Worst of Cybersecurity Reporting

Yael Grauer and David Huerta return with their annual critique of technology journalism, this year covering stories from 2021. They group the weakest coverage into four failings: not reading a company's privacy policy or terms, repeating press releases without checking them, leaving key details vague, and relying on sources without relevant expertise. Examples include a messaging app's data-sharing prompt that was not actually new, an open-source audio editor's analytics being labeled spyware, a quantum computing claim that rested on a company's announcement, and a mobile voting app story that gave vendor rebuttals equal weight without contacting the researchers involved.

The middle of the talk argues that the problem spans the whole ecosystem, not just individual writers. Deadlines, editors rewriting headlines, public relations staff who speak only off the record, and companies with unclear data practices all contribute. The speakers suggest that reporters read documentation and compare changes, contact everyone named in an allegation, verify vendor claims independently, and make sure headlines match the reporting. Researchers criticizing an article should explain their objections in detail, and companies should be transparent and willing to put named spokespeople on the record.

The question-and-answer section covered public records requests, which the speakers described as slow and frustrating, with some agencies narrowing or closing requests on technicalities. They recommended vetting anyone who asks for an interview and leaning on community resources for handling records requests. The closing message is that careful reading, cross-checking and expert sourcing matter more than speed.