Meet the Press! Guidance for Answering Important Media Inquiries

As an information security professional in higher education, at some point in your career you will be asked to talk to the press. Be prepared by meeting with your institution's marketing and communication folks before a reporter ever phones you. The marketing and communication team can provide coaching, and they probably have a "survival kit" to share with you. Heed their advice—it is what they do for a living.

Just in case the phone rings today, here are some important tips from a conversation we had with Thomas Fladung at a Cleveland-based crisis communications firm.

Authors: What should we do when a reporter asks for an interview?

Fladung: Prepare, prepare, prepare! Always ask what the reporter is after. Reporters want to tell a story, so be aware that you and your institution may be cast as the "bad guy" while those affected by a security breach may be cast as "victims." If your institution is at the center of their story because of a recent breach, "no comment" really isn’t an option, unless you want to immediately be judged guilty.

Authors: How should we respond if a reporter asks us about higher education information security in general?

Fladung: You should research what is going on at other schools in case a reporter calls you to comment on someone else’s security breach or on the general state of information security in higher education. If you’re really not comfortable doing so, you can politely say, "No, thanks."

Authors: If our institution has experienced a security issue or breach, how do we get ahead of the story?

Fladung: Here is a suggested pre-interview checklist so you'll be ready to respond when you receive that inevitable request from a reporter.

• Ask for the reporter's name, phone number, e-mail, and their publication or news outlet.
• Confirm the reporter's deadline. This is very important because deadlines can require a tight turnaround. If you are feeling rushed, you may want to decline and request a longer time frame for the next story.
• Research the reporter's previous articles. This may help determine if the reporter will be friendly or antagonistic.
• Ask about the intended story topic and angle. Remember, there are differences between newspaper sections (e.g., Front Page, Metro, Business, Lifestyle, and Sports).
• Find out what media outlet the reporter represents. Some may actually be writing industry sales or marketing articles rather than mainstream journalism articles. Some popular media outlets are after different information than technical outlets.
• Request a list of questions prior to the interview. Think through your responses before you meet with the reporter. Working out your answers in advance keeps you on topic, and on message.

Authors: What survival tips do you have for the interview itself?

Fladung: Think ahead about three key messages you need to get across in the interview. Gather examples that illustrate your messages through stories, anecdotes, and data-filled examples.

Sometimes you need to lead the reporter back to your key points. Here are some examples of "bridging phrases" that may be useful:

• "The real issue is…"
• "Let me add…"
• "It is important to emphasize…"
• "The most important point to remember is…"
• "Another question I'm often asked is…"
• "That deals with one aspect of a larger issue…"
• "It's too early to talk to you about that, but what I do know is…"
• "Let me put this into perspective…"
• "I'm glad you asked me that. People have that misconception, but the truth is…"
• "Here is what we did and what we're going to do about it..."

Authors: What can we do to prepare for an online interview?

Fladung: The most fundamental recent change in journalism is the iterative reporting process. In the past, a story was not ready for publication until the main sources had been interviewed, so an editor would not release a story until it was "ready." Now, for online reporting, the story is "ready" as soon as the reporter can nail down the basic facts.

E-mail interviews are great, especially if you have a chance for a "read back," which is when the reporter sends you the questions in written format, providing you with an opportunity to think about the questions and compose your answers as time allows. Once you respond, the reporter will review the responses and request clarification as needed.

Authors: What if we are not interviewed for a story about our institution? How should we respond?

Fladung: Ideally, you or a representative of the institution would be invited to respond to a reporter for the first version of a story. If that is not the case, these tips will help.

If you did not receive a request for an interview, get in touch with the reporter. Ask for a "new story" with your voice and your perspective.

Authors: Do you have any last words of advice to prepare us for media inquiries?

Fladung: Here are some key dos and don'ts that I have learned over the years.

Do:

• Tell the truth
• Tell it first (for emergency or breach response interviews)
• Tell it all (all of the information that you have available or authorization to share)
• Practice (being interviewed is truly a learned skill)
• For a short-fused interview, get the deadline, and take time to prepare
• Return media calls promptly
• Develop your sound bites and use them
• Repeat key messages
• Be concise and clear
• Stay on message (especially when questions are intended to divert you)
• Stay positive in thought, demeanor, and word
• Tell stories
• Correct misinformation immediately

Don't:

• Be boring
• Use jargon (especially in the security and technical realm)
• Say "no comment"
• Speak to the media when unprepared
• Speculate
• Repeat negative phrases
• Place blame
• Let your guard down

Remember: Stay on your message, speak the truth as you know it, and be friendly. This may not guarantee the ideal story about you or your institution, but at least you'll be prepared to deal with media inquiries in the future.

Thomas Fladung is Vice President of Hennes Communications, one of the few firms in the United States focused exclusively on crisis communications and reputation management. Fladung spent 33 years in newspaper newsrooms and held lead editing positions at the Detroit Free Press, St. Paul Pioneer Press, and Akron Beacon Journal and, most recently, served as managing editor of The Plain Dealer. Fladung, a native of Canton, serves on the board of the Cleveland Press Club.

Robert Henry joined the Information Services team as Chief Information Security Officer for Santa Clara University in December 2012 to establish a new information security program with an emphasis on policy development, security awareness development, and incident response. From 2007 to 2012, he established the information security program at Boise State University. Previously, he served as a systems engineer for Boise State. A graduate of Boise State and the University of New Hampshire, he holds CISSP, GIAC Forensic Analyst, and GIAC Incident Handler credentials.

Tom Siu is the Chief Information Security Officer at Case Western Reserve University. Tom directs the information security office, with responsibility for information security administration and operations in a research university environment. He also is responsible for governance of identity management, IT policy, and security policy at CWRU. Tom started along the information security pathway in 1990 with an appointment as one of the first ADP security officers while serving in the U.S. Navy.