Don't fear journalists! Talk to me!

Don't fear journalists! Talk to me!

Speakers: Omer Benjakob, Investigative Journalist, Haaretz

Conference: Virus Bulletin

YouTube: https://www.youtube.com/watch?v=1CdMUB9Lcwo

Overview

In his compelling Virus Bulletin talk, "Don't fear journalists! Talk to me!", Omer Benjakob, an investigative journalist for Haaretz in Israel, challenges the conventional, often adversarial, relationship between cybersecurity researchers and news media. Benjakob argues that despite perceived conflicts of interest, both parties share a fundamental goal: to create public value and improve safety in a rapidly evolving digital world. His presentation serves as a practical guide and a passionate plea for enhanced collaboration, aiming to demystify journalistic practices and empower researchers to share their invaluable insights more effectively.

Benjakob, who specializes in the overlap of technology and national security, highlights the critical gap in public understanding of complex cyber issues, often exacerbated by the technical jargon of research reports and the PR-driven nature of corporate communications. He asserts that journalists desperately need the deep, nuanced understanding that researchers possess, while researchers need the reach and narrative-building capabilities of media to inform the public and drive meaningful change. The talk is a call to action, encouraging cybersecurity professionals to overcome their apprehension and engage with journalists to collectively address the urgent challenges of the digital age.

This article delves into Benjakob's insights, exploring the systemic issues that hinder effective communication, detailing practical strategies for fostering trust and collaboration, and showcasing concrete examples of high-impact investigative journalism born from such partnerships. It aims to equip cybersecurity defenders with the knowledge and confidence to proactively engage with media, thereby contributing to a more informed public discourse on critical cyber threats.

Background

▶ Watch: Don't fear journalists: Bridging research and media (0:00)

For many years, the coverage of technology and cybersecurity in the media has been largely superficial, often described by Benjakob as "Startup Nation pornography" – an endless stream of press releases detailing company funding rounds, exits, and new product launches, devoid of deeper analytical or national security context. This approach often treats cyberattacks as isolated incidents, reported reactively based on finalized corporate reports or official attributions. The problem, as Benjakob identifies, is multifaceted:

Firstly, cybersecurity research reports, while vital for the professional community, are frequently inaccessible to the general public and even to seasoned journalists not embedded within the technical discipline. They are laden with specialized terminology, intricate technical details, and novelty pitches aimed at peers, making it challenging for external audiences to grasp the core significance without extensive prior knowledge. This siloing of knowledge means that crucial insights remain locked within the expert community.

Secondly, the traditional channels for information dissemination from the cybersecurity sector to the media are often mediated by PR departments. This process filters information, prioritizing corporate interests, brand image, and pre-approved messaging, which can inadvertently obscure critical public interest narratives or delay the reporting of emerging trends. Journalists, who seek to uncover stories that "not necessarily people want to come out," find this restrictive.

Thirdly, researchers themselves often operate under strict Non-Disclosure Agreements (NDAs), corporate policies, and a culture of cautious attribution, which can make direct, candid communication with journalists feel risky or even impossible. There's a prevailing fear that speaking to a reporter will immediately lead to a published story, potentially jeopardizing careers or violating contractual obligations. This fear is compounded by a misunderstanding of journalistic practices, particularly how sources are protected.

This confluence of factors creates a significant gap: the public remains largely unaware of the true scope, implications, and underlying dynamics of cyber threats, while researchers miss opportunities to amplify their findings and contribute to broader societal awareness and resilience. Benjakob argues that this under-coverage of the digital arena has contributed to many societal issues, from the spread of misinformation on social media to the vulnerabilities of critical infrastructure.

Key Findings

▶ Watch: Undercover investigation reveals mass avatar disinformation systems (9:50)

Benjakob's central thesis is a powerful reframing of the relationship between cybersecurity researchers and journalists: they are not adversaries but allies working towards a common goal of public good. He asserts that "we're actually all on the same side" in the pursuit of improving the safety and well-being of humankind in a rapidly changing and scary digital world. This fundamental shift in perspective underpins his key findings:

1. Mutual Dependence for Public Value: Journalists desperately "need your help" because the digital arena has been critically under-covered. They require the deep, nuanced insights of researchers to understand complex cyber phenomena beyond superficial incident reporting. Conversely, researchers need the "reach" of journalists to translate their findings into accessible narratives that can inform the public and influence policy. The public, in turn, needs "clarity" on these issues. This symbiotic relationship is essential for creating genuine public value.

1. The "Sensitivity Mismatch": What researchers perceive as highly sensitive or proprietary information (e.g., precise attribution details like "Fuzzy Bear 25 vs. Jumping Koala 24," specific IP ranges, internal political attributions) is often "the least interesting things for journalists." Journalists are typically more concerned with the impact of an attack – that "hackers screwed up this system" – rather than the granular technical specifics that are crucial for peer validation within the research community. This mismatch highlights an opportunity for collaboration where perceived risks are often exaggerated from a journalistic perspective.

1. Untapped Knowledge and Lost Value: A vast amount of valuable information and insight exists "on the sidelines" of formal cybersecurity research. Benjakob notes that many researchers possess extensive knowledge about disinformation campaigns, fake accounts, or broader influence operations that never make it into official reports because their firms are focused solely on "cyber stuff." This represents "so much knowledge being lost" and a missed opportunity for "value that can be given in this two-directional relationship."

1. Journalism as a Form of Research: Benjakob views journalism as a type of research that employs methodologies and systematic work to craft narratives and make complex technical worlds accessible. He emphasizes the iterative process of figuring out "what is actually interesting and what is actually the story," often requiring consultation and collaboration. This perspective aligns journalistic work with the analytical rigor of cybersecurity research, fostering common ground.

1. The Human Element and Physical Manifestation: The talk stresses the importance of making cyber reports understandable to a layperson (e.g., "my mom needs to be able to understand cyber reports"). This requires connecting digital processes to their tangible manifestations in physical reality, such as ransomware threatening hospitals or the exposure of sensitive data like gun owners' lists. Overcoming the "superficial dichotomy between physical and digital" is crucial for fostering broader public engagement and understanding.

These findings collectively argue for a proactive, trust-based engagement strategy between cybersecurity researchers and journalists, emphasizing shared objectives over perceived conflicts and recognizing the unique contributions each field can make to public safety and awareness.

Technical Deep Dive into Researcher-Reporter Collaboration

▶ Watch: Media 101: Understanding 'on background' and setting terms (13:00)

While Benjakob's talk does not delve into traditional cybersecurity technical content like code or protocols, it offers a crucial "technical deep dive" into the mechanisms and best practices for improving researcher-reporter ties. This involves understanding the operational "hacks, exploits, and best practices" of journalistic engagement, which are as critical for effective public discourse as technical exploits are for system compromise. Benjakob aims to demystify these processes, making dialogue "more accessible and possible."

The core of this deep dive lies in establishing clear communication protocols and building trust. Benjakob introduces several key journalistic terms and concepts that researchers must understand to engage confidently:

1. On Background: This is perhaps the most critical term for researchers to grasp. On background means that a journalist can use the information provided but cannot quote the source directly or attribute the information to them by name. This allows researchers to share sensitive insights – like spotting a trend of overhyped "hack-and-leak" operations based on publicly available data – without fear of direct exposure or violating corporate policies. It's a mechanism for flagging important developments, providing context, or correcting misinformation without formal attribution. Benjakob illustrates this with the example of Iranian groups dumping open buckets and portraying them as impressive cyber hacks; a researcher sharing this "on background" allows a journalist to frame the narrative accurately, even if they can't quote the source.

1. Setting Conditions and Terms: Journalists are highly accustomed to operating under specific conditions set by their sources. This means researchers are empowered to dictate the terms of their engagement. Conditions can include:

• No direct quotes: Information is for the journalist's understanding only.
• Anonymity: The source's identity will not be revealed.
• Meeting protocols: Specific locations, no recordings, etc.
• Pre-publication review: Requiring the journalist to clear any published information derived from the conversation with the source first.

This flexibility allows researchers to tailor interactions to their comfort level and corporate constraints, providing a structured way to share insights without undue risk.

1. Off the Record vs. On the Record: While not explicitly detailed, Benjakob implies these standard journalistic distinctions. Off the record means the information cannot be published at all, even without attribution; it's purely for the journalist's context and understanding. On the record means the information can be published and attributed directly to the source. Understanding these gradients is crucial for managing disclosure.

1. Anonymous Attribution: Even if a source doesn't want to be named, information can still be attributed to a general category, e.g., "cybersecurity experts," "a source familiar with the matter," or "researchers observing the trend." This allows for attribution without compromising individual identities, providing a middle ground between full anonymity and direct quotation. "It doesn't have to be attributed to you," Benjakob clarifies.

1. Whitewashing Sources: Benjakob explicitly states that protecting sources and whitewashing information (i.e., finding ways to publish content without revealing the person who provided it) constitutes "95% of my week." This is a core journalistic skill. A journalist can take a tip from a highly sensitive source and then corroborate it through other means, or present it via a less sensitive source who is willing to be named. This process ensures that vital information reaches the public while safeguarding the original informant. He likens this to the "highly confident" attribution used by cyber firms, where the how of knowing is often omitted to protect sensitive intelligence sources or methods.

1. Focus on Trends, Not Just Incidents: Researchers often discuss "trends" and "what you're seeing" informally among themselves, especially at conferences. Benjakob encourages sharing this "nascent" information, even if it's not yet formalized into a report. These early indicators are invaluable for journalists to build broader narratives, understand emerging threats, and differentiate between genuine waves of activity and mere hype. This iterative process of discovery and narrative crafting is where journalist and researcher interests truly align.

1. Bridging the Jargon Gap: A significant challenge is translating highly technical concepts into language accessible to a general audience. Benjakob acknowledges that researchers' reports are "very difficult to read if you're not in the profession." Journalists serve as interpreters, distilling complex "cyber stuff" into understandable terms. Researchers can assist this by focusing on the "why" and "impact" rather than just the "how" of technical operations.

By understanding and leveraging these "technical" aspects of journalistic practice, cybersecurity professionals can move beyond the fear of engagement and proactively contribute to a more informed public discourse, ensuring their critical insights reach beyond the confines of specialized reports.

Demo / Proof of Concept

▶ Watch: Journalist's job: Protecting sources and sensitive information (20:00)

While Benjakob's talk isn't a traditional technical demo, he provides compelling "proofs of concept" through examples of successful investigative journalism enabled by close collaboration with cybersecurity researchers. These stories highlight the power of combining journalistic inquiry with deep technical insight to uncover narratives of significant public interest that would otherwise remain hidden.

1. The "Fake News for Hire" Industry Investigation: This was a multi-national undercover investigation conducted with journalistic collectives like Paper Trail Media and Der Spiegel. The project exposed the inner workings of the fake news for hire industry, revealing mass avatar systems and disinformation service providers that operate sophisticated botnets for social media influence. Benjakob recounts how journalists went undercover, filming meetings with "fake news salespeople" who demonstrated specialized software. For the journalists, these systems were "science fiction" – they "had no idea" such sophisticated operations existed, largely because they still believed platforms like Facebook were effective at taking down fake accounts.

However, when these findings were shared with digital researchers, "a lot of the people in the kind of I'll say digital world knew exactly what it was." These researchers immediately recognized the underlying mechanisms: "Oh yeah, of course, like you know, there's avatars. We're seeing it. There's got to be some system to run it. This is how it would work. You know, there's some SMS verification system running here in the background that allows them to automatically set up accounts." This collaboration was crucial because the technical forensics were "wild" and "only built on the fact that we were in touch with really good researchers." This example perfectly illustrates how researchers hold critical contextual knowledge that can transform journalistic discoveries into profound insights, even if that knowledge "didn't make it into any research" reports themselves.

1. Israel's "Talent Brain Drain" in Offensive Cyber Security: This investigation focused on a significant, yet often unaddressed, trend: the migration of highly skilled Israeli offensive cybersecurity and exploit researchers to other countries, particularly European cities like Barcelona. This story, Benjakob notes, "is not on any kind of research firm's agenda, but it's actually very big on public significance." It touches on national security implications, as these individuals often have military backgrounds, and their departure signifies a shift in Israel's cybersecurity ecosystem.

The ability to track and analyze the movements of specific cybersecurity researchers and conduct corporate analysis on them was "all based on information that was shared with me on trust." Researchers within the community provided names and insights, enabling Benjakob to connect the dots and expose a trend with significant long-term consequences for national security and talent retention.

1. Huawei's Headhunting in Israel: Another impactful story concerned Huawei's aggressive headhunting practices in Israel, specifically targeting individuals with military experience in offensive cyber operations. Benjakob received information from multiple sources who sent him job postings and expressed concerns that such practices, while common in Israel, "in America this is not legal... at least socially acceptable if not also legally acceptable."

This investigation sparked a crucial public debate in Israel about the ethical and national security boundaries of red teaming and defensive cybersecurity work for foreign, particularly Chinese, firms. It highlighted a discussion that was already mature in Western countries (influenced by figures like Trump) but was nascent in Israel. The article itself "was de facto a debate between like two or three different people and two different lawyers" on the legality and appropriateness of such employment. This demonstrated how journalistic inquiry, fueled by researcher tips, can instigate vital national conversations on emerging geopolitical and ethical challenges in cyber.

These examples underscore Benjakob's core message: by understanding and engaging with journalistic processes, cybersecurity researchers can contribute to high-impact public interest stories that go beyond traditional incident response and corporate PR, addressing broader societal implications of the digital world.

Defensive Implications

▶ Watch: Case study: Offensive cyber talent brain drain from Israel (23:00)

For cybersecurity defenders, Omer Benjakob's talk offers crucial insights that extend beyond traditional technical defenses, providing a framework for defending the public sphere from misinformation, under-informed narratives, and a general lack of understanding about critical cyber threats. The "defensive implications" here are about proactive engagement and leveraging media as a force multiplier for public awareness and resilience.

1. Proactive Information Sharing as a Threat Intelligence Feed for the Public: Instead of viewing media engagement as a reactive exercise to PR crises, defenders should see it as a proactive mechanism for sharing threat intelligence with the broadest possible audience. By providing journalists with "tips on trends" – even nascent ones – defenders can help shape public understanding of emerging threats, attack methodologies, and adversary motivations before they escalate. This can foster a more informed citizenry, which Benjakob's "my mom needs to understand cyber reports" anecdote powerfully illustrates. An informed public is a more resilient public, better equipped to recognize phishing attempts, understand the risks of ransomware, or grasp the implications of data breaches.

1. Bridging the Gap Between Technical and Human Impact: Defenders are often focused on technical indicators and mitigation strategies. Journalists, however, excel at translating these technical details into human-centric narratives. By collaborating, defenders can help journalists articulate the real-world consequences of cyber events (e.g., ransomware impacting hospital operations, data leaks exposing personal safety risks). This contextualization is crucial for policymakers and the public to truly understand the urgency and allocate resources effectively for cybersecurity.

1. Countering Misinformation and Hype: Benjakob highlighted how "80 to 90%" of hack-and-leak operations targeting Israel were "complete overhyped kind of like you know attention grabbing stuff." Defenders, equipped with deep technical understanding, can leverage "on background" conversations to provide journalists with the necessary context to debunk or accurately frame such events, preventing public panic or misallocation of resources based on sensationalized reporting. This is a critical defense against information warfare and psychological operations.

1. Influencing Policy and Resource Allocation: High-impact investigative stories, often born from researcher-reporter collaboration, can bring to light systemic vulnerabilities or policy gaps that might otherwise be ignored. The Huawei headhunting story, for instance, prompted a national debate in Israel about the ethics and security implications of talent recruitment by foreign powers. By contributing to such narratives, defenders can indirectly influence policy decisions, drive regulatory changes, and secure better funding for cybersecurity initiatives.

1. Building Trust and Long-Term Relationships: The foundation of effective media engagement is trust. By proactively engaging with journalists, respecting their role, and understanding their needs (e.g., source protection, narrative building), defenders can cultivate long-term relationships. These relationships create reliable channels for information exchange, allowing for more nuanced and accurate reporting over time, and ensuring that critical cybersecurity perspectives are consistently represented in public discourse.

In essence, the defensive implication is that cybersecurity professionals have a civic duty and a strategic opportunity to move beyond the confines of their technical reports and engage with the media. This engagement is not just about public relations; it's about actively shaping the information environment, fostering public resilience, and ultimately strengthening the collective defense against a constantly evolving threat landscape.

Key Takeaways

• Journalists and cybersecurity researchers share a common goal: To create public value and enhance safety in the digital world, making collaboration a strategic imperative.
• Understand journalistic communication protocols: Leverage terms like "on background" to share sensitive information without direct attribution, protecting sources while informing the public.
• You can set the terms of engagement: Reporters are accustomed to strict conditions; researchers can define how and what information is shared, mitigating perceived risks.
• Focus on trends and impact, not just granular technical details: Journalists prioritize accessible narratives and the broader significance of cyber events over specific attribution or deep technical jargon.
• Your "sideline" knowledge is invaluable: Information about disinformation, influence campaigns, or industry trends that doesn't fit formal reports can be critical for public interest journalism.
• Proactive engagement builds trust: Regular, informal interactions with journalists foster relationships that lead to more accurate, impactful reporting and a more informed public.

About the Speaker(s)

Omer Benjakob is an investigative journalist for Haaretz, one of Israel's leading newspapers. Based in Israel but with American roots, he specializes in reporting on the intricate overlap between technology and national security. Benjakob has been with Haaretz for 10 years, shifting from traditional tech coverage to a more national security-focused approach, aiming to uncover stories that go beyond corporate press releases. His work often involves deep investigative journalism, collaborating with digital researchers and journalistic collectives to expose complex issues like the fake news for hire industry and the geopolitical implications of offensive cyber talent. Benjakob is a passionate advocate for bridging the communication gap between the cybersecurity community and the media, believing that mutual understanding and trust are essential for informing the public about critical digital threats.