2020 in the archive: the year attention was reallocated, not expanded

The arithmetic answers it in one line. 2020 holds 1,891 entries and the year before holds 1,687, a rise of 204. Entries concerning the pandemic or working from home number 289. Take them out and what remains is 1,602 — 85 below the previous year.

So the rise is not a rise. Strip one subject and the decline that has been running since the autumn of 2017 continues without a break, at very close to the rate it was already travelling at.

That is worth separating from a claim it resembles. This page is not saying the pandemic caused the field to write less about other things; a subtraction cannot establish a cause, and the previous piece in this series overreached in exactly that way and had to be corrected. What the arithmetic establishes is narrower and still useful: the exceptional year is not exceptional once one subject is removed, so any explanation of 2020 as a year of expanded activity has to survive that removal first.

The monthly figures are what turn a subtraction into something more interesting, and they are the next section.

Roughly 61 entries a month at the deepest point, and it did not recover. Non-pandemic writing begins the year at 170, bottoms out at 109 in Mar, and finishes December at 139.

What that means concretely is that every subject not connected to the emergency competed for a smaller share of a fixed quantity of attention. Vulnerability disclosure, authentication, insider risk, regulatory enforcement, hardware, the slow arguments about identity and access — all of it continued happening and less of it was recorded.

The mechanism is not mysterious. A publication has a fixed number of slots in a week and a finite number of people to fill them, and a subject that every reader is living through wins that competition without an editorial decision being required. Nobody chooses to cover authentication less. It simply loses.

There is a second-order effect worth naming. Displacement does not fall evenly: subjects with a natural news hook survive it, and slow structural ones do not. An enforcement action or a disclosed breach still arrives with a date attached and gets written up. An argument about privilege management, certificate lifetimes or the state of an organisation's asset inventory has no date, and it is the first thing to lose its slot when the week is full.

So a shock does not simply reduce coverage. It shifts the balance towards events and away from conditions, which over a long enough period makes the record read as though the field consisted mostly of incidents.

For anybody using a record like this one to reason about a period, that has a direct consequence. A subject appearing less often during a shock is evidence about the newsroom, not about the subject, and a comparison that spans 2020 will show declines in almost everything for reasons that have nothing to do with the things declining.

It partly did, and the partial recovery is the interesting part. The non-pandemic band climbs back from 109 to around 139 by December, which is most of the way but not all of it: January's 170 is never reached again in this year.

One reading is that the pandemic simply kept a residual share — it never falls below double figures after March, and December is one of its larger months at 31. A subject that stays at a tenth of the output permanently reduces what is available for everything else.

The other reading is that this is the ordinary decline reasserting itself. The years either side of 2020 were falling, so a band that ends lower than it started is doing what the record was doing anyway, and the pandemic explains the shape of the dip rather than the level it recovers to.

This archive cannot separate those two, and it is worth saying so rather than choosing the more satisfying one. The measurement that would settle it — what would have been written in the absence of the shock — does not exist and cannot be constructed from anything here.

The intrusion disclosed in the middle of December, in which a compromised software update from a network monitoring vendor reached tens of thousands of organisations including several governments, appears in this archive 2 times. Both are in Dec.

Nothing about that is a failure of judgement. The disclosure landed with a fortnight of the year remaining, the extent took months to establish, and an entry filed in December could not have said much beyond that something serious had happened.

It is the third December in this archive with the same property. A grid attack at the end of 2015 entered as a question a week after the event. A processor-level flaw broke in the opening days of 2018 and belongs to a year that had not yet started when it was found. Events do not distribute themselves conveniently across reporting periods, and the ones that arrive in the final fortnight are systematically under-recorded in the year that contains them.

The asymmetry is between when something happens and when it becomes describable. An intrusion of that kind is discovered, then scoped, then attributed, then argued about in hearings, and each stage produces writing months apart from the last. The archive records the final stage of one event beside the first stage of another and files them under whichever year they landed in.

The practical form of that is worth keeping. Any annual summary of anything is weakest about its own last month, and the December of a bad year is precisely where a reader should expect the record to be thinnest.

One subject moved against the displacement. Entries touching hospitals, patients, medical devices or the vaccine effort number 68 across 2020 — a small share of the year, and one of the few that ends higher than it began:

• Jan3
• Feb5
• Mar6
• Apr4
• May4
• Jun6
• Jul3
• Aug5
• Sep6
• Oct5
• Nov9
• Dec12

From 3 in January to 12 in December. The proportions are modest and the direction is unambiguous, running opposite to almost everything else in the year.

The reason is that healthcare sat on both sides of the reallocation at once. It was where the emergency was happening and it was also a legitimate security subject, so it did not have to compete with the pandemic for space — it arrived attached to it. Nothing else in the archive had that property.

The December entries give the flavour without needing interpretation: ransomware described as falling hardest on hospitals, tens of millions of medical images sitting on servers with no protection in front of them, and warnings about the distribution effort that was about to begin. A ward that cannot admit patients because its scheduling system is encrypted is the point at which arguments about security in healthcare stop being conducted in the abstract.

The caution belongs with it. 68 entries is a doubling of a small number rather than a large movement, and a subject that quadruples from three to twelve has not become dominant. What makes it worth recording is the direction, in a year where the direction of nearly everything else was down.

A subtraction on its own proves very little. Remove any sufficiently large subject from any year and the total falls; the question is whether the expression doing the removing is measuring the thing it claims to.

So the same test runs on the years either side. It matches 5 entries in 2019, out of 1,687, and 163 in 2021, out of 1,628.

That is the pattern it should produce if it works. Almost nothing before the event, a large presence during it, and a substantial residue afterwards — because the subject did not end in December. An expression that quietly matched general vocabulary would have returned a large number for 2019 too, and it returns 5.

This is published rather than done privately for a specific reason. The previous piece in this series named a cause for a decline on the strength of three data points, and measuring four more years removed the conclusion. A claim without its control is a hunch with figures attached, and the difference is not visible from the outside unless the control is printed.

Less well than the one before it, and the gap is large enough to qualify everything above. The share of entries carrying a written summary, by year:

• 201866%1,156 of 1,758
• 201977%1,300 of 1,687
• 202050%947 of 1,891
• 202152%850 of 1,628

77% in 2019 and 50% here. The year that gained entries lost description, so a good deal of 2020 exists in this archive as a headline and a date with nothing underneath.

That has a specific consequence for the counting on this page. Subject matching runs over titles and summaries, so a year with less summary text offers less surface to match against, and every subject figure for 2020 is a floor drawn from thinner material than the equivalent figure for 2019.

It cuts in a direction worth naming rather than glossing. If anything it makes the central finding conservative: the pandemic subject was found in 289 entries despite half the year having no summary to search, so the true share is more likely above 15.3% than below it. An undercounted displacement is still a displacement.

What it genuinely weakens is any fine-grained comparison of small subjects between 2020 and 2019. A category that appears to have halved may have done nothing of the sort and simply lost the text it was being found in — which is why the argument on this page rests on a large movement in a large subject rather than on a set of small ones moving together.