Journalists have both an ethical duty and a practical need to protect their sources and information. Even as technology has enabled writers and sources to communicate faster and easier, tactics for intercepting information have also evolved. Journalists must stay up-to-date on how to communicate securely with sources and protect their information. Unfortunately, the best tips and resources are hard to find all in one place. To help journalists stay on top of security in 2019, we’ve compiled some of the best tools and advice right here.
Whether you’re a new journalist or a veteran reporter brushing up on digital security, this blog will cover some of the most important steps you can take to protect yourself, your sources, and your stories in 2019. Keep in mind that many of these tips and tools can also be applied outside the newsroom.
Communicating With and Protecting Sources
Just as journalists face threats to their security and credibility, so do sources.
The first step to protecting your sources is ensuring they have a safe means to communicate with you, either through interactive messaging or the transmission of files. Sources should be as educated as you to maintain privacy—otherwise no measures you take will be enough to keep your conversations secure.
Unencrypted email or text messages are not secure for sensitive information. Along with being readily available to anyone who gets your password or device, these channels can be hacked, intercepted, or monitored by service providers and governments.
End-to-end encryption scrambles the content of your messages. They can only be unscrambled and read by using the recipient’s private key. The catch is that end-to-end encryption does not hide your metadata, which can include your subject lines, recipients, and more. Metadata can reveal very sensitive information about you and your connections, even when the content between you cannot be read. Fortunately, with the right mix of tools, journalists and sources can greatly increase the security of their information.
Here are some secure alternatives to simple email and text messaging:
SecureDrop: a submission system that allows sources and whistleblowers to anonymously send documents to you or your news organizations. One of the key features of SecureDrop is that it severely limits the trail of metadata that prying eyes can recover. To learn more about how SecureDrop works and the issues it solves for, visit their Frequently Asked Questions.
Signal: the preferred messaging app for journalists. As Martin Shelton, who works in privacy, security, and identity at Google Chrome puts it, “it looks and feels identical to your default text messaging app, but security experts so often recommend it because of what it does in the background.” Under the surface, Signal offers end-to-end encryption. Not even their developers can access your messages and calls.
Encrypted Email: If you must use email to communicate with sources, these messages should be protected by end-to-end encryption. You can also get step-by-step directions from Comparitech’s “How to Encrypt Email [Gmail, Outlook iOS, OSX, Android, Webmail].”
Along with protecting the content and metadata of your communications with sources, you may also need to keep their identities confidential. This means being conscious and careful about where and how you store contact information.
- Educate sources on the best ways to communicate with you
- Use secure channels like Signal, Securedrop, and encrypted email, but keep in mind no communication channel is completely impenetrable
- Store all source names and contact information in a secure place
Keep Your Notes and Your Work Secure
Once you have information, you must make sure it doesn’t fall into the wrong hands, whether the threat is corporate, governmental, or some other outlet. Your notes and drafts can tip off bad actors about who your sources are and where you get your information. Once they're in the wrong hands, the information can be manipulated or misrepresented. Someone can also interfere with or threaten other sources and resources. To keep your information, notes, and works-in-progress hidden from prying eyes, be conscious and consistent with how you store your information and how you access them.
Some of your most important tools for protecting your work are:
Strong and Diverse Passwords: It may sound obvious, but a strong password is absolutely essential. Whatever other security measures you take, your password is an important hurdle to those trying to access your information. You should also have different passwords for different accounts, apps, and devices. This ensures that even if one of them is compromised, the others won’t.
A secure password manager can help you maintain the many passwords you will need. Martin Shelton has written about some of the most popular password managers, explaining their benefits and drawbacks. 1Password even has a program that offers free accounts to journalists. The EFF also offers tips on creating strong passwords, syncing accounts, and using password managers.
2 Factor Authentication (2FA): This security measure forces anyone trying to access your information to input another piece of data along with your password. To learn when and how to implement 2FA, use our Digital Security Action Plan.
Encryption: Along with encrypting messages, phone calls, and emails, you can also use encryption to protect your hard drive and devices. As David Trilling, a journalist, photographer, and the managing editor at Eurasianet.org, explains for Journalist’s Resource, “Full-disk encryption scrambles your data so that even if the device (your laptop hard drive, for example) is stolen or seized, the material on your computer cannot be read without the password.” He notes that although both Apple and Windows offer encryption, the user must activate it. There are also independent encryption apps you can use, like VeraCrypt.
Additional Resource: Follow this Digital Security Action Plan for a step-by-step guide to securing your online presence.
For more detailed tips, check out this comprehensive tips sheet from Journalist's Resource.
- Protect all your devices and accounts with strong passwords and consider using a password manager if you need one
- Add 2 factor authentication to vital devices or accounts to add an extra layer of security
- Encrypt the data on your devices, either by activating features included in your operating system or by adding an encryption app
Journalists have a responsibility to protect sources who help them uncover important stories, but this responsibility has evolved as more and more communications move to the digital space. Whatever beat you cover or how small or large your audience, there are tools and strategies that can keep your communications and data more secure and provide a strong foundation of basic digital security. Use these tools and resources to keep you and your sources secure in 2019.
You can also get started with securing your digital presence across channels and platforms. Use the Account Safety Cheat Sheet to easily identify what accounts you may need to secure and track.
Photo by Adrianna Calvo from Pexels