A news desk that covers legal developments lives on volume. Orders, notifications, bulletins and filings arrive all day, and someone has to decide which ones deserve a reader’s attention and which can wait. Security teams face the same arithmetic with alerts, and the discipline built around it is called SOC Ops: treating the security operations centre as a service people can rely on, not a room full of screens. This piece borrows that discipline to diagnose a problem most editorial desks recognise, the intake queue that grows faster than anyone can read it.

It is an informational comparison, not guidance for any legal matter. The legal subject here is only the desk’s raw material; the point is the workflow around it.

The symptom: a queue that never empties

Picture a desk that tracks court listings, regulator circulars and gazette notices. Every morning the pile is bigger than the editors’ capacity. Some items are obviously important, many are routine, and a handful look important but turn out to be a restatement of something already covered. The editors respond the way tired people do: they skim, they skip, and the unread backlog quietly becomes the real archive.

In a security operations centre the symptom has a name, the untriaged queue, and it sits at the top of the list of known anti-patterns in the Ops Atlas entry on SOC Ops. The Atlas frames the root cause as simple queue maths. How long an item waits depends on three things: how fast items arrive, how long each takes to handle, and how many people are available. Change one and the wait changes. Ignore all three and the wait simply grows.

Diagnosis one: nobody wrote down what happened to each item

Ask a busy desk what became of a particular circular and the honest answer is often “we probably looked at it.” A SOC Ops team would not accept that. Every alert gets a recorded disposition, and the Atlas lists four of them: a true positive, a benign positive, a false positive, and undetermined. The useful insight is in the second one. Research cited in the Atlas found that most of what analysts call false positives are really benign triggers, meaning something genuine happened and it was simply harmless once you knew the context.

Translate that to the desk. An item that looks like a major ruling but is only a routine adjournment is not a mistake by your feed; it is a benign item that needed context. If you log it as “junk” you will fix the wrong thing, perhaps by dropping a source that is actually valuable. If you log it as “routine, context needed” you learn which items need a one-line note and which sources need nothing at all.

• Worth publishing: the item meets your written test for coverage.
• Routine but genuine: real, harmless, and explained by context.
• Not relevant: the source produced noise for your beat.
• Undecided: parked with a named owner and a date.

Four labels cost a few seconds each. In return the desk can finally measure what its feeds are worth.

Diagnosis two: one clock for everything

Many teams track a single number, the time from arrival to closure. The Atlas pushes back on that and recommends two clocks instead. The first stops when a human first acts on the item, because automatic tagging or auto-forwarding can make a queue look responsive when no person has looked at anything. The second runs until the item is decided or handed to someone else.

On a news desk the equivalent is easy to see. A story that was auto-filed into a folder by a rule has not been triaged; a story that an editor opened and tagged has. Count only the second kind. The same source also recommends reporting a median and a high percentile rather than one average, because a single very old item can wreck a mean. Our own working version: publish “typical” and “slowest tenth” figures per shift, and the overnight gap that an average hides will appear on its own.

Diagnosis three: the handover that loses things

Desks change hands too. The morning editor leaves, the evening editor starts, and half-finished threads vanish between them. The SOC answer in the Atlas draws on a pass-down log: outgoing and incoming staff both sign it, and anything the incoming person has not explicitly accepted remains the outgoing person’s responsibility. That small rule removes the most common excuse in any relay, that someone assumed someone else had it.

It works on a desk with almost no adaptation. Keep one shared note per shift. List each open thread, who holds it and what the next step is. The incoming editor initials the threads they accept. Whatever is not initialled stays with the person who is leaving, even if that costs a brief phone call.

A worked example from this site’s own archive

The clearest local example is the daily digest. The recurring series, such as the 19 June edition of our top-twenty legal roundup, already forces the kind of selection a triage queue demands: of everything that arrived that day, twenty items earned a place. Compare it with the edition one day earlier and you can see the cap doing its job. A fixed ceiling makes the desk choose, and choosing is precisely what a queue without a ceiling never does.

Guardrails against gaming the numbers

Speed-only targets push people to close items before they are understood, and the Atlas notes that reopened items climb when closing time is the sole goal. Reward volume on a desk and you get more items touched, fewer genuinely read. Measure the team, not individuals, and count reopened items.

On tooling, the Atlas is firm that an automation touch is not triage. Let software narrow the pile, let editors decide, and tie any rule that mutes a source to an owner and an expiry date.

A one-week fix you can start Monday

1. Pick one feed and write the four-label scheme on a card next to the screen.
2. Log a label for every item from that feed for five working days.
3. Start the pass-down note at the first shift change.
4. On Friday, count items per label and note the median and slowest-tenth time to first human look.
5. Decide one change: a source to trim, a context note to template, or a shift gap to cover.

One caveat: the Atlas admits the name is its own informal shorthand, and organisations label this work in many ways. You do not need the label. You need a queue with a ceiling, a record of every decision, honest clocks and a clean handover. Start there, and the backlog stops being an archive of things nobody read.