Digital security for journalists. The complete operational guide.

Most “digital security for journalists” guides are written for a threat model that no longer exists. They tell you to use a password manager, enable two-factor authentication, and keep your software updated. That was 2015 advice. In 2026, journalists face commercial spyware deployed by democratic governments, retroactive laws criminalising published material, border agents with forensic extraction kits, and cloud providers that hand over years-old data on subpoenas they cannot legally disclose.

This guide is the operational protocol we recommend to journalists we work with. It assumes you already know the basics. It assumes your adversary is serious. It assumes that being wrong means someone gets identified, arrested, or killed.

Step 1. Build a real threat model before you touch any tool

Privacy advice that starts with a tool recommendation has failed before it began. The first question is not “which VPN” or “which messaging app”. The first question is: who specifically is trying to reach your information, what can they do with it, and what happens if they get it.

A beat reporter covering city hall has a different threat model from a correspondent covering organised crime. A freelancer filing from Istanbul has a different threat model from a staffer at a US daily. The tools that protect one can be useless, or actively dangerous, for the other. Signal is a sensible default against most threats. It is a liability in a country where installing Signal is itself evidence of wrongdoing.

Before you change anything about your setup, spend an afternoon mapping four things: who you protect (sources, colleagues, family), what information would harm them if exposed (identities, locations, communication patterns, documents), who specifically wants that information, and what resources those adversaries have. State actors with legal subpoena power behave differently from state actors with zero-click malware, which behave differently from commercial adversaries with hired investigators.

Our complete walkthrough is here: How to build your threat model in 20 minutes. The output is a one-page document that dictates every tool choice that follows. Without it, you are buying security theatre.

Step 2. Your device strategy is your single most important decision

A recent iPhone with Advanced Data Protection enabled and Lockdown Mode activated is one of the most defensible consumer devices available today. A recent Pixel running GrapheneOS with Google Play sandboxed is comparable. Everything else is a compromise.

The hardware matters because it dictates what happens after device seizure. On an iPhone with Secure Enclave and a strong passcode, forensic tools like Cellebrite and GrayKey have to fight the hardware, and the hardware rate-limits them. On a three-year-old Samsung, those same tools often walk straight in. That is not a theoretical difference. It is the difference between a source being identified or not.

If you cannot afford a recent iPhone or Pixel, the next best move is not to buy a cheaper phone and hope. The next best move is a dedicated device strategy: one personal phone for your life, one work phone with nothing on it you cannot afford to lose, and one travel phone that is wiped between trips. Compartmentalisation is cheaper than hardware.

We compare hardware options in detail: GrapheneOS vs stock Android for civilians. For travel specifically: Travel phone setup, clean device before travel.

Step 3. Messaging: what actually works, and what does not

The messaging landscape for journalists in 2026 has narrowed. A lot of options marketed as secure have been quietly downgraded by their own design decisions.

Signal remains the default for most situations. Its threat record is verified in multiple legal proceedings where Signal was subpoenaed and had nothing to provide beyond a phone number and registration date. Use disappearing messages on every sensitive conversation. Verify safety numbers with your most sensitive contacts in person. Do not rely on Signal in countries where installing Signal is itself an incriminating act. Our comparison of Signal vs ProtonMail vs Wire for sources covers the edge cases.

iMessage can be acceptable, but only if both parties have Advanced Data Protection enabled. The default iCloud Backup setting gives Apple a copy of your messages that can be subpoenaed. Green bubbles fall back to SMS and are unprotected. How the FBI recovered deleted Signal messages from a seized iPhone shows why backup configuration matters even when the app itself is encrypted.

Telegram is not end-to-end encrypted by default. Regular chats are readable by Telegram. Only opt-in Secret Chats are E2EE. Treat Telegram as a public broadcast channel, not a private communication tool.

WhatsApp uses the Signal protocol and is end-to-end encrypted, but Meta collects extensive metadata: who you talk to, when, how often, from where. For a journalist, WhatsApp metadata is often more revealing than content. If you must use WhatsApp, assume Meta knows every source you have.

Email is not a secure channel by default. ProtonMail is end-to-end encrypted when both parties use it. For everything else, assume email is archived forever by at least one party and subpoenable. How to communicate with confidential sources safely is the protocol we recommend.

For hostile regions where Signal or WhatsApp are blocked or monitored, we cover the fallbacks in Encrypted messaging apps ranked for travelers in hostile regions.

Step 4. Network: the VPN is the least interesting part

Journalists tend to overweight the VPN decision and underweight DNS, Wi-Fi hygiene, and traffic analysis. A VPN hides the site you are visiting from your ISP. It does not hide your behaviour from the site, it does not protect against fingerprinting, it does not anonymise metadata, and in many cases it does not even do what you think it does. Can you be tracked through a VPN? Real cases, documented walks through the failure modes.

For journalists, pick a VPN for one of three reasons: you need to hide your browsing from a hostile ISP, you need to bypass geo-restrictions to access censored information, or you need a dedicated clean IP for a specific operation. For the first two, Mullvad and Proton VPN are the defensible choices. For the third, a self-hosted VPS with a privacy-respecting provider is cleaner than any commercial VPN. Our reviews: Mullvad VPN review 2026 and Proton vs Mullvad 2026.

DNS deserves more attention than it gets. Every website you visit is queried through DNS. By default, that query goes to your ISP in clear text. They see every domain you attempt to reach, whether or not you use HTTPS, whether or not you use a VPN at the wrong layer. Use encrypted DNS at the OS level and configure it to a trusted resolver. Your VPN should handle this when connected, but many do not. Verify.

Public Wi-Fi, airports, hotels, cafes, should be treated as hostile by default. Your hotel Wi-Fi was compromised before you checked in explains the failure pattern. On any network you do not control, assume traffic analysis is occurring and route critical communications through a VPN you already trust.

Step 5. Accounts: identity separation is the actual defense

The hardest part of digital security for journalists is not technical. It is behavioural. Most journalists work with a single digital identity that links their reporting, their personal life, and their professional network through shared email addresses, shared phone numbers, and shared devices. That single identity is the attack surface.

Operational identity separation means different email addresses, different phone numbers, different devices, different browser profiles, different payment methods, for different roles. Your reporter persona on Signal should not share infrastructure with your Twitter account, which should not share infrastructure with your family group chat. Each reused piece of infrastructure is a correlation an adversary can build on.

This is not paranoia. It is how forensic investigators work. Given one piece of information, a phone number, an IP address, a Google account, they walk backwards through every service that saw it, correlate with every other service that saw something similar, and reconstruct a graph of who you are, what you do, and who you talk to. The only defense is not to create the correlation in the first place.

The full protocol: Operational identity separation, the OPSEC principle most people skip, and the practical how-to: How to create accounts without linking your identity.

Step 6. Authentication: SMS codes are worse than no MFA

Two-factor authentication prevents the most common category of account compromise. But not all 2FA is equal. SMS codes, the most common form, are vulnerable to SIM swapping, SS7 interception, and phishing via any voice call that asks you to “confirm a code”. SMS codes can be intercepted in real time shows the documented attacks.

App-based codes (TOTP) are a major upgrade. They live on your device, they do not transit a cellular network, and they are phishing-resistant in most common attacks. Hardware keys using FIDO2 standards, YubiKey, Titan, SoloKey, are the gold standard. They are immune to every phishing attack we have seen, because the cryptographic challenge is bound to the specific website domain, not to a user-visible code.

The distinction matters when the attack is real-time social engineering rather than automated phishing. In three confirmed breaches in April and May 2026, the attackers walked employees through MFA approval live on a phone call. TOTP codes were valid. The session was authentic. Only hardware FIDO2 keys, or device-bound passkeys, refuse to authenticate when the origin is wrong, regardless of what the human does.

For any journalist who can afford thirty euros for two hardware keys, the answer is: buy two, register both on every high-value account, and store one in a different physical location. The operational upside is enormous. The downside is that if you lose both, recovery is painful. Never let an account silently downgrade to SMS as a recovery option.

Step 7. Cloud: assume every provider will be subpoenaed

A US-based cloud provider, Google, Apple, Microsoft, Dropbox, AWS, is subject to US legal process for any data it holds, wherever on the planet that data is stored. This is the CLOUD Act. The same is true in modified form for European providers under European law, for UK providers under the Investigatory Powers Act, and so on. If your source documents live with a third party that can decrypt them, they can be reached.

For journalists, the implication is simple. Anything truly sensitive lives in end-to-end encrypted storage where the provider cannot decrypt it, or it does not live in the cloud at all. Proton Drive, Tresorit, Mega, Cryptomator-over-anything, or local-only storage on an encrypted volume are the categories that hold up. How law enforcement accesses your account data walks through the process.

For international investigations, the risk multiplies. Cross-border data requests, what happens when two countries want your data explains how MLAT and the CLOUD Act interact to reach data that theoretically sits in a protective jurisdiction.

Step 8. Travel: the border is its own threat model

Border agents operate under reduced Fourth Amendment protections in the US, reduced equivalents elsewhere, and nearly unlimited search powers in countries like the UK under Schedule 7 or Hong Kong under the 2026 device unlock law. A US citizen can refuse to unlock a device and walk in, but their device may be seized and imaged for weeks. A non-citizen refusing is almost always denied entry. A foreign journalist in a hostile country can be detained, have their source material extracted, and be deported with no practical recourse.

The only defense is device minimisation before the trip. A dedicated travel phone, containing only what you need for the trip. A travel laptop, clean-installed, without a single email account that matters. Real source material, unpublished drafts, sensitive documents, none of it should be on a device that crosses a border. Border agents can search your laptop without a warrant and Hong Kong device unlock border law 2026 detail what you face in practice.

If you must travel with sensitive material, the protocol is to ship it ahead via an encrypted cloud service that the destination network can reach, not on the device itself. Or to carry it on an encrypted USB drive that you can dispose of if necessary. Never on the laptop.

Step 9. Metadata: more dangerous than content

End-to-end encryption protects content. It does not protect metadata. Who you talked to, when, for how long, from which location, how often, this is often more revealing than the messages themselves. A journalist whose Signal is perfectly encrypted can still be burned by a call record showing a 40-minute call from a known sensitive number at the time a leak occurred.

Every file you share carries metadata. Photos contain GPS coordinates, timestamps, device model, sometimes the serial number of the camera. PDFs contain the software used to create them, the author’s name, and often revision history with deleted content still recoverable. Word documents include track-changes you thought you removed and usernames you forgot were ever in the file. Strip metadata before sharing any document to a source you are protecting, or any document from a source you are protecting.

The tools: ExifTool for photos and documents, cleanmydoc for Office files, mat2 for general media. The habit: strip before every single exchange, no exceptions. Metadata vs content in court walks through actual cases where metadata was the decisive evidence.

Step 10. The social-media attack surface most journalists forget

Every post on a journalist’s personal account is raw material for an adversary. A photo of a coffee table reveals your current city. A tagged event reveals your professional network. A complaint about a noisy neighbour places your home. Data brokers aggregate all of this, link it to addresses pulled from public records, and sell the combined profile for fifty dollars.

Data brokers publish your address covers the downstream threat in detail. For journalists, the practical rule is: no location tagging, no photos that reveal your home or your family’s home, no real-time posting from locations you want to keep private. Delete old posts that no longer serve you, the platform is not going to do it for you. Data brokers do not delete you, they archive you explains why a single deletion request is not enough.

The more subtle trap is what Instagram, X, and TikTok algorithms infer from your behaviour. Who you follow, who you unfollow, who you view repeatedly without interacting with, how long you watch each video. All of this is logged, retained, and subject to legal process. A judge in a divorce can subpoena it. A hostile foreign government can request it through the CLOUD Act. A researcher can buy it from a data broker who acquired it through a partnership. Judges are using Instagram against you documents the pattern.

Step 11. When things go wrong: incident response for journalists

If you believe a device has been compromised, the protocol is not to hunt for malware. Commercial spyware like Pegasus and Predator is engineered specifically to evade detection, and if it is on your device, you will not find it without forensic-grade tools. The protocol is: assume compromise, preserve evidence, migrate to a known-clean device.

Do not factory-reset the suspect device. Do not run diagnostics. Do not install “cleaning” software, most of it is itself malware or reports back to adversaries. Power the device off, disconnect it entirely, seal it in a Faraday bag if you have one, and contact Amnesty International’s Security Lab, Access Now’s Digital Security Helpline, or Citizen Lab for forensic analysis. These organisations do this work without charge for journalists and human rights defenders. Pegasus does not need you to click anything explains why detection is hard.

For account compromise, the sequence is: change passwords from a clean device, revoke all active sessions, audit every connected application, review recent account activity for unfamiliar entries, and enforce hardware-key MFA on re-entry. Do not do any of this from the potentially compromised device.

If sources may be affected, contact them through a channel you both trust, warn them clearly, and assume your previous channel is now surveilled. The choice of how to warn a source without alerting an adversary who may be reading the warning is the hardest operational decision in this profession. There is no clean answer, but Most journalists are compromised before they know it walks through what we have seen work.

Step 12. Build the habit, not the fortress

Digital security for journalists is not a one-time setup. It is a practice. The tools change. The adversaries change. The laws change. The hardware you bought last year is a generation behind what your adversary has this year. Threat models drift as you move between stories, regions, and sources.

The journalists we see sustain real security are the ones who build routines: a weekly account audit, a monthly threat-model review, a pre-trip checklist, a post-trip device wipe. The ones who fail are the ones who set everything up correctly in January and then assume they are fine in July. The hostile world is not static. Your security cannot be either.

Further reading on Predaxia:

• Build your threat model: How to build your threat model in 20 minutes
• Pre-travel checklist: Security checklist before traveling to high-risk countries
• Source protection: How to communicate with confidential sources safely
• NGO-adjacent field guide: Digital privacy guide for NGO workers abroad
• Diplomats and high-risk travel: Digital security for diplomats and expats in high-risk countries
• Device forensics: What they can extract from a seized device in 6 hours
• The adversary is often closer than the state: An NGO worker’s phone was searched at the border

This guide is updated as the legal and technical environment changes. Last revision: April 2026.

Frequently asked questions

What is the single most important digital security practice for a journalist in 2026?

Build a real threat model before you change any tool. The most dangerous journalists we see are the ones who bought every security product and never mapped who is actually trying to reach them. The second most dangerous are the ones who use no security at all. The first group at least spends money on the wrong problem; the second cannot even tell you what the problem is.

Is Signal still safe for journalists in 2026?

Yes, for most threat models. Signal’s encryption is intact, its metadata collection is minimal, and its legal record of not holding data for subpoena is documented across multiple cases. The caveats are behavioural: disappearing messages must be enabled, iCloud or Google backups must be disabled, safety numbers must be verified with critical contacts, and Signal must not be the channel through which you reveal the identity of a source that Signal’s metadata alone would burn. For countries where installing Signal is itself incriminating, different tools apply, see our coverage of messaging in hostile regions.

Do I really need a Pixel with GrapheneOS, or is a recent iPhone enough?

For most journalists, a recent iPhone with Advanced Data Protection and Lockdown Mode is sufficient. GrapheneOS on Pixel is the stronger choice if your threat model includes sophisticated state actors, if you need sandboxed Google Play specifically, or if you prefer to not trust Apple at all. Both are defensible in 2026. The wrong answer is a budget Android with a weak passcode, a manufacturer that delays security updates, and no hardware root of trust.

What do I do if I think my device is compromised?

Assume compromise, preserve the device, migrate to a clean one. Do not reset, do not run cleaner software, do not install anti-malware apps. Power off, seal, and contact Amnesty Tech, Access Now Digital Security Helpline, or Citizen Lab. All three provide forensic support to journalists and human rights defenders at no cost. In parallel, warn any sources who may have been exposed through a channel you did not use from the compromised device.

Is a VPN enough to protect my browsing?

No. A VPN hides your traffic from your ISP and whatever is immediately above you on the network. It does not protect against the websites you visit, fingerprinting, traffic analysis, compromised DNS, legal requests to the VPN provider, or behavioural correlation. Treat a VPN as one layer in a stack, not as a solution. The categories of attack that defeat VPNs in real cases are documented extensively in our reporting.

Should I use a password manager, and if so, which one?

Yes. The practical choices in 2026 are 1Password, Bitwarden, or Proton Pass. All three are end-to-end encrypted. 1Password has the best user experience and enterprise features but is closed-source. Bitwarden is open-source, self-hostable, and cheaper. Proton Pass is tightly integrated with the rest of the Proton ecosystem. Avoid password managers bundled with browsers, they are cache-and-sync products, not adversarial-grade storage.

How do I keep a source anonymous in a country with internet surveillance?

The short answer is that you probably cannot, using only technical tools, against a determined state adversary in a country with comprehensive surveillance. You can raise the cost, you can obscure the signal, and you can create reasonable doubt in an investigation, but the structural facts, that you have met, that communication has occurred, that the source exists, are often knowable from the surrounding behavioural and metadata patterns. The most effective source protection combines technical measures (end-to-end encryption, identity separation, operational devices) with legal measures (source protection laws, jurisdictional awareness, prior agreement with your outlet’s legal counsel) and behavioural measures (not breaking patterns, not creating suspicious anomalies in your regular life). We cover this protocol in depth in our source communication guide.

What should I remove from my social media before starting a sensitive story?

Anything that places you geographically in real time, anything that reveals your professional network in the relevant area, anything that identifies family members or collaborators who did not consent to public association with your work, and anything that creates a pattern you will need to break during the investigation. Adversaries building a profile of you will start with your public footprint. Reduce the public footprint before the investigation begins, not after something has already leaked.

At a glance: operational checklist

Before you go to bed tonight:

• Enable Advanced Data Protection on iCloud, or disable iCloud Backup entirely
• Verify your Signal safety numbers with your three most critical contacts
• Disable SMS as a recovery method on your email and password manager
• Register a second hardware key on every high-value account and store it separately
• Strip metadata from the three most recent sensitive files you shared
• Sign out of every browser session you no longer recognise
• Delete one account you have not used in over a year

Before your next international trip:

• Prepare a dedicated travel device with minimum accounts
• Ship source material ahead via encrypted storage, do not carry it
• Memorise a legal protocol for your destination country
• Brief one colleague on your itinerary and check-in schedule
• Set a wipe schedule for the travel device on return

Weekly habit:

• Review active sessions across your critical accounts
• Check for new data-broker listings of your name and address
• Review what your social-media algorithms think you are interested in

The fortress you build once and never maintain is not a fortress. It is a deceptively named building.

---

There’s no perfect setup. Anyone selling you perfect is selling fear. The goal is simple: make yourself a harder target than the person next to you.