- Hi, I'm Jesse Krembs,
and today we'll be taking a look inside security
at The New York Times.
This talk is also unofficially titled,
"A media security primer for hackers",
but it's really for both journalists and hackers.
Most talks start off or end with a thank you at the end,
right, rushes off stage, thanking all their friends,
but really I'd like to start this talk off
by saying thank you to a bunch of people.
First of all, my girlfriend for her love and support
and for putting up with all my craziness when I'm like,
hey, honey, I need you to get out of the apartment
while I record my talk
because I don't want anyone to see me doing it
because that would be weird.
I'd also like to thank everyone at The New York Times
who has reviewed this talk with me
and helped me make improvements
and helped me dot all the I's and cross all the T's
and make sure everything looks really nice and sharp.
We really do try to get the story right every time.
It's been a crazy couple of years,
and in that time we've all gotten to watch a lot of movies
and have to watch the Fred Rogers movie,
it was really great.
And there's a scene in that movie
where they take a couple of moments
just to think about all the people in their lives
who have helped them get to the stage in life
where they are right now.
And we don't do that enough.
So let's just take a few moments right now
to just sit quietly and think about all the people
that have helped us get to where we are in our lives today.
All right, all right, all right,
let's get this show on the road.
So I'm really gonna quickly start off with my journey,
I think this will help reveal some of my biases
and some of the stuff in my life
that kind of formed how I got here
and why I think certain things are needed and some aren't.
I've been a long time DEF CON goon,
my first DEF CON was DEF CON 6,
and that was a really pivotal moment in my life.
Working at DEF CON really has given me a lot of confidence,
but it's also given me a lot of life lessons in,
A, working with really tight timelines,
really chaotic environments,
really challenging people,
and really learning about how to deal with
just time-based pressures in a technical and logistical way.
From my experience at DEF CON,
I ended up starting a nonprofit called The Hacker Foundation
where I had my first interactions
with the media as a subject,
but also doing a little media support,
which is also very interesting.
And that was great.
And then for years I had regular jobs,
I was a bike messenger,
a caterer, stuff like I was a webmaster for a brewery,
and I was a wireless engineer,
and then I was doing offensive security
for the phone company.
Those were all great jobs,
people I worked with were wonderful,
but I really felt like I needed to just
look a little bit more at stuff.
And I heard about this thing
called the Internet Freedom Festival in Valencia, Spain,
and I decided I'd go do it and see what it was like.
It was really different conference
from DEF CON in a lot of ways, a lot of,
it was very different from a lot of hacker cons,
but similar in the way that all festivals are.
And I got to meet a bunch of journalists
from around the world there,
and I was talking to, they had these.
Okay, so they had these little tiny beers
called cana in Spain for one euro, it's really great.
It's a little small beer,
it's got just as much beer as you want.
So I'm having a beer with this journalist
and we're talking about stuff and he's like,
oh, I have this source I want to talk to.
I want to talk to kind of,
I don't wanna be overwatched by the government.
And so I'm like, okay, we'll just call him on Signal,
that's a really good method.
And he says, oh, no, no, he doesn't have a cell phone.
I'm like, oh, okay.
Well, you have to come on landline,
here's some stuff you can do to minimize the risk,
you can't negate it, but you can minimize it.
And he goes, oh, no, no, he doesn't have that type of phone,
he has this type of phone.
And I'm like, oh, interesting.
So this is the importance of getting more details.
So basically the source that he was trying to talk to
was a villager who had a party line.
So if you called that number,
you called everyone in that village.
So, and I was like, this is a really hard problem,
I don't have a solution for you now.
And I still actually don't have a solution for this problem,
but it stuck with me, it sticks with me today.
I think about this problem, I think it's a really good,
an interesting problem.
And these are some of the technical security challenges
that journalists are dealing with.
And so I left Valencia, Spain,
went back to my regular life as it were,
but I kept thinking about
what was this, this stuff.
And I started spending more time in New York City,
and there I saw someone very special there.
And then I saw a job open at The New York Times,
I said, no, you won't get the chance to do this again,
you should apply.
So I applied, I contacted someone I knew
with The New York Times and said,
hey, can you reach into the pile and pull mine out
because I have a non-traditional background,
my resume not even get seen by anyone.
So my resume got passed around to some folks,
they looked at it, I did a phone screen,
I did an interview, I did another interview,
I did a day's worth of in-person team interviews,
and they liked me, they really liked me.
So I got a job offer and I took it,
and that's how I ended up with The New York Times.
I applied for the job, get the job,
not that complicated, right?
And since day one, it's been a very exciting,
fulfilling and rewarding job.
And that's the quick version of
how I ended up with The New York Times working full-time
in media journalism.
I think it's important though to think about
what gets you up every day,
the getting the job is not the end of the journey,
it's the beginning of the journey
or it's beginning another phase of the journey.
So one of the things I really like about my job is
that I think this is sort of good,
I think news-making organizations,
The Fourth Estate is a key part of a country
and it's really important
to be an engaged citizen in that country,
so I basically do that all the time now,
which is really nice.
The job isn't just about protecting shareholder value,
we are a publicly traded company,
but it's not just about making money,
it really is a very mission-oriented job and company,
which is great, I really enjoy that.
The problems are hard, they're hard in both technical ways,
but also in logistical and very human ways.
If you have a really whizzbang,
super-awesome technical solution,
but you can't explain it to somebody over the phone,
or they don't have the equipment,
or they don't even know how to use the technology,
it doesn't matter, right, it won't solve the problem.
So coming up with solutions that are really,
work in a variety of environments
and a variety of stressors is really, really a delight.
So that's great.
The people at The New York Times are characters,
there is tons of great characters,
they make movies about these people,
but then you end up meeting them in the hall
and having coffee with them and being like,
huh, interesting.
They're a fun bunch,
and they're driven and they're passionate
and they're persistent,
which is I think a lot of qualities that hackers enjoy.
And the work is evergreen, right?
The work we do is, I always feel like every day I go in,
we're always getting new challenges
and new things are always popping up,
the news happens all the time.
I also think that there is a kind of cousin relationship
between journalists and hackers.
We're both very interested
in having information free to the public,
so the public can make well-informed decisions.
Hackers really tend to be very interested in acquiring info
and showing it off to their friends
because look, what I can get.
Journalists tend to be a little bit more downstream,
they tend to be more like,
look at this information I got (laughs) from some hacker,
this is great, let me show it off to the world.
They also tend to be very rigorous
in their analysis of that information,
which I think is much needed.
So let's just really quickly talk
about New York Times by the numbers.
There are no typical news organizations,
The New York Times is an atypical news organization
in many ways, it's 169 years old,
maybe 170 is their birthday next year.
Yeah.
As you can imagine, a company that old
has a lot of technical debt,
but it also has a lot of history,
and that history is good.
One of the great things about working at The Times,
in the before times was that we ran in the office
and many floors below the one
that I work on is the archive.
So I went down to the archive
and got to plough through the paper card catalog index
for Felix Krembs, who is,
okay, I believe a great, great cousin of mine
or an uncle maybe.
Anyway, he was a big time broadway actor at one point,
and so I got to find his name in the card catalog,
then go into the actual like archive stacks
and pull out the digital photos of him
that were provided by his agent to The Times,
which is and hold them and showed them off to my family,
which was great.
Really a wonderful experience.
We have a lot of great people who work at The Times,
we have 4,500 employees, this includes reporters,
this includes people that print the paper,
this includes admins and tech staff,
this includes developers.
We have 1,700 reporters worldwide,
which is a huge amount of people to have.
200 of them are overseas.
Those 200 are really some of the best reporters we have
because they're the only person
you can sometimes send to a place
because they're the only person
logistically available to do the work.
So they have to be well-prepared
and on top of the situation
and really understand what's going on there.
They're really at the tip of pen,
it's very exciting to work with our foreign journalists
or our overseas journalists.
We have 500 developers,
no other company makes The New York Times app
and website like The New York Times.
It's new territory for everybody all the time,
so we're constantly learning and being challenged
and developing new things with our developers.
We have 31 foreign bureaus and 16 national bureaus,
so we have offices globally and nationally
and a variety of other facilities.
We are a factory that prints newspapers,
which is pretty cool.
And then now we also have a very diversified workforce
who lives and works all over the world and the country.
So that's a whole new challenge
is just that geographical spread, right?
We just have to keep everybody safe,
and (mumbles) as it were.
There's 7.8 million subscribers,
that's a lot of subscriber data,
that includes all kinds of PII.
We have 100 million plus registered users,
which represents a huge amount of data,
which we also have to keep safe, of course.
And then if you actually think about that,
classic InfoSec training, CIA training,
confidentiality, integrity and availability,
not the other CIA.
So we have to get the paper out all the time,
we have to get the news out on the newspaper
and on the website.
So, and that's average weekly audience
of 7.6 million people, that's a lot of people to reach.
We move a lot of data just in general, right?
We print, we produce 150 plus
pieces of journalism every day.
And it's not just print, it's not just photos,
it's podcasts and TV shows and live streams of events
and stuff like that.
And finally, there's a plus sign
after all the stuff on this slide, right?
That's because we're growing,
and growth brings its own challenges.
I used to work for a dying industry,
and that has its own challenges too,
but growth has a lot of challenges.
It feels fun, but it's also very scary.
And so I think that's a whole other
interesting kind of pseudo number.
So that's The New York Times by the numbers in a nutshell.
This isn't just me, I'm not the only person
at the working InfoSec at The Times
or even work in security.
The InfoSec team at The New York Times is composed of
the security operations team.
I work on that team, we are the front lines,
we answer and advise on all kinds of questions
and issues every day, every hour.
I'm on call at this very instant recording this talk.
We have an intelligence team who does the forward
and backward looking intelligence gathering
to help us figure out what threats we need to align to,
and where to best use our resources.
We have an education team,
education is a huge part of what we do
because of the independence of so much of our staff.
Having well-educated, well-prepared staff
is really very, very key.
Like I said, we have our own apps,
so then we have our own AppSec team,
which is really another key, key thing.
We have a secure architecture team because we have,
imagine this, a giant technical, a giant cloud presence.
So, of course, we have a secure architecture.
Incidents happen, if they didn't happen,
none of us would have jobs.
So having an incident response team who can guide both,
who can help the InfoSec team do their job better
when we're responding to incidents,
but also guide the other people involved in that incident
through the process.
It's wonderful.
I live in New York City,
and New York City has been hit with all kinds of
business continuity events within my lifetime,
and not just like in the last 20 years.
So that's another thing that we,
is also with the InfoSec sphere.
And then finally, of course, we're a business,
so we have to manage our risk and our compliance needs
just like every other business out there.
We're not the only security operations at The Times,
we also have a physical security team,
nationally and internationally.
And all three of these teams:
InfoSec, national and international, all meet together
and the threat response team where we trade intelligence
and we work on ways, we overlap
because increasingly there is a great deal of overlap
in what we all do together.
That's just the security apparatus, right?
That's the people that have security somewhere in the title,
but we also have really wonderful sys admins out there
who really hold the standard
and do a really, really good job
of making sure that our systems are secure,
so we don't have to bug them.
That's so nice when you have really top
motivated sys admins making it happen.
So we don't have to be like, hey, it's back to Tuesday,
you've got to patch that.
They're already like, to patch that, I'm like even better.
We have a great end-user support team out there
who just listens to our users.
So when the user says this thing,
(laughs) and they're like, oh, that's a security event,
you need to talk to these people right now.
And then we have folks in the newsroom:
editors, support staff and journalists
who help us coordinate, inform us of events,
inform us of threats that they've gotten
both in the physical, but also in the technological sphere,
tell us about all kinds of stuff
they're hearing on the street,
which is also really wonderful.
And then also the past has helped us.
We've learned a lot from the past
and from the people that have been at The Times before us
who have helped build the organization and the team.
So it's just not just now that got us to where we are.
The present is made by the past
and the past has contributed mightily.
So here's a quick guide for journalist security for hackers,
but also conversely if you're a journalist,
this is also for you.
This is a really great graph
that kind of shows the threat continuum
for journalists out there.
And on one side we have murder
and on one side we have litigation.
Death is a very real concern for a lot of journalists,
this is very high-risk job in a lot of ways.
It shouldn't be, but it is.
And it's not typically one would consider a high-risk job,
but in 2020, 66 journalists lost their lives
in the course of reporting.
Just today I was reading in the paper about a reporter
who lost their life in a conflict area.
And the week before a journalist also lost their life
covering a parade.
And targeted killings by repressive governments,
they're too often willing to kill journalists
to keep citizens in the dark about their actions,
it does happen.
So we always have to factor that in
when we're thinking about the physical security
aspects of journalism.
This also kind of plays into the InfoSec,
which is not traditionally something we would do,
but increasingly repressive governments
and non-state actors use technology
to assist them in precursor activities to murder.
Going down the matrix really quickly, we have harassment.
I have a slide for this, we'll talk about this in a bit.
So the security team at The New York Times
doesn't protect journalism, we protect journalists.
And journalists' job is to protect journalism,
and that means producing high-quality journalistic works
and not so censory.
It means that they should,
our job is to keep them safe enough,
so that they don't feel that they can't cover a story
because it's too hot, it's too sensitive.
And this ties to the next thing, right?
If they think that people are after them
from hacking, that's an issue.
So we help protect against that as well.
Political pressure, that's basically way above my pay grade,
but it's definitely something that does stop
or does concern some journalists at some times.
Denying access is another way
that journalists work is threatened, right?
Either in the withholding
or manipulation of press credentials or to deportation,
PNG, persona non grata,
someone out of a country, so they can't come back
is something that does happen
and has happened in the two years
that I've worked with The New York Times, two journalists.
Ad pressure is a factor,
boycotting The New York Times
or another news organization through ad,
through people that would advertise with The Times
is definitely an influence that has effected organization,
media organizations worldwide.
Censorship.
Right now there's some government
censoring The New York Times
(laughs) somewhere in the world,
either overtly or covertly.
We at The Times try to provide news to everyone
as much as possible all the time.
We, for example, I was talking with a colleague today
about our Onion, The New York Times' version
of the Onion Service.
We do have an Onion Service online,
and that's specifically as part of our
censorship busting operations.
Reputational attacks.
There are attacks against the practice of journalism,
against the organization,
and of course, against the reporter themselves
trying to de-legitimize them.
And that's a more long-term
kind of highbrow argument,
but I think it's also a definite concern of journalists.
And then finally at the very end of the spectrum
is litigation and lawfare where we like to think
that very civil people use very civil words
in a very civil environment
to try to win civil arguments.
It doesn't always occur,
but we'd like to think that that happens.
So there are kind of three bins that are inherent,
and one of them, the last one
kind of doesn't fall on the matrix
because it kind of pervades all of them naturally.
There's the physical security stuff,
which is an increasing concern year after year
in journalism.
Increasingly year after year is also the need
for increased information in cybersecurity.
As technology plays a bigger and bigger role in reporting,
and our lives both as a day-to-day activity
but also in the nature of how reporting is done.
Understanding how technology works,
how big data can be
understood and analyzed is really key.
Finally, there's a psychosocial security concern here.
It's taken I don't know how long
has journalism existed for, right, for ages.
It's taken a long time for people to realize
that the day-to-day stresses
of being a journalist takes a serious
and possibly negative toll on the practitioners.
And so when we're working with journalists
and we're talking about security practices,
we're really trying to,
to train them for an ultra marathon, not a sprint.
The best, most fun journalists to hang out with
are the ones who have been around the block a lot.
They have great stories, they're really well seasoned,
and they have some really good security practices
based upon some hard-won lessons.
So any media information security organization
would definitely take a look at all of these things
that are highlighted here in bold as something
that they would pay attention to on a regular basis.
So I mentioned harassment at the beginning.
I kind of glossed over it, but let's look at harassment,
we're gonna throw a bunch of numbers at you,
but I think it's, I want to get this point through.
So Lucy at the CPJ helped put these numbers together for me
because this is not something
that I look at the numbers of every day,
but in 2019 90% of respondents to one of their studies,
two journalists experienced safety issues
or threats in the USA,
which is we like to consider one of the more safe countries
to be a journalist.
And then large numbers of journalists
have been harassed in various ways.
63% of all journalists have been harassed online.
I think we in the InfoSec community
are familiar with the fact that people get harassed online,
journalists get it all the time,
and they get in very real ways.
Following up that number very shortly,
very shortly behind it, 58% have been harassed in-person.
I have had my run-ins in life,
but I haven't been systematically harassed in-person, right?
I can think of one or two incidents, right?
But in this case, it happens to a lot of people
who work in journalism.
Finally, this bottom number 26%
have been physically attacked, right?
So one in four, a little bit more than one in four
had been attacked in the course of doing their work.
That's a pretty big percentage for a job
that isn't really about getting in physical altercations,
they're not wrestlers here.
And the other thing to think about is that this is,
there is some disparity here, right?
Women get this way more than, way worse than men.
Two-thirds of women respondents say
that they've been threatened
or harassed online at least once
according to the International Women's Media Foundation.
And one in 10 of their people that they've surveyed has said
that they had experienced a death threat in the last year,
not just harassment, but straight up death threat.
And I see these threats and they're real,
they're not, people aren't joking (mumbles)
So harassment is a real issue,
that's something we deal with on a regular basis.
And it goes hand-in-hand with social media presence.
Having a strong social media presence for a journalist
is a huge career asset.
If you look at big names at any media organization,
they usually have big followings on social media,
on Twitter or on Instagram or whatnot.
Some of the organizations don't realize this,
but curating and maintaining your presence
on social media is work.
It's one of the reasons I don't do it
is because I don't wanna do the work,
I don't wanna have a big social media presence
because I do other things.
And with that presence will come harassment.
Most platforms are woefully unprepared to provide
any real support regarding online harassment,
both to journalists and to just regular people.
I think there's plenty of evidence of that
if you look through the MindSphere
of the InfoSec community online.
So one of the places that I always see a lot of people get
kind of spur of the moment harassment is from hot takes
or spur of the moment comments.
So I always advise journalists to be thoughtful
and considerate about everything they post online,
and that they separate their personal
and their private and the public persona,
so they get some separation
because they deserve it frankly.
But, yeah, hot takes tend to get people in some trouble,
but they should have the right to have hot takes. (laughs)
People just need to start being nicer to each other.
So really quickly people often ask me,
where does the responsibility for security journalists lie?
And it really lies with the journalists themselves.
The buck stops with them
because there's a ton of competing interests.
And my interests are not necessarily
the same as the journalists, same as an editor.
The editors' isn't the same as the journalists
and the journalists' isn't the same
as all those other things.
Everybody has different needs and wants and desires here.
So finally at the end of the day,
it's really the journalists' decision.
If they're gonna cover a story
and how they're gonna cover that story.
The job of the InfoSec team or any security team
working with media is to prepare them with the best tools
and knowledge available,
and give them the freedom and respect
to take care of themselves,
and also to do the best they can in covering that story.
That's it.
But it's often the journalists' job to make sure
it goes down correctly.
So let's really quickly talk about training and advisement,
that's something that we spend a lot of time doing,
a lot of time we do at The Times.
Training is lessons,
pre-prepared lessons
where we really get people brought up to speed on
proper techniques and tools.
And advisement is when they come to us and say,
hey, Jesse, I got this question and we think about it,
and we give them the best advice we can
about what they can do.
This is often what will happen
if you as a security professional end up working with
any news organization or media person,
they will ask for advice about something.
So make your advice actionable.
Journalists have a lot of competing interests,
and their time is very valuable,
and they basically have to deal with a ton of stuff.
So making practices that are doable
and not theoretical is really the best thing I can suggest,
but they are curious and persistent folks,
so expect them to ask you challenging questions
about the practice or advisement that you give them.
All right.
So here are five basic practices for journalists.
As a journalist you should be doing these,
as a information security professional and hacker
and journalists who are asking you for advice,
this is the five pieces of advice
maybe you should give them, it's a great starting point.
Use strong diverse passwords on all your accounts.
Please, please, please.
You're gonna have a lot of accounts as a journalist.
And so you're gonna need to use strong diverse passwords.
This will, of course, mean
you need to use a password manager.
Any password manager out there is probably better
than no password manager,
and a real online password manager that's backed up
that's securely operated and securely run
is really the best solution.
Notebooks, things you remember,
iterations of things you remember
are really, really not, do not work.
Use second factor authentication on everything you can,
as much as you can.
Skip over doing it with SMS though.
Use authenticator apps and use hardware tokens.
Use authenticator apps that backup to your password manager,
so that if your phone is lost, stolen or confiscated,
you can get back in the game real quick,
and you don't have to re-enroll everything.
Use hardware tokens whenever possible.
Have two and have the codes, of course.
One of the key things to do is to take that second token
and keep it in a safe place,
and not carry two with you at all times,
just have the one on you at all times.
Use a VPN, use it on every untrusted network
that you run across,
that you're operating a computer or a phone on.
Any untrusted network is not your home network
and not your work network,
so pretty much all the weird networks you jump on,
all the press pool networks,
the Olympics are at a convention or something,
especially this convention.
Companies should have a VPN for, again, to its own assets.
Journalists should collect third-party VPNs
as they see fit.
There's a bunch of great ones out there,
there's plenty of market research
about which ones are the best.
Just choose one that's a high-quality
reputable VPN provider.
Keep track of your assets, where you store your information,
divide your public and private assets.
Your work computer shouldn't be your personal computer
if at all possible.
I know this sounds annoying,
but it's a really good thing to do for a number of reasons.
If you're a freelance, I know this is really tricky,
but definitely think about keeping
as much of your public and private life separate
from a data compartmentalization
or information compartmentalization standpoint.
Update early, update often.
I don't know anyone who suffered greatly
from updating to the latest version of some OS
or patching their systems.
I do know people who have suffered greatly
from not doing that.
Use secure messaging platforms,
use Signal for as much messaging as you can.
You can even use it to securely store your notes,
you can just message yourself notes, right?
Signal is a great tool, we really like it.
The other secure messaging platforms out there
have a lot of different interests
that don't always seem to align with their user interests.
But you're gonna have to go with the sources,
so whenever possible try to shift to Signal,
but if you have to use one of those other third-party
messaging platforms, secure messaging platforms,
do find the online guides that are out there
about running those more securely,
so that you can minimize your attack surface
and your exposure.
So it's not just reporters who are part of the newsroom,
there's also editors out there.
So here's the five basic practice for editors.
You really need to communicate
known security risks to your journalists.
If you know it's a security risk,
your journalists who is maybe been around for a long time,
or maybe hasn't may not know them for whatever reasons,
let them know, tell them these are the things
that I am concerned about for your safety
or your information security safety regarding this story.
When a journalist comes to you with security concerns,
you need to listen to them
and factor them into the reporting.
You also need to connect that reporter with support systems,
be them in-house or external to help them stay safe.
It's really very, very, very useful when an editor says,
hey, I've got a team, they're gonna cover the story.
Can you talk to them?
Have a regular and clear cadence of communication
with your reporters when they are in the field.
This is really key.
Always start off the conversation
with the same basic question set, PSI.
What's the position, right?
Where are they in the story, physically in the world,
and where are they in the story?
What's the situation?
What's the environment around them looking like?
What's the situation looking like?
And what are they planning to do next?
If you can have those three pieces of information handy,
when something goes wrong,
or you think something might be going wrong,
then your security team will be able to
find even better support.
And finally, you have to do
all the things in the previous slide.
You need to be the example of how to do
secure journalism securely.
So the fun never ends, it never gets easier
as you move up the old hierarchy in the newsroom tree.
So that's the basics for journalists
and editors in the newsroom.
Let's talk a little bit about some of the stuff
that we in the InfoSec team deal with on a regular basis,
and more of what we do.
So here's the more of what we do.
We help journalists and editors gather
and secure source material all the time,
we make sure that we don't cross any legal red lines,
we never instruct sources on how to get information.
It's not our job, we're not doing that.
We're really looking for sources to,
they had something they wanna give us,
they collect it and they delivered to us.
We operate a tips line
and we operate our own SecureDrop servers
from the Freedom of the Press Foundation,
so people can get us that information.
Also we will develop solutions, if needed.
We are always concerned about the intent
and operation of nation-state actors,
both on how they are interacting with our journalists
and what capabilities they have,
and whether or not they've exercised those capabilities
against us or other news organizations.
As a telecommunications guy,
I'm super into telecommunication security,
so all the types of communications,
both in how it can be used for surveillance,
how it can be used for interception,
so we're constantly looking at that
and trying to improve our own telecommunication's security
as best we can within the operating environment we are in.
We operate a factory that makes newspapers,
so we have all the industrial control systems
you might imagine that exist in any factory out there,
which is really great.
It's also really challenging because it's a lot,
it's very different from a lot of the other stuff
we've talked about today.
I said it before, I'll say it again,
we have our own
apps that we build, so having secure applications
that are both externally facing,
like the one in your phone from New York Times
is the Crossword, but also internal apps
that we use to build, run and operate the newspaper
or the newsroom is really key as well.
And so we look at the security of those things
as another area of concern or focus.
Of course, we're concerned
about our cloud architecture and infrastructure.
We've moved out of data centers everywhere,
we're a very cloud-centric company now.
I think any news organization storing data centers
is possibly making a mistake.
So having secure cloud architecture
that is both redundant,
available, but also absolutely secure
and admirable is really, really key.
And finally I'm gonna kind of lump into
enterprise security here,
but this is just a grey business of the grey lady, right?
This is, we're just like every other company out there.
So we have legacy systems we need to keep in track of,
we have kind of the not-so exciting
information security things like your HR systems
or your accounts payable systems, which are very exciting
because they involve real people's lives and getting paid,
but that's a huge area for us to also pay
a great deal of attention too.
And that's really the nutshell of,
you look at the newsroom very specifically,
and then the rest of the company at large.
So let's look at some hard problems that we faced
that we can't really solve,
these are not things that we're like one of many
who would desire these outcomes,
but these are really kind of interesting hard problems.
And if you're looking for a challenge out there,
please take a look at my list of hard problems
and solve them for me,
and just produce the golden goose
because that would be awesome.
One of the things we run into all the time
on social media platforms is a lack of clarity
and consistency in language
and presentation security controls.
Social media platforms really seem to like to change
their security controls all the time,
change how they're referring to things,
even at the most basic manner.
So that when we say, hey, this is what you do to do this,
and one of our people goes,
I don't see that button and we look at it
and we go, it was there yesterday.
If there was a system or a scheme where
the policy you would like as an individual
for your security controls and privacy controls
could be read from a file as opposed to like
clicked on a bunch of random
like boxes on five different tabs, that would be great.
So if you have any influence or control over this,
that would be wonderful.
I'd really like someone to produce the holy grail
of telecommunications devices.
I need something about this big,
it does like multiple hundreds
of megs of bandwidth reliably, runs on batteries,
so that when we send journalists to natural disasters
or conflict areas
or just out into the hinterlands of the world,
they have a way to return us high-quality rich journalism.
We're not just a print org,
and more it's not just some words we need to scream out,
we're not just dictating phone,
dictating stories over teletypes now.
We are trying to move up the scale
of the kind of media we're producing.
So that would be great if you can do that.
I'm not asking for much.
As we all know, when you get a large gathering
of people together, a festival or an event or a rally,
we often see modern telecommunications,
wireless telecommunications kind of grind to a halt
or slow way down,
and then what happens is journalists
basically have to go to the event,
cover it as best they can,
and then get back to some sort of usually a landline,
but sometimes just outside of that cell area
to file their story and provide some context for it.
So really what we're looking for is something like
wireless mesh network, something like Gotenna
or Meshtastic that can send print ready photos or videos
as well as long bits of text,
that would be an amazing little tool
to help us get that working.
We'd love some tools that allow for a lightweight mobile
opt-in mobile device management.
So we work with freelancers,
and their phones are their phones, they're not our phones,
we're not gonna top down just like
start putting our policy on their phone.
So something that is, but we could come up with some like
quick enrollment thing where we're like
under these circumstances, what do you want us to do?
Da-da-da-da.
So that if they get detained for whatever reason,
we can, A, know that they're detained
because we can track them physically
and we're allowed to through their device,
or we can lock their phone for them.
In that same vein, remote journalist check-in tools,
these generally don't work at scale
and we have a lot of journalists,
so we do a lot of check-ins.
So if there's a tool out there
that would allow basically a way for journalists
to self-enroll for security check-in
and then check-in and they would be able to report back,
and if the check-in didn't work or they hit the red button
because the meeting is not going well,
and they really do need some backup,
that would be wonderful.
Tor network speeds, I love it
when a source comes to us and says, hey,
I've got six gigs of data I wanna drop on you,
and we're like, yes, that's wonderful.
And then they say, over an OnionShare,
and I'm like, eh, uh-huh,
because I know downloading six gigs of data
over the Tor network is really, really, really painful.
So anything you can do to help speed up
the Tor network speeds would be great.
Operating proper relays and exit nodes is wonderful,
supporting them financially,
so they can hire more folks to work on the project towards
currently working on increasing their network speeds.
I'm really excited about that project
at many different levels.
Speaking of that six gigs of data we just got,
it'd be really great
if we had a really wonderful set of tools
for source media sanitization.
We are looking at tools right now,
but it doesn't seem like anyone makes a really great
robust method for sanitizing masses of data
at scale in a newsroom,
especially with a lot of the controls
and features we would like to see as a news organization
and not a financial organization
or an insurance organization.
Finally, we have all this data right,
better tools for searching
and analyzing large mixed files sets.
So you just get a lot of random stuff in folders sometimes,
and you're like, okay,
so there's folders of PDFs, interesting.
You can't just grep that, maybe it's mixed set, right?
Maybe it could be a lot of different data.
So having a way to handle that would be wonderful.
Finally, an external message handling tool
for secure messaging platforms.
When we start getting 10X messages in our tip line
because of a campaign from a group
that would really like to be heard,
it makes it very difficult for us
to weed through all of that information.
So something that we could operate
that would allow us to manage all those messages
in a secure way and do some filtering and binning,
so we can really go, okay, this is all from this,
but here's a unique tip and here's a not unique tip
would be great, especially for apps like
WhatsApp, Signal, Telegram.
Again, not an easy thing, but definitely worth doing,
especially we want these tools to be tools
for simple good.
Those are the hard problems.
Oh, and finally Bellingcat has their own list of
OSINT projects that they're working on,
that are stalled GitHub stuffs.
Definitely check out Bellingcat's work
and their need for building tools
for open source investigators.
So maybe you wanna get involved,
maybe hopefully I've inspired you.
Please think about attending the Internet Freedom Festival,
there possibly will be some similar meetups
like that in the states in the next couple of months,
so definitely stay on the lookout for those.
Attend the journalist convention if you feel like,
that's another great place to
like kind of get a flavor for what's going on.
If you're looking for work,
check out the Digital Rights Job Board,
a lot of posts are put up there.
I post all The New York Times jobs to that board
as they come up and there are openings right now
at The Times in the security group.
We have major, I mean we're not the only, we're not the...
There are other newspapers out there,
there are other news orgs, surprise.
So definitely check out The Wall Street Journal,
Bloomberg, The Washington Post, CNN, BBC,
Reuters, AP, Gannett.
And also if you don't wanna switch your job,
but you just wanna try and help your local newspaper,
it's a really good idea.
Local news is really, really, really important,
and it's really, really, really on the ropes right now.
So definitely think about checking in
at your local newspaper,
even if it's an alt weekly
and ask if they want any help
because they might, they probably do need the help.
And even if it's just advisement,
it could lead to something you could not,
but it could definitely help.
If you are a researcher, if you're like working NGOs,
you like doing advocacy,
definitely check out some of the NGOs working in this space.
There's the committee to protect journalists
who help me get some of my stats.
There's Reporters Sans Frontieres,
they're a wonderful organization.
The International Federation of Journalists is out there
working on behalf of journalists internationally.
The International Women's Media Foundation
is another great place to look in that.
The Freedom of the Press Foundation,
a lot of folks I bet you in this very room
are from that organization.
So please think about working for one of them
or working with them.
And there's a bunch more, I didn't even name
also working on these same issues.
So hopefully you've found this talk enlightening.
If you have any questions, feel free to ask me,
you can hit me up on Twitter, my DMs are open.
And I'm not a great Twitter person by the way,
but I will look up an eye out for you.
So feel free to ask me any questions you like.
Thank you so much, and have a good day.