What strategies can you use to protect sensitive information in your reporting?

1 Encrypt your devices

One of the first steps to protect your sensitive information is to encrypt your devices, such as your laptop, smartphone, tablet, or external hard drive. Encryption is a process that scrambles your data and makes it unreadable without a password or a key. This way, if your device is lost, stolen, or seized, your information will not be easily accessible by anyone who does not have the encryption key. You can use built-in encryption features on your devices, such as BitLocker for Windows or FileVault for Mac, or install third-party encryption software, such as VeraCrypt or Cryptomator.

2 Use secure communication tools

Another strategy to protect your sensitive information is to use secure communication tools that offer end-to-end encryption, meaning that only you and your intended recipient can read the messages. Some examples of secure communication tools are Signal, Wire, or Threema for text messages and calls; ProtonMail, Tutanota, or Mailfence for emails; and OnionShare, Firefox Send, or WeTransfer for file transfers. These tools prevent anyone, including the service providers, from intercepting, monitoring, or modifying your communication.

3 Avoid public or untrusted networks

A third strategy to protect your sensitive information is to avoid using public or untrusted networks, such as Wi-Fi hotspots in cafes, hotels, or airports, or networks that belong to someone you do not know or trust. These networks are often insecure and vulnerable to hacking, snooping, or spoofing. If you have to use them, you should always use a virtual private network (VPN) service that encrypts your internet traffic and hides your online activity from your internet service provider (ISP) or anyone else on the network. You can also use Tor Browser, which anonymizes your browsing and routes your traffic through a network of volunteer servers around the world.

4 Delete or destroy your data

A fourth strategy to protect your sensitive information is to delete or destroy your data when you no longer need it or when you face a threat of confiscation or compromise. Deleting your data means erasing it from your devices or online accounts using secure deletion tools, such as Eraser, BleachBit, or Shredder, that overwrite your data with random patterns and make it unrecoverable. Destroying your data means physically damaging your devices or storage media, such as smashing, burning, or shredding them, so that they cannot be repaired or accessed.

5 Protect your sources

A fifth strategy to protect your sensitive information is to protect your sources, especially those who are vulnerable, anonymous, or confidential. You should respect your sources' wishes and expectations, and not reveal their identities or locations without their consent. You should also verify your sources' credibility and reliability, and not fall for misinformation or disinformation. You should communicate with your sources using secure tools, and avoid leaving any digital traces that could expose them. You should also educate your sources on how to protect themselves and their information, and provide them with support and assistance if needed.

6 Update your security

A sixth strategy to protect your sensitive information is to update your security regularly and frequently. You should always keep your devices, software, and apps updated with the latest security patches and fixes that address any vulnerabilities or bugs that could be exploited by hackers or malware. You should also use strong and unique passwords for your devices and accounts, and change them periodically. You should also use two-factor authentication (2FA) or multi-factor authentication (MFA) whenever possible, which adds an extra layer of security by requiring a code or a device in addition to your password to access your accounts.

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?