When Forbes tech reporter Emily Baker-White found out last year that ByteDance, the controversial China-based firm that runs the video-sharing platform TikTok, had used the app to track her whereabouts as she covered the company, she knew she was on to a major story. And she was worried — but not necessarily about herself. The “theory” behind the tracking, she says, was to cross-reference her locations with those of TikTok employees to see who might be talking to her.
“During this saga, I have not ever feared for my physical safety. I have not ever been really afraid of the company [or] the Chinese government coming after me,” says Baker-White, who has reported extensively on whether TikTok’s “access to information about, and ability to influence, millions of U.S. citizens” is a national security risk. “But I know that there are [sources] I've spoken to who do have those fears.”
Baker-White is right to be concerned.
It’s been a decade since whistleblower Edward Snowden, the former contractor working at the National Security Agency who leaked classified information about the U.S. government’s surveillance of its own citizens, chose to make his identity public via The Guardian. Snowden insisted that even though he believed he’d done nothing wrong, he expected “to suffer” for releasing sensitive documents — and accepted those consequences. But in countless instances in national, international, and local reporting, that’s simply not the case: Well-placed sources share tips and data that crack big stories — on the condition that their identities remain secret.
“The fact that a technology company was trying to surveil me makes me want to cover them more, not less”
— Emily Baker-White, tech reporter at Forbes
For journalists, protecting a vulnerable source is partly about protecting the flow of information. But the bigger, more important concern is that “somebody has entrusted their safety and livelihood to you — and that's a pretty solemn, heavy responsibility,” says Glenn Smith, watchdog and public service editor for The Post & Courier of Charleston, S.C. and part of the investigative team that won the 2015 Pulitzer Prize for Public Service for a story about the extreme history of domestic violence and the murder of women in the state.
The same technologies that have dramatically expanded the universe of how journalists connect with confidential sources can also imperil their ability to keep the identity of those sources concealed. Electronic communications can be silently monitored by governments, businesses, or even criminal enterprises. And of course, there’s still the old-fashioned way: just having someone tailed. As authoritarianism has spread around the globe, repressive governments in places like El Salvador, Hungary, and Burma have weaponized tracking of reporters with an eye to intimidating muckrakers and suppressing critics and free speech advocates. The spying can extend to unearthing, pursuing, and punishing confidential sources that help journalists break stories.
Bottom line, “In the surveillance age, the more you can stay offline, basically the safer you and your source will be,” says Ela Stapley, digital security advisor for the Committee to Protect Journalists.
While some journalists go to great lengths to follow that advice, in many cases, technology is simply the shortest route between tip and publication. As the threat of surveillance has ramped up, so have the precautions journalists use to protect the identity of their tipsters — or try to do so.
Like Snowden, former F.B.I. official Mark Felt ultimately chose to reveal himself as “Deep Throat” — the source that helped The Washington Post’s Bob Woodward and Carl Bernstein break the Watergate break-in story. The Post protected Felt’s anonymity for more than 30 years until he went public; while actively chasing the story, they took now-legendary precautions (late-night parking garage meetings with no notetaking, coded signals, and more) to do so.
Of course, the Watergate era was a profoundly different time. Reporters and sources weren’t exchanging emails and texts in 1972, or carrying multiple smartphones, or communicating via text and video chat.
In a more recent case, former National Security Agency linguist Reality Winner served prison time after printing out a secret document detailing Russian attacks on the U.S. voting system and anonymously mailing it to The Intercept. An Intercept reporter sent a copy of the of the report to the N.S.A.’s media office — with a crease in it showing it had been printed out. Only a few N.S.A. workers had printed the report, helping them identify Winner. After the incident, then Editor-in-Chief Betsy Reed wrote that “at several points in the editorial process, our practices fell short of the standards to which we hold ourselves for minimizing the risks of source exposure when handling anonymously provided materials.”
In that case, the source’s cover may have been blown during an investigation of their actions by their own workplace or agency as well as a lack of precautions by a media outlet. In other cases, an investigative reporter may be the one under investigation.
Two years ago, a media consortium coordinated by Forbidden Stories and supported by Amnesty International launched The Pegasus Project. The project used a massive document leak to show that nearly 200 journalists worldwide had been targeted for cybersurveillance via an Israeli firm called NSO Group, which created the Pegasus spyware and counted both autocratic and democratic governments among its clients.
“If you read [case] studies of very famous whistleblowers,” such as Snowden and former Army intelligence analyst Chelsea Manning, “a lot of their initial contact with journalists was very frustrating, because they were trying to find a secure way to get in contact with journalists and journalists were not responding, basically, or did not have the tech knowledge in order to be able to respond safely,” CPJ’s Stapley says. “Journalists are lacking training in how to manage sensitive communications with possible whistleblowers and also [on] receiving of documents.”
Today, many more outlets provide that training to reporters — and publicize secure contact methods for tipsters.
Some, like The Washington Post, use SecureDrop, an encrypted, anonymized “open source whistleblower submission system” managed by the Freedom of the Press Foundation. The Post’s SecureDrop instructions are explicit, starting with, “Go to a place with a public Internet connection, one that you don't normally frequent.” The system gives sources a codename no one else knows — not even The Post.
ProPublica, in addition to using SecureDrop, offers a whole page of ways to reach reporters, including via email, an online form, Signal, and snail mail, noting that “U.S. postal mail without a return address is one of the most secure ways to communicate. Authorities would need a warrant to intercept and open it in transit.”
Ultimately, no system is foolproof, and no device can be 100 percent secure.
Ben Hubbard of The New York Times, who has spent years covering Saudi Arabia and wrote a book about strongman Crown Prince Mohammed bin Salman laid out his “unnerving” experiences with being hacked in a 2021 piece on how he was targeted repeatedly, most likely with Pegasus, even though he hadn’t clicked any suspicious links. Despite the help of Citizen Lab, a University of Toronto institute that studies spyware, the identity and motivation of his hackers proved elusive.
“Did they steal my contacts so they could arrest my sources? Comb through my messages to see who I’d talked to? Troll through photos of my family at the beach? Only the hackers knew,” Hubbard wrote. “As far as I know, no harm has come to any of my sources because of information that may have been stolen from my phone. But the uncertainty was enough to make me lose sleep.”
Large, well-funded media outlets with robust security protocols are acutely aware that even the best defenses aren’t impregnable. Much of what they do to try to head off intrusions is also applicable to medium and small outfits and even in everyday life.
Neena Kapur, director of information security at The Times, says that as a baseline, it’s good to think about “using secure communication tools like Signal that are end-to-end encrypted” and setting messages to “disappear” (or auto-delete) periodically, as well as using two-factor authentication, which requires both a password and a uniquely generated code to get into accounts and apps.
“It's very easy to just [go] hardcore security immediately,” but as a practical matter for everyday work, extreme measures like consistently using burner phones or toting a Faraday bag, which isolates mobiles from external communication, won’t be effective “90 percent of the time, and will actually make people’s lives a lot harder,” Kapur says. “You can’t operate on code red all the time.” Overprotection can even be a disadvantage at times, she notes: You can protect your SIM card with a PIN — but if you forget your code when you need to make an emergency call, you could be in trouble.
There are practical and relatively easy security measures any reporter can take, she says, such as making sure VPNs are trustworthy and limiting the amount of data you carry around in your devices. Something as simple as completely powering down your mobile — something just four percent of Americans said they did “frequently” in a 2015 Pew study — can remove some forms of spyware from your device.
And reporters may choose encrypted messaging apps and email — but what about the software they use for taking notes and writing drafts? There are apps for that, such as one called Bear, that feature end-to-end encryption. There’s also the basic need to physically secure your phone (and when prudent, disable Face ID, so that if someone grabs your cell, they can’t unlock it and get access to everything by just holding it up in front of you).
Broadly, Kapur and other experts advocate for figuring out a risk model and planning accordingly. And a lot of that calculation depends on the subject matter and the location of the reporting and the sources.
Reporters in Latin America, for example, have long been aware of the dangers of hacking and spying by hostile, secretive governments. “We live looking over our shoulders,” says Nelson Rauda, a reporter for El Faro, the first digital-native news site of El Salvador.
Rauda was already taking myriad measures to secure his information when he found out that he and a score of colleagues had been targeted with the Pegasus spyware between June 2020 and November 2022. “I just felt like a clown,” he says. “All of that — what for, if they were already tapping into our [phones]?”
These days, Rauda stays as offline as he can. “I buy an agenda, like my father does and like my grandfather did, [to log] my appointments, because I feel safer with a notebook that I carry all the time with me than having all of my things in a Google calendar.” When he arranges a face-to-face talk with a source, he keeps the message vague: “I’ll just call them or text them to say, ‘Hey, let’s meet — same time, same place,’ and they already know where.” Now that his phone has been “weaponized” against him, he feels safer not bringing it to source meetings at all.
Some media outlets encourage sources to share information in certain ways, but Rauda doesn’t think trying to steer them toward more secure tech always helps. “I had a 60-year-old judge who was my source. How do I teach this person to download Signal and talk to me using that if he barely uses WhatsApp? So for me, technological-based solutions are in a lot of cases worthless,” Rauda says. “I just try [to] find a way to live and manage situations [off] the grid.”
After El Faro found out about the Pegasus intrusion, the site in January 2022 ran a detailed investigative piece explaining what it knew. The next day, “A source called me and said, ‘Hey, Nelson, I read the report. Now I know why my wife was fired from her government job,’” Rauda recalls. While Rauda’s still not sure the dismissal was directly linked to the sourcing, “I was devastated. [I] was feeling so guilty. [I’m] a victim in this case, but I felt it had been my fault.”
El Faro also spoke directly to its sources in a separate editorial, addressing the gravity of the exposure with a promise — and a prediction: “We will continue developing strategies to offer more and better guarantees to those who confide in us. That will in turn provoke even more intense surveillance from the regime and greater attacks against our work.”
Reporting goes on, but sources are leery. There’s a real cost to that, Rauda says. “It’s harder. It’s more expensive, because nowadays to talk to certain people, we have [to] rent hotel rooms or Airbnbs so we can meet people. [We’ve] had to go out of the country to meet people, [because] that’s the only way that they will talk to us. But we’re still doing it,” he says.
El Salvador isn’t even the biggest user of Pegasus spyware. That dubious honor goes to Mexico, per an April report in The New York Times.
Prominent Mexican investigative journalist Carmen Aristegui felt “a mixture of anger and powerlessness” when she learned she and her family had been spied on with Pegasus in 2015 and 2016. According to a Citizen Lab investigation, Aristegui received more than 20 texts that “included NSO links purporting to come from: the U.S. Embassy in Mexico, Amber Alerts, colleagues, people in her personal life, her bank, phone company, and notifications of kidnappings.” Her son, a minor at the time, was also intensely targeted. As in the case of many types of malware, the texts included links meant to give spies access to and control over the phone.
Since then, “One of the biggest problems is the loss of contact with some of our sources [who], once this scandal became known, distanced themselves, because there was no way we could guarantee the security of their information,” says Aristegui, recipient of the 2023 IPI-IMS World Press Freedom Hero award for “decades of fearless reporting on corruption in Mexico.”
“Nowadays to talk to certain people, we have [to] rent hotel rooms or Airbnbs so we can meet people. [We’ve] had to go out of the country to meet people, [because] that’s the only way that they will talk to us”
— Nelson Rauda, reporter for El Faro
Other sources continue to cooperate, albeit “in a more cautious manner,” she says. While Aristegui continues to receive information electronically, she exercises caution “primarily by trying to maximize direct contact with people face-to-face rather than telephone or email or WhatsApp or anything that could be spied on,” she says.
“We even go to the extreme that when we get together face-to-face, we take all our cell phones and we put them in a box and we put this box inside a refrigerator or a microwave, or we take it somewhere far away from where we’re talking,” she adds. A Faraday bag, which has the same kind of metal mesh as the door of a microwave, is another option.
In March, President Joe Biden signed an executive order prohibiting the federal government from using commercial spyware, having already blacklisted NSO in 2021. As The Times reported, the administration said NSO’s products were “being abused by authoritarian nations” to go after journalists, human rights advocates, and politicians. TechCrunch noted that Biden administration officials voiced concern that democratic governments had also adopted the technology and that “the United States was trying to get ahead of the problem and set standards for other governments and its allies.” But it’s not just foreign malware reporters have to worry about. The risk of surveillance for American journalists may still well originate at home — with their own government agencies — under federal espionage laws.
In 2013, the Associated Press reported that the Justice Department had secretly obtained two months’ worth of phone records for AP reporters and editors — a move then-AP President Gary Pruitt called an "unprecedented intrusion" into newsgathering. Justice Department officials didn’t want to reveal why it wanted the information, which included records of calls to and from AP offices and reporters’ personal phones. But as AP noted that at the time, the government was investigating “who may have leaked information contained in [an] AP story about a foiled terror plot.” Pruitt said the case had a chilling effect on sources’ willingness to speak to reporters.
That same year it came out that the Obama Administration had extensively tracked reporter James Rosen when he was chief Washington correspondent for Fox, examining his phone calls, personal email, and entrances and exits from the State Department. Rosen was even labeled a co-conspirator with the person who leaked the information he reported about North Korea. While he ultimately wasn’t charged with a crime, The New Yorker pointed out, it was “unprecedented for the government, in an official court document, to accuse a reporter of breaking the law for conducting the routine business of reporting on government secrets.” A Washington Post report at the time also questioned whether the conspiracy claim was “little more than pretext to seize his e-mails to build their case against the suspected leaker.”
In 2021, during the administration of former President Donald Trump, the Justice Department was again revealed to have obtained the phone and email records of journalists from The Washington Post, The New York Times, and CNN. The reporters were working on a range of stories from years earlier that had related to the federal government and Russian interference in U.S. elections.
That outlets learned sometimes years after the fact about the surveillance underscores that “there are scenarios where records that could disclose the identity of a confidential source can be obtained by governments, and you wouldn't even know it. And [that's] the real kind of danger zone,” says Gabe Rottman, director of the Reporters Committee's Technology and Press Freedom Project.
“If your [phone] records are handed over to the Justice Department and you're not notified, you can't go to court [to] negotiate over the scope of the subpoena [or] try and quash the subpoena as unreasonable,” Rottman says. A broad records grab could reveal the identities of multiple confidential sources and “give the government insight into what stories you're chasing.”
To that end, Rottman says, the most secure technologies “are the ones that retain the least information,” so that if a reporter is “served with a subpoena, or if they're hacked by a nefarious actor, [they] just don't have the information in their possession.” In some cases, he says, information can be protected under reporter’s privilege statutes or the Privacy Protection Act, which “limits not just federal officials, but state and local officials, in terms of using warrants to get work product or documentary material from journalists.”
But even with such shield laws, there’s always what Rottman calls that “self-help” dimension to protecting source identities and other sensitive information. “The most important thing to do,” he says, “is to be both cognizant of, and exercise control over, [what] digital information you create as part of your reporting.”
It’s not just foreign and federal governments that go after reporters — nor is the cloak and dagger intrigue limited to the national and international arenas.
When Florida Power & Light was gearing up to try to buy Jacksonville’s local utility company for $11 billion, Nate Monroe, a metro columnist for The Florida Times-Union, dove into critical reporting on the deal: “It was in a lot of ways a local story, [but] there were big stakes,” he says.
As Monroe was watching, he was being watched.
As the Times-Union, Orlando Sentinel, and non-profit news consortium Floodlight reported, a consulting firm working with FPL had a 72-page dossier on Monroe that “delved into his financial history, his political party affiliation, the names and phone numbers of his relatives and neighbors, his unredacted Social Security number, the make of his car, his driver’s license and license plate numbers, and places where he’d lived since childhood.” He was photographed without his knowledge. He was tracked — even, apparently, while out of town for a friend’s wedding five hours away from Jacksonville.
Monroe found out about the surveillance from — who else? — an anonymous tipster.
“I believe that there were more documents about the surveillance stuff that we just never saw,” Monroe says. “I don't know if they were looking for whether I was meeting with [confidential] sources.”
He says he hasn’t lost his sources en masse, but these days, Monroe tries to remain mindful of his surroundings. “If some consulting firm is [using] badass Israeli software to tap into my phone … I don't have the bandwidth to control for that,” he says. But “going to the City Hall watering hole to meet someone for a happy hour is not a thing I do anymore. I try to think about places that are a little bit off the beaten path.” He sets his phone to regularly delete messages, preserving only what he really needs, and uses encrypted apps like Signal.
“When you've been followed, I promise you, you're gonna look in the rearview mirror when you're going to meet a source. You're gonna give it an extra couple looks. And you're not gonna leave your phone at the bar when you go to the bathroom,” he says.
Monroe also takes pains to be direct with tipsters about the risk they’re taking — and his ability to mitigate it.
“This does not always work to our — and by our, I mean journalists’ — benefit, but now when I talk to confidential sources, particularly for the first time, I try to be really clear with them about what it is they'd be agreeing to do by being a source, and to be clear that I cannot ensure that they will be protected because there are things out of my control,” he says. “I think one way to protect people is to be clear to them about what the risks to them are that we cannot protect them from.”
Baker-White, the Forbes reporter tracked by ByteDance, agrees that having that kind of talk up front is vital.
“Every source's fears and every source's needs are going to be different. Sources can be scared of different things. They can be scared of foreign governments, they can be scared of the U.S. government, they can be scared of private companies, they can be scared of private citizens. And you really have to work with [them] to understand what they are afraid of [or] what the potential threats are against them,” she says.
In March, Baker-White reported for Forbes that the FBI and Justice Department had launched an investigation into ByteDance’s use of the app to surveil journalists, including her. She says as far as she knows, none of her sensitive contacts came to harm because of the monitoring, and she’s continued to report deeply on the company — including with help from confidential sources.
“The fact that a technology company was trying to surveil me makes me want to cover them more, not less — and I think covering surveillance is an important part of the way everybody understands the risk,” she says. “Maybe if we have more reporting, we'll get less surveillance.”
