Mobile Privacy for Journalists: A Practical Starting Point

Source protection is the cornerstone of investigative journalism. Historically, that meant protecting identity — not revealing who talked to you. Today, it requires an additional layer: protecting location. Because your phone knows where you met your source, how long you were there, and whether you returned. That information can be subpoenaed, hacked, or purchased.

The Specific Threat Model for Journalists

Unlike private individuals, journalists operate in a threat environment that may include: state actors with telecommunications intercept capabilities, corporate legal teams with discovery powers, sophisticated private investigators retained by subjects of reporting, and — in some jurisdictions — physical surveillance. Your threat model should reflect the sensitivity of what you are working on, not a worst-case assumption that paralyzes you, but a realistic assessment that drives proportionate countermeasures.

The Source Meeting Protocol

Before meeting a source in person: (1) Leave your personal phone at your newsroom or at home. The device that goes to the meeting should be a dedicated device, purchased with cash if necessary, containing no personal accounts. (2) Ensure your personal phone's synthetic location profile places it somewhere innocuous during the meeting window. (3) Travel to the meeting location via route that does not involve your vehicle (which may be trackable via license plate readers). (4) At the meeting location, request that your source also leave their personal device elsewhere.

Digital Hygiene for Active Investigations

• Use Signal for all source communication — disappearing messages enabled by default
• Route all reporting-related internet activity through a VPN with a no-logs policy
• Maintain a clean research device with no personal accounts for background searches
• Use browser isolation tools (separate browser profiles or containerization) for investigations
• Assume your newsroom Wi-Fi is monitored — use your own VPN even on trusted networks
• Enable full disk encryption on all devices involved in sensitive reporting

When You Are in the Field

In hostile environments — protests, conflict zones, authoritarian jurisdictions — treat every phone as a potential evidence device. Enable your synthetic location before you leave your hotel. Disable biometric unlock and use a strong PIN (biometric authentication can be compelled physically; a PIN cannot in most jurisdictions). Know your legal rights regarding device searches at borders before you arrive at the border.