Journalists and activists often face elevated threats to their privacy and security. Their work can attract attention from governments, corporations, criminal organizations, and hostile individuals. Effective privacy practices aren’t optional – they’re a professional necessity. Let’s examine threat models and defenses for high-risk users.
Understanding Elevated Threat Models
Compared to general users, journalists and activists may face:
State-level adversaries with sophisticated capabilities
Targeted surveillance rather than mass collection
Physical threats and intimidation
Legal pressure and detention
Device seizure and forensic analysis
Network attacks targeting them specifically
Social engineering and infiltration attempts
Standard privacy advice may be insufficient for these threats.
The Pegasus and Targeted Spyware Threat
Commercial spyware like NSO Group’s Pegasus has been used against:
Journalists investigating powerful figures
Activists and human rights defenders
Lawyers representing dissidents
Family members of murdered journalists
This spyware can compromise even fully updated phones through “zero-click” exploits requiring no user interaction. Defending against this level of threat requires extreme measures.
Device Hardening
Use most secure available devices: iPhones with Lockdown Mode, GrapheneOS on Pixel devices
Enable maximum security features: Lockdown mode, secure boot, all available protections
Reduce attack surface: Uninstall unnecessary apps
Update immediately: Security patches applied without delay
Reboot regularly: Some attacks are persistent only until reboot
Consider dedicated devices: Separate phones/computers for high-risk work
Communication Security
Trusted communication channels are essential:
Signal: Industry standard for secure messaging; use disappearing messages
Wire: Alternative with multi-device support
Encrypted email: PGP or Proton Mail for less time-sensitive communication
Voice calls: Use encrypted voice through Signal rather than regular phone calls
Verify safety numbers: Confirm identities through out-of-band verification
Source and Contact Protection
Protecting sources requires comprehensive practices:
Secure initial contact: SecureDrop, encrypted email, in-person meetings
Compartmentalized contact lists: Don’t store sensitive contacts in cloud-synced address books
Code names: Don’t use real names in stored communications
Limited information: Don’t store more about sources than necessary
Secure storage: Encrypted notes for sensitive contact information
Travel Security
Travel creates unique risks:
Border crossings: Devices may be searched, copied, or seized
Hotel WiFi: Often monitored or compromised
Physical surveillance: Tracking and following
Hotel room searches: Devices left in rooms may be tampered with
Cellular interception: IMSI catchers in some locations
For high-risk travel, consider clean devices with minimal data, established connections through trusted infrastructure, and assume hostile networks.
Operational Patterns
Avoid patterns that could reveal information:
Vary work times and locations
Don’t always meet sources in the same places
Avoid making sensitive calls at predictable times
Use different communication channels for different contacts
Be aware of physical surveillance
Document Security
Sensitive documents require protection:
Encrypted storage: VeraCrypt containers for sensitive files
Air-gapped analysis: Examine sensitive documents on offline devices
Sanitized sharing: Remove metadata before publication
Secure deletion: Overwrite or destroy old materials
Backup planning: Encrypted backups in safe locations
Social Engineering Defense
Activists and journalists are targeted with sophisticated social engineering:
Fake interview requests carrying malware
Impersonation of trusted contacts
Romantic relationships established for intelligence gathering
Fake event invitations with malicious attachments
Pressure tactics creating urgency to bypass careful thinking
Verify identity and requests through independent channels, especially before opening attachments or following unusual instructions.
Physical Security
Physical security complements digital security:
Secure work locations: Don’t work on sensitive materials in public
Privacy screens: Limit shoulder surfing
Secure storage: Safes for sensitive devices and documents
Awareness of surroundings: Notice surveillance and unusual patterns
Personal safety: Travel routes, meeting locations, contingency plans
Legal Preparation
Understanding legal protections and risks:
Know your rights regarding device searches
Have contact information for lawyers
Understand reporter’s privilege in your jurisdiction
Know legal aid resources for activists
Plan for detention scenarios
Mental Health and Sustainability
Constant vigilance is exhausting. Sustainable security practices include:
Build security habits that don’t require constant decision-making
Have trusted colleagues to share burdens
Recognize signs of burnout
Take breaks from high-vigilance work
Access mental health support when needed
Burnout is itself a security threat – exhausted people make mistakes.
Network of Support
Don’t go it alone:
Professional organizations: Committee to Protect Journalists, Reporters Without Borders
Digital security groups: Access Now, Freedom of the Press Foundation
Legal aid: EFF, Reporters Committee for Freedom of the Press
Peer networks: Other journalists/activists facing similar threats
These organizations provide training, response support, and advocacy.
Incident Response Planning
Plan for compromise:
What do you do if you suspect device compromise?
Who do you contact if detained?
How do sources reach you if your usual channels fail?
Who has emergency access to critical materials?
What information must be protected at all costs?
Having plans before incidents occur enables better response.
Documentation and Evidence
For activists documenting human rights abuses:
Verifiable documentation: Tools like Tella and ProofMode provide verifiable timestamps and metadata
Secure storage: Distributed copies in multiple secure locations
Source protection: Witnesses and victims need protection too
Legal frameworks: Documentation should support potential legal action
For Students and Researchers
Privacy and security for high-risk users involves real-world stakes that make this work meaningful and challenging. Organizations like the Freedom of the Press Foundation, Access Now, and the Citizen Lab offer training, research opportunities, and ways to contribute.
Even if you’re not a journalist or activist, understanding these threat models helps you appreciate the broader privacy landscape and contribute to systems that protect those who need it most.