Managing risk to the media from emerging networked technologies

This thesis investigates the research question: How can members of the press in democratic countries improve their identification of, protection from, and resilience against threats from the Internet of Things (IoT)?
This question is important because the existence and maintenance of a free press can be used as a barometer for the state of a democratic society, as public access to factual information about powerful people and organisations is key to an educated electorate. Therefore, attempts to curtail transparent, accessible and free journalism can be seen as threats to a branch of the critical national infrastructure of a democracy, and thus to the democratic state itself. This has potential implications on an individual human rights level and in terms of international relations and security. This project falls best within the EPSRC Global Uncertainties research area, as it investigates the threat to the free press branch of democratic infrastructure posed by emerging technologies and new legislation.
The thesis pilot study investigated how some high-risk members of the media perceive and combat IoT threats to their work and wellbeing. The study found that most of the pilot study interviewees only had an abstract idea of IoT threats, thus highlighting the need for further research and resources. All interviewees said that their primary strategy for mitigation of IoT threats is simply to avoid interaction with IoT devices. However, 26 out of 34 surveyed cyber security experts said that they believed that it would be impossible for members of the general public to opt-out of interaction with the IoT within the next five years, which would render the primary strategy given by all journalist respondents completely redundant. A solution applicable to both the work and work practices of journalists, as well as understandable for journalists to implement themselves, represents a clear gap in current practice and academic literature. Therefore, this thesis has created a multi-piece toolkit that enables members of the press to identify threats from IoT devices to themselves and their work, and then identify the countermeasures best suited to their context, customisable on numerous levels.
The toolkit is also informed by this thesis' comparative profiling and analysis of the journalistic security environment in four democracies (UK, US, Taiwan, Australia), so that the solutions presented are grounded in reality. These country profiles comprehensively investigate and document what journalists and media organisations are currently doing, procedurally and technologically, to protect themselves against innovative and well-resourced attackers. The profiles compare this information with the recommendations of experts from a variety of backgrounds, including academic, governmental and non-governmental.
The toolkit includes:(1) A conceptual model to categorise IoT devices by environment (location), via systematic literature review, intended to demonstrate to members of the media the scope and scale of where IoT devices may present threats.(2) A second conceptual categorisation of IoT threats to journalists, covering threats to information as well as related legal and physical threats, also created by literature review of currently feasible capabilities.(3) An interactive framework of countermeasures to the threats to ensure that members of the media can effectively decide how to protect themselves. These countermeasures are linked to phases of the overarching editorial workflow, to ensure that their implementation is feasible and that they are clearly useful by/for specific role categories within the media.

This project falls best within the EPSRC Global Uncertainties research area, as it investigates the threat to the free press branch of democratic infrastructure posed by emerging technologies and new legislation.

It is part of the nature of Cyber Security - and a key reason for the urgency in developing new research approaches - that it now is a concern of every section of society, and so the successful CDT will have a very broad impact indeed. We will ensure impact for:

* The IT industry; vendors of hardware and software, and within this the IT Security industry;

* High value/high assurance sectors such as banking, bio-medical domains, and critical infrastructure, and more generally the CISO community across many industries;

* The mobile systems community, mobile service providers, handset and platform manufacturers, those developing the technologies of the internet of things, and smart cities;

* Defence sector, MoD/DSTL in particular, defence contractors, and the intelligence community;

* The public sector more generally, in its own activities and in increasingly important electronic engagement with the citizen;

* The not-for-profit sector, education, charities, and NGOs - many of whom work in highly contended contexts, but do not always have access to high-grade cyber defensive skills.

Impact in each of these will be achieved in fresh elaborations of threat and risk models; by developing new fundamental design approaches; through new methods of evaluation, incorporating usability criteria, privacy, and other societal concerns; and by developing prototype and proof-of-concept solutions exhibiting these characteristics. These impacts will retain focus through the way that the educational and research programme is structured - so that the academic and theoretical components are directed towards practical and anticipated problems motivated by the sectors listed here.