It seems clear, with four years of hindsight, that the American news media owes John Podesta an apology. The political media did almost everything wrong in covering the theft-and-leak of his private emails amid the heat of the 2016 presidential campaign, four years ago today—and yet it’s not at all clear that if confronted by an operation similar to what Russian intelligence executed in targeting the Democratic National Committee via Hillary Clinton’s campaign chair, that we’d get it any more right now.

In fact, so-called “hack-and-leaks” remain one of the most difficult stories to confront appropriately. As we enter the final weeks of the 2020 presidential campaign, when each day seems primed for an October surprise, it’s worth thinking deeply about what makes these incidents so pernicious—and how we as a news media and a society might respond more maturely and rationally than in 2016.

From dozens of conversations this year with numerous reporters, editors, researchers, and executives—as well as a tabletop exercise I ran at the Aspen Institute this summer along with Vivian Schiller, the former CEO of National Public Radio, who now directs Aspen’s media and technology program—it’s clear there’s a shared unease about how the news media handled the 2016 Russian attack on the DNC and Clinton campaign chair John Podesta. The unease stems not from any partisan preference for or against Hillary Clinton; it has to do with the sense that the US media allowed itself to be the delivery mechanism for a Russian attack on our democracy.

The basic details of the Podesta leak have come into focus thanks to the work of US intelligence and Robert Mueller’s investigation as special counsel: On October 7, 2016, just hours after US intelligence first warned publicly of Russia’s unfolding attack on the presidential election and just 30 minutes after the damaging Access Hollywood tape was released, Wikileaks began publishing thousands of emails stolen earlier that year by Russia intelligence from Podesta’s personal email account.

Ever since the dust settled in November following Trump’s surprise victory, there’s been an uncomfortable sense that the media’s tendency toward horse-race coverage aided and abetted a surprise attack by America’s foremost foreign adversary. The Podesta theft and subsequent leak destabilized the campaign and muddled the line between two controversies—confusing many voters between the leak of the Podesta emails and the questions around Hillary Clinton’s use of a private email at the State Department.

A “hack and leak” is among the most likely attacks the US might face in the closing weeks of the presidential race, and it is also one of the hardest to respond to adequately and effectively. The path forward requires understanding both the lessons of previous attacks and why Donald Trump’s words and actions have made the current landscape particularly vulnerable.

How We Got to Now

The first major hack-and-leak was met with more amusement than alarm. To this day, North Korea’s 2014 attack on Sony Pictures Entertainment remains misunderstood—a bizarre incident by a bizarre regime, more embarrassing than harmful, protesting a mediocre stoner movie with Seth Rogen and James Franco.

Yet it was actually a deeply destructive landmark attack, as it turns out, for reasons we didn’t realize at the time. Beyond the actual financial and physical damage, the Sony hack burned itself into America’s mind because the hackers hit the softest part of the company’s IT system—emails—and weaponized that information through the use of social media. North Korea got the mainstream media to pick up on those leaks and do the hackers’ bidding, causing reputational and financial damage to the company as Sony’s innermost secrets were spread across the internet for all to read. A stolen spreadsheet of a company’s executive salaries proved irresistible to reporters, who published it quickly; ditto for reporting on executives’ candid comments on colleagues, actors, directors, and other Hollywood luminaries. Particularly in the sped-up news cycles of the digital age, the media had decided that the “newsworthiness” of purloined internal secrets outweighed any ethical dilemmas raised by how that material was obtained. In Sony’s case, there was no sense or allegation of wrongdoing—just hot gossip.