How can journalists encrypt their digital communications to protect their sources?

While I wholeheartedly agree with the ethical and professional importance of protecting sources, I must push back on the claim that encryption renders those communications unassailably secure. It's a powerful tool, yes, but like any fortress, it has its vulnerabilities. If a government or criminal organisation wants to access and manipulate encrypted data all they have to do is get access to the device that has the decryption key. This can be done by forcing/compelling the person to access the decrypted data as it is commonly done in dictatorships or by legal threats. In the end encryption is only as strong as the human who hold the decryption key.

If we look at the question from the point of view of the source/whistleblower, journalist have to protect two important things; one is to prevent the identification of the source, i.e. the protection of personal data linked to the source. The other is the content of the sent message. The easiest way to solve these two aspects is for the journalist himself to provide a web-based interface, which the source can use from anywhere, and the web interface itself solves the encryption of the communication in the appropriate way. (suitable algorithm, sufficient key general ensuring 128 bit entropy, etc.) It is a much more complex question how the journalist protects the information collected, but I ran out of the allowed 750 chars...

Encrypting digital communications is essential for journalists to fulfill their professional obligations and ethical responsibilities. It safeguards the identity of confidential sources, preserves freedom of the press, and protects investigative work from external interference. By using encryption, journalists not only build trust with their sources but also adapt to digital threats and maintain the independence necessary for unbiased reporting. Overall, encryption is a crucial tool for ensuring the security, privacy, and integrity of journalism in the face of surveillance and privacy challenges.

Some contacts in the field of journalism, do not require secure communications, while others do not. Communications imply data moving between two parties, therefore online encryption is required. Best recommendation would be to utilize a VPN. For saving communications, offloading onto an encrypted device that may be secured via offline storage... lock box etc. Do not store sensitive data online. period.

Depending on the sensitivity and how classified the communication is,different modes of security or even encryption can be employed. A decision will then be made on what the level of encryption and from what point to what point should we have an encryption, especially when an end-to-end may not be used for the document when in transit.

As stated before encryption is only as strong as the human or device that holds the decrypted key. As it has been reported countless times everything from email to crypto has been accessed or stolen by simply accessing the device with the decrypted data and decryption key. This is usually done by going through the weakest point which is human vulnerability. So whilst having encrypted data protects the companies offering the service from any responsibility to what is heald or passed through the servers, it does not protect the end users as that is what is targeted by governments and criminals.

In safeguarding journalistic communications, it's crucial to encrypt various elements, including written messages, file transfers, voice communications, metadata, and device storage. Additionally, encrypting internet traffic and promoting secure browsing practices enhance overall digital security. The following are examples of content and traffic that absolutely needs to be encrypted: >Text Messages and Emails >File Transfers >Voice Communications >Metadata >Device Storage >Internet Traffic >Secure Browsing

Here are some tools and techniques to encrypt journalist communications: - Use messaging apps with end-to-end encryption, such as Signal or WhatsApp, for text messages. - Utilize encrypted email services like ProtonMail or Tutanota for secure email communication. - Use encrypted file-sharing platforms like SecureDrop for transferring sensitive documents. - Employ tools like VeraCrypt for encrypting files before sharing them. - Choose encrypted voice call apps such as Signal for secure conversations. - Enable device encryption features on laptops, smartphones, and other devices. - Use a reputable Virtual Private Network (VPN) to encrypt internet traffic. - Ensure the VPN service prioritizes privacy and does not log user activities.

I always say if it is made of 1s and 0s, someone somewhere can access it. The most sophisticated criminal gangs and also government spies never use digital communications for this exact reason. Most times it is more secure to go analogue and do all your communications in person or using paper.

By thoroughly considering the threat model, journalists can tailor their encryption practices to the specific risks they face. This approach helps create a robust security strategy that aligns with the realities of the journalistic environment and provides effective protection for sensitive communications and sources. Considering the threat model is a crucial step in designing an effective encryption strategy for journalist communications. A threat model involves identifying potential adversaries, their capabilities, and the likely scenarios in which an attack might occur. Journalists can consider the threat model when encrypting their communications by identifying potential adversaries and understanding their capabilities.

Protecting the confidentiality of the w-blower-journalist channel is one thing. It is a much more complex question how the journalist protects the information collected, where and how he/she works with it, and with whom he/she shares the data. The process followed without error is much more important than the selected specific cryptographic algorithm. As general advice, journalist should follow these rules: -keep the data on a lockable external data medium, which is encrypted at the disk level. - manage the data on a dedicated computer without an internet connection. - it is useful if the operating system is a virtual machine that always starts from a clean state, so that temporary files created during processing do not accumulate on it.

I agree that it is important to educate yourself on all the ways of encryption but once again it is also very important to understand the shortcomings of encryption. All these foundations offer courses on the latest tech and best digital practices for secure communication, but most of the time these are third party systems or open source projects that are vulnerable. But the main issue with these organisations is that they create a false sense of security to their attendees making them believe that technology will keep you secure. If you are a whistleblower or journalist certainly use these encryption tools to make first contact but then the absolute best practice is to come out of digital communication and instead meet face to face.

Journalists can tap into resources available from the Electronic Frontier Foundation (EFF), the Knowledgeflow Cybersafety Foundation (KCF) and the Media Cybersecurity Briefing (MCB from securityandprivacy.ca). Consider also: Online Courses and Training Workshops and Seminars Security and Privacy Guides Join Security Communities Read Books on Digital Security Follow Security Experts University Courses and Degrees Hands-On Practice Mentorship Programs Stay Informed through News Outlets Collaborate with IT Professionals Use Open Source Resources

Encryption is rarely the problem. Given how infrequent encrypted communications are, encrypted traffic stands out as something deserving further attention. In work with NGOs in this area, the concern is that sources in high risk areas will be coerced to give up the encryption keys - so encryption may actually increase the vulnerability of a source. What everyone is looking for is authentication of a message - the proof that a transmission really did come from a source out in the field, no matter what the originator address was. A long time ago projects existed to add authenticating information to a message in a subtle way (for example, Cryptorights Highfire), but I'm not sure what has happened to them - withered on the vine I think.

If you look at all the stories of exposed whistleblowers and private communications these always come from humans handing over their devices where the information is decrypted. Before you trust encryption just ask yourself the question: If I am strongarmed physically, can this information be accessed? If you want to take evidence to expose something then use non internet connected devices such as a digital camera and then pass the information by physically contacting the journalist and passing them the data on a physical SD card.