Managing risks to the media from emerging networked technologies

The consumer Internet of Things (IoT) poses unprecedented security challenges to certain sections of society, including the news media. Many consider the press to be a branch of critical national infrastructure in democracies, as attacks on journalists have implications for individual human rights and national and international security. Focussing on democratic countries, this research considers how members of the press can improve their identification of, protection from, and resilience against threats from the IoT. This interdisciplinary research utilises mixed methods and qualitative and quantitative thematic analysis, including literature reviews, comparative case study methodologies, online surveys, and interviews. Participants include experts in journalism, cyber security, law, technology, relevant policy, and states' capabilities relating to technological exploitation. This research includes the findings from an exploratory study to scope the novelty of focusing on journalists as a specific population threatened by the IoT. This mini-study interviewed and surveyed journalists and cyber security experts to determine how high-risk members of the media might perceive and combat consumer device threats to their work and wellbeing. This research found a sizeable gap between cyber security expertise and journalistic practice regarding risk assessment and management. Specifically, although journalists are at particularly high risks of many forms of attack, their awareness of, and protections against, IoT threats were clearly found to be limited. Therefore, this thesis comprises a multi-piece toolkit that enables members of the press to identify threats from IoT devices to themselves and their work, and then identify the countermeasures best suited to their context. The toolkit includes: A conceptual model to categorise IoT devices by environment (location), via systematic literature review. This model demonstrated to members of the media the scope and scale of where IoT devices may present threats. A second conceptual categorisation, also created by literature review of currently feasible capabilities and validated by surveying states' capabilities experts, explores threats to information, as well as related legal and physical threats to journalists and their work from the IoT. The main contribution of this thesis is an interactive framework of countermeasures to these IoT threats to enable members of the media to decide how to protect themselves. The countermeasures are linked to phases of the overarching editorial workflow, to ensure that their implementation is feasible and that they are clearly useful by and for specific role categories within the media. This toolkit is also informed by the thesis' comparative profiling of the privacy, security, and data protection policy and law environments in the United Kingdom, the United States of America, Taiwan, and Australia. These profiles, combined with the recommendations of academic, governmental and non-governmental experts, and synthesis of multiple disciplines of academic literature, ensure that the toolkit created and presented in this thesis is versatile and realistic to help members of the media combat threats posed by the IoT to their societal function.