Understanding Nascent Newsroom Security and Safety Cultures: The Emergence of the “Security Champion”

ABSTRACT

This paper utilizes concepts from new institutionalism to help explain journalists’ and news organizations’ resistance to implementing security-related practices despite a deteriorating safety and security environment for journalists in the United States. Through 30 interviews with journalists, technologists, and media lawyers, I identify three main variables for the resistance to the development of newsroom security cultures, as well as a new social actor necessary for the development of security cultures in newsrooms: the “security champion.” The emergence of this new institutional entrepreneur highlights an intriguing tension. Although news organizations have engaged in slow adoption of the anonymous whistleblowing platform SecureDrop, they have not necessarily engaged in an institutionalization of security practices throughout the newsroom. The decoupling of these two factors represents attempts by news organizations to have institutional legitimacy while not changing core practices. In conjunction with this phenomenon, inspired individuals in newsrooms across the country are becoming ad hoc “security champions” in order to build security cultures from the ground up.

KEYWORDS:

• Information security
• institutional entrepreneurs
• institutional logics
• journalism
• legitimacy
• new institutionalism
• security cultures
• decoupling

Acknowledgments

The author would like to thank Dr. Barbie Zelizer and Fellows at the Information Society Project at Yale Law School for their feedback on earlier drafts of this article, as well as the anonymous reviewers and the editorial team.

Disclosure Statement

No potential conflict of interest was reported by the author(s).

Notes

1 Information security refers to “the protection of information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide confidentiality, integrity, and availability” (National Institute of Standards and Technology).

2 Information security cultures refer to the “shared pattern of values, mental models and activities that are traded among an organisation’s employees over time, affecting information security” (Karlsson, Åström, and Karlsson 2015, 247).

3 The review included the sites for the 50 top newspapers identified in the 2018 Pew State of the News Media survey, as well as the subset of their “digital-native” outlets that engage in investigative reporting, and a small selection of additional notable journalistic outlets, including nonprofit newsrooms, non-newspaper legacy media companies, and wire services.

Additional information

Funding

The author gratefully acknowledges the Tow Center for Digital Journalism at Columbia University for its financial support of this research through its Knight News Innovation Fellowship.