Editorial Standards

Independence#

FISRO decides what to investigate and publish on the basis of public interest alone. No funder, partner or company may review, approve or change our work before publication. If FISRO ever accepts funding or enters a partnership, we will disclose it on our Transparency page and, where relevant, in the pieces it might be thought to affect.

Types of publication#

We label every piece so readers know what they are reading:

• FISRO Investigation. Original reporting and research by our team, based on our own evidence.
• Reported News. An account of an event based on sources outside FISRO, each attributed.
• Analysis. Our interpretation of verified facts. Analysis is opinion grounded in evidence; we mark where interpretation begins.
• Technical Advisory. What is vulnerable, what is fixed, and what to do, with a source for each line.
• Explainer. Background for readers who are not specialists.
• Research Report. A numbered report with methodology, data and reproducible findings.

Accuracy and attribution#

We say how we know what we know. We prefer primary sources, name them, and link to them. We distinguish what is confirmed from what is reported, disputed or unknown, using the statuses described in our Methodology.

We do not fabricate people, quotes, data, interviews or results, including in illustrations or examples. We do not use anonymous sources unless the information is important, cannot be obtained otherwise, and an editor knows the source’s identity; when we do, we explain why.

Fairness#

When a piece makes a serious allegation about an identifiable person or organisation, we give them a reasonable opportunity to respond before publication and report their response fairly. Threat-actor names or attributions are published only when the evidence supports them, and we explain how strong that evidence is.

Minimising harm#

We weigh the public interest in publishing technical detail against the risk that it helps attackers. We do not publish working exploits, credentials, or personal data from breaches. We do not identify victims of crime, especially of online sexual exploitation, and we never request or handle child sexual abuse material.

Automation and AI#

We may use software, including AI language models, to help research, summarise or draft. An editor is responsible for the release decision and review of sources, quotations and wording. No content is published automatically. Material AI assistance is disclosed in the article methodology, including drafting assistance. Proposed exercises are distinguished from experiments actually performed.

Corrections#

We correct errors promptly and openly. See our Corrections policy.