Securing a vital public sector cultural institution
Czech Radio (Český rozhlas), serves as the public radio broadcaster for the Czech Republic. Operating continuously since 1923, it holds the distinction of being the oldest national radio broadcaster in continental Europe. Currently, they employ about 1,500 employees located all around the country.
“Czech Radio is a national cultural institution whose mission is to serve the public,” says data journalist Jan Cibulka, who has been with Czech Radio for a decade. In addition to his reporting, he co-hosts the Antivirus podcast, which focuses on cybersecurity education. He also educates the broadcaster’s editorial staff on cybersecurity issues.
“Ransomware, hacktivism and attempts by nation-states to interfere with our activities have been increasing in recent years. Perpetrators are becoming more capable, better organized and faster.”
Defending newsrooms against sophisticated cyber attacks
As journalism has transitioned into an increasingly digital field, the associated cyber threats have grown in tandem. Czech Radio faces a complex landscape of adversaries ranging from criminal groups deploying ransomware to nation-states and hacktivists seeking to undermine independent journalism. Cyber attack perpetrators are becoming more sophisticated, using methods like spearphishing and DDoS attacks to disrupt operations.
“In the event of a partial shutdown of our publishing platforms, attackers could take us out of service during critical moments, such as elections, floods or international crises,” says Cibulka. “This would undermine the public’s right to information, as well as the trust in our work as a whole.”
Internally, the organization must navigate the financial reality of being a media institution where budgets are often stretched thin, making security investments appear superficially less essential. However, the cost of underestimating these risks has already been felt: Czech Radio has been hit by multiple phishing campaigns and a ransomware attack that crippled their cloud service provider.
As editors are often seen as the easiest entry point for attackers, securing individual work accounts against those who wish to discredit or threaten publishing activities has become a top priority.
“YubiKeys have brought a higher level of security for our editors and peace of mind for administrators.”
Beyond SMS: deploying phishing-resistant authentication
“The integration with YubiKeys was seamless, since we were already familiar with the technology and knew what to expect from it.”
“Czech Radio is very well aware of the importance of secure authentication,” says Cibulka. Leadership recognized that weak multi-factor authentication, such as SMS messages, were no longer sufficient for the modern threat environment. In the high-risk context, they turned to modern hardware security keys, like the YubiKey, which requires a physical touch or tap to authenticate, blocking man-in-the-middle attacks. Manufactured in Sweden, a single YubiKey can store 100 passkeys, as well as Smart Card credentials and more.
During cybersecurity training for journalists, the team learned about Yubico’s Secure it Forward program, which donates YubiKeys to non-profit organizations, human rights defenders and journalists around the world. While the organization had previously used YubiKeys for a small number of critical workers, they sought a way to systematically deploy to a larger group.
The decision to standardize on YubiKeys was driven by the need for a solution that supports FIDO2 and the growing passkey standard. The deployment targeted dozens of employees, primarily focusing on IT technicians and editorial staff. YubiKeys are now used as the primary security method for logging into sensitive work accounts, including social media platforms, providing a robust defense where passwords alone fail.
“Our experience with the Secure it Forward program was seamless and fast.”
Frictionless security for critical editorial teams
The partnership with the Secure it Forward program was characterized by its speed and lack of friction, allowing for a rapid security upgrade.
For Czech Radio, the primary benefit has been a significantly higher level of security for the editorial team, which in turn provides peace of mind for the IT administrators. From the perspective of the employees, the hardware-based approach has simplified their daily workflows. Users have found the process to be less cumbersome than traditional multi-factor authentication methods.
“Our users like the YubiKeys because it’s a straightforward path for them, unlike other MFA methods.”
Protecting public trust through proactive cyber defense
The experience at Czech Radio serves as a reminder for other media organizations to address security vulnerabilities proactively. Implementing cybersecurity tabletop exercises and high-assurance authentication early on can prevent significant future hardships and technical headaches.
For a public broadcaster, securing the digital identity of its journalists is not just a technical requirement, but a fundamental necessity for protecting the public’s trust and their access to reliable information.
Cibulka advises other journalists or organisations considering improving their authentication: “Start addressing security issues as soon as possible. From experience, I can swear that you’ll save yourself an enormous amount of headache in the future.”
“We definitely feel YubiKeys have brought us increased security.”