*This* Made It Past Review?

[andveryginger]

The DHS Daily Open Source Infrastructure Report is one of my daily reads. It is described on the website as "a summary of open-source published information concerning significant critical infrastructure issues," and generally contains links to articles, reports, and even news broadcasts. The links are grouped by critical infrastructure/key resource sectors, as defined in the infrastructure protection plan. Researching these links and doing the summaries takes no small amount of time, though each sector was traditionally responsible for finding their own information and submitting it by deadline.

Because I'm a daily reader, I'm accustomed to a certain style and tone for the document. An example from today's Banking and Finance section:

13. April 28, Daily Bruin – (California) Duffel bag prompts examinination by Los Angeles Police Department bomb squad. A duffel bag left in the parking structure of Chase Bank in Westwood, California April 27 was deemed nonexplosive by the Los Angeles Police Department (LAPD) bomb squad at 2 p.m. The bomb squad arrived at Chase Bank at 1:30 p.m. to examine the bag, which was thought to be suspicious, a LAPD sergeant said. A note on the outside of the bag read "Keep away confidential," according to police. The bag belonged to a homeless person and contained clothes and other miscellaneous items, the sergeant said. While police were investigating, several Westwood intersections were blocked off, and foot traffic around the bank was redirected. Source: http://www.dailybruin.com/articles/2010/4/28/duffel-bag-prompts-examinination-los-angeles-polic/

Fairly short, sweet, to the point. It reads like a shortened version of a news article, with a decent lede, and provides a few quotes to back it up. The language is fairly professional, even if the grammar and flow are a little stiff.

Scrolling down -- still in Banking and Finance -- I then see the following:

19. April 27, WCTV 11 Tallahassee – (National) There is lots of mortgage fraud in Florida and Georgia. An annual report by the Lexis Nexis Mortgage Asset Research Institute has Florida ranked as the tops in mortgage fraud for 2009, while Georgia came in 8th. Fraud includes lying on a mortgage application, but this year much of the fraud stemmed from inaccurate appraisals. A Valdosta State University economics professor said he was surprised to see so many cases as a result of appraisals. "Appraisers can give you numbers that may not be reflective of what's truly going on in the economy," he said. "Certainly one issue is just the sheer volume of foreclosure issues. Florida and Georgia both have lots of foreclosures, and that makes it difficult to find three, comparable homes for an accurate appraisal." The report said mortgage fraud and misrepresentation increased 7 percent from 2008 to 2009. Source: http://www.wctv.tv/news/headlines/92242554.html?ref=554

"There is lots of mortgage fraud in Florida and Georgia?" That is your lede? Not, "Annual Report Reveals Increased Mortgage Fraud in Florida and Georgia?" Or maybe, "Mortgage Fraud on Rise in Florida and Georgia?" Hell, the author of this one could have even quoted the article title, "Mortgage Fraud High in Florida and Georgia." Instead, the analyst chose to say, "There is lots of mortgage fraud in Florida and Georgia."

Maybe I'm being too picky; the rest of the summary isn't great, but it certainly reflects better diction than the lede. When compared to the previous entries, however, this just sounds unprofessional and displays a lack of editorial polish.

Another entry can be found in the same sector:

21. April 27, Forbes – (National) Inside the brains of a professional, bank-hacking team. Following the cyberspying breaches at Google, Adobe, Yahoo!, Intel, Juniper and others, there has been much discussion and dissection of targeted attacks. But rarely is an individual operation laid out in step by step detail. And rarer still is an account told from the hacker's perspective. But just such an account has been provided by the individual who runs Netragard, a cybersecurity consultancy that, among other services, performs penetration tests on clients to expose their security vulnerabilities. In a blog post April 26, the consultant laid out a recent hacking operation that his SNOsoft research team was hired to perform on a bank client. Though he does not name the target, he describes step by step the social engineering involved in sussing out the bank's defenses, including staging a fake job interview with unwitting employees of the company. The technical strategy for breaching the bank's defenses — a targeted, booby-trapped, PDF attachment — is not a surprise. But the detailed description of the preparation for that exploit is a rare window into the hacking process. Source: http://blogs.forbes.com/firewall/2010/04/27/inside-the-brains-of-a-professional-bank-hacking-team/

Again, the overall summary isn't horrible -- there are a few things I would have said differently, but the lede is the attention getter: "Inside the brains of a professional, bank-hacking team." What about, "Inside Look at a Bank Hacking Operation?" Or, "Inside the Minds Behind a Professional, Bank-Hacking Team?"

The use of phrases like "inside the brains" and "lots of mortgage fraud" make these summaries sound as though they were written by a fourteen-year old Valley girl, not an infrastructure analyst. I understand that not everyone has strong writing capabilities; I've met plenty of learned engineers that can't put together a compound sentence. But that's what editors/reviewers are for. These last two items should never have made it through the review process, much less released for public consumption. And if they are being written by interns, or lower-level staff (as I suspect they might be), then more attention needs to be paid. These documents should reflect the professional audience they are intended for.