Digital security is not just about yourself and your assets; it’s about your sources and their identities. You may not have to deal with highly sensitive photos or footage on a regular basis, but it’s good to have an idea about what protections exist should you need to keep files secret, or your sources anonymous.
While protecting data may be more crucial to investigative reporters, as they deal with confidential documents on a regular basis, it is just as important for visual journalists working on sensitive stories. It’s important to keep in mind when operating in dangerous places, and if your subjects or local staff could be reprimanded by helping you do your work.
There is no such thing as constant and absolute security, but there are strategies to make yourself less vulnerable. We may have no way of protecting ourselves from the NSA monitoring us, but we can protect ourselves from less sophisticated, but just as threatening, adversaries lurking in our digital worlds.
We’ve put together a list to serve as a starting point for thinking about security.
ORGANIZATIONS MADE FOR JOURNALISTS
First off, you should take advantage of all the free online resources provided by organizations dedicated to protecting journalists. Information about digital security changes quickly, but these organizations are thinking specifically about your needs as a journalist.
- The Rory Peck Trust was created in the interest of freelancers and aims to provide practical assistance and support to freelance journalists and their families worldwide. They have a detailed section dedicated to digital security. It includes information on using public computers, protecting files on your own computer, using mobile phones, and more.
- The Committee to Protect Journalists (CPJ) has a section on information security that serves as a good introduction to understanding what you need to protect your data.
- Reporters Without Borders monitors attacks on freedom of the press, and also provides material assistance, like flack jackets, for journalists working in conflict zones. They recently published Enemies of the Internet, a report that focuses on surveillance, and examines how traditional surveillance strategies and cyber surveillance are used by different states to monitor citizens and journalists.
- The Tow Center for Digital Journalism provides information on cyber security and holds lectures and workshops devoted to the subject.
IDENTIFY THE RISKS
When you set out to do a story, you should identify what entities could be trying to get ahold of your information and why. If you identify potential risks, then you can determine the precautions you need to take. Security can be a hassle, so if you don’t need to go all-out you shouldn’t. There is a big trade-off between convenience and security: the more security you need, the more time and resources you need to spend on it.
MAKE AN INVENTORY
You need to know what you have and where you have it. What data do you have that someone else might want or use against you? What do you have on your computer? What do you have on your external memory devices? What’s on your phone? What’s in your email? What do you have in the cloud? Knowing what data you have will help you identify how many precautions you need to take to safeguard it.
ENCRYPT YOUR DEVICES
You need to think about securing your hardware. This can involve anything from encrypting your entire hard drive to just certain files saved on your machine. There are many programs you can use, but we’ve listed three popular ones here:
- TrueCrypt is free open source software and has a great beginner’s guide
- Filevault 2 for Mac users
- Bitlocker for Windows users
SECURE ONLINE CONNECTIONS
It’s not enough to encrypt the data stored on your devices; you need to make sure the connections you’re making with your machine are as secure as possible.
- Virtual Private Networks (VPN) enable you to send and receive data across shared or public networks as if you were directly connected to a private network. For example, if you’re doing a story in Russia, you could set up a VPN that makes it look like you are sending emails from New York, so that your communication does not raise red flags. You may be part of an organization that has a VPN or you can set up your own. Some VPNs available for free or hire are ProxPn, Viking VPN, Astrill, and StrongVPN. Always beware of the VPN’s terms of services as it may not be available in certain countries.
- The Tor Network is free software and an open network that helps you defend yourself against traffic analysis, so that agencies scanning the net don’t pick up on your activity. It makes you and your data anonymous by bouncing your communications around a distributed network of relays run by volunteers all around the world.
- SSL Certificates help you authenticate, verify and encrypt your data when you are online. The Beginner’s Guide to SSL Certificates by Symantec is a document that explains what extra security steps you can take with authentication, verification and encryption. You don’t need to use their brand, and they do a good job of breaking down the terms and they are a widely trusted company.
Make sure your passwords are strong and unique. They should be at least 12 characters and be a combination of letters, numbers and symbols. Services such as LastPass can help you generate and remember multiple passwords.
SCRUBBING THE METADATA ON IMAGES AND FOOTAGE
The metadata in your pictures and videos can be very helpful for you – and similarly helpful to potential adversaries. You should think about erasing the details that could make you or your sources vulnerable. Some widely used EXIF tools are good for this purpose.
Simply deleting files on a computer or any memory device does not actually erase the data. A skilled technician can retrieve files long after a standard deletion. To get rid of data in a more efficient way, you can use software such as CCleaner.
YOUR ONLINE PRESENCE
Finally, this may go without saying, but you need to be smart about what information you are sharing publicly. Think about how you will be perceived in a different culture, by state authorities, government adversaries, and your potential sources. You need to watch out for the kind of pictures of you that are posted, controversial and opinionated posts, the ‘Likes’ that could make you seen as a sympathizer or affiliate of a particular organization, and more. A good resource is Own Your Space: A Guide To Facebook Security, which was not written for journalists, but is a good document that talks specifically about Facebook, and can be applied to other platforms.
Note: The staff at Columbia Visuals are not experts on digital security. The resources listed here are offered as sources for potentially helpful information, with no guarantee of their effectiveness for individual situations.