Managing risk to the media from emerging networked technologies

本文调查了一个研究问题：民主国家的媒体成员如何提高他们对物联网（IoT）威胁的识别、保护和抵御能力？这个问题很重要，因为新闻自由的存在和维持可以被用作民主社会状况的晴雨表，因为公众能够获得有关有权势的人和组织的真实信息，是受过教育的选民的关键。因此，限制透明、无障碍和自由新闻的企图可被视为对民主国家关键国家基础设施的一个分支的威胁，从而对民主国家本身的威胁。这对个人人权以及国际关系和安全都有潜在的影响。该项目最适合EPSRC全球不确定性研究领域，因为它调查了新兴技术和新立法对民主基础设施的自由新闻分支构成的威胁。论文试点研究调查了一些高风险媒体成员如何看待和应对物联网对其工作和福祉的威胁。该研究发现，大多数试点研究受访者对物联网威胁只有一个抽象的概念，因此强调了进一步研究和资源的必要性。所有受访者都表示，他们缓解物联网威胁的主要策略就是避免与物联网设备交互。然而，在接受调查的34名网络安全专家中，有26人表示，他们认为在未来五年内，普通公众不可能选择退出与物联网的互动，这将使所有记者受访者给出的主要策略完全多余。一个既适用于记者的工作和工作实践，又能让记者自己理解并付诸实施的解决方案，代表了当前实践和学术文献中的一个明显差距。因此，本文创建了一个多部分工具包，使媒体成员能够识别物联网设备对自己和工作的威胁，然后确定最适合其背景的对策，可在多个层面上进行定制。本论文还对四个民主国家（英国、美国、台湾、澳大利亚）的新闻安全环境进行了比较分析，从而为该工具包提供了信息，因此所提出的解决方案是基于现实的。这些国家概况全面调查和记录了记者和媒体组织目前在程序和技术上所做的事情，以保护自己免受创新和资源充足的攻击者的侵害。这些简介将这些资料与来自不同背景的专家（包括学术、政府和非政府）的建议进行比较。该工具包包括：(1)通过系统的文献综述，根据环境（位置）对物联网设备进行分类的概念模型，旨在向媒体成员展示物联网设备可能构成威胁的范围和规模。(2)对记者的物联网威胁的第二种概念分类，包括对信息的威胁以及相关的法律和物理威胁，也通过对当前可行能力的文献综述创建。(3)一个应对威胁的互动框架，以确保媒体成员能够有效地决定如何保护自己。这些对策与总体编辑工作流程的各个阶段相关联，以确保其实施是可行的，并确保它们对媒体中的特定角色类别明显有用。该项目最适合EPSRC全球不确定性研究领域，因为它调查了新兴技术和新立法对民主基础设施的自由新闻分支构成的威胁。

This thesis investigates the research question: How can members of the press in democratic countries improve their identification of, protection from, and resilience against threats from the Internet of Things (IoT)? This question is important because the existence and maintenance of a free press can be used as a barometer for the state of a democratic society, as public access to factual information about powerful people and organisations is key to an educated electorate. Therefore, attempts to curtail transparent, accessible and free journalism can be seen as threats to a branch of the critical national infrastructure of a democracy, and thus to the democratic state itself. This has potential implications on an individual human rights level and in terms of international relations and security. This project falls best within the EPSRC Global Uncertainties research area, as it investigates the threat to the free press branch of democratic infrastructure posed by emerging technologies and new legislation.The thesis pilot study investigated how some high-risk members of the media perceive and combat IoT threats to their work and wellbeing. The study found that most of the pilot study interviewees only had an abstract idea of IoT threats, thus highlighting the need for further research and resources. All interviewees said that their primary strategy for mitigation of IoT threats is simply to avoid interaction with IoT devices. However, 26 out of 34 surveyed cyber security experts said that they believed that it would be impossible for members of the general public to opt-out of interaction with the IoT within the next five years, which would render the primary strategy given by all journalist respondents completely redundant. A solution applicable to both the work and work practices of journalists, as well as understandable for journalists to implement themselves, represents a clear gap in current practice and academic literature. Therefore, this thesis has created a multi-piece toolkit that enables members of the press to identify threats from IoT devices to themselves and their work, and then identify the countermeasures best suited to their context, customisable on numerous levels. The toolkit is also informed by this thesis' comparative profiling and analysis of the journalistic security environment in four democracies (UK, US, Taiwan, Australia), so that the solutions presented are grounded in reality. These country profiles comprehensively investigate and document what journalists and media organisations are currently doing, procedurally and technologically, to protect themselves against innovative and well-resourced attackers. The profiles compare this information with the recommendations of experts from a variety of backgrounds, including academic, governmental and non-governmental. The toolkit includes:(1) A conceptual model to categorise IoT devices by environment (location), via systematic literature review, intended to demonstrate to members of the media the scope and scale of where IoT devices may present threats.(2) A second conceptual categorisation of IoT threats to journalists, covering threats to information as well as related legal and physical threats, also created by literature review of currently feasible capabilities.(3) An interactive framework of countermeasures to the threats to ensure that members of the media can effectively decide how to protect themselves. These countermeasures are linked to phases of the overarching editorial workflow, to ensure that their implementation is feasible and that they are clearly useful by/for specific role categories within the media.This project falls best within the EPSRC Global Uncertainties research area, as it investigates the threat to the free press branch of democratic infrastructure posed by emerging technologies and new legislation.