As I’ve said before, journalists perform the role of intelligence officers for OSINT products. The similarities are more clear when you examine the editorial cycle alongside the intelligence cycle, but we’ll leave that aside and look at what this view of journalists means for hackers.

Primarily, as a hacker, you will face journalist trying to elicit information about your activities, capabilities and intent. They will use this information to flavor and direct their narrative, part of the final product they disseminate. As a source, you have no control over the narrative, the message, that is being developed by the journalist. Your ability to maximize benefit and minimize harm from this process is entirely dependent on your interaction with the journalist. Coaching and preparation for this is usually called “media training”, which is essentially a suite of OPSEC skills.

A Short Course in Media Training

Vet your journo: you need to do a background check on the journalist, read some of their previous work, find out who they are working for, what they are writing about, and what agenda they are pushing. This is your opportunity to find out if you’re being setup as a patsy, dealing with an idiot, or engaging with someone who is knowledgable and sympathetic to your views. You can back out at this point with minimal repurcussions.

“Off the record”: [UPDATE: “Off The Record” (OTR) is an agreement between the journalist and the source (that’s you.) The journalist must agree to OTR up front before you start talking. This applies to the other “magic words” too. And even so, it is still just an agreement, the journalist is bound to uphold it only by their ethical standards. Anything you tell a journalist may be published.]

if you say “off the record”, the journalist is obligated not to include your name or what you say in their final product. This is an obligation, not a law, so don’t rely on it. However it can be useful if you want to inform the narrative, without appearing in it. Also useful are “background” and “deep background”, which both obligate the journalist to keep your name (and probably the information you provide) out of the final product. They’re phrases used to allow you to corroborate a story, for example, without being quoted or appearing in the story.

Get it in writing: try to get the questions for the interview in writing before hand. This will allow you to prepare answers with supporting data, or at a minimum prevent you from being ambushed with questions you aren’t comfortable with.

Answer in writing: if possible, try to do the interview over email, or another written medium. This should help to minimize misquotes as the journalist will be able to refer directly to your written statement.

Putting words in your mouth: if a journalist asks a specifically worded weird question that is basically a yes/no, they are trying to put words in your mouth. If you respond in the affirmative, they can quote you as having used that phrase. Always say no. Even if you agree, rephrase the statement to match what you want to say. Don’t let the journalist dictate your responses for you.

Stay on target: if you have a message that you are trying to convey (you should, why else are you talking to the media?), stick to it. Make sure that you emphasize again and again your core message. This is what “talking points” are about. Know what you’re saying, and keep coming back to it.

Watch your mouth: journalists can quote you with anything you say, so be careful what you say in their presence. If you don’t want them to be aware of something don’t mention it around them. Basic STFU OPSEC.

Those are just the bare minimum of media training basics that you should be familiar with before talking to journalists. Their desire to collect and publish information doesn’t mean that you have to provide it to them, but if you so choose, at least speak to them on your terms.