Threat profile: journalist or activist
You work with sensitive sources, participate in political or social activism, or share information that powerful parties dislike. How do you protect yourself and your sources?
Threat profile: journalist or activist
This is a serious profile. The threats are more real, the consequences of a mistake are greater, and the adversary may be actively trying to identify you, intimidate you, or pursue you legally.
This article is intended for: investigative journalists, (political) activists, whistleblowers, people in countries with limited press freedom, and anyone who regularly works with sensitive sources or politically sensitive information.
Disclaimer: This article provides a starting point, not a guarantee. Operational security is complex and context-dependent. For critical situations: seek professional advice.
Threat analysis: who wants what from you?
Before doing anything: who is your adversary?
Commercial data collectors — ad networks, data brokers. Goal: profiling for commercial purposes. Approach: same as a normal user, but stricter.
Criminals — account takeovers, extortion, identity theft. Approach: strong authentication, no password reuse.
Employers or clients — monitoring of work traffic, equipment. Approach: separate work from activism.
Opponents in a conflict — doxing, harassment, account hacking. Approach: minimal digital footprint, strong account security, no personal information online.
Government agencies — legal surveillance, infiltration, device seizure. Approach: the full package below.
You don’t need to defend against all adversaries at once. Be honest about who your real risk is.
Core principles
Compartmentalisation Separation between identities, devices, and communication channels. Your activist life must not cross your journalist life. Your anonymous account must not be traceable back to your real name.
Minimal footprint Share as little information as possible, including unintentionally. Metadata is just as dangerous as content.
Need to know Share information about sources, activities, and plans only with those who genuinely need it.
Assume your devices can be compromised Plan as if someone will get your phone one day. What’s on it? What can they see?
Behaviour checklist
Communication
- Signal or Molly for all sensitive communication — no WhatsApp, no Telegram for sensitive matters
- Set disappearing messages in Signal (24 hours for active source contact)
- Never send sensitive information over regular email — use PGP or SecureDrop
- Verify contacts out-of-band (call sources on a known number, verify Signal safety numbers)
Device security
- GrapheneOS on your primary phone (not an option? iOS with maximum hardening is a fallback — see iPhone privacy settings)
- Auto-reboot set to 18–24 hours
- USB restricted to charging only
- Know and use lockdown mode (power button → Lockdown)
- Separate devices for sensitive work where possible
Anonymity
- Tor Browser for sensitive browsing
- Mullvad VPN with DAITA for daily use
- Separate devices and accounts for anonymous activities
- Never use incognito as a substitute for anonymity — incognito hides nothing from your provider
Source protection
- SecureDrop for anonymous document submission (if you’re a journalist)
- NEVER document the identity of sources digitally
- Strip metadata from documents before publication (ExifTool, MAT2)
- Never share the exact time or location of a meeting digitally
Preventing device seizure
- Full-disk encryption — goes without saying
- Strong passphrase, no biometrics as primary unlock
- Know how to quickly enter lockdown mode
- Consider a duress PIN — a code that wipes the device (GrapheneOS feature)
Tools
| Purpose | Tool | Note |
|---|---|---|
| Messaging | Molly (Signal fork) | Via its own F-Droid repo |
| Anonymous browsing | Tor Browser | Via Guardian Project repo |
| VPN | Mullvad (no account, payable with cash/Monero) | Maximum anonymity |
| Email encryption | GnuPG + Thunderbird | See PGP guide |
| Anonymous document submission | SecureDrop | For journalists |
| Metadata removal | ExifTool / MAT2 | Mandatory for source protection |
| Secure phone | GrapheneOS on Pixel | No alternatives that are better |
| File encryption | VeraCrypt | For sensitive storage |
Specific to the Netherlands
Source protection law Journalists in the Netherlands have legal source protection. But that protects your source legally — not technically. A court can demand data. Technical protection (encryption, anonymity) is your responsibility.
GDPR as protection You have the right to know whether government agencies are processing data about you. You can exercise that right, though the AIVD (intelligence service) is not required to disclose everything.
Bits of Freedom Bits of Freedom is the Dutch digital civil rights organisation. They provide legal advice on digital rights and monitor surveillance legislation.
What hardware adds
At this threat level, hardware genuinely adds value:
Faraday phone pouch — for sensitive in-person meetings. No signal = no location tracking via phone. Also leave the phone at home when going to a sensitive location.
Hardware security key (YubiKey) — for accounts you absolutely cannot afford to lose. Phishing-resistant by design.
Privacy screen — if you work with sensitive information in public.
Separate “burner” phone — for activities you want completely separated from your real identity. Buy with cash, activate over wifi without your real SIM.
Further learning
- EFF’s Surveillance Self-Defense — comprehensive guide, multiple languages
- Security in a Box — tools and tactics for activists
- Access Now Digital Security Helpline — free help for journalists and activists
See also:
- iPhone privacy settings — if you’re not (yet) using GrapheneOS
- Android privacy without a custom ROM — hardening for regular Android
- GrapheneOS hardening guide
- PGP: encrypted communication
- GrapheneOS profiles
- VPN on GrapheneOS
- All GrapheneOS guides — complete overview
- Which network setup fits your threat profile? — Protectli + OPNsense for advanced users
Reviews: