Expert Advice to Keep Your Sources and Whistleblowers Safe

Investigative reporters today face an increasingly hostile landscape. Surveillance is pervasive, whistleblowers take immense personal risks, and the simple act of contacting a journalist can trigger far-reaching consequences – but there are ways to protect your information and your sources, veteran journalists and safety experts said during a panel at the 14th Global Investigative Journalism Conference.

Source protection requires more than just encrypted apps and cautious communication, the panelists – Arnaud Ouédraogo, coordinator of investigative network Cenozo in West Africa, Paul Radu, co-founder and head of innovation at the Organized Crime and Corruption Reporting Project (OCCRP), Delphine Halgand-Mishra, founding executive director of The Signals Network, and Runa Sandvik, founder of Granitt — told the audience.

It demands careful planning, a deep understanding of digital and physical threat environments, and a willingness to adapt, the experts explained during the “Source Safeguarding: Protecting Whistleblowers and Leaks” session.

Above all: it’s crucial to always consider legal, physical, and digital risks – if you neglect one, you risk exposure or harm.

Keep Your Digital Environment Safe

Keeping digital communication and data safe is imperative for investigative journalism. While it can be overwhelming, there are some easy steps to take to make sure your digital communication is as safe as possible.

“The good news is that the tools that you need to work safely do exist,” Sandvik said. “You need to be comfortable using them, but they’re there.”

• Turn on two-factor authentication.
• Use encrypted messaging.
• If resources allow, have a dedicated laptop and phone reserved for sensitive investigations.
• Systematically anonymize sensitive data in your communication. For example, you can save a person under a different name.
• Encrypt all sensitive documents (VeraCrypt, Cryptomator).
• For an extensive list of tools and tips, there are guides available.

Runa Sandvik, founder of Granitt, listing tips for keeping sources safe at a GIJC25 panel. Image: Vivian Yap Wei Wen for GIJN

Plan Your Specific Investigation

Once you’ve made sure that you have taken all steps for your general security, you need to make sure that you plan your specific investigations as much as possible.

“Using all of these tools…  is only one part of the puzzle,” Sandvik cautioned. “Another really really big piece is how you plan your work.”

• Make sure to have a system in place to back up data in case it gets compromised or lost on a seized device. While you cannot prevent all threats, you can prepare for them: police might arrest you, but you can ensure that they don’t have access to data and that you have a backup.
• If possible, keep sensitive data in a remote or third-party location. Authorities might be able to search your personal devices, home, and office — but if you keep sensitive data and devices in an alternate — for example, a family member — this could protect you and your sources. (Note: involving a family member in your investigation in any way could also expose them to additional personal risk, so consent and candor are key before taking this step.)
• Plan how sources can safely get in touch with you, for example via end-to-end encrypted messaging apps.
• If you’re crossing borders or are travelling to sensitive areas, make sure to cut off access to internal communication and data storage at your work. Use a burner phone and laptop if possible. Delete Signal and other apps before you take the plane (after having backed up your chats) and re-install it once you’re past the border.
• Make sure that your information is not only in the hands of one person. Fragmentation of information reduces the risk of a source being identified or threatened once you publish the story: if they’re the only ones who have specific information, they might be targeted.
• Turn your phone off when meeting a source about sensitive information.

Emotional Safety of Whistleblowers and Sources

Sharing information with journalists can be extremely stressful, especially if it relates to traumatic experiences.

“When you talk to a source who is really worried, really stressed, there are ways to make them more comfortable, and also make them feel that you’re the right person to work with,” Halgand-Mishra said.

Arnaud Ouédraogo (right), coordinator of the CENOZO investigative network, discusses threats to source protection in his native West Africa. Image: Vivian Yap Wei Wen for GIJN

Here is how to make sure the whistleblower or source feels as safe as possible.

• Language matters. Give the source control by informing them about the process, telling them in advance what will happen, and what the point is of the conversation. Ask for permission to talk about their experience to make them feel like they are in control. For example, you can use language like “Would it be ok to talk about X?” or “This is what I was hoping to discuss with you today, does it sound OK?”
• Let them keep control of the situation. Sometimes, sources might start feeling emotional or start crying. Ask them if they want to continue or pause — that’s a way to show that you care, and make them feel in control. When speaking with someone who is traumatized or stressed, they might not present things in the most logical order. Check with them whether you’ve understood them correctly and repeat it with your own words. Use phrasing like “I want to make sure that I heard this correctly.” At the end of the conversation, check whether the experience was acceptable for them. Tell them that what they said was important if you think it was worthwhile – it will make them feel heard.
• What if someone voices suicidal thoughts? Do not pretend you didn’t hear: you need to address it directly, because you might be the only one they ever shared those thoughts with. Show them that it is good they shared it with you: they might feel guilty about having told you. You can say something like “I’m sorry to hear. Thank you for sharing. Thank you for your trust.” Refer them to therapists for professional help. Try to make personal contact: Get on the phone, and check what they’re doing at that moment. Next time when you talk with them — say, a week later — talk with them about those feelings as well. Don’t be afraid to bring up the subject.

For more tips on how to engage with sources, you can sign up for a free online training from The Signals Network for journalists in early 2026.

Envisioning a Safer Future for Sources

Today’s digital environment is not the same as it was 10 years ago — there are more tools available to protect your online communication.

Currently, the SIROS foundation and OCCRP are working on a Digital Press Pass that aims to give citizens access to information they can use for investigations. “It’s based on the principle of verified anonymity,” Radu said. “What this means is that you get an identity and you share as much as you want [of your identity]. You pick how much you want to share.”

The goal is to roll out a trial run amongst 50 trusted journalists for now, and expand it to 1,000 people next year. The organizations are working together with governments to see how the program can be rolled out safely to ensure both anonymity and verification