news on the television. And it strikes me that with both of those, because of what went into the production and distribution, that there was time for reflection before they published. And of course that's all been turned upside down these days, in the race to get clicks, people want to publish as quickly as possible.

Anjali Shah: Yes, I think that's absolutely true. So partially that comes with the sensationalization of the media, which is a result of increasing competition. Because funds to journalists are so limited in so many different countries, journalists all feel like they have to compete for those funds. And if your worth as a journalist is measured by the number of clicks that an article receives, or the number of views that a soundbite receives on YouTube, you then have no real option. It's either get out of the industry or conform to this idea of 24/7 news that doesn't really inform anyone of anything. It just escalates this psychological stress that people feel when they think about having to watch the news.

Dave Bittner: Yeah, it seems to be also, as you mentioned, we've seen this erosion in the number of new sources that are available. Particularly it seems to me, here in the US for example, local news has really been hollowed out, those small community newspapers. They're pretty much gone now. What do you suppose the long-term effects of that could be?

Anjali Shah: So that's something that really concerns me. Local news disappearing means that different regions around the world, and particularly in democratic countries; to my knowledge anyway, because in authoritarian countries there tend to be all sorts of different restrictions on reporting; you end up with news deserts. So there are people who will only have access to national news or news from a different area in the same region that doesn't quite get into specific stories that would be relevant to people in that area. And that I think long term is going to diminish the kind of interest that people in those areas have in political processes, in the smaller scale activities that build on each other to create the sort of democratic fabric of a country. If you don't vote in a local election because you don't know what's happening or who the contenders are, you then maybe lose your interest in national politics. Or even worse, if you don't vote in a local election, you end up with fewer contenders who would be suited to national politics. Does that make sense?

Dave Bittner: Yeah, it absolutely does. I know that one of the things that you're working on is a framework for news organizations to improve the protection of their staff. Can you take us through, what are you working on there?

Anjali Shah: So I am in the process of creating that. Partly some of the research that I've already done has contributed to different taxonomies that helped me to categorize and map the ways in which, and the different environments in which, journalists might interact with consumer internet of things devices. And lots of them aren't immediately obvious to the general public and therefore to journalists, but they would be potentially obvious to security experts. But one of the things that I've noticed with one of the taxonomies that I've created is that journalists can't really accurately assess their risk profiles or the environments that they're in, in terms of what devices they're interacting with and the secondary implications of those interactions.

Because there's no clear way of informing them that exists so far of the legal threats that are associated with mass data collection, or of the physical threats that are unlikely in most scenarios, but are nonetheless still a possibility, as well as the ways in which the information that they use for their stories could be affected, could be amended legally by an intelligence service, or could be duplicated or could be deleted, because these devices are insecure and they're everywhere. The television in the lobby of a news organization's building could be internet connected, and that could be an easy access point for someone who wants to attack the news organization systems provided they're not segregated properly. So the framework that I'm working on takes into account the physical and legal security of the journalists and their sources in these different countries. And I'm hoping that it will be able to supplement the journalistic security training and risk assessment work that's being done in each of those countries by the news media.

Dave Bittner: Is it a matter as well that these organizations need to have folks who are responsible for the online security of the journalists? In other words, I suppose you can't expect journalists to be cybersecurity experts?

Anjali Shah: No, I think that's a very good point. And one of the things that I've realized throughout my research is that you can't just protect the newsroom as a newsroom, and you can't just protect the news organization as a business. You need both sides of the media to be protected, because otherwise, if something's not protected as a business, it's not financially viable to keep producing independent news. And if it's not protected as a newsroom, you can't produce that news anyway. So I think that it's very important that journalists have the tools available for their own individual protections, but also that if a news organization exists, if journalists are collected together in that way, they have people there, points of contact.

And I think that's particularly relevant even to countries where journalists are being laid off, the US and the UK are two massive examples of that. During the pandemic, we've had so many journalists being laid off that everyone is effectively a freelancer now. And just because they're not protected by security experts within organizations doesn't mean that there shouldn't be or that there can't be experts in associated trade organizations or non-governmental organizations or even points of contact in the government who are able to provide them with legal advice, social advice, and any other kind of security strategies that they need.

Dave Bittner: In terms of the trends that you're seeing of journalism within democracies, what direction do you see things headed, are we headed in a good direction? Is journalism in a healthy place in the world's leading democracies?

Anjali Shah: I think that there are two sides to that. Journalism is, in terms of acts of journalism, like I mentioned before, the activity of reporting which I believe makes you a journalist whether or not you're accredited, that seems to be flourishing. Individuals are using their smartphones, they're using their notepads if they're out and about with a pen and paper, to document what's happening in the world and to try and feed that, usually through the internet, to other people who are interested. And I think that it shouldn't be undervalued, right? Blogs are a hugely important way of communicating information that is relevant to a populace, even if mainstream news organizations don't have the bandwidth to do that. So that's one side of things.

The other side of things is that because of this lack of funding, because of the lack of protections in terms of preventing media monopolies, because of a lack of protections in terms of educating journalists and news organizations, including their executives, including their lawyers, including their security experts, on the kinds of security protocols and processes and strategies long-term that they need, you see more successful attacks on journalists.

And while my pilot study demonstrated that a lot of journalists don't know what the threats are through the internet of things, it also demonstrated that journalists with even a tiny bit of knowledge were trying to go back to analog ways of collecting information, right? They were ditching their phones and going out into the streets and using a pen and paper, trying to implement dead drops, trying to prevent sources from using too much technology, in an effort to protect their identities. And those methods, while I understand why journalists are returning to them, because they worked before, they don't necessarily work anymore, not in all contexts. And certainly not in countries like the UK, like Australia, the US, or Taiwan, where internet of things devices have been picked up, the markets are flourishing, and the devices are both everything and everywhere.

Dave Bittner: Let's dig into some of the specifics here in terms of the threats that journalists are seeing. What are some of the types of attacks that you've been tracking?

Anjali Shah: So it's very difficult with internet of things devices to work out whether or not an attack has happened. There are amazing organizations like the E-Safety Commission in Australia, which carries out investigations into the use of internet of things capabilities in intimate partner violence situations. So we know that these devices are being used to target individuals and that these scenarios where privacy and security are threatened do exist on an individual level. And I think because of that, it's really highly likely that adversaries, especially well-resourced adversaries, would use these capabilities against high value targets like journalists. Because it's important to remember that journalists themselves might not be the end point of an investigation. You also have sources, you have people within the journalists orbit, you have other journalists within a news organization. Those are things that it's really important to be cognizant of.

But also there have been specific attacks, like you might have heard of Marie Colvin, who was a foreign correspondent for the Sunday Times. She was assassinated by the Syrian government in 2012 after the building that she was in was identified due to signals from a satellite phone. So while she wasn't targeted through novel consumer internet of things devices, that's a really clear example of how similar technologies can be identified and they can be used to lethal effect in direct retaliation for the kind of media attention that she brought in that case to the conflict. It's important also to remember that it's not just states that are potential attackers, you've got organized crime, you have large corporations, banks, as far as I've been able to tell from my research are responsible for a lot of investigations into whistleblowers. And those investigations often go through the journalists that have broken the stories.

So these are things that we need to consider. And above all of that, and on an even more meta level, there's the internet of things international supply chain. And that includes manufacturers and data centers located in various jurisdictions, it includes all sorts of individuals all over the world, and really complicates mitigation considerations. So going back to the Taiwan example, my research has found that journalists in Taiwan might trust the Taiwanese government not to track them without good reason, like the pandemic. But smartwatches, which are largely manufactured in China, or that use apps developed in China, will give rise to additional supply chain considerations in terms of communication of confidential information. And without an awareness of these devices, of where all the chips are made, which requires a level of expertise that maybe different countries don't have, these threats are going to continue to grow.

Dave Bittner: Are there things that folks who are security professionals can do to support the efforts of journalists? Can they lend their skills? Is this a matter of contacting their representatives and having their voices be heard that they are in support of a strong, free press? Do you have any thoughts there?

Anjali Shah: Absolutely. So technical solutions and mitigations are only going to take us so far. At the moment, the biggest threat that journalists perceive to their work and to their wellbeing and to their sources is legal. And part of that is caused by a lack of regulation of the technologies, and by increasing numbers of laws citing national security, that allow really comprehensive surveillance. And that includes metadata collection and retention and access by state agencies. That includes all sorts of laws that allow warrants or warrantless interception. And so reporting becomes chilled. So lobbying for better regulation of technological markets and also better laws, or shield laws or privacy and data protection and security protections and safeguards for journalists, and journalistic and source information. I believe that's the way to go.

Dave Bittner: Are there any things we can do in our own consumption habits of supporting the parts of journalism that are probably better for us in the long run?

Anjali Shah: I think that news literacy in every country and every community needs to be improved. I think that it's worth paying to get past any paywalls that journalists and news organizations put up. I also think it's worth making sure that you take a beat to think before sharing an article or a news clip with 30 or 40 friends and contacts on WhatsApp or on Twitter. It just means being more aware. And I think that mindfulness is relevant in all aspects of our lives, but it is especially important when it comes to news consumption, because journalists that are not getting heard are still getting targeted. And the way to prevent that is to make sure that we're listening across the board. We don't necessarily need to listen to places that have been discredited, but we do need to make sure that we're continually updating our understanding of which organizations, which journalists can be trusted, and for which topics, right? It's about looking to experts. And a belief in experts, a trust in experts, is something that I think is vital for all elements of our lives in the future and at the moment.

Dave Bittner: Our thanks to Anjali Shah for joining us. Don't forget to sign up for the Recorded Future Cyber Daily email, where every day you'll receive the top results for trending technical indicators that are crossing the web, cyber news, targeted industries, threat actors, exploited vulnerabilities, malware, suspicious IP addresses, and much more. You can find that at recordedfuture.com/intel. We hope you've enjoyed the show and that you'll subscribe and help spread the word among your colleagues and online. The Recorded Future Podcast production team includes coordinating producer Caitlin Mattingly. The show is produced by The CyberWire, with executive editor Peter Kilpe. And I'm Dave Bittner. Thanks for listening.