How Journalists and Civil Activists Respond to Cyber Threats in Wartime

The Sociological Group 'Rating' conducted a sociological survey titled 'Digital Security Needs of Journalists and Public Sector Representatives' from 26 June to 10 July 2024. The research was commissioned by the NGO Internews Ukraine.

FULL TEXT OF THE STUDY IN UKRAINIAN

Page Blocking, Virus Attacks, and Other Threats

The survey revealed that since the beginning of the full-scale war, journalists and civil activists have frequently encountered five key digital security challenges: 

1. DDoS and phishing attacks. 

2. Blocking of the social media pages due to mass complaints from bots. 

3. Hacking of the social media page accounts, website admin panels, and TV communications. 

4. Virus attacks. 

5. Spamming by bots in messengers and social media comments.

'They target the most active ones. Or the more influential you are, the more attacks you face,' said Volodymyr, a representative of the NGO.

In response, organizations encourage employees to improve their information hygiene skills by teaching them how to critically evaluate information received via email or messenger, regularly changing passwords, using corporate email accounts, and limiting admin panel access to a select few.

'Even though respondents are aware of basic digital security practices, many do not consistently apply them. For example, they continue using the Telegram messenger, despite knowing the potential risks, or they communicate through both corporate emails and personal messengers,' noted Igor Rozkladaj, Deputy Director of CEDEM.

Digital Security Policy and Treat Response Protocols

The findings indicate that some organizations lack a dedicated digital security policy. Typically, security guidelines are embedded into more general instructions for interacting with specific resources and services.

'Beyond the absence of security policies, many media outlets, especially regional ones, don't even conduct internal digital security training. Additionally, respondents often don't see themselves as potential targets, so they're less motivated to strictly adhere to digital security protocols,' added Alina Eleutherova, a digital security expert at Internews Ukraine.

A minority of organizations have implemented advanced security protocols, including response plans for account or server breaches. These rules include restrictions on using personal computers for work, backing up data to cloud storage, using secure servers, and more. Some organizations have dedicated security teams tasked with preventing and responding to digital threats.

'Our IT department handles this. We have specific protective mechanisms, contracts, and clouds backups. We also have closed servers for archiving older data. Essentially, we've established a comprehensive protection system,' explained Maryna, a journalist interviewed for the survey.

"One of the key priorities of the Media Programme in Ukraine is to ensure the sustainability of independent media," noted Oksana Maydan, Deputy Director of Internews Network. "Nowadays, this means safeguarding systems and networks from cyberattacks and establishing processes that minimize the risk of business disruption, financial loss, and reputational damage. The findings from the Internews Ukraine study are helping shape an effective digital security support plan for Ukrainian media and civil society."

Popular Data Protection Methods and Training Needs

Most survey respondents are familiar with the basic digital security practices and believe they take adequate steps to protect their data. They reported following guidelines for creating strong passwords, using password managers, and enabling two-factor authentication.

Respondents also stated that they carefully scrutinize emails and messengers to avoid phishing attempts. However, only a few mentioned using antivirus software, VPNs, and licensed software; making regular backups; reading technical documentation when installing software; avoiding downloading documents on devices not connected to the organization's server; and moving work online when possible.

While some respondents feel that the available information on digital security is sufficient, it should be implemented more actively. Others expressed a desire for more regular training to stay updated on emerging threats. They emphasized the need for practical knowledge and case studies in training sessions.

Respondents expressed interest in learning more about: 

• different types of VPNs and the characteristics of psychological operations (PSYOPs); 
• methods for protecting media websites and safeguarding sensitive content;
• secure channels for transmitting information; 
• ways to identify deepfakes and understand how AI is used to create fakes.

'In 2023, analysts recorded a 62.5% increase in cyber incidents compared to 2022, according to data from the State Cyber Defense Centre of Ukraine's State Service of Special Communication and Information Protection. The foe exploits any information it can access: hacked accounts become part of bot farms, personal chats with relatives in the Armed Forces of Ukraine are read, and social media accounts are hijacked to promote propaganda. By following basic digital security rules, you can make yourself a less vulnerable target,' concluded Alina Eleutherova.

As part of the 'Digital Security Needs of Journalists and Public Sector Representatives' study, analysts conducted 20 in-depth interviews with 15 journalists, three civil society organization representatives, and two digital security experts.