Mérték Media Ombudsman – The media echo of the BKK hack

On 13 July 2017, the Budapest Transport Authority (abbreviated as BKK in Hungarian) launched a new system for the online sale of public transportation tickets. Within hours, users had discovered the bugs and security flaws in the system. In our analysis, we wanted to find out whether the online media were helpful in understanding the issue at hand, whether their coverage of the topic served to promote the information and sound opinion-formation of the public. This analysis is the second instalment of the monthly Mérték Ombudsman series.

With the support of the Google Digital News, Mérték Media Monitor strives to foster the emergence of an online media environment that promotes critical thinking and a desire for objectivity on the part of both media consumers and newspapers. One aspect of this project is the creation of a media ombudsman-type platform that publishes critical analyses on the online media’s coverage of certain events, on the reports and editorial contents concerning the given event. Each of the individual instalments in the series will take a detailed look at the way in which the online media present a current issue. The goal is not to evaluate the performance of a particular media outlet or journalist, but instead to provide the most comprehensive analysis possible of issues that were widely covered in the media.

The BKK launched a new online ticket sales system on 13 July 2017. Users identified bugs and security in the systems within hours of its launching. They indicated these problems to the company, which reacted by reporting them to the police. Our analysis looks at the way this issue was covered by the online newspapers 24.hu, 444.hu, 888.hu, alfahir.hu, atlatszo.hu, hvg.hu, index.hu, mno.hu, and origo.hu.

The analysis was written by Eszter Katus, a journalist at Szabad Pécs and Magyar Narancs.

How a tech news item become political

Although based on the 123 articles analysed we can assert that six of the eight news portals (index.hu, 24.hu, 444.hu, hvg.hu, mno.hu, alfahir.hu) were quick and informative in covering the issue, neither performed serious independent journalistic work in its reporting. For the most part, they drew on the materials published by the media outlet that first provided new information – though one must also add that in most cases they did so with an accurate attribution of the source. The portals not only relied on other online news portals for information, they also used other types of media as sources: online news portals that are critical of the government cited RTL Klub, Inforádió and M1. The latter was primarily referenced when the given news site wanted to present the position of the BKK or T-Systems (this subsidiary of Hungarian Telekom (which is itself a subsidiary of Deutsche Telekom) created the online ticketing system used by the BKK) or the Budapest municipal government. This was necessary because those representing the aforementioned institutions did not respond to the questions put to them by newspapers that they regarded as being affiliated with the opposition, and they only communicated through the public service media and in the form of public statements.

Despite this fact (or maybe because of it) all news sites were able to bring up new developments and threads in the case, though they mostly found out about these based on readers’ tips or from social media. The online newspapers consulted the views of public figures who were not directly involved in the case, such as the former BKK CEO Dávid Vitézy, the writer György Dragomán, or the founder of the tech company Prezi, who all commented publicly on the case, primarily on Facebook. Some news sites also found other sources: a journalist at index.hu, for example, asked a web development company for assistance in performing a test buy in the BKK webshop to highlight the flaws in the system, while journalists from index.hu, 24.hu, and mno.hu personally attended the press conference, and 24.hu asked a lawyer whether the student hacker had committed a crime. For the most part, however, the news portals just used each other’s coverage as their source: among the 123 articles reviewed, the ratio of materials produced by the given newsroom vs. materials taken from other news sources was 41 to 82. It appeared that the news portals did not check the factual accuracy of the news items they took from other sources, and they tracked press statements and Facebook posts to find further information.

Those media not affiliated with the governing party used relatively little of the information provided by the MTI, though in part this probably owes to the fact that the news agency itself published few items on this subject. Index.hu alluded to this in an opinion piece. By contrast, 888.hu and origo.hu were not only slow in their reporting but their articles were mostly lifted word-by-word from MTI’s press releases. Those who only consulted these media for information on the days in question would have hardly found out about the details of the case, even though it also affected regular ticket buyers. At most, a reader would have seen a line or two indicating why the cited announcements had been made by those responsible.

In itself, the underlying news, that is the fact that the BKK had launched an online system for selling tickets and that this system was flawed, would have been a security technology-related item. But the fact that the press reported about this, the manner in which the BKK and T-Systems reacted to these events (silence, statements denying and deflecting responsibility, police reports), and that their reactions, too, were picked up by the media, turned the issue into a broader public matter with political ramifications.

 Movers of events rather than their reporters

It is probably no exaggeration to claim that beyond the original events – i.e. that there were flaws in the ticketing system and that a student was reported to the police and arrested – almost all of the subsequent events were generated by the subsequent news coverage. The initial reports about these events inspired various reactions: they elicited the anger of Facebook users; forced parties to react (or gave them the opportunity to exploit the situation); inspired the attacks against the BKK website; the filing of police reports against those responsible for the attacks, etc. Thus, the news sites were not only involved in this story as passive observers but they actively shaped the events and then reacted again to the subsequent events they had co-generated. Moreover, they often disseminated opinions: Media that are critical of the government (index.hu, 24.hu, 444.hu, hvg.hu, mno.hu, alfahir.hu) projected the dysfunctionality, incompetence, and arrogance of the government and its affiliated public bodies (BKK, police) onto these events. Pro-government media (origo.hu, 888.hu), by contrast, sought to portray the events and their coverage as unprovoked and unfounded – indeed, even illegal – attacks by the opposition press and the “ethical hackers.”

The actual protagonists of this affair, the BKK, T-Systems and the municipal government of Budapest barely figured in the articles of critical media. The reason is that the companies did not react to questions put to them by the media, and they only disseminated their own response once some events reverberated massively in public, but even at that point they only communicated through press releases and the public media, including the MTI. The media that are not government friendly cited these opinions, while the pro-government media only referred to the flaws in the online ticket platform and the arrest of the student once the final apology had been issued.

The eight portals published seven opinion pieces in nine days. Index.hu, hvg.hu, and mno.hu each published two, while 24.hu published one. Six of the seven op-eds included the author’s name, the one exception was one of the opinion pieces published by hvg.hu. Though the other portals did not publish any official editorial opinions on this case, the opinion and news report genres often overlapped in articles, and the language in items that otherwise appeared to be factual reports often included words that would normally only be allowed in opinion pieces (e.g. the BKK’s “miffed response”, descriptions of the BKK as “amateurish”, “pathetic”, “absurd”, “ridiculous”, the entire procedure had been “revolting”, etc. The opinions of the respective authors/news portals were discernible in most items published on both, government-friendly as well as critical media. Index.hu, hvg.hu, mno.hu, 24.hu, 444.hu, and alfahir.hu unequivocally took the position that the BKK’s online ticketing system is unstable, and that the persons who had pointed to the flaws in the system with a desire to help were punished rather than rewarded; that the police report against the student and his arrest were scandalous; and that the apologies issued by the BKK and T-Systems were insincere. The “ethical hackers” were on the right side of the issue, while BKK (and T-Systems), along with the political power behind them (i.e. the Fidesz government), the authorities, and the public media were on the wrong side. Initially, the press outlets only referred to these events as flaws and deficiencies, but by the end of the period investigated they described the affair as a scandal.

On the other side of the spectrum, origo.hu and 888.hu chose to remain silent on the issue during the first days, and only reported about the events when ignoring them was no longer tenable. Though both sites refrained from stating their opinion, their coverage only include those facts and statements which suggested that the BKK’s system only had minor flaws that had been quickly fixed. The government’s communication strategy was often readily apparent in their articles: A worthy initiative “had been subject to attacks”; the press only reported about the negative aspects; what we don’t address does not exist. They only reported in the final days of the period investigated about the fact that a young man had been taken in by the police, that there were security gaps in the online ticketing system. None of their articles featured any sources apart from the MTI. Six of the articles published on origo.hu were taken from the MTI, only one was authored within the newsroom. 888.hu published only two articles on the issue, and though the author was not named, the basic information once again stemmed from the MTI.

Even reading all the news on all the sites, a reader would not have been able to put together a complete synthesis of the actual events. Since the various opinion and views appeared alongside each other, often the reader could not be entirely certain whether she was reading a factual report or an opinion piece. Typically, however, the news portals did not directly meddle in politics: only index.hu (one item), 24.hu (one item), mno.hu (two items), 888.hu (one item) and alfahir.hu (one item) reported about the actions and statements of political parties. They gave more generous coverage to the reactions of readers, social media users, and various – mostly unnamed – experts, though this was the case only in the articles of media that were not friendly to the government.

The full analysis (in Hungarian) is available on Mérték’s website.