Verify the requester and assignment through an independently found publication contact, then check which information you are authorized to release. A confirmed journalist does not automatically have permission to receive internal material.
A press inquiry can ask for sensitive information without including a link or attachment. Before replying, check who is asking and which parts of the answer your organization has approved for release.
The answer itself can be valuable
Proofpoint’s April 2024 research described TA427 contacting foreign-policy experts with relevant questions and maintaining conversations over weeks or months. Its researchers assessed that the actor might satisfy intelligence requirements by asking for opinions and analysis directly. They observed personas associated with media, academia, government, and think tanks. These were findings about that actor and the researchers’ visibility, not evidence that every unsolicited interview request is malicious. Proofpoint: TA427 information gathering
A May 2024 joint FBI, State Department, and NSA advisory also documented North Korean actors posing as journalists and other experts. It described initial messages without malicious links or attachments and later messages that could introduce them. The advisory makes clear why an apparently ordinary first exchange deserves a sensible intake process. Joint advisory, summary and red-flag indicators
For a company, the practical application is broader than that historical targeting. A question about an unpublished launch date, an unresolved incident, or a customer’s deployment can ask an employee to release information the company has not approved for that audience. These company examples illustrate disclosure risks; they are not attributed TA427 incidents.
Verify the journalist and approve the answer
First, establish whether the requester and assignment are real. Second, decide whether the proposed answer is suitable for release. Neither decision substitutes for the other.
A real journalist may ask a question that you cannot answer. A fake journalist may ask a question that can be answered entirely with a public link. Knowing who asked does not decide what you can tell them.
If your organization has a communications or media-relations team, route the inquiry there through the normal internal channel. Give them the original message, claimed publication, deadline, and questions. Avoid forwarding internal notes or suggested sensitive answers to the outside address while waiting for approval.
For a new contact, the communications owner can find a newsroom or publication contact independently of the message and confirm the person and assignment. A recognizable byline helps locate a real person; it does not establish that this particular sender controls that person’s account. Our callback contact-source guide explains the same contact-selection problem in support workflows.
Freelancers and new publications may not have a large staff directory. An incomplete directory lookup is a reason to seek another supported route, not a verdict of fraud. Record what could and could not be established, and let the responsible communications owner decide how to proceed within policy.
Before answering the inquiry
Recommended intake, not an observed incident
- Receive the inquiry
Record questions, publication, assignment, and deadline.
- Verify the assignment
Communications uses an independently located publication contact.
- Review the answer
The information owner identifies public material and approves any release.
- Record both decisions
If unresolved, hold and name an owner. If both permit release, send only the approved response.
A confirmed identity does not approve disclosure.
Review the answer, including what it confirms
Do not limit review to attachments. A brief sentence may confirm a fact that was previously uncertain. “We are still evaluating that supplier” tells the recipient something even if you attach no document.
A useful review asks whether each answer draws only on approved public material, adds internal knowledge, or combines the two. Link to the published statement when that meets the request. If the employee wants to add context, identify the additional fact and the person authorized to approve it.
A promise to keep a conversation private does not give the employee authority to share restricted information. Let communications handle attribution and interview arrangements under the organization’s process.
The same check applies to introductions. An offer to connect the requester with a colleague can expose a private contact or move an unverified request to someone with more access. Ask the colleague or responsible owner before making that introduction. Publicly listed contacts can be provided according to your normal procedure.
Some answers can be public; others need approval
Questions about the same project can need different release decisions:
- “Where is the announcement?” An approved public link may answer this.
- “Will the pilot become a full deployment next quarter?” The answer could reveal an internal commercial decision.
- “Which reliability problems remain unresolved?” The answer might disclose technical findings or customer information.
Confirming the assignment does not authorize all three answers. Communications can review the public link while the project owner considers deployment timing and reliability details.
If the assignment cannot be confirmed, the communications owner can keep the inquiry pending or decline under policy. An employee does not need to accuse the sender of impersonation. A usable holding response is: “Our communications team handles interview requests. I have sent them your questions and deadline.” Only use that statement after actually making the referral.
Record which answers are approved
Record the assignment check, exact question, proposed answer, release owner, and decision.
Keep the original inquiry in the approved system. Use references to internal evidence rather than copying sensitive material into a broad training report. If an answer is still waiting for approval, leave the next reviewer a name to contact and the question that needs resolving.
Our public-information mapping article covers what an attacker can learn before contacting an employee. This workflow covers what the employee might add voluntarily. A helpful, accurate answer is still a disclosure decision when it contributes information that was not public.
Give staff a reachable communications contact and a named owner for answers that need approval. A deadline should lead to that person, not to an improvised disclosure.
