Journalist and source safety
How journalists and sources should choose a private communication channel
There is no single safest channel for every source. The right choice depends on whether the real risk is identity exposure, message content, document metadata, device compromise, or unnecessary retention.
Begin with consequences, not an app list
Before contact, ask what could happen if the source's identity, the message content, or even the fact of communication became known. The Committee to Protect Journalists recommends completing a digital risk assessment rather than assuming one tool solves every threat. Its current guidance also separates content encryption from metadata and device security.
Use CPJ's risk-assessment template and Digital Safety Kit as starting points. A reporter handling a routine confidential clarification and a whistleblower facing state surveillance do not have the same threat model.
Three jobs are often confused
- First contact: letting a source discover and safely choose an appropriate route before they reveal something sensitive.
- Ongoing conversation: exchanging messages, calls, or files after both sides understand the risk and have verified whom they are speaking with.
- Anonymous document submission: protecting a source's identity while receiving material that may itself contain identifying metadata or malware.
Freedom of the Press Foundation calls out the “first contact problem” because a source can compromise confidentiality before a reporter has a chance to move the conversation. Its source-protection collection recommends advertising channels and explaining their different properties in advance.
Match the channel to the job
| Situation | Usually the better starting point |
|---|---|
| Routine, non-sensitive outreach | A normal published newsroom contact method |
| Ongoing encrypted conversation where the parties can verify each other | An established end-to-end encrypted messenger supported by the newsroom, such as Signal |
| High-risk anonymous documents or whistleblower material | A newsroom's SecureDrop installation and its published source instructions |
| Low-risk, already-known participants who mainly want to avoid another permanent thread | A short-lived channel, after checking its audit status, metadata, authentication, and deletion scope |
This is workflow guidance, not a universal security ranking. Freedom of the Press Foundation's guide to confidential tip pages explains why newsrooms should present multiple channels honestly. SecureDrop's official documentation describes a system built specifically for anonymous source submissions through Tor and hardened newsroom workflows.
Encryption does not erase metadata
End-to-end encryption can protect message content from the service carrying it. It does not automatically hide who connected, when they connected, IP addresses, phone numbers, account identifiers, message sizes, or other surrounding data. CPJ warns that metadata can reveal a communication pattern even when content is encrypted.
Anonymity requires a separate design. SecureDrop uses Tor because hiding content alone is not enough for a source whose identity must remain unknown. A normal web chat, including Babili, should not be treated as a substitute for that anonymity model.
Documents and devices can reveal more than the conversation
- Office documents may contain author names, revision history, internal paths, or organizational identifiers.
- Photos can contain location, device, timestamp, or editing metadata.
- Opening an untrusted file can expose a newsroom device to malware.
- Downloads, screenshots, clipboard history, cloud backups, and notification previews can create new copies.
- A seized, unlocked, or compromised endpoint can reveal plaintext regardless of the transport.
Do not improvise document sanitization in a high-risk situation. Follow the newsroom's established process or seek help from a qualified digital-security professional.
Where a disposable room fits—and where it does not
A disposable room can reduce retention for a low-risk conversation between people who already know whom they intend to reach: scheduling, a non-critical clarification, or a temporary exchange whose main concern is avoiding another permanent inbox thread.
Babili is an experiment in that narrow category. It requires no account, encrypts message and file content in the browser, relays ciphertext without persisting a server-side transcript, uses single-use invites, and lets the creator destroy the room.
It is not appropriate for anonymous or high-risk sourcing. It has not had an independent security audit, file-event authentication and sender identity verification are not implemented yet, and Cloudflare can observe ordinary relay metadata including IP addresses, timing, sizes, and presence. A participant or compromised device can retain everything received.
A safer newsroom sequence
- Publish several contact options before a source needs them.
- Explain which option provides encryption, anonymity, or only convenience.
- Complete a risk assessment before moving sensitive material.
- Verify identities through a separate known channel when the workflow requires it.
- Minimize identifying details and retain only what reporting, safety, and legal duties require.
- Reassess the channel when a routine conversation becomes sensitive.
The most responsible tool choice may be the one that tells a source not to use it. A clear boundary is more useful than a broad “secure” label.