NRK publishes first ever threat assessment report

The threat situation facing NRK is “more complex now than 10 years ago”. This is according to a new threat assessment published by the public media organisation last month. The threat assessment report maps out the various threats that potentially prevent NRK from carrying out its public service mission.

Increasingly the frontline for journalism is online, and public media organisations and their workers are not immune from such attacks. “10 years ago we focused mostly on physical security measures to prevent bomb attacks and armed intruders, similar to what Norway was exposed to on 22 July 2011”, NRK’s Head of security, Øyvind Vasaasen, told PMA, referencing the unprecedented terrorist attack in Norway that resulted in the killing of 77 people. “Now the threat picture is more complex.”

From disinformation and digital attacks, to violence, espionage, and fraud, the report outlines various risks, threat actors and threat levels.

“Hybrid threats are both about disinformation and for example digital safety. We therefore believe it is useful to see this in context and that our journalists are aware of this threat.” As Mr. Vasaasen also observed, “Social media has changed journalism completely and it is easier to manipulate the public, for example in connection with elections.”

NRK recently experienced a DDOS (Distributed Denial-of-Service) attack, which made their website, nrk.no, unavailable to the public for about half an hour. According to Mr. Vasaasen, “the attack was connected to the war in Ukraine and most likely came from pro-Russian hacker groups. We must prepare ourselves to be able to handle digital attacks in a completely different way than before.

NRK has already been working to improve its organisation’s own preparedness response – adapting to and finding different ways to reduce risks from new “hybrid threats” by enhancing its “digital competence” and training employees in digital security. The organisation has also introduced a management system for safety that involves both senior management and the Board as part of its wider security and emergency preparedness efforts.

While the assessment was conducted by the security department, it received help from an external consultant and involved colleagues from various parts of the organisation. The report is now being delivered to the whole organisation via a “communication package that all members at NRK can use in editorial meetings and training.”

NRK intends to create a legacy out of this first threat assessment, which will form the “necessary basis” for reducing NRK’s vulnerability from present and future threats and be a useful resource for other businesses in the country. Mr. Vasaasen and his team plan to conduct a threat assessment annually.

Ultimately, exercises like this are extremely important for democracy – in the fight for the truth – as well as public trust and credibility in public media. “A free and independent press is absolutely necessary to ensure democracy and contribute to stability,” said Mr. Vasaasen. “It is therefore important to tell both journalists and the public what they should be on guard against. One should always ask, who benefits from this particular news clip being spread right now.”

With the threats facing media organisations more multi-pronged than ever before, it is important these organisations are working to anticipate the threats, and are looking to adapt their responses and resources to the evolving situation intentionally. It is imperative they continue to carry out their public service missions safely and uninterrupted now and for the future in the face of these threats.

NRK’s threat assessment report is an innovative way of addressing these threats, and demonstrating transparency by showing the public exactly the sort of threats they continue to face. By including their audience in this process, it establishes a greater level of connection and trust between public and media.

A free and independent press is absolutely necessary to ensure democracy and contribute to stability. It is therefore important to tell both journalists and the public what they should be on guard against. –Øyvind Vasaasen, Head of Security, NRK