What Journalists Need to Know About Digital Safety and Security?

The Internet and the digital era have disrupted many industries. Some, like real estate, marketing, commerce, etc. have found a way to thrive in the new digital world, while others like brick-and-mortar booksellers, language translators, travel agencies have seen a decline as a result of online services like Amazon or Expedia that essentially do the same thing as them.

One of the industries most affected by digitalization is journalism. In many ways, the transition from print to digital hasn’t been an easy one. Many newspaper chains like the Tribune filed for bankruptcy as they couldn’t adapt to the new era.

People are looking for news in a different way than they did 20 years ago. The Internet has way surpassed the newspaper in that regard. For example, the graph below is from 2008’s Pew Research Center study and shows the main source for people to get the news from. 12 years later (say that in Squidward’s voice), the gap is much, much greater.

A Digital Safety and Security Challenge for Journalists

The Internet has brought many new challenges to journalism and the press.

Readers are today expecting a faster news delivery. Today you can learn what happened 5 minutes ago in Brazil, while in the 1990s or before you’d only learn about it the next day (at best).

Advertising revenue has dropped for print media 44% between 2005 and 2009 as print classified ads are outcompeted by ads on the Internet, PPC campaigns, social networking and such.

However, few challenges are as significant and impactful for journalism as digital safety and security.

Almost every day you can read about a journalist or news media company being hacked. For example, in October, 2019, 100 journalists, political dissidents and human rights activists had their smartphones hacked using a WhatsApp vulnerability.

The bigger problem for journalists is that it’s not only random hackers that they have to worry about, it’s also their own governments if they do so much as tweet about something.

Digital Security Best Practices for Journalists

Journalists need to adopt certain best practices when it comes to digital security. However, before we get into that, it’s important to first define what is digital security and why it’s important for journalists.

Digital security includes tools and practices one can use to protect their online identity and sensitive information. For journalists, this is even more important as often they don’t have to worry just about their own online security, but also that of their sources, who might want to stay anonymous.

To achieve this, journalists should follow these digital security best practices:

1. Secure your online accounts with strong passwords

The first doesn’t apply only to journalists, but everyone else. Your password is the first line of defense for your online accounts and you need to make it strong. First of all, this means never use the same password more than once. Always use a unique password for every account.

To further protect your passwords and online accounts from hackers, you can also use 2-factor authentication (2FA), which will add an extra layer of protection beyond the login credentials (username and password).

2. Regularly erase your digital tracks.

Everywhere you go on the Internet, you leave digital footprints in the form of cookies. Get into the habit of deleting these as well as your entire browsing history often as these can be used to spy on your activities as a journalist.

With this in mind, stay in the habit of hidden browsing, using Incognito mode (for Chrome) or Private Browsing (on Safari), or the equivalent for other browsers. However, keep in mind that all this does is make the browser not record your cookies. Sites you visit will still record your IP and your browsing will be visible to your ISP (which in turn may reveal this information to the authorities).

3. Mask your IP with a VPN.

Speaking of digital footprints, none is as big as your IP address. You’ll leave it everywhere you go like a kid who just stole some chocolate. VPN is one of the best ways to browse the Internet safely without revealing your real IP as the traffic will go through a VPN/proxy server so that anyone looking will see the VPNs IP and not yours.

4. Use Tor.

Although The onion router has a somewhat dark reputation as a place where criminals of all types congregate, which by the way, is completely undeserved, we shouldn’t forget that its main purpose is to allow people to be anonymous online. 

That’s exactly what journalists need and many, like ProPublica, have adopted Tor and have .onion sites (.onion sites can only be accessed if you have Tor browser installed).

5. Use encryption tools for journalists.

The very notion of installing encryption tools like OpenPGP might scare a lot of journalists, but this is necessary if you want to protect your messages. Once you have OpenPGP installed, it becomes virtually impossible for anyone without the proper combination of public and private keys to decrypt your messages.

Furthermore, journalists should also consider using encrypted services. For example, instead of Skype, use an encrypted messaging app Signal and if you need to send sensitive documents online, use SecureDrop instead of Dropbox.

6. Use anonymous email services

While researching for this article I stumbled upon this opinion article. While the author started nicely by recommending Signal and Tor, it completely went off-track by bashing PGP and especially email. 

Yes, email is 40+ years old, but has evolved multiple times since. Email is still one of the top business and private communication tools and it remains relevant.

Now, I’ll give the author the benefit of the doubt that he was thinking of mainstream email services like Gmail, Yahoo! or Outlook. These are indeed not safe for sending confidential documents and communicating anonymously. 

This is why journalists need to use anonymous email like CTemplar, which will keep their identities hidden from prying eyes. 

CTemplar allows you to become a ghost by signing up completely anonymously (without a phone or SMS verification) and it will also hide your IP address. 

We also have a “no data-retention policy” which means that, once you press Delete, the message will be permanently deleted (and not stay in our logs for the next 6 months like with some providers). We can do this because our physical servers are located in Iceland, whose privacy laws allow us to do this and protect your data.

Of course, keep in mind that all anonymous email providers, CTemplar included, are obligated to respond to legal court requests and therefore must provide them with encrypted email contents and other metadata in our possession and we do so in regards to things like terrorism or children abuse.

Ready to get your privacy back? Create your anonymous encrypted email with CTemplar today!