Hostile environments & source protection
Short answer Yes. Phone carriers sell location data. In documented US cases, major carriers sold real-time location to data brokers and bounty hunters. In the EU, GDPR limits this, but carriers still retain location data for up to 12 months and have been repeatedly breached. Your carrier knows where you are. That data does not…
Short answer A VPN protects your network traffic. It does not protect you from spyware, compromised accounts, or mistakes already made. If your device has spyware, the VPN is irrelevant. The spyware operates above it. If you are logged into accounts that identify you, you are not anonymous. A VPN is one layer of a…
Short answer Pegasus doesn’t require a malicious link or a compromised attachment. It exploits vulnerabilities in apps already installed on your phone — iMessage, WhatsApp, FaceTime — and installs without any action from you. No link, no notification, nothing out of the ordinary. The most dangerous thing about Pegasus is not what it does once…
Short answer Proton VPN is the most audited, most transparent VPN at consumer price. Swiss jurisdiction. Open source. No connection logs, verified under real Swiss court requests. Not the fastest. Not the lightest. The one we would trust if our connection logs could end up in court. We affiliate with Proton. We say that upfront….
Short answer No. But it is an essential part of the stack, and that distinction matters. 1Password manages credentials. It generates strong, unique passwords, stores them in an encrypted vault, and makes them accessible across devices without requiring you to remember or reuse them. For the threat profile most journalists face — credential phishing, account…
Short answer Mullvad is the most anonymous consumer VPN available. No email required. No identity attached at any stage. Cash payment by post accepted. Swedish police visited their servers with a warrant in 2023 and found nothing, because nothing is stored. Mullvad does not run an affiliate programme. We make no money from recommending it….
Short answer The surveillance does not begin when you publish. It begins when someone decides they want to know what you are working on. By the time you have a reason to suspect something, the access has usually already been established. This is not speculation. It is the pattern across documented cases in different countries,…
Short answer The right answer is not one tool. It is understanding what each tool actually protects, what it exposes, and at which point in a source relationship each one belongs. Most guides to secure communication treat this as a ranking exercise. Best, second best, avoid. The reality is more precise. Each of these tools…
Short answer The image was not intercepted. It was not hacked out of a server. It was handed over voluntarily, as part of a routine document request. The GPS coordinates embedded in the file placed the source at a meeting they had denied attending. The journalist never shared the photo publicly. It was in a…
Short answer The email was not intercepted or hacked. It was handed over by the provider under a legal request the journalist never knew existed. The failure was not technical. It was a misunderstanding of what “secure email” means when the provider is a US company subject to compelled disclosure with non-disclosure orders. The email…