A source-protection plan should make confidentiality an incident-response objective: identify which sources and records are at risk, limit unnecessary exposure, assign decision-makers, and set safe ways to contain an intrusion and keep essential newsroom work running. The right controls depend on the newsroom’s systems, resources, likely adversaries, and jurisdictions; no single tool or universal legal framework fits every organization.
Start with the sources, risks, and consequences
Before choosing tools, map what could identify or endanger a source and how an attacker might obtain it. Assess risks to both the journalist and the source, including an adversary’s authority, resources, and technical capacity. The Committee to Protect Journalists (CPJ) recommends this kind of risk assessment in its 2021 guidance, “Digital and Physical Safety: Protecting Confidential Sources.”
As an Amazon Associate I earn from qualifying purchases.
Record the assessment in terms staff can use when making decisions:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Sources: Which people or groups require heightened confidentiality, and what could happen if they are identified?
- Information: Which messages, files, notes, contact details, metadata, or reporting records could reveal a source or story?
- Systems and people: Where is that information stored or transmitted, who can access it, and which devices or accounts are involved?
- Threats and context: Who might seek the information, what capabilities or authority might they have, and do travel, physical access, or changing reporting conditions alter the risk?
Revisit the assessment when a story, threat, source relationship, or reporting environment changes. The purpose is not to predict every attack, but to decide where the newsroom needs stronger safeguards and what to do if those safeguards fail.
#1 Best Overall
Assign authority before an incident
Write down who leads the response and who can make time-sensitive decisions. A plan is difficult to use if staff must work out during an intrusion who can isolate a system, notify leadership, or contact an affected source.
- Name a primary incident lead and a backup, along with the technical responders and the people who receive monitoring alerts.
- Identify editorial decision-makers, legal contacts, and the staff authorized to communicate with affected sources.
- Specify who can take a system offline or restrict access, and how that action is coordinated with editorial leadership and technical staff.
- Set an escalation trigger: for example, a suspected intrusion involving systems that hold source identities or reporting materials should reach the designated lead promptly.
- Arrange access to qualified technical and legal help appropriate to the newsroom’s size and jurisdiction, rather than waiting until an incident to find it.
CISA’s “Shields Up: Guidance for Corporate Leaders and CEOs” (published in 2021) advises including senior leadership in incident-response planning and practicing the plan. Its corporate guidance should be adapted to newsroom operations, but the underlying point is practical: technical containment, editorial judgment, and organizational decisions need a defined handoff.
Set communication and device practices for sensitive work
Agree in advance which channels staff may use for routine contact and which are appropriate for sensitive source conversations. CPJ recommends end-to-end encrypted messaging where possible, and advises considering dedicated devices for sensitive-source work. A dedicated device can reduce the mixing of sensitive work with everyday accounts and activity, but it adds setup, maintenance, and training requirements; choose practices that match the newsroom’s capacity and threat model.
Include a fallback channel and a way to escalate if the usual channel or a staff device may be compromised. If a source first contacts a journalist through a less secure service, do not assume that moving the conversation erases the earlier exposure. Avoid promising anonymity beyond what the newsroom’s actual workflow can support.
Device and account rules should cover who can access them, how access is protected, how sensitive work is separated where feasible, and how staff report loss or suspected compromise. Minimize unnecessary copies of source information. Treat metadata and access to devices as part of the confidentiality risk, not as separate technical details.
Control documents from receipt through deletion
Source protection depends on what happens to a document after it arrives as much as on the submission channel. Define how staff receive, review, export, store, retain, and delete sensitive material, including backups and copies in messaging apps.
- Receive: Use an approved intake route for the source’s risk level. Limit collection to material needed for reporting, and restrict who can see incoming submissions.
- Review: Specify where files may be opened and by whom. Consider whether document metadata or embedded details could identify a source, and avoid moving files to ordinary systems without a deliberate reason.
- Export or transfer: Set an approved method for any necessary transfer, with access limited to authorized staff. SecureDrop’s document-handling guidance describes using an encrypted USB export device, typically protected with VeraCrypt, when a digital copy must move from its isolated Secure Viewing Station to an everyday workstation. That is a workflow-specific measure, not a universal prescription.
- Retain and delete: Establish retention and deletion rules that fit the newsroom’s threat model. Include working copies, exports, backups, and messaging-app data so that deleting one visible copy does not leave an untracked duplicate.
CPJ cautions that deleting a message from an account may not remove copies held by a service provider. Treat deletion as one part of data handling, not proof that all traces have disappeared.
Free tools Windows power users keep installed
One-click scans. No signup required.
Prepare the response to a suspected compromise
The plan should address both a confirmed intrusion and a credible suspicion that a device, account, or environment holding sensitive reporting is compromised. SecureDrop’s installation guidance calls for monitoring and incident-response plans covering outages and a compromised environment. Adapt that discipline to the systems your newsroom actually uses.
- Escalate: Notify the named lead and technical responders through a channel that is not itself under suspicion. Bring in editorial leadership when source safety or publication decisions may be affected.
- Contain: Limit further access or exposure in coordination with the people authorized to isolate systems. Avoid improvised actions that could spread exposure or destroy information needed to understand the incident.
- Assess source risk: Determine which accounts, devices, records, or people may be affected. Have the designated editorial and technical leads assess possible source exposure, consulting legal counsel as appropriate.
- Preserve and investigate: Preserve enough evidence for an investigation while minimizing further access to source-identifying material. Use qualified technical help when the newsroom’s own capacity is insufficient.
- Communicate deliberately: Decide who may contact affected sources, what can safely be said, and whether any reporting or publishing activity needs to change. Do not make promises about exposure or anonymity that the facts cannot support.
- Recover and review: Restore affected services through the newsroom’s recovery process, then update the plan based on what failed, what worked, and any remaining source risk.
Keep essential newsroom work running
Identify the systems and workflows that support critical functions, such as publishing and communications, and map their dependencies. Decide which functions must be restored first and what safe fallback process staff can use if normal systems are unavailable. CISA recommends identifying systems that support critical functions and testing continuity so those functions can remain available following an intrusion.
A fallback should not simply recreate the same source-exposure risks on an improvised channel. Specify which work can continue safely, which source-related tasks should pause, who approves the fallback, and how staff return to normal operations once systems are trusted again.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Use exercises to make the plan usable
Run tabletop exercises with editorial, technical, and senior leadership. Work through a plausible scenario—such as an outage or suspected compromise involving a system used for sensitive reporting—and ask participants to follow the actual escalation, containment, source-assessment, and continuity steps. CISA recommends practicing incident plans through tabletop exercises.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →After each exercise or real incident, record where roles were unclear, alerts did not reach the right people, or a fallback created new risks. Update contact details, responsibilities, and procedures, then make sure staff know where the current plan lives and when to use it.
Best Value
Decide whether a submission platform fits the threat model
SecureDrop is an open-source whistleblower submission system used by media organizations. Its documentation describes sources and journalists connecting over Tor to dedicated, on-premises infrastructure, with a segmented network and a separate workstation process for handling submitted files. The documented design aims to limit metadata and exposure of decrypted files.
That architecture comes with operational requirements. SecureDrop’s installation guidance calls for dedicated physical servers, separation from the corporate network, a trusted hosting location, a monitoring plan, and incident-response plans for outages and compromised environments. Installation and use also require operational security practices, technical setup, and staff familiarity. The project warns that no system can guarantee safety.
Evaluate any submission route—including SecureDrop—against the source’s likely risks, who operates or can access the infrastructure, what happens if a device or file is compromised, staff training needs, legal jurisdiction, and recovery requirements. A tool is one part of a working security practice; it does not address every risk from device access, spyware, provider-held message copies, or file metadata.
Review legal and cross-border questions with counsel
Source-protection law, reporting obligations, and law-enforcement response procedures vary by jurisdiction. Cross-border reporting can add questions about which laws or authorities may apply. Have qualified counsel review the newsroom’s procedures for its locations and operations; a general technical plan cannot establish a universal legal rule.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
