Digital dead drops in 2026. SecureDrop, OnionShare, and what is actually used now.
SecureDrop for newsrooms. OnionShare for known recipients. What each tool does, when neither is the right answer, and the practical guidance.
-
-
Counter-surveillance for journalists. The patterns that get noticed before the story is filed.
The journalists who get hurt are followed, photographed, and intercepted in physical space. Surveillance detection routes, patterns to notice, and the operational baseline.
-
Russia didn’t break Signal. It used the feature you’ve never checked.
Russia ran a phishing campaign that compromised around 300 Signal accounts belonging to ministers, military, diplomats, and journalists. The encryption was never touched. Attackers used Signal’s own Linked Devices feature.
-
You don’t have to be a suspect. You just have to have been there.
Hankey v. United States: the Supreme Court heard arguments on April 26, 2026 on whether a warrant targeting a geographic area, not a person, is constitutional. Your phone’s location history is the evidence.
-
Digital security for journalists. The complete operational guide.
The operational digital security protocol for journalists in 2026. 12 steps from threat modelling to incident response. Written for people with real stakes.
-
A journalist was arrested in Kuwait for reposting a CNN video. The law used to charge him didn’t exist yet when he posted it.
Ahmed Shihab-Eldin was arrested in Kuwait for reposting CNN footage of a US fighter jet crash. The law used to charge him was enacted twelve days after his arrest.
-
The US government now requires visa applicants to make their social media public.
As of March 30, 2026, US visa applicants must set all social media profiles to public before their interview. For journalists, lawyers, and NGO workers, this means exposing source networks to government vetting.
-
The FBI recovered deleted Signal messages from a seized iPhone. The encryption wasn’t broken.
On March 10, 2026, FBI testimony in a federal trial in Texas revealed that investigators had extracted incoming Signal messages from a defendant’s iPhone, even after the app.
-
The FBI seized a Washington Post reporter’s phone. It contained 1,200 Signal sources.
On January 14, 2026, the FBI seized the phone, laptops, and Garmin watch of Washington Post reporter Hannah Natanson as part of a leak investigation.
-
Your phone carrier sells your location data.
In 2018, a Missouri sheriff used a carrier-data reseller called Securus to track the location of a judge and a fellow officer without a warrant.
