How can you ensure your sources remain confidential in digital journalism?

Encryption is great for protecting the content of your messages. Used properly, an encrypted app like Signal is orders of magnitude more secure than email or SMS. Bear in mind, however, that if your device is compromised (e.g. infected with spyware) encryption will not necessarily protect the content of your messages. If you can read them on your device, anyone who has compromised that device can likely read them as well. You also need to consider collateral data. Have you created a contact entry for this sensitive source? The contacts database used with your phone or email program may not be secure. When you schedule a meeting with this source, do you put it on yr calendar? How do you refer to them in emails or calls with your editor?

Encryption is a fundamental method for securing digital communications, ensuring that information shared between journalists and their sources remains confidential. Use encryption services to encrypt mail, use secured messaging such as the Signal, and as with my previous responses, secured file sharing by granting access only to those who need the access. Also, add the levels of access i.e. read-only or edit capability. beware though about giving edit access to resources to maintain the integrity of the documents.

Don't hand them out publicly or mention them. Your security is in your hands. Other ways of being secure are to not answer emails you are not expecting, or know the originator. Another way is to password protect your documents and only share with intended people you want to see your message. Typically everyone has a VPN system on their PC as well.

One can not ensure that your source remains confidential but you can protect your data. By using file, Thumb drive, and hard disk encryption. A court can rule that you release your files and fine you until you do. If you want your files secure do not store them in a digital form. Maintain an encrypted paper file in your safe.

Encryption is a great tool to secure your digital communication. Platforms like Signal or secure email services provide end-to-end encryption, making it more difficult for third parties to intercept communications.

The easiest way to get anonymity in one package is by leveraging TAILS linux distribution. If anonymity is top priority, I’d recommend using it on a Live media too. Note that VPN and Tor do not necessarily mix well when it comes to ensuring anonymity (you may reference Tor’s official docs on this). Also if you want to conceal usage of Tor from your ISP, you can leverage Tor Bridges.

In the old days, journalism involved researching, interviewing, reporting, and producing/publishing reports in magazines or newspapers. These need to be secured in various manual ways. Digital journalism is the same, but this time publishing through digital platforms such as websites, social media, and podcasts. This means protecting the confidentiality of the source is equally important, as susceptible information could put sources at risk if exposed. To maintain source confidentiality use strong unique passwords, combined with MFA. It adds layers of security, making unauthorized access to sensitive information significantly harder. In terms of governance, the Access Rights controls in various information security standards apply.

I would highly recommend using a password vault, such as BitWarden or Keepass, or the one embedded in your browser. You then only need one strong password to access the vault. Such tools provide a nice integration in most applications and OS, they generate long password you don't ever have to input or remember.

Another good option is Steganography, that allows to conceal a file into another. OpenStego seems to be a reliable and well established solution. But what about not needing to do all of this? Ideally you want to run on a Linux USB stick. Unplug the stick, everything is gone, no data is stored neither on the USB key nor on the machine you used.

I always did it the old fashioned way...by keeping my word. Sure, we didn't communicate via email or text or mail. And, followed 'loose lips sink ships," as a mantra. When sources tip me, I still needed to verify. But I knew which direction to look, and who I could check with, and what to look at. Technology is great. But never forget, the bottom line is low tech: keeping my word. Integrity.

Educating your sources: Educating your sources about digital security is a critical aspect of protecting their confidentiality and ensuring the integrity of the journalistic process. Advise them to use safe and secure document-sharing platforms that are access-controlled. Phishing can also make them a victim to disclose confidential sources, hence creating cybersecurity awareness to the sources is also important.

There are several ways to protect sources in digital journalism: 1. Use encryption: use encrypted communication tools such as Signal or ProtonMail to securely communicate with sources. 2. Secure your devices 3. Use secure connections 4. Protect our identities 5. Store information securely 6. Limit access: to those who have a legitimate need to know and limit the number of people who have access l 7. Remove identification metadata In short, I would go ‘old skol’ … that is, I’ll go non-digital, analog.

Stay away from creating a digital record and go analog for those sensitive discussions/interviews when you need to shield a source: - Use the phone (not text, not Zoom, not email, not Teams, etc.) or meet in person whenever practical. - Use pen/paper for taking notes. - Don't record conversations digitally; if you must record, use an old micro-cassette recorder. - Don't keep notes on your computer and clear your mobile phone records regularly. - Write your story completely on paper. When it's complete, transfer it to your computer and send to your editor immediately.

Stay off the grid as much as possible (no GPS, no phone with a removable battery - have many for different use cases). Do not use them connected alongside your "official" everyday phone. "Keep them separated" [The Offsprings ™©] Only connect when needed: connect-transfert-disconnect. Only use off grid devices for digital pieces. Be very diligent on what you use to do what (do not login on your work phone for personal stuff). Use a Linux USB thumb-drive to leave as few clues as possible.