Accessing information is challenging enough, but keeping the information safe, as well as ourselves, is becoming increasingly difficult.
Most journalists don’t work in war zones, and most won’t be gunned down in their offices by terrorists, as we witnessed in the horrific massacre of Charlie Hebdo journalists in Paris. But many reporters still receive threats or outright physical obstruction while trying to get and keep information.
Here are tips and resources for keeping you and your records safe when the stakes are high.
DATA PROTECTION
Keep confidential and important information on a flash drive, not a laptop hard drive. Find flash drives that are disguised as common objects (I’ve seen ChapStick and eraser flash drives) and load encryption software in case it’s lost. Don’t use public computers, and turn off your computer when you aren’t using it. Come up with a password that is a phrase you can remember, mixed with random characters. Save data on CDs and store them in old music CD cases.
ONLINE SAFETY
Attackers can infect your computer or phone with malicious software to give them access to your computer files and communications. Urge your company to invest in digital security and training for the IT staff to help reporters with all the gizmos they don’t have time to learn (e.g. Tor, PGP, Tails, SecureDrop).
SOURCE PROTECTION
Sometimes the best public records are provided by confidential sources and leakers who you want to protect. If they’re exposed they could be fired, or worse. Use codes for confidential sources in your notes. Use secure email or GoPhones to communicate. Think beyond your immediate tools on how you might be tracked and linked with a source, such as public video footage or credit card activity. Also, it is important to know your state’s shield law protections so you don’t promise confidentiality that the law can’t deliver.
SUBSTITUTE FILES
OK, you have some important documents or data. How do you keep it safe from theft or being strong-armed, perhaps by a police officer at a crime scene or protest? Keep dummy thumb drives, notebooks or photo cards containing useless information so if you are forced to hand over your notes by a police officer, official or thug, you can do so without disclosing the information that is really important.
HIDDEN METADATAMetadata is the information kept behind the scenes of a file that tell stories about the files, including who created it, when it was created and when it was last changed (right-click on a file icon and choose “properties”). This can give away sources or other information to those who might want to learn about your reporting processes. Clear the properties on sensitive files so it doesn’t show up. Note that reporters can ask for the original electronic files of government officials and then view the metadata. In Arizona, Washington and other states, requesters have a legal right to see metadata.
FORCED SEARCHES
In the United States, federal officials are not allowed to search newsrooms willy-nilly, thanks to the Privacy Protection Act of 1980. Many states have their own laws further limiting state and local searches. Generally, officials need warrants to do any search; make sure a lawyer reviews the warrant. The problem is the PATRIOT Act appears to have emboldened some officials into thinking they have greater latitude for spying on journalists, including getting their phone records secretly, which they have done through Foreign Intelligence Surveillance Act warrants.
The bottom line is that with the proliferation of information digitally comes new ways for records to be seen by others, and communications to be monitored. For a lot of journalists’ day-to-day work it doesn’t matter too much; but when it counts, take precautions and keep it safe.
David Cuillier, SPJ’s Freedom of Information Committee chairman and immediate past president, is associate professor and director of the University of Arizona School of Journalism, a former newspaper reporter and editor from the Pacific Northwest, and co-author with Charles N. Davis of “The Art of Access: Strategies for Acquiring Public Records.” Email: spjdave@yahoo.com
Information Security Resources
• Committee to Protect Journalists Security Guide,
tinyurl.com/CPJSecurityGuide
• The News Media and The Law fall 2014 issue on digital security
tinyurl.com/RCFPMediaLawResources
• Reporters Committee for Freedom of the Press guide to shield law protections
tinyurl.com/RCFPShieldLawGuide
• Electronic Frontier Foundation Surveillance Self-Defense
ssd.eff.org/en
• Freedom of the Press Foundation encryption guide
• freedom.press/encryption-works
• International Center for Journalists Digital and Mobile Security Guide in Mexico tinyurl.com/ICFJDigitalSecurity
