Worst of Cybersecurity Reporting

Yael Grauer and David Huerta return for their sixth annual session dissecting security and privacy news coverage from 2024. They set ground rules first: the session covers news articles rather than opinion pieces, press releases, TV segments or social media posts, and a single bad story does not mean the author or outlet is bad. Their examples are sorted into categories, running from invented claims to sensational and mistaken technical reporting.

The middle of the session walks through specific cases. A widely repeated claim about a botnet of smart toothbrushes came from a hypothetical scenario that outlets reported as fact. A story linking solar flares to a cellular outage ignored that the connection was unconfirmed, and a near-maximum CVSS score for a printer bug was presented as an apocalypse without considering how the software is deployed. Other cases include a misreading of what a Meta API could access on Netflix, the loose use of the term open source for a Llama license, and recurring myths about Signal, WhatsApp metadata, burner phones and phones secretly listening.

The closing section turns to practical advice. Journalists should push back on misleading headlines, verify claims pulled from translations or social media with the original source, and correct errors quickly. Security researchers should place severity scores in real-world context, label hypothetical examples clearly, and consult the people who would actually apply the fix. The speakers expect AI and large language models to be the next major source of misreporting.