Skip to content

Journalists and source protection

In investigative reporting the heaviest risk usually lands on the source, not the reporter. A reporter who gets noticed still has an editor, a media lawyer, and peers behind them. A source often does not: a mid-level employee, a civil servant handling a file, a monitored activist. When a source is identified, the consequences are theirs to carry.

This page is deliberately short. The canonical English-language playbooks are strong, and we route depth to them in Where to go from here. What we add is a regional read: working with sources inside the less open jurisdictions of Asia-Pacific, where exposure can mean detention, where SIM and account registration is tied to a legal identity, and where cross-border data requests between governments are a real part of the threat model.

Where the depth lives

The Freedom of the Press Foundation's source-protection guides and EFF Surveillance Self-Defense's Journalist on the Move are the references we point to for tool-by-tool, step-by-step instructions. This page assumes you'll go there for specifics. It exists because FPF's guides are English and Spanish only, so a regional English page still helps reporters in this part of the world line the advice up with local conditions.

The metadata problem comes first

Before any tool choice, the core risk to understand is metadata. Encrypting the content of a conversation does not hide who contacted whom, when, and how often. That pattern alone can burn a source: if a company's logs or a telco's records show that an employee messaged a known reporter the week before a story ran, the content of those messages is almost beside the point.

So source protection is mostly about not creating the linkable trace in the first place, not about encrypting it after the fact. For the underlying concepts, see why metadata matters and anonymity, privacy, pseudonymity, and confidentiality, which is the distinction reporters most often get wrong: a confidential channel is not an anonymous one.

The source-protection lifecycle

A useful way to think about it is as a lifecycle, from first contact to post-publication cleanup. Each stage asks the same question: if an adversary later obtained communication logs, cloud backups, or a seized device, could they trace it back to the source?

First contact

Publish a way to be reached safely, rather than waiting for sources to improvise an insecure one. At a pointer level:

  • Signal is the most common individual reporter inbox. It is end-to-end encrypted and the server can't read message content. Note that registration requires a phone number; the source's number can be hidden from you with a Signal username, but the number still anchors the account, which matters in jurisdictions with mandatory identity-linked SIM registration.
  • SecureDrop is the institutional option: an open-source submission system maintained by the Freedom of the Press Foundation, where sources reach a newsroom over a Tor onion service so neither side sees the other's location or IP. It needs real infrastructure and maintenance, so it's typically run by larger outlets. Individual reporters do not need to feel they're failing for using Signal instead.
  • Onion services more generally let a source connect without revealing where they are. A self-hosted onion inbox is a lighter-weight version of the same idea.

If a source reaches you first through an insecure channel (work email, a mainstream messenger), don't discuss anything substantive there. Move the conversation to a secure channel with a contentless first message, and don't forward their original message around the newsroom.

Verifying identity without creating evidence

Confirming who a source is and protecting who they are are two sides of the same task. Cross-check the claim against public information (a stated role against a company site or past interviews; whether leaked documents match the organization's formats and terminology). What you should not do is ask for ID cards, badges, or pay slips as "proof": those become the very evidence that exposes the source if a device is later searched. A second set of eyes from an editor catches a lot of social-engineering attempts.

Technique does not protect a source who is identifiable from the story itself, so settle how the material will be used at first contact rather than at publication. Agree on the level per topic, not per conversation: on the record, quoted anonymously by role, background only, or not used at all. The anonymous-quote level is where sources get burned, because the role description can identify them on its own — if only three people fit "an engineer on that project," the attribution names all three. Widen the description or drop to background.

Two things are worth separating explicitly. A source decides how their words are used; the newsroom decides whether the story runs. When a source asks you to spike the piece, what usually helps is addressing the specific fear (will they be identifiable, when does it publish, who else is talking) rather than debating the story. Do not promise what you cannot deliver: "no one will know it was you" is rarely true, and promising it costs you the source's trust at the worst moment. Promise the things you control instead. If a source withdraws before publication, re-source or drop the material; if they withdraw after, be honest that published material is not retractable, which is a reason to have said so at the start. A source whose anxiety far exceeds your read of their situation often knows something you don't — ask.

Sources who don't use these tools

Most digital-security guidance assumes a source who can install Signal, strip metadata, and run Tor Browser. Older sources, sources with hearing or vision loss, and sources without smartphone habits are common in exactly the stories that matter, and pushing them onto unfamiliar tools usually produces a misconfigured install or a lost contact. Move the technical burden to your side instead.

In practice that means meeting in person where you can, at a place that costs the source little to reach; avoiding phone and video with a source whose hearing is poor, in a room quiet enough for a hearing aid to work; keeping sessions short; and leaving no notes, tool instructions, or business cards behind in their home. Where a channel is unavoidable, a landline or SMS the source can actually operate may be the right trade-off against an encrypted tool they cannot, since an unusable tool means they fall back to the least safe channel available. Treat that trade-off as provisional: a case can escalate to an adversary who can obtain call records, and those records typically outlive the story. Strip metadata from their files yourself rather than teaching them, remind them to delete originals from their own phone, and be careful about handling their device, since your actions leave traces that a later search will find. Consent also needs more care here: a source may not distinguish "online" from "in the paper," so state plainly that the story will be public, searchable, and visible to family.

Exchanging files

Treat every file as carrying metadata until proven otherwise. Office documents, PDFs, photos, and video routinely embed author names, GPS coordinates, device models, timestamps, and edit history. Strip it before opening or forwarding; FPF and EFF cover the specific tools. Store sensitive material in an encrypted container rather than on a desktop or in personal cloud sync, and when you pass files onward to an editor or lawyer, use an end-to-end encrypted transfer rather than a mainstream attachment or a cloud-drive share link, each of which leaves a record on the platform's side.

Interview records

Keep only what you need to write the story. Use code names instead of real names, keep the code-name-to-identity mapping stored separately and encrypted, and avoid recording third parties (family, colleagues) who aren't part of the story. For high-risk recordings, a standalone, offline audio recorder keeps the file off a phone that is otherwise tied to your SIM, accounts, location history, and automatic cloud backup. Upload to an encrypted container promptly, then delete from the original device.

Keeping multiple sources apart

Once a story has more than one source, you carry a second duty: keeping them from learning about each other. If one is identified, the subject organization works outward through their circle to find the next; sources who know others are talking change their accounts; and a source who genuinely does not know who else spoke has nothing to give up under questioning.

Use a different channel per source, keep separate code-name schemes with the mappings in separate files rather than one master table, and split interview notes by source. The riskiest step is verifying one source's detail with another: put a specific claim to a second source and they now know someone talked, and can usually guess who. Abstract the detail, approach it through public or procedural framing, and treat it as independent corroboration only when the second source volunteers it. The same problem returns at the writing stage — a fact only a handful of people could know is an attribution in disguise, so count how many people could plausibly know each detail before it goes in the copy.

Post-publication cleanup

Publication is often when source risk rises, because the subject organization starts an internal investigation and reviews who had access. Before the story runs, remind the source about likely access-log reviews and office monitoring, and agree on a quiet period with no contact. On your side, weigh keeping records (a defense against litigation) against destroying the link to the source, set disappearing messages on the relevant threads, and consider reimaging a reporting laptop after a high-sensitivity story. The public, citable evidence behind the story should be preserved; the private back-and-forth with the source should be cleared as early as it safely can be.

The regional angle that changes the advice

The general lifecycle above holds everywhere. What shifts in this region is the consequence of exposure and the reach of the adversary.

  • Working with sources inside less open jurisdictions. When a source is physically inside a jurisdiction where exposure can mean detention or worse, the source's local conditions dominate the threat model, not the reporter's. Network censorship can block the very tools you'd want to use, so confirm what actually works on the source's side before relying on it, and assume the source's device and home network are higher-risk than your own.
  • Identity-linked SIM and account registration. Across much of Asia-Pacific, SIM cards and major platform accounts are bound to a legal identity by law. A phone number is often not a pseudonym but the legal person. This is exactly why phone-number-anchored tools, useful as they are, are not anonymity tools, and why the metadata trail matters more here than the guides written for other contexts assume.
  • Cross-border data requests are real. Governments in the region do make formal and informal requests to each other and to platforms for user data. A channel that is safe against one government is not automatically safe once a second one can ask the first. For a source crossing a border, or a reporter traveling to meet one, treat the trip itself as a stage in the lifecycle.
  • Reporting in or on mainland China puts the weight on people who stay. The exposure that matters is not mostly the visiting reporter's. A mainland interviewee can face charges without anything resembling a classic leak: the Counter-Espionage Law as revised in 2023 widened what counts as espionage, the state-secrets law revised in 2024 brought "work secrets" under the same protection regime, and elastic public-order offenses cover the rest, so speaking to foreign media can itself be the exposure. Assume domestic communications are obtainable — WeChat is not end-to-end encrypted, Signal, WhatsApp, and Telegram are blocked, and the VPN a source would need to reach you is itself legally grey. The same applies, and is more often overlooked, to fixers, translators, drivers, and the friend who made the introduction: they carry comparable risk, are rarely treated as "sources," and are still living there after you leave. The risk peak arrives after publication and after your departure, so agree on a no-contact period beforehand, don't thank anyone publicly, and route any decision about someone leaving the country to an organization with local experience. Since July 2024, state-security officers have explicit authority to inspect personal electronic devices, with reported customs spot-checks of phones and laptops in Shenzhen and Shanghai. Verified 2026-08: FOTN 2025 China.
  • Hong Kong's state-secrets offense reaches the source directly. The 2024 Safeguarding National Security Ordinance (the Article 23 legislation) criminalizes unauthorized disclosure of information classified as a state secret, so a source's leak can itself be a crime, not just a firing offense, and a reporter who solicits or knowingly receives the material risks being treated as party to the same offense. The Hong Kong Journalists Association still operates and still publishes, but has absorbed years of doxxing campaigns and official pressure, so don't assume it's the safety net a press-freedom body would be in Taiwan or Japan. Route instead to Reporters Without Borders, the Committee to Protect Journalists, and the Access Now Digital Security Helpline (24/7, multilingual).

For the travel side of this, pre-departure digital safety walks through briefing yourself on a destination's censorship, legal, and SIM picture before you go. For the empirical regional backdrop (what's actually blocked, where), see the Regional Observatory. The companion activists' digital preparation scenario covers overlapping ground for sources who are themselves organizers.

Where to go from here