As a journalist, you might rely on social media to find, contact, and communicate with your sources. But how can you ensure that your interactions are secure and confidential, and that you don't compromise your sources' safety or credibility? In this article, we'll share some tips and tools to help you protect your sources on social media.
Not all social media platforms are equally trustworthy when it comes to privacy and security. Some might collect and share your data with third parties, others might be vulnerable to hacking or surveillance. Before you use a platform to communicate with your sources, do some research on its policies, features, and reputation. Look for platforms that offer encryption, anonymity, and data protection. For example, you might use Signal, Telegram, or Wire for messaging, or ProtonMail, Tutanota, or Mailfence for email.
Avoid mainstream SM platforms, as their job is to make money from your data. Signal is (probably) the most secure encrypted messaging app. Telegram is good if you select the right options, otherwise, they retain the encryption keys, so could potentially read messages. WhatsApp offers end-to-end encryption, but not to business accounts. Also owned by facebook! so I'd question what happens to your data. Anonymization (protecting the source) is as important as encryption. Tools like TOR make it difficult to trace the session's origin. Some news outlets offer anonymous information submission eg Guardian's SecureDrop Make sure you absolutely understand how the platform works before you use it.
Encrypted messaging apps like Signal, WhatsApp, or Telegram offer end-to-end encryption, which means your conversations are secure and not easily accessible to third parties. Secure Your Devices: Ensure your devices, including smartphones and computers, are protected with strong passwords, PINs, or biometric authentication methods. Encourage your sources to use pseudonyms or anonymous social media accounts when communicating with you. Avoid using any personally identifiable information in your communications. Inform your sources about the potential risks of communicating through social media and the importance of being cautious with the information they share.
One of the challenges of using social media to find sources is that you might not know who you are really talking to. Fake accounts, bots, trolls, and impostors are common on many platforms, and they might try to deceive you or feed you false information. To avoid falling for scams or hoaxes, you need to verify your sources' identity and credibility. You can do this by asking for proof of identity, checking their online presence and activity, and cross-referencing their information with other sources.
Recommend that your sources use platforms that offer increased privacy features, such as private messaging, end-to-end encryption, and the ability to post anonymously if necessary. Before engaging with a source on social media, confirm their identity through multiple channels, such as phone calls or face-to-face meetings, if possible. Avoid sharing sensitive information about your sources on social media platforms, and use secure methods of data transfer if necessary.
Another way to protect your sources on social media is to use strong passwords and secure devices. Your passwords should be long, complex, and unique for each platform. You can use a password manager to generate and store them safely. Your devices should be updated, encrypted, and protected by antivirus software. You should also avoid using public Wi-Fi or shared computers to access your social media accounts, as they might expose your data to hackers or snoops.
Protect your own social media accounts with strong, unique passwords, and enable two-factor authentication (2FA) to prevent unauthorized access. Turn off location services on your device to prevent revealing your location and that of your sources in your posts. Use Encrypted Emails: When sharing documents or information with sources, use encrypted email services like ProtonMail to add an extra layer of security. Keep your devices and apps updated to ensure you have the latest security patches and bug fixes. Review your social media accounts and assess what information about your sources might be inadvertently revealed through your posts, comments, or followers.
Avoid public wifi. If a hacker positions themselves between you device and the public WiFi access point, they can spoof a WiFi where they can intercept and read your traffic. ￡100 pen-test tool like pineapple will do this. Even web browsing over public wifi is questionable. Is possible for a spoofed access point to terminate your "secure" HTTPS and read your traffic. Years ago, when facebook refused to encrypt web traffic there was Firesheep - a browser plugin to intercept facebook traffic on public WiFi. If you must use a laptop on public wifi, use a VPN, and check the tunnel endpoint is where you think is it! Best option - tether your laptop to your mobile phone and get a good data plan.
Even if you use a secure platform and device, your messages with your sources might still be stored on the platform's servers or your device's memory. This means that they could be accessed by law enforcement, hackers, or anyone who gets hold of your device. To reduce this risk, you should delete or archive your messages as soon as possible. Some platforms allow you to set a timer for your messages to self-destruct, or to enable a disappearing mode. You can also use apps like Signal or Telegram to delete or archive your messages manually.
Consider archiving or deleting sensitive conversations when they are no longer needed and keep your direct messages or conversations as private as possible. Be aware of legal protections for journalists and their sources in your jurisdiction, and understand your rights and responsibilities. Consult with legal experts on how to best protect your sources while complying with the law.
Finally, you should educate your sources on how to protect themselves on social media. Your sources might not be aware of the risks or the best practices of using social media to communicate with journalists. You should inform them about the platform's privacy and security features, the importance of using secure passwords and devices, and the need to delete or archive their messages. You should also advise them to avoid posting or sharing anything that might reveal their identity or location, or that might contradict their information.
Source protection is of utmost importance in journalism. Always consider the potential consequences for your sources and take appropriate measures to ensure their safety and confidentiality when using social media as a communication channel.
Make sure you absolutely understand how the platform works before you use it. Unfortunately, this might mean some technical brain-ache, but if you don't select the right options (usually this means dont use the default settings), your security can be compromised. When anonymizing browsers first came out, many people used them thinking they did encryption too. The clue was in the title - they only hid the message origin, not the message contents. Now they often encrypt and anonymise. But the message is, if you dont understand how it works you could be opening yourself to bigger troubles.