They spent a year and a half on this fairly obvious thing only to conclude nothing new here and offer no useful advice beyond common best practices.

Are they going to waste the next year on how Twitter, Facebook, etc. can be used by criminals?