Digital Security Advice for Journalists Covering the Protests Against Police Violence

This guide is an overview of digital security considerations specific to journalists covering protests. For EFF’s comprehensive guide to digital security, including advice for activists and protesters, visit ssd.eff.org. Legal advice in this post is specific to the United States.

As the international protests against police killings enter their third week, the public has been exposed to shocking videos of law enforcement wielding violence against not only demonstrators, but also the journalists who are tasked with documenting this historic moment.

EFF recently issued Surveillance Self-Defense tips for protesters who may find their digital rights under attack, either through mass surveillance of crowds or through the seizure of their devices. However, these tips don’t always reflect the reality of how journalists may need to do their jobs and the unique threats journalists face.

In this blog post, we attempt to address the digital security of news gatherers after speaking with reporters, photographers, and live streamers who are on the ground, risking everything to document these protests.

The Journalists’ Threat Model

When we talk about security planning or “threat modeling,” we mean assessing risk through a series of questions. What do you have that you need to protect? From what or whom do you need to protect it? What is the likelihood you will need to protect it? What are the consequences if you fail to protect it, and what are the trade-offs you’re willing to make in order to protect it?

With the threat model of a protester, we often pay special attention to the need to protect the anonymity and location of those who could face retaliation for exercising their rights to march and demonstrate or who may have their rights violated as police investigate the actions of others. This means that we often recommend protesters leave their devices at home, use a temporary device, or keep their devices in airplane mode.

A journalist, however, is generally more open about where they are and when, either through the credits on the photographs they publish or the bylines on the articles they write. And because many need to get out their stories rapidly or even in real time, going device-free or keeping devices in airplane mode may not be an acceptable option.

The journalist’s protest threat model is complex. First, they have to worry about the police. Law enforcement could seize their devices, which in turn could expose their sources and research in addition to their personal information, and could separate them from their work product for months. Journalists could also find that police may follow their digital footprint to investigate sources (as the Feds did when Sean Penn interviewed Joaquín “El Chapo” Guzmán, despite Penn taking some security precautions). Journalists have also told us about experiences with thieves who use protests as cover, such as having laptops and other equipment stolen from their cars while they are in the field. Finally, journalists (especially photographers) also must remain aware that they may be confronted by protesters themselves, who may be trying to protect their images as part of their own threat models. (Again, it’s important to consider the likelihood of the threat: the Freedom of the Press Foundation’s research has found that the overwhelming number of attacks on journalists have been by police, not protesters.)

Each of these threats may require taking different steps to secure your data. And, the steps needed will depend, too, on the form of your news gathering and the tools that you rely on in the field, whether that is taking photographs, conducting interviews, or live streaming video. To protect yourself and your data, you will need you to think carefully about the kind of journalism you’re doing (say advocacy journalism vs. traditional daily news reporting), the situation you’re joining, and the particular risks that you may face.

There is only one piece of advice that we believe holds for all journalists: think ahead and be deliberate. Consider the threats and make a decision about the risks and trade-offs. In doing so, here are some steps to consider.

Minimize your digital content at risk. Be prepared for the possibility that if you are arrested, police may confiscate your devices, and may keep them long after you are released to try to break into them. Minimize the amount of sensitive personal and professional information you carry in order to minimize the risk of exposure. If practicable, you may consider leaving personal devices at home and instead carrying a work or burner phone with minimal personal information on it. If that is not possible, consider minimizing the amount of sensitive information available by logging out of email, social media apps, and other apps containing data that you would not want the police or others to access.

Encrypt devices with a long passcode where possible. Police may try to break into your phone, and a long passcode is significantly more difficult to crack. Keep them and others out of your devices by protecting them with strong passcodes of 8-12 random characters that are easy for you to remember. Deactivate touch unlock and face ID on your devices. In the U.S., law currently provides stronger protection against police forcing you to enter a passcode than forcing you to biometrically unlock your device. Using a long passcode may be less convenient, but iOS and Android both allow you to take photos and video without unlocking your phone. See the “Take photos and videos without unlocking your device” section of our Attending a Protest SSD guide.

End-to-end encrypted messaging. By using end-to-end encrypted messaging, such as Signal (available for iOS and Android), you are making it far more difficult for law enforcement to obtain and read your communications, be it between you and your sources, your editorial team, or your personal contacts. You will want to make sure everyone on your newsgathering team has the same app installed and has each other’s contact information in advance of the protest. You may also find it useful to have several different encrypted messaging systems installed, since protesters and other sources may be using other apps. Many of these apps, including Signal, provide an option to have messages disappear anywhere from ten seconds to a week after they are first read, which will protect your communications if the police or others breach your phone.

Press passes. Many journalists won’t enter a volatile situation like a protest without having visible credentials provided by their news organization, a journalism association, or the local government. A press pass certainly can be useful in establishing your identity as a journalist. However, to obtain a government or police-issued press pass, it’s important to recognize a large trade-off: you may need to provide personal information or submit to a background check.

Hide your notifications. Consider turning off notifications, or, at minimum, restricting messaging apps from displaying the content of messages and message sender information. If your phone is seized or lost, you won’t have to worry about someone easily reading your private communications.

Back up your data before the protest. If your device is lost, stolen, or confiscated by police, you will be glad to have a backup of your information stored in a safe place.

Back up your data during the protest. If you are taking photos, video, or notes on a phone or other digital device during the protest, consider trying to back up your work in real time. This could include emailing important photos to yourself or setting up automated cloud storage while in the field. If your phone or camera is lost, stolen, or seized, you won’t lose your own coverage of what took place. But prepare for the possibility during the protest, the cell phone network may be oversaturated, unavailable, or slow.

Assume digital cameras are not encrypted. Few digital cameras provide the ability to encrypt. It is safe to assume that photos and videos taken with a digital camera will be stored unencrypted, unless explicitly stated otherwise.

Use multiple memory cards. Some cameras provide the capability to store your photos simultaneously on two cards. Taking advantage of this capability may be obvious to many photographers, who know that a memory card can fail just when you need it most. However, there is also a digital security element: by cycling through memory cards regularly, you are ensuring that you will not lose all of your photographs if your camera itself is seized or damaged.

If you are detained by police, refuse to consent to a search of your devices. If police ask to see your phone, you have the right to refuse your consent and to refuse to give them your passcode. Note, however, that police may still seize it to try to break into and search it later.

For more resources on this issue, visit EFF’s Surveillance Self-Defense Guide, the Committee to Protect Journalists, and Freedom of the Press Foundation.

Are you a journalist covering the protests? We would appreciate feedback and to hear about any other practices you’ve developed for protecting your digital privacy. Additionally, if you are in need of legal assistance in relation to your work reporting on the protests, we may be able to find you some help. Email us at info@eff.org.