Protecting sources and sensitive communications
Choose communications around the risk, minimise what you retain and remember that protecting a source involves more than encrypting messages.
Last reviewed: October 2026
Protecting a confidential source is not mainly a question of choosing the “most secure” app. It is about understanding what could identify the source, who might want that information, and how it could leak through communications, devices, accounts, documents or ordinary working habits.
The right arrangements for a routine contributor may be completely inadequate for a source who could lose a job, face prosecution or be put in physical danger.
Start with the consequences
Before exchanging sensitive information, ask what would happen if the relationship became known. Consider who might realistically try to discover it and what access or capabilities they have.
That determines the precautions. A source worried about an employer reading corporate email faces a different problem from somebody at risk from a state intelligence or law-enforcement agency.
For genuinely high-risk sources, get specialist advice early. Do not wait until large amounts of sensitive material have already accumulated.
Agree how you will communicate
Use end-to-end encrypted communications where appropriate and make sure both parties understand what the chosen service does and does not protect.
Encryption can protect the content of a conversation in transit. It does not necessarily hide the fact that two people communicated, the telephone numbers or accounts involved, information stored on either device, screenshots, backups or what someone can see when a device is unlocked.
For sensitive work, avoid moving a conversation casually between email, SMS, social media and messaging apps. Agree a channel and a method for verifying each other if something unusual happens.
Verify identity when it matters
An attacker who takes over an email or messaging account may be able to impersonate the source or journalist convincingly.
If a message suddenly asks you to change channel, open a document, reveal information, reset an account or meet somewhere unexpected, verify it another way. For particularly sensitive relationships, agree a simple verification method in advance.
Collect less and keep less
Every stored contact, message, recording and document can become evidence of a relationship.
Do not retain sensitive material simply because storage is cheap. Decide what needs to be kept, where the authoritative copy will live, who genuinely needs access and when working copies can be removed.
Be careful with contact names. Saving someone as “Confidential source – investigation” may undo a great deal of sophisticated security.
Think beyond the message
Documents and photographs can contain identifying details. File metadata, tracked changes, filenames, comments, cloud-sharing history, visible surroundings and small details in an image can all reveal more than intended.
Before publishing source material, consider whether it needs to be redacted or recreated rather than merely cropped or visually covered. A black rectangle placed over text is not necessarily a secure redaction.
Voice, writing style and distinctive factual details can also identify people even when names have been removed.
Protect both ends
Your security does not compensate for a source using a monitored work laptop or an unlocked phone shared with other people. Explain the risks in plain language and agree precautions the source can realistically follow.
Do not overwhelm a source with tools they do not understand. Complicated security that causes mistakes can be worse than a simpler arrangement used consistently.
Remember that deleting a conversation from your own device does not necessarily delete it from theirs, from backups, or from service-provider systems.
Separate especially sensitive work
For higher-risk investigations, consider separating sensitive communications and material from routine production activity: separate accounts, browser profiles or dedicated devices may reduce accidental exposure and limit what is available if an everyday account is compromised.
This is risk reduction, not anonymity. A determined adversary may be able to correlate identities and communications in other ways.
If you think a source may have been exposed
Do not compound the problem by sending detailed warnings through a channel that may itself be compromised. Stop, assess what information could have been exposed and get appropriate security or legal advice.
If you suspect targeted hacking, spyware or account compromise, preserve evidence rather than immediately wiping devices. Specialist organisations including Access Now, the Committee to Protect Journalists and Reporters Without Borders provide assistance to journalists at risk.
The objective is not secrecy for its own sake. It is to make sure that a person who trusted you is not exposed because of an avoidable weakness in the way the work was handled.