Protecting sources and contacts: Five digital security tips for journalists

It was 4 a.m. when reporter John Njoroge and his family were awoken by the sound of shattering glass. Ugandan military intelligence officers were smashing windows, trying to break into their house.

"My son [woke] up screaming and my wife was scared," said Njoroge, then a journalist with the fortnightly news magazine, "The Independent".

The military ransacked Njoroge's home, searching for documents related to a story the magazine had published about torture carried out by Ugandan intelligence forces.

A few days later, the officers turned up at the office of "The Independent" and confiscated all the electronic devices and files they could find, including computers, CDs and videotaped interviews. Njoroge, along with the magazine's publisher and editor were arrested (the first of several times) and later charged with sedition (charges which were eventually dropped).

The experience, which happened several years ago, strengthened Njoroge's resolve to continue working as an investigative journalist.

It also made him realize he had to keep his information and his contacts safe, leading Njoroge to sign up for a digital security workshop at Uganda's Hub for Investigative Media.

Since its founding three years ago, the hub has trained more than 300 journalists and human rights defenders on digital security.

One of the hub's trainers, Ronald (who doesn't use his last name for safety reasons) has these five tips on how journalists can help protect their sources.

1. Understand that even if you think you have nothing to hide, you have a duty to protect colleagues and sources 

Protest against the closure of Ugandan newspaper Daily Monitor in Kampala, Uganda, in 2013

When he's conducting workshops, Ronald asks journalists to think about the people they are communicating with. "Are they comfortable with you letting out the information?" he asks. He says no one ever says "yes".

To underline the importance of digital safety, Ronald uses the analogy of someone driving down a road. A driver might feel comfortable in their own car, he says, but if they don't care about the people driving in front of them, they could end up accidentally killing them. 

Another analogy that works well, he says, is comparing digital safety to home security. "You don't let everyone enter your home anytime they feel like it and [who] start looking through your cupboards," he says.

2. Don't just click on links in emails – they could be malicious 

Although many journalists are concerned about state surveillance, the biggest online threat, says Ronald, are phishing emails hoping to hook a person's password or other personal information. The email messages can be so sophisticated that when they ask people to click on a link, the request often appears to be legitimate.

A message might be along the lines of "I saw you cover human rights topics, here's an article you might find interesting" or it might supposedly come from a person's bank saying there has been unusual activity in their account. The link then takes them to a fake website or page asking them to log in with their password or reveal other personal information. Hackers can then access – and steal - all the data and information stored there. 

3. Think about how and where to store your contacts' details so that you don't put your contacts at risk

A Congolese refugee in Uganda listens to the radio

Journalists and human rights defenders need to think seriously about the consequences if others access their email accounts or phones, says Ronald, because that's where they usually save their contacts' details. 

Ronald uses the example of a contact with sensitive information about oil – a hot issue in Uganda. If a journalist adds that person's details to their contact list – and especially if it is a long list – they might put the word "oil" behind the person's name. This way, the journalist can find it more easily.

But journalists and human rights defenders should never do this because it makes it easier for authorities to track down the contact, as well. 

Journalists also need to consider whether their phones (or anywhere else others can generally access) are the best place to store details because it puts the contact at greater risk.

4. Think about how to communicate with sources

Journalists need to be clear on how they will communicate with, and receive information from, a source, especially if that person is dealing with sensitive information, says Ronald. 

A first step, he stresses, is for journalists to explain how sources can communicate securely before exchanging this information. 

Sources should be told not to exchange information using unencrypted emails as this information can be easily read. Phone calls should also take place over secure lines. If they are not, they should only be used for arranging a meeting place to talk. Find more about this here. 

5. Secure your communications with strong, safe passwords

Journalists should have strong passwords, change those passwords frequently, and add an extra layer of security by usingtwo-factor authentication to open their email account on any computer or device they use, says Ronald.

Warning: Digital safety is a tool, not a cure-all. 

"The tools are just like shoes," Ronald warns journalists. "If you wear them, they will cover your feet but they will not stop you from becoming tired when you [go for a] walk or go jogging. It's the mindset that matters, [that] will keep you safe, and not just the tool." 

Uganda's Hub for Investigative Media, together with support from DW Akademie, has trained more than 300 journalists, bloggers and human rights defenders on how to defend themselves online.

The hub has 24 journalists working as trainers and mentors. John Njoroge is now one of those mentors. He says given the training he received himself, he can now protect himself and his sources online, and navigate the Internet without the state apparatus knowing the details. Njoroge and his colleagues are determined to continue training other journalists on how to work safely.

Author: Asumpta Lattus, DW Akademie Country Coordinator, Uganda (hw)