When a source trusts me with sensitive information, their safety often depends on how I handle that communication. Over the years covering government and technology, I’ve learned that encrypted messaging apps can be indispensable — but they’re not a magic shield. If you’re an independent journalist like me, you need a practical, legally informed approach to protect source confidentiality while using these tools.

Why encryption alone isn’t enough

Encryption like Signal’s end-to-end protocol protects the content of messages from being read by third parties. That’s critical. But I always remind colleagues and sources that metadata — who messaged whom, when, and where — can still be revealing. Courts and law enforcement can also compel service providers or device access. In short: encryption reduces risk, it doesn’t eliminate legal exposure.

Know your legal landscape

Before relying on any tool, I make a point of understanding the legal protections (or lack thereof) where I work and where my sources are located. Questions I always ask:

  • Does my jurisdiction recognize a journalist-source privilege that protects against subpoenas?
  • How do courts treat encrypted comms and metadata requests?
  • Are there mandatory reporting laws or other duties that could force disclosure?

    • If you’re unsure, consult a lawyer experienced in media law. I’ve written to counsel before publication to clarify how a given revelation could expose a source and what we can do to limit that risk.

    Choosing the right tools — and why I prefer layered approaches

    Not all apps are created equal. I regularly recommend Signal for direct messaging because of its strong encryption, minimal metadata retention, and open-source protocol. But I never rely on Signal alone. For certain high-risk exchanges I’ll pair messaging with:

  • SecureDrop or similar whistleblower platforms for large document transfers.
  • Temporary burner numbers and separate devices to compartmentalize identity.
  • Air-gapped or encrypted storage for downloaded material.

    • Below is a simple comparison I use when weighing options:

    ToolStrengthLimitations
    SignalStrong E2EE, minimal metadataRequires phone number; device can be seized
    WhatsAppWidespread adoption, E2EEOwned by Meta — more data tied to account
    Telegram (secret chats)Optional E2EE in secret chatsDefault chats are not E2EE; server metadata
    SecureDropDesigned for anonymous document submissionRequires technical setup; not for casual messaging

    Operational security (OPSEC) practices I use

    Good OPSEC is where technology and habit meet. These are concrete practices I follow and recommend to protect confidential sources:

  • Minimize identifiers: Use burner phones or secondary SIMs for source communication. Don’t mix source contacts with personal or professional contacts on the same device.
  • Verify identities: Always perform key verification on Signal or similar apps. A trusted contact verification prevents man-in-the-middle attacks.
  • Disappearing messages: Enable disappearing messages for sensitive conversations, but treat this as an added layer — not as airtight proof-delete.
  • Secure backups: Disable cloud backups for encrypted chats or ensure any backups are locally encrypted and stored securely. Backups can be an easy way for authorities to get readable copies.
  • Device security: Use full-disk encryption, strong passcodes, and biometric locks. Keep OS and app software patched. Consider a dedicated, hardened device for sensitive work.
  • Network hygiene: Use a reputable VPN when connecting from public networks, and avoid unknown Wi‑Fi hotspots. For extra caution, use Tor for browser traffic related to sources.
  • Compartmentalize: Separate identities across apps and devices. Treat each source as a distinct operational compartment.

    • How to respond to subpoenas or device seizure

    No one wants to imagine a court demand, but planning ahead is essential. Here’s how I prepare and respond:

  • Pre-arrange legal counsel: Have a media lawyer you can call immediately. Speed matters when a subpoena arrives.
  • Know your rights: Your lawyer can file a motion to quash, seek protective orders, or invoke privilege where available. These motions buy time and can sometimes block disclosure.
  • Don’t alter evidence: Avoid deleting messages after a subpoena — that can create legal trouble. Follow counsel’s instructions about preservation.
  • Consider negotiation: In some cases, you can negotiate with authorities to hand over non-sensitive items or provide redacted materials while protecting source identities.
  • Pre-publish disclosures: If safe and strategic, publishing can sometimes reduce the value of compelled disclosure. Talk to counsel first — publication can also create legal exposure.

    • Explain risks to sources and get informed consent

    I never promise absolute secrecy. Instead, I describe risks clearly and document consent. My approach:

  • Explain technical risks (e.g., device seizure, metadata leaks) and legal risks (e.g., subpoenas).
  • Offer safer channels and let the source choose the level of risk they accept.
  • Get explicit confirmation from the source about their preferences for anonymity and publication.

    • That conversation is important ethically and legally: it demonstrates that you considered the source’s safety and made a reasonable effort to protect them.

    When to avoid messaging apps altogether

    There are moments when even the most secure app isn’t the right choice. If the source is in a highly surveilled environment or uses a company device that’s monitored, I’ll push for face-to-face meetings or submissions via SecureDrop. For some whistleblowers, encrypted email with PGP or physical handoffs still offer the safest channel.

    Record-keeping without exposure

    I maintain careful internal records about communications and consent, but I keep those records encrypted and access-limited. Logs that could identify a source are treated as highly sensitive and stored offline when possible. If a legal demand targets your records, the fewer identifying notes you keep, the better.

    Practical checklist before taking a leak

  • Discuss and document consent and risk with the source.
  • Choose the most appropriate channel (Signal, SecureDrop, encrypted email) and vet the tool’s limitations.
  • Use burner numbers/devices and enable app security settings (disappearing messages, PINs).
  • Disable cloud backups for sensitive chats and encrypt local copies.
  • Have legal counsel on call and a plan for subpoenas or device seizure.
  • Keep sensitive records encrypted and compartmentalized.

    • Every situation is unique, but these practices have helped me protect sources while reporting stories that matter. If you’re an independent journalist, build these habits now — and keep updating them. Threats evolve, and so should our methods for defending the people who trust us with the truth.