Operational Security for Journalists: A Practical Starting Point

Most digital security guides for journalists either overwhelm or under-deliver. The overwhelm usually comes from trying to cover every threat in one sitting. The under-delivery usually comes from treating the problem as one-size-fits-all. Neither is useful.

When I work with journalists on operational security — through the Source Protection Programme or with independent clients — the first thing I do is spend time on threat modelling before touching any tools. The tools are downstream of the threat. Getting the threat wrong means the tools are either insufficient or so heavy that nobody uses them.

What threat modelling actually means

Threat modelling is a structured way of answering: who wants to harm me, what do they want, and what can they realistically do?

For a journalist, those questions get specific fast. A freelancer covering local government faces a very different threat landscape to someone investigating organized crime or state-level malfeasance. Applying the same toolset to both wastes time in the best case and creates false confidence in the worst.

The four things I ask at the start of any conversation:

1. Who is your adversary? Individuals, corporations, law enforcement, intelligence agencies — their capabilities differ enormously.
2. What are they after? Source identity is usually the primary concern, but metadata, financial trails, and location data are increasingly as valuable.
3. What do they already have? Prior access, legal compulsion, or technical capability — some threats arrive not through hacking but through subpoenas.
4. What are you willing to accept in terms of friction? A tool that is theoretically secure but practically unusable will be abandoned.

The answers shape everything else.

The common failure modes

Encrypting the content but not the metadata. Signal encrypts message contents. It does not hide the fact that two people communicated, when, and approximately where. For many threat models that’s fine. For some it isn’t. Knowing the difference matters.

Device security without physical security. A journalist can have full-disk encryption, Signal, and a VPN, and still have a source compromised because a contact printed something and left it in their car. Digital and physical security are not separable.

Trusting infrastructure you don’t control. Corporate email accounts, cloud storage subscribed to by an employer, work-issued devices — all of these have data subject to third-party disclosure. Using them for sensitive source communications is a risk that doesn’t go away with clever workarounds.

Single points of failure. A source’s identity protected behind a single account with one password and no second factor is one phishing email away from exposure.

A minimal, actually-usable stack

For journalists who aren’t facing nation-state adversaries but do face corporate litigation risk, law enforcement compulsion orders, or targeted harassment:

• Signal for source communications — enable disappearing messages, turn off link previews, and understand that your contact list is visible to Signal if they require it via legal process
• Proton Mail or Tutanota for email — end-to-end encrypted where both parties use it; better than nothing where they don’t
• Full-disk encryption on every device — FileVault on Mac, BitLocker or VeraCrypt on Windows, standard on modern iOS/Android
• A password manager — Bitwarden is free and open source — with unique strong passwords everywhere
• Two-factor authentication via an authenticator app (not SMS) on all accounts that support it
• A separate device or browser profile for sensitive research — kept clean of logged-in accounts

This is not a comprehensive setup for high-risk investigative work. It is a floor that meaningfully reduces common risks without requiring significant behaviour change.

What I don’t cover here

Some threat models require considerably more: air-gapped machines, anonymous purchasing, compartmentalized identities, and careful consideration of legal jurisdiction. These are beyond the scope of a starting-point guide and require proper in-person training and ongoing practice.

If your work regularly puts sources at physical risk, please seek specialist training — organizations like Access Now’s Digital Security Helpline, or the Freedom of the Press Foundation, can connect you with appropriate support.

KIBERNETIKANTO runs operational security workshops for journalists and activists. If you’re interested in a session for your team, get in touch at [email protected].