Since the Sony Pictures attack story began to gather pace at the end of November until now, there has been one group who have bore the brunt of criticism for their actions – not Sony or the attackers, but the press.
Now I’m not here to claim the pride of the union and defend the honour of Journalists, as there has been some good and bad reporting done. However the fact is that the press have little to work with in terms of facts about the incident so there is a lot of repetition about who is responsible and to blame, and the pendulum of the finger being pointed at North Korea has gone back and forth.
From my perspective, there is little information on (what for me) are the two key questions: how was it done and why did they do it. My journalism training taught me that to get the best from a story, you have to ask and get answers to six questions:
Who – well we know a group called Guardians of Peace have claimed responsibility, but we don’t know who is backing or supporting them, or if they are part of a nation-state cyber offensive division, or a group of hackers doing it for the lulz.
What – Sony Pictures were attacked and had a serious amount of data leaked and published, including employee personal details and upcoming films.
Why – following on from the last point, that is really all we know. Has there been references to North Korea or the film The Interview in the messaging? Have Sony done a lot wrong in recent years? Is this an extension of the Anonymous assault on Sony from 5+ years ago?
When – leaks began in November, assuming that the attack was done some time that month.
Where – One piece of research did pinpoint the attack as having been done from a Bangkok hotel.
How – That is the big question and to date, we don’t really have a clear answer. Originally the attackers asked for money, and made no mention of the film.
Yes the press do some stupid stuff, and attribution does carry some gravitas when it comes to a good headline, but in order to do our job well and properly we need more evidence of how and why. Opinions are great on a story, and I’m very fortunate to have contacts in a number of sectors who can shine a light on their view of the situation, but without hard evidence we are forced to speculate.
Let’s assume that Sony Pictures has not called in a consultant to assess and repair the damage, so there is no third party assessment of the situation. Also, Sony Pictures reportedly had a security team of around 11 people; where are they now? What are they doing now? I don’t expect someone from that team to go rogue and spill the beans to the first journalist prepared to offer their ear, but the lack of information coming from Sony Pictures in total isn’t helping the press, or the wider industry in learning about what went wrong.
As I said at the start of this blog, I’m not here to defend the press en masse, but what message I do want to convey is that the press have little to work with for this story apart from rumour and speculation. Should they not cover it at all until there is more of a story? That’s a solution sure, but publishing is a numbers game these days, and editors and publishers demand stories and high numbers of visits and do you know what gets people reading? Fresh angles on popular stories – and if we can find anything, it will go on.
I’ve said this before, but don’t hate the press, work with the press, as by working together it will be the only way everyone gets better results on what they are looking for.
Update – I have been reminded that FireEye’s Mandiant forensic investigation division is working with Sony Pictures. To date, nor FireEye or Mandiant have been prepared to comment on this investigation.