Engaging the Media: Know Your Target

I will let our wonderful panel of speakers introduce themselves and welcome to engaging the media know your target hi everyone I'm Jen Ellis I am something at rapid7 as something I represent and I have both worked with the media as a PR person pitching to them and trying to help our spokespeople and our partners tell stories in the best way possible and I've also more recently become a spokesperson myself which is a very weird thing when you make the leap from puppet master to puppet experience so I bottom line is that I've ever worked with media for a long time including all of these fine gentlemen right here we have five reporters who work in a pretty

pretty wide range of titles with different audiences but all of whom are reporters who specialized in security they've covered security for a long time they write predominately about security topics regularly and so they know this community they've interacted with people in this community for a long time they're highly invested in this community learning how to engage the media and the best way possible because it benefits them so they're going to talk a little bit about their experiences today and then in the second session which if you care to stay for they're going to talk about they'll actually do much more sort of workshop II type stuff on how you can pitch to them and you'll have the opportunity to

actually pitch to them here and now and maybe get a story written citing I'm very confused to see that there is at least one other reporter in the audience here to figure out how it is that you pitch to media and but I would say like these guys are really good guys a quick know for the cavalry don't know how familiar people are but generally speaking you know we're all about trying to connect security expertise with manufacturers and policy makers people who basically are making decisions that impact how security is built in to technology and as part of that we need to help technical people who've become better advocates better storytellers that are able to translate

the technical knowledge that they have so that's the sort of rationale behind pretty much the entire track is all about how you build ambassadors but specifically this session and the next one are focused on how you do that through media which is obviously like a vitally important platform when you want to disseminate information broadly so let know I'm going to ask the panelists just to run down and introduce themselves quickly emphasis on quickly and then we'll jump right in thank you well I guess I'm in Thompson I'm the reporter of the register and have been covering security for about ten years covering IT for about 25 so I think my first articles about this wonderful new thing called multimedia

where you get videos and pictures in the same thing I'm Sean Gallagher I'm the IT and national security editor at ARS technica I worked in good nurse Curie editor I've been covering IT for well 30 years and prior to that I was a naval officer information security officer and so I had a little bit of a look at on both sides of things and currently I do the dance between doing day-to-day news coverage of security issues and running our own testing labs Technica Steve Reagan senior staff writer at CSO online managing editor of salted hash and prior to getting in the journalism I worked in the security field for about 10 years so I've been

doing security now for just over a decade and I still do day-to-day news but focus more on investigative pieces lately I'm Joseph Cox from motherboard which is the technology section of vyse cybersecurity tool underground space industry as you'd probably tell I'm probably the youngest here I've only been a journalist in about five years so hopefully I can bring some naivety to a discussion hi Mike yeah I got that built in i'm paul wagon seal i'm the senior editor in charge of security coverage at Tom's guide and laptop magazine yeah despite that title I probably have the shallowest person here since like basically I we don't really I cover up basically breaking news I do have people

write future pieces on really consumer oriented security trying to reach the average reader basically the most kind of really consumer facing stuff so you know I don't deal well there really technical stuff but I also have to learn how to translate stuff to very general audiences and I I also go on TV a lot to explain things to even more general audiences which is helpful all right thank you guys so as your presence here kind of indicates generally speaking there are media at conferences lots of people who work in security attend conferences so they are probably going to interact with you either directly or indirectly what should people be aware which they be thinking about when they

attend conferences in terms of sort of press interaction basically be aware that anything you say is on the record if if this is one of the big things that I find going from the UK to the u.s. in the u.s. if someone says off-the-record that's supposed to mean off the record in the UK and for most of the genders or industry unless you say this is specifically off-the-record ever thing else is open yeah there's a so it's key to understand that when you're in a public environment like a conference any conversation you're having out in the open is probably going to be listened to by anyone around you and one of those people might be a

member of the press and that's why the b-sides hooks give us these pink badges so that we listen to the red it's usually red is usually pink I think you want to stand out a bit more that's right that's right there does it so we have a half life so that being said it's important to understand who you're talking around if you're not in a position to speak publicly but we also as journalists are not necessarily out looking for some of us are not out looking for a specific story you're overhearing signal something that somebody says a conference others maybe we've we've run across that a few times even in places where it was theoretically off the record there have

been there have been stories about things that people said that really should not have never made it to a story because there had been agreement in advance that it should have been covered you can give them an example an example so our so Marcus actually instead of Marcus let's do one that's related to Calvary okay that's gin said earlier this is policymakers connecting people right so a few years ago DEFCON I'm walking we're at the Rio and those of you who are there at DEFCON 3 oh you remember that's this mile long walk to go from the cond all the way to the front of the hotel and it was about 700 people in this

hallway we're all moving it's like a big herd of cattle we're just walking up this thing and there's people having conversations all around me including one individual who is working on a policy thing that this individual should not be talking about now I had known that this policy thing was in the works but I didn't know who was involved I didn't know really what the goals were the aims were and I knew some of the people who were either on the outskirts trying to get to work or you know have you but I didn't have the whole picture until I started walking behind this individual who was casually telling his friend about everything that's going

on with this initiative and the thing is this particular initiative is sensitive if the the policymakers involved it got wind that the press especially but anybody else had gotten you know details and knowledge about what they were working on they were afraid it was going to be scrapped so FIDIC came out or if in a leak that got back to them you know this could have been disastrous yet this individuals just walking up the hallway discussing everything that's going on now this is one of the few times I've given Jin a heart attack because she was my meeting I was walking to him when I sat down I looked at dead knee I said so

tell me about blah and explained what I knew yeah it was my initiative and it was very funny to see the blood drained from her face but all of that happened because somebody was having a conversation and was not aware of who was standing around them now I could have written a story about that but short term I would have gotten a great story long term I would have lost several sources it's not worth it for me so I didn't do anything but that's my take on how to do something another journalist wouldn't do that which is why it's imperative you understand where you are and what you say is on the record even if you're not talking to a

journalist they can use it and just to bounce back on that a little bit everybody's a journalist now if you've got a Twitter account if you've got a blog they still call them blogs if you if you get blogs yeah if you have a youtube channel bits of video right those people are journalists and the traditional media is no longer just the sole source of journalism so anything you say could end up in a tweet that's that's the way it is anything you say could end up on a Facebook post they get shared across the entire Internet I mean that's the way it is so you need to be aware of your surroundings if you're if

you're having a conversation with somebody and it's something that you really don't want to end up shared with the rest of the world you need to have a conversation someplace where that's not going to happen I mean it's probably helpful to explain why that's actually the so if you only quote something that's been nice and approved nee got a cute little embargo and the press people of you know signed off and everything you're not necessarily presenting reality we're not exactly doing our jobs so some people researchers PRS whoever they may be they may think there would be inappropriate for a journalist just to report something they overheard but yeah if you're not do if you're not

going to be presenting reality you're gonna be presenting something plastic instead and ultimately some people may think we're [ __ ] and a lot of people think I'm an [ __ ] we have a job to do and it's kind of bouncing off Steve said sometimes you may not bend the rules because that sounds manipulative but you may make editorial decisions backward yeah that will benefit other stories in the future you may ever hear something you may not necessarily even though you can do so it's probably just worth bearing in mind why a journalist would actually do that in the first place what are the things we have to learn in this industry in particular is balance I

have to learn when not to write a story versus wind to write a story because when you cover security particular vulnerabilities and you know things that happen really quickly in our industry our words have impact not just because of you know a given vendor looks bad but their customers could be at risk from something we've written because what happens if I go in too deep of technical details on a vulnerability and somebody comes along and says I understand what he's talking about I could recreate this attack and now I'm gonna go off on their own you've got to be really careful with what you're right and the thing is especially here at blackhat I will hear vendors discuss

their vulnerabilities in enough detail to where if I wanted to I could write about that and there's a real risk that somebody could go through and recreate an attack you never want that the patch then you know what's dispatched and fixed that's a different matter entirely but when it's still live and things are going on you have to be really careful with what you're writing about and how you do it because your words have an impact far beyond just clicks and views is the same thing as ethical disclosure yeah with bug we were in the same situation so let me ask you so Joe said that you know as reporters reporting on what's really happening the world it's it thankfully

it's it's your responsibility to report what you hear and Steve gave an example of when he chose not to write about something to make sure that he didn't do damage so how do you decide what are the criteria that you look at to determine whether it's worth writing about something that you've overheard the very first rule is does the public have a right to know this do they absolutely need to know this and if the answer to that question is yes then no other question matter it's the story gets written because it is my job to to expose the truth to the public to make sure everybody's informed and that people in power are held accountable in

our industry and when you say that what we mean is that the vendors that are putting out products they're not doing anything Shady they're not abusing the data or the authority or the the relative control they have over their customers they don't abuse that we're the ones that hold them in check for that stuff so that's the first thing is does the public need to know and also a dad you know in terms of the the pressure that you could put on companies to actually get their software updates out online I mean Oracle is the the key case in this they'd sit on patches for 6 to 12 months you know one things I admire

about some security researchers is that they are saying right you have a deadline we've identified this phone bill see you can deal with it or you can't deal with it but within 30 days or 90 days or whatever we're gonna get out there and that's the only way you get software fix yeah I think the other thing is one of the things I look at when I do stories is whether it's something that's actionable whether it's a piece of information that somebody can take and actually do something to either protect themselves or to others or make a decision that's important to them I mean if it's something that's just a fact it's just a fact that is detached from

context then what the point of reporting it I mean then what is the public's need to know in that sort of situation but if it's something that has context trended that is important that's something where you know that piece of information could inform people on making a decision to protect their privacy and protect their security then it's something that we want to cover as quickly as possible and sometimes that that means taking a few steps back and and talking to the vendors first but we're eventually going to cover the story I mean kind of on the flip side of that is what you decide to omit and we've kind of define touching on that we deal with a lot of data

breaches you know tens of millions hundreds of millions of user accounts or especially recently focusing on malware that's used in domestic violence interfaces facilitate stalking and rape we're not going to print the names of people who are being stalked or necessarily the people who are actually carrying out those crimes either unless they're a public official or there's some sort of overriding public interest the public interest is in the breach itself and what the data is being useful we're in quite a strange beat in that I mean I would say majority but a lot of the stories you're gonna have this trade-off between what you're going to admit and what you're going to publish and you don't necessarily get that in

all journalistic beats know as an example on that I just wrote a story that ran today on hunting down fishing kits and run hunting down fishers and I published the email of an individual who had entered that email into his fishing kits because I felt you know that's something worth publishing because we're identifying the person who's involved in the operation at least by their email address and I wouldn't normally print somebody's email address I wouldn't normally say give somebody a URL to some place they're gonna go in and and find bad things but in this case you know if somebody was running a bunch of different fishing sites and he advertised his skill by even having his

nom de hack in his custom web shell that he installed in every society operated a fishing site off of I figured it might as well give out his web address do we give it out his email address anywhere you get a hold of them you're helping with us branding that's right free advertising I mean I won't go to this deeply because it is kind of going on a side note but that idea of advertising we do when we emit information we sometimes decide to get rid of that explicitly for that reason hackers contact me a lot officer they all have motivations a lot of them want free advertising for their new data dump whatever it may be right a lot of them

will say hey can you put my jabber handle my XMPP handle in here because obviously they want to be contacted yeah no no the the reader does not need to know how to get all of this data then sometimes the hackers will go somewhere else and then you'll see a piece on various tech blocks that will go unnamed and they all have the Java handle in them so clearly the german's has made an agreement ler so they're asking you to do their PR yeah yeah and with all that being said in a way we are still doing their PR even if we don't include the handle which is again why you may omit or decide to include certain details

because you have to get that balance between what the public needs to know and you know not inadvertently giving free advertising attackers in the same vein of criminals advertising and in doing like research and what the public and what not have any of you in this room seen emails lately that starts off with I know your password is blah and you're going to pay me okay so I know that watching porn yeah I've been tracking down these emails they started in late June and I found the group responsible for and I know what data breach they got their stuff from but the thing is the state of breach has only partially been exposed which means this

company had a problem that was much bigger than what they thought so now what do I do do I write about everything or do I give them time to fix this and figure out the scale and scope and he answer that question is you give them time to fix it because I don't want to risk before I have all my ducks in a row and absolute proof because I need to sources on a data breach and to sources on the emails before I can print this I have to verify improve things right well for right now I've got enough information to go to this company and say your problem it's much bigger than you thought you need to

do some work so are going to dig into it and maybe there's something there maybe it's not but before I have that proof I can't write this story yet but it's been an ongoing investigation so you have to really balance what you're writing because I have enough right now if I want it to embarrass myself and if I'm wrong I could totally put this company on but I won't so not only have I considered that that is what I do and the thing is I got one of those emails and I know where it came from as well because there's only one place I use that pass what they wrote but just having that that's still not enough to

print it's not enough it's not enough for me I want that company on record I have to have more than just a passive thing but that's my standard not every journalist is like that you know everybody's different but yeah I mean that's that's when you have to you have to balance what you know and what you don't know and what you run within what you don't the point was reporters having people in their network that they can use a third-party corroboration when they're investigating something which I'm sure everybody sitting at this table does yes and actually also their own skills because they've been doing this so long that they have they've developed their own skills so it that might actually be a

good point to talk about the difference between on the record off the record background and Chatham House all right so first we're gonna do the really easy one most of you are familiar with off the record all right off the record is really simple I cannot use your name I cannot use what you've told me I can't use anything in our conversation I'm using you as an example because I can just look at you right now so you and I are talking nothing like you tell me can I go into doing a story but here's a problem everything you've told me I can go to him and say hey I heard have you heard anything and now I'm

going to get an on-the-record source for the information you told me that's exactly what a reporter is supposed to do but because you were off the record you're not going to be in the story but if he confirms what you said that can go into the story on background means that you and I are going to have a conversation but I'm not going to name you I might quote you I might use what you've said in this story but you're not going to be named you'll sometimes hear that is not not for attribution but what that means is when you see a story that says sources close to the investigation a senior White House official or what

have you that's not for attribution quote that's on background people familiar with the matter yep yes and then you have on the record the easiest way to remember this is on the record as always and you will always be quoted and everything you say on the record can and will be used against you and that means all of your quotes are gonna be headlines especially if you said something inflammatory or if you said something that catches someone needs attention there's a good bet you'll see that prominently in the article but it's easier for you to remember and this is what we started our conversation on everything you say is on the record the only way you go on background the

only way you go off the record is if you have a really good relationship with that particular journalist and that takes a lot of time to build you know Trust is not something you just give away Trust is earned so unless you absolutely trust that reporter you never go off the record and you should only go on background sparingly because you don't want us to constantly have to rely on you as an on background source when eventually you're gonna burn bridges enough to where your motives would be questioned if you constantly want to stay on the background or try to go off the record we're going to dig into why what's your motive Fickett what's your

motive for coming to talk to us why are you here what are we looking for so there's there's a lot that goes into that but it's a relationship status and Trust little more you work with a journalist maybe you trust more that's where you get your your variations anyone sorry good no it's gonna save it Chatham House rule right that's that's the interesting one that actually in DC Paul and Sean and I had a good conversation about that what was the dinner the Chatham House Rules oh yeah that was the that was the one where Marcus yeah yeah so yeah that's a good story so malware tech blog I think everybody knows him as Marcus sessions he's not in

the room but he's here I invited him he was he was that he was at Def Con last year and there was a Chatham House Rules dinner and so Chatham House Rules means generally speaking that what's said in the room can leave the room but you're not supposed to tribute it to anybody in the room it's supposed to be information shared with colleagues so is essentially the same thing is on background but there's some variation on it so it was a dinner and he was sitting down at a table and having conversation about all the things he was doing in town because he was with his company and they had rented out a mansion as their as their place to stay

in town on Airbnb and you know pretty reasonable we have that many people will stay in a big house I think it came down to be cheaper than a hotel based on the math I did and you know he's an a visitor of the United States I was good time to use a firearm drive around in the souped-up rental cars because that's what Vegas is all about right here you get a rental car drive around the rail car go out to the gun range and shoot an automatic weapon all perfectly legal all perfectly legal yes even for foreigners all right you're killing Jews to kill people yes geeks with guns kill people right so he was discussing all this with

a young reporter who was at the time working for the outline who was a table and yeah I won't name him right now because he's technically a minor yeah doesn't excuse under yes so in any case he when when Marcus Hutchins got arrested the young journalist from the outline then rode up everything he said in this conversation and made it as scandalous as possible on the way it sounded like he was living high on the hog driven living a new state of him in a mansion and was driving expensive cars I'm not shooting firearms total [ __ ] and so the FBI used that as reason to put a hold on him to prevent him from

being released on bail because he had done these things and so he was a risk to the public it was a conversation that should have never made it into a publication it was yeah let alone let alone making making it the basis of an article so that's why you know when you're having conversations with people who are journalists of a certain type you need to really understand who the journalist is before you have a conversation with them and also you need to make sure that it's clear even though the rules were state at the beginning said yeah this is all off the record this is all not for comment not you cannot print any of this this is just

for your information yeah and then for us you got to realize that made us all look bad it really did I mean that personally upset me that article I met both people involved they're both perfectly nice people in general but yeah that I I couldn't support that move on that part of that journalist it was it was too much of a burn it was it was there was no real upside I got a quick hit you know a day and a half's worth of clickbait and then your credibility is shot my credibility is shot show of hands how many of you have had media trainer tour all dealt directly with a journalist okay so I want you to think

about that interview that interview and interaction you had with the journalist okay I want you to think about how you felt at the end of that interview was it a good interview is that somebody with - again did you feel like that they understood what you were talking about and you were comfortable talking to them about that but given topic you didn't have to repeat yourself or try to explain something they were on the same page with you the whole time this is the type of mechanic you look for when you evaluate a journalist this is how you know who you're talking to and what you're discussing the problem is you can't do that with every journalist you

see in a room like even with us sitting here on the stage because we've never interviewed you you don't know us so when we talk about the the hit piece that eventually came out of that that one particular dinner there was no way for Marcus to have known that that was the journalist was going to write what eventually became a hit piece based off some passive conversation which is how that story was developed and so you have to really be careful with what you're saying and always assume unless you know that person really well everything you say is eventually going to wind up in a story it's the easiest way to exist when it comes to on the record off the record

on background etc okay so you know the journalist and you're taking a leap of faith and you're going to go off the record or on background what is the golden rule of this what do you always do before you start make an agreement like very explicit agreement where the journalist or maybe the source will say can we go off the record and the journalist will say yes now the reason you do there and this happens all the time because I work with people who are not media trained their teenage cybercriminals organized cyber criminals who don't really give a [ __ ] about media norms and they will say bla bla bla off the record this and I sometimes

especially for the teenage ones and this may be a slightly controversial point I will explain to them explicitly why can't do that wise problematic and then I will say maybe the beginning hey if you want to be anonymous here you have to say now and you don't do that with all sources but when I'm dealing with minors and people who are not media trained it sometimes feels appropriate to give them their heads up not me clearly not media trained it's in our interest to kind of give you a brief primer and we can tell that you're not media trained simply by the way you act when we approach you and we ask some baseline questions a lot of people who

are not used to the media are very nervous when they they talk to us and they're kind of jittery they stumble through a lot of points and so it's a thing where you you kind of have to walk them through these steps and calm them down and that is one way to build a rapport also to give you know a baseline established with the interview subject and but yeah we're the nice guys what we do that I mean honestly there are plenty of reporters who are going to be like cops who basically just let you incriminate yourself without you know any Mirandized yeah I don't necessary have a problem with someone incriminating themselves if it's in the

public interest I mean I think I think I'm okay to come out as the [ __ ] on the panel but I don't have a problem with that yeah yeah exactly but it's not necessarily our job to protect these sources less of course you're talking about anonymous sources off the record keeping to all those agreements if somebody makes a decision to go hack a hospital or whatever it may be they've made that decision I'm going to report on I'm giving on my job to stop them getting dated right I can give you a very specific example of that there was a gentleman who was a contractor for the University of Maryland and he decided to take it into

his hands to show that there was a breach at the University of Maryland by publishing the president of the university's social security number on reddit yeah well at Andres name date of birth yeah so he so so David was his name I'm not gonna get in the rest of his name because he's gone on to other things now but you can google it he decided to do yes he would talk to me because I I I knew where he lived and I had his phone number and I gave him a call and he said yellow sit down for lunch and I'll tell you everything and he literally told me everything he did and I said you have

you talked to a lawyer about this before I stopped him and I said okay you realize you've been questioned by the FBI and you're going to and you may be prosecuted are you going to do is it yeah I talked to my lawyer I'm gonna do this said okay and from then on it was I just went with a story because you know I gave this guy an opportunity to not hang himself but he went to great lengths to explain to me how he googled orked his way into a shell at and um the University of Maryland and found a backdoor into their Drupal's their Drupal environment that we found the Drupal files and found the hard-coded

password into their assistant into their Oracle database that ran their LDAP and he got all the Social Security numbers for every student at school and every and every faculty member and he decided that this was really bad and he just couldn't go through normal channels to handle this so he published the president's social security number on reddit and then claimed to be a grey hat hacker and there's some very cryptic emails and that didn't end well for him it actually ended very well for him because he didn't get prosecuted but it didn't end well for him in terms of his employment so in that case you know I at a certain point stop myself from

stopping him because he just wouldn't stop talking which which is a really important point that you know there are cases and I always speak for myself I let these these guys weigh in for their own thoughts but there are plenty of times when I'm going go out of my way to try and stop you from hanging yourself but there are also times what I'm gonna give you all the Rope you want and I'm gonna keep giving you all the Rope you want because this story is more than my personal thoughts on the matter so I've talked to executives who have gone completely off the rails from their talking points and then during the interview and they have

said things that you just would not believe that like the PR person that's on the call with them is in tears please stop please don't say any more and they keep going I've once had a company a well-known company who's in their own lawyer gave me quotes that made them look their own legal team was talking to me basically just going completely against the grain and I could have stopped it but why you knew who I was when you call it you called me I'm not gonna stop you from doing that say it just again know who you're talking to and and just remember the easiest rule is everything you say is on the record

always yeah so three three quick points just doesn't mean capsulation then of what we just talked about with this is exactly just said are on the side of being on the record you should only go into a different state in extreme circumstance and anybody who works with PR or comms professionals in your organization you should only ever do it their say-so they should have the decision-making on that number to be explicit that you're changing the status before you give the information not after or it doesn't count you can't there's no there's no go backs and reduce and number three when you do it you get their explicit agreement they have to say the words to you it's not

like you can say we're gonna go off the record and they nod or they grunt or they go yeah if they do that you just sit and look at them and then if they really want you to continue they'll say yes we're off the record literally at lunch took two of the panelists out and said hey everything at lunch is and they both said off the record and we compete by your lunch it was to her point also keep in mind rarely will the journalist offer you on the are off the record or background you have to request it we won't walk you into that we're going to just let you talk so you have to

understand the rules before you start talking you know what you want out of that conversation but also you have to agree to it yeah it's this is one of the key cases when Tony Blair the warmongering that former prime minister my country you know when his kid was talking with the took my his kid gang inoculated someone was talking about it and then pointed it at the tape recorder and put their finger up to their lips it's just like that's not off the record if you want to get off the record you have to get the journalist to say yes we are off the record you have to get that agreement otherwise it's all for grabs

and even if you do if the recorder is still turned on it's still on the record I mean honestly you got to make sure that if you're talking with somebody off the record they don't have a pen in their hand they don't have a recorder turned on they don't have your iPhone turned upside down with recorder on make sure they're not recording a conversation that is committed that's all it is very easy just got them to say so I mean I have to I have to agree Dunbar goes all the time for product releases or whatever and I literally have to say yes I agree to the embargo and I will want to be embargo and it's

the same thing with off-the-record yes I look yes this is off the record or even if you could just say is this off the record and you will say yes but that's usually enough it's better to say it all but I have to agree to it yeah I'm right so you mentioned recording and a lot of reporters do you record the conversations they have [ __ ] should spokespeople be worried about that should they be recording it on their side what are you abusing yes and they should not be worried about it and yes they should record in their sad because because first of all recording equals accuracy and if I record to something that means I'm not gonna make a mistake

in my notes because I'm gonna listen to that several times over or I'm gonna have somebody transcribe it and compare it against my notes and listen to the recording after I see the transcription to make sure I got exactly what I thought I got you want to have your own recording of a conversation because of this reasons we've talked about you know in terms of when you say something is off the record you want to have a recording of them saying is it's off the record you want to cover your ass and you also if they if they if some if the reporter writes something that is contrary to what you said you want to have a record of what

you actually said to them to be able to show that they weren't accurate to be honest and we're kind of lazy I mean I'm a lazy journalist when I have to be alright when I can be and but the it's actually if you are answering a journalist questions it is often best to do so via email you would know exactly what you're writing the the journalist knows exactly what he or she is getting there's no ambiguity most of the time I know that seems kind of dry and it's it's often faster and more expedient to have a conversation but conversation there is nuance that could think we can be interpreted different ways with email that's not really the case I mean we're

talking a lot about print journalism here but of course there is audio and visual as well right and if you are recording a conversation and the source believes it's for print and then you try to use it for a podcast as New York Times recently didn't it was kind of a controversy around that it's kind of an open question because everything is an exact science but if you have an inkling maybe there's going to be used for a podcast and maybe you don't consent to that you can maybe make that viewpoint no it doesn't mean the journalist is going to agree and then maybe you can stop interview whatever it may be but just bear in mind that audio recordings

can be used for various different purposes especially as online media becomes much more multimedia focused as well because we publish audio recordings as well video video business now might actually want to touch upon upon broadcast media radio and TV because that is kind of a big part of my job and how much experience you guys have I mean I well we had we had a case recently where we were getting involved with somebody who's trying to recreate an old computer and they said well we we didn't say well you said you say so we published the audio transmission if you're doing an interview you should record it and the person you're interviewing should also record it that

way you know what is being said this done how does the spokesperson handle that then so the article comes out and you go back to the recording that University made and because you look at anything that doesn't look right so you go back to your recording and you verify it's not what you said how should the person then handle that with the reporter there basically it's a four with us but from my perspective would be you know contact reporter say this is an error I need a correction from you on this this is what it was said we have audio vit here if you want to check our audio to make sure that you didn't miss here

and be you know accommodating then that way what should they expect as a desired outcome from that they should expect a correction okay yeah they should expect a correction if if I write something and it is incorrect and somebody informs me and I M an error I'm going to correct it and usually in you know if unless it's a very minor error I'm going to say in the story there's an updated you know and we previously reported X that's not correct this is this is this is the truth and [Music] the if that isn't if you don't get that kind of an outcome the next step is to go to the editor-in-chief of a publication and then after that it's it

gets to legal I know but if you've got a recording then you have grounds for basically saying you know it's not it's not depending upon what the law of the land is I mean you're basically unless it's something that's flagrant it's not going to get you you're not gonna get anything out of court out of it but it is good it you also can then use it to punish them in person in public so Security Twitter dangerous dangerous place let me say something wrong and ends up and social media ends up in another publication things like that where if somebody prints something wrong and it gets shown to be wrong by someone else in public it does great damage to

the reputation did the wrong thing I don't know John Mack if he was in the audience all of these people come here and they've met you guys and they'll come and chat with you afterwards and you'll become besties and you'll go to the far and some drinks like you guys are all BFFs now forever right and so like fake in yeah tell you whatever they want they can get hammered with you like this is a thing is it doesn't work that way I'm sorry all right okay case in point about God 15 years ago I'll be in this industry that long Microsoft put out a press release server where they said you know they've done

like 2000 CIOs and 32% were willing to go into cloud this is how old this thing is and we got the press releases like great more than two-thirds of people don't want to go into cloud and Microsoft PR core we up we decide that's not the angle we were looking for is so that's not my job but you know once you put the information out there you don't have any control over where it's done so put the information out there in the best way you can but don't expect us to be very nice to that and we're journalists 24/7 except when except when I declare I met a journalist cuz ever drink in my hand

that's a situation I mean you have to know the person you're dealing with and you have to have ground rules if establish with them before you have a conversation with them anytime yeah you also have to understand that their job it's a lifestyle I mean I my job at ours does not end at the end of a normal work day any day my wife is a saint and puts up with me doing projects that run into the weekends and late hours on a regular basis especially when I'm like chasing down a fishing people but yeah when average will start my wife put aside all of the weekend and we in plans and I was just like I need to

write this right yeah right yeah so so we I mean it is a it is a calling and as we do this stuff because we like to do it and we feel connected to the community we write about generally speaking I think but also because we feel that we are delivering information people need and that is a commitment it means that we're living our jobs most of the time so even in the most casual conversations I have during the day with people you know sometimes I say hey you know that conversation we just had you know that's a story and I hope you don't mind if it's not honor its it wasn't off the record there's an example that as I

was having a conversation with people who had worked on ceased at in Baltimore and some of them worked in the mayor's office and there's a ton of stuff that came up a conversation I said you know I'm gonna be revisiting this of you and it probably will be in print so and there are people whose kids go to school with my kids so they all know who I am they all know what I do there they're okay with it mostly I mean just on this kind of bouncing off the point of BFFs forever I will admit I have sources who are now friends but they are no longer sources and you can't have a friend who then

becomes a source I mean as you can probably appreciate this stuff is messy but if you don't have the ability to address and they can knowledge your biases you well first of all you shouldn't be doing journalism and then you also should not be having friends or working sources so if you can't do that just do not use friends who are sort of down I've lost stories because these people were sources now they're friends and we're having beers and I'm not gonna write about this because I actually care about this person he'll be deeply inappropriate if I am but that's a conflict of interest right there so yeah exactly so we just step back from things

like then some people will say that if you have a conflict of interest it depends obviously on the spectrum pal severe is if you just do a disclaimer you know it's okay oh I used to work at this place or whatever maybe at that point there are just some things you just shouldn't be covering and you shouldn't be people you shouldn't be quoting if you're particularly close to them disclaimer or not I would much rather obviously this case dependent but it's probably better just not to do it and maybe get another report to do it it doesn't have the interest rather than just trying to do like a water Fink disclaimer on the piece okay so we've

got about ten minutes left I would like to have now two audience questions yeah

well I wish I was I wish I was there at the table you can just give me a second to read your questions with it so and I'm actually gonna deep I'm not gonna make you about that individual so generally speaking of her hippies comes out how would you respond to such a thing how would you advise them well under yeah under the specific circumstances I would say if it's a hit piece I would say you want to enlist some help to deal yeah one of the things that I tell people when they're in that sort of situation is they really need to you know I can't be their PR person but they need to have a PR person or

somebody who's there who's there they're the person they turn to for advice to have them deal with a situation they need a third party who can act on their behalf and you need to be clear about what the issues you have with a story are you need to outline what the problems with the story are and you have to be very clear about what you want done to make good for this story so what will make you whole from having this incorrect story published and the next step is beyond that you know that comes down to PR really it comes down to having other people do media for you and and overcome the story and that's why

those people are out there doing that job because you know you have to have people we can turn to when there's something said about you that's you know that's a hit BC Marcus didn't have a PR organization behind it no he I got screwed but badly he did he got screwed badly by journalists who's going to fluff himself for ratings look the fact of the matter is if you're speaking to a journalist you need to be very very careful and you need to have a personal relationship that you understand that this is not how things are done Marcus got done over badly but not everyone has a PR team behind them I have no sympathy

with someone from you know a major networking company or a major software company that says oh I was done over by by a journalist because you've got armies appears behind you it's the individual hacker who gets screwed over by Jonas and that's the way it goes because some people are willing to [ __ ] over other people for my video for the clips yeah journalism is supposed to be about you know what is it we'll see quote comforting the afflicted and afflicting the comfortable so you you've got a you know we as journalists you know want to go after stories that have an impact and our and our have something that people can come away with and and

learn something from that they can take action on or that they can incorporate into their lives right and there are other people who are out there who are just gonna get paid who are out for pageviews right right yeah I mean it's one key thing though that you have to understand the the question to go back to it was what happens when somebody writes a hit piece right you have to understand what a hit piece is just cuz you're mad at the article or you think the article sucks that's not a hit piece that's your your your feelings being hurt sorry for you go cry in a corner a lot of times because you disagree with

the coverage that does not make it a hippies a hit piece is almost you have a good chance of going to court over it type of story that's a hit piece yeah and they're very very rare very rare and the thing is if I can prove what I've written it's not a hit piece no matter how much you hate it and you're going to take me to court I write and if I can prove it I'll win I will win ten times out of ten I will won a hundred times out of 100 because all I have to do is prove what I've written and that's as simple as it gets the thing is when you

want to try to get what you assume to be a hit piece corrected you have to prove everything you're saying because you got to remember your army and your armies of PR people would help you that's why it's good if you've got a PR team to work with them because they can help you get this done you have to prove your claims before I'll change my story just because you don't like your quote if I say you've said it and I've got the proof you've did that's your quote you have to understand that there's also effect yeah and the thing is the more you try to fight to change the story the bigger that story's gonna get right and

you've given me the ammunition I need to generate new stories about how you are now attacking a journalist because you really didn't want this out there in the public well now what else do you have to hide it is very simple to build things onto that and if Steve and I both have specific examples that we can talk to in the Bay Area there are seven pr's for every journalist in the Bay Area and they are all trying to push their point of view I'm sorry unless you got proof you can [ __ ] off no he's literally told me that when I've learned him mine is really it's kind of minor but like you know yeah you may

think it's a hit piece you may think something good out of context you may think a journalist is not telling the whole story but that is if we're printing the facts then that's unassailable even if we're not giving the whole context even if we're not telling the other side we ought to tell the other side but we don't have to and when you're trying to hit back against something you've got to prove that the person did it wrong and recipe I was like erroneous it's imperfect but yeah I doesn't make it bad yeah we're out of time so I was going to final note you guys have made yourself sound super scary [Laughter] you know in like sort of 10 seconds or

less you could each just say like you know one thing that's nice about what yeah how to like engage positively speak honestly we will deal with you honestly if we did any dealing on the same terms [ __ ] with us and we will screw you over that's that's that's a good note to land on there I want to say that you know generally speaking I am I've been told I'm overly generous with my time with people who have questions about how they should interact with me so I'm cool with people calling me and saying how is the best way to approach you what kind of stories are you looking at what kind of things are you really interested in

because the people who do that give me the best stories yeah so you know don't be afraid to reach out and call one of us and say what do you want to hear about you know what are what would this sort of a topic interest you and how is it how should I present it or just even if it's a story you're not giving to us I mean I've had meetings with people I've had you know instead of the bar with people at black hat and DEF CON where I've said you know they've come to me and said how do i pitch this is a story and I go through with them say you know this is what you need to do we need

to figure out who you're going to give it to you and just put give the motivating point behind it and all that and and deliver it and it's worked out for them so I'm happy to talk to people anytime everybody knows that apparently because I have like 9,000 unread email messages I don't pick a fight with someone who buys ink by the barrel that is a very old say but here's the thing these days don't pick a fight with somebody who runs their own server because they could constantly generate content and they'll bury you under it but the problem that you know like Jen said we sound really scary and we should be scary to a degree we absolutely

should you should take caution when speaking with journalists but remember if you give us the truth in your honest and open with us we're gonna be the exact same way back we have nothing to hide so it's in our interests to have an honest open relationship and conversation with you it's always going to be that way just briefly and more generally journalists have failed we have a massive distrust in the media at the moment there's a serious media literacy problem as well concentrate fake news readers don't quite understand what happens when they read and on the source they think the journalist doesn't know who that person is when of course a majority of cases the argon though the

fact they were having this panel now I mean of course this is quite specific information but clearly journalists need to do more to educate the public about what journalism actually is and asking journalist these questions and of course that's reciprocating is I mean literally the least we could do to actually try to this is bad air minimum yeah I mean basically we like to think we're operating in the public interest that what we do is for the public interest you approached us with with that and we'll be very receptive to it cuz that is really what we are here trying to do despite the fact that we know what everyone hates us that's really all

we're trying to do and honestly just come to us with that and scotch yeah come to us with scotch and you'll really get our attention ologist hey sure whatever Bourbons one employee's not to scream please join me in thanking out Wilson jealous for that time [Applause]