You Received a Leak. Now What?
A practical guide to protecting your sources. And yourself
Based on a presentation by Apostolos Pyrgiotis (Freedom of the Press Foundation) and Kolja Weber (Flokinet), done for Dataharvest 2026.
Investigative journalism depends on sources who trust you with sensitive information. That trust has a technical dimension most journalists never learned about in school. This guide walks you through what happens before a tip arrives, what to do when it does, and how to publish without burning the person who came to you.
Before the Tip - Setting Up Your Tipline
How sources find you
Your tipline must be public. Sources need to know it exists before they have something to share, which means advertising it everywhere: on your website, blended into articles, and yes, even in print. The Washington Post, for example, publishes its SecureDrop address prominently. If a source only discovers your tipline after deciding to leak, it may already be too late for them to act safely.
For technical guidance on making the most of a SecureDrop tipline, see the official documentation: https://docs.securedrop.org/en/stable/admin/deployment/getting_the_most_out_of_securedrop.html
What your IT team needs to get right
The page where sources learn how to contact you must itself be safe to visit. Concretely:
- No subdomains. Use newsroom.org/tips, not tips.newsroom.org, subdomains are easier to block and flag.
- No analytics, no trackers, zero server logs. Every log is a record that could be subpoenaed.
- Tor-friendly. No CAPTCHAs, no JavaScript that blocks Tor Browser users.
- Trustworthy hosting. Use a provider that is censorship-resistant and keeps no logs.
What your sources need to know
Before a source ever contacts you, they need to understand several things that no amount of good technology on your end can fix if they get wrong:
- Never use work devices or work networks. Corporate systems are monitored.
- Use public spaces. Cafés, libraries, anywhere not associated with them personally.
- Files carry fingerprints. A leaked document can be traced back to the specific printer or computer that produced it.
- Follow the instructions. Your tipline should explain exactly how to use Signal, SecureDrop, or whatever channel you offer.
- Never discuss the leak with anyone. Not friends, not colleagues, not people they trust.
A cautionary tale: Chelsea Manning
In 2010, Chelsea Manning was leaking classified documents and felt isolated. (Chelsea is an American activist and whistleblower. She is a former United States Army soldier who was convicted by court-martial in July 2013 of violations of the Espionage Act and other offenses, after disclosing to WikiLeaks nearly 750,000 classified, or unclassified but sensitive, military and diplomatic documents. She was imprisoned from 2010 until 2017, when President Barack Obama commuted her sentence. See more info posted on Wikipedia https://en.wikipedia.org/wiki/Chelsea_Manning) She turned to Adrian Lamo, a former hacker, via encrypted chat, not to share information, as he was not a journalist, but for emotional support. She wrote: “but im not a source for you … im talking to you as someone who needs moral and emotional f****ing support.” Lamo replied: “i told you, none of this is for print.”
It was. And Manning’s identity was exposed.
Sources and journalists need to understand and always remember the human factor, the impulse or the need to confide in someone, to seek support, to share the pressure and letting in any third party which might undo every technical precaution.
Hardening Your Phone - GrapheneOS and Signal
What Signal actually knows about you
Signal is end-to-end encrypted and stores remarkably little data. When the US government subpoenaed Signal for information on 37 phone numbers, here is what Signal was legally able to hand over: the account creation date, and the last connection date. Nothing else: no messages, no call logs, no contacts, no group memberships, no profile information.
Signal itself has stated: “We simply don’t have access to things like messages, calls, profile information, group information, contacts, stories, call logs, and many other kinds of content and metadata, and we cannot share data in response to valid legal requests that we never had in the first place.”
You can read every subpoena Signal has ever received at: https://signal.org/bigbrother
(Thinking ahead and anticipating potential risks: for now Signal does not conduct any active traffic analysis, but that could change by a judge order and in that case then, the IP addresses and temporary cryptographic keys used during a session could theoretically help law enforcement build a picture of who communicates with whom, even without reading any messages. With that in mind, mitigating measures could be: download and install Signal from their website and not via Google, do not install both Signal and Whatsapp on the same phone used, and/ or (if possible, depending on the European country), buy and use a SIM that does require registration with personal data.)
Signal settings every journalist should enable
These are not optional extras. They are baseline protections:
Setting | Why it matters |
Sealed sender | Makes it harder for Signal’s infrastructure to track who is talking to whom |
Sealed sender → Allow from anyone | Extends the above protection |
Disable link previews | When Signal generates a preview of a link, it contacts the server behind that link, revealing your IP address |
Registration lock | Prevents someone from hijacking your account by taking over your phone number (SIM-swap attack) |
The phishing attack on journalists, January 2026
In January 2026, dozens of journalists were targeted by a fraudulent account calling itself “Signal Security Support ChatBot.” The message read: “Dear User, this is Signal Security Support ChatBot. We have noticed suspicious activity on your device […] To prevent this, you have to pass verification procedure, entering the verification code to Signal Security Support Chatbot. DON’T TELL ANYONE THE CODE.”
The goal: take over journalists’ accounts to see who they communicate with and read their messages. Signal has confirmed: Signal will never contact you in any way via a two-way chat within the app. Never share your Signal PIN with anyone.
The device itself: what happens when police seize your phone
In January 2026, the FBI raided the home of Washington Post reporter Hannah Natanson to gain access to her Signal contacts (over 1,169 current and former US federal employees). They seized her phone. What the court order revealed: “Because the iPhone was in Lockdown mode, CART could not extract that device.”
Her Lockdown mode setting stopped the extraction. Source https://www.404media.co/fbi-couldnt-get-into-wapo-reporters-iphone-because-it-had-lockdown-mode-enabled/%5D
How phone extraction tools work, and their limits
Companies like Cellebrite sell devices to law enforcement that can extract data from seized phones. Understanding how they work helps you understand your defenses:
- BFU (Before First Unlock): The phone has just been switched on or rebooted. Encryption keys are not yet loaded into memory. Much harder to extract data from.
- AFU (After First Unlock): The phone has been unlocked at least once since last reboot. Encryption keys are in memory. Far easier to extract data from.
- TPM (Trusted Platform Module): A chip built into the device that limits how many times a PIN can be guessed wrong before the device wipes itself. Available on iPhones and on Google Pixel phones (which run GrapheneOS).
The practical implication: a phone that has been recently rebooted and not yet unlocked is significantly harder to extract data from than one that has been in active use. A phone protected by a strong passphrase (not a short PIN) is harder still.
Cellebrite tools have been documented in use against journalists and activists in many countries, including, but not limited to Serbia (prompting Amnesty International’s report), Kenya (against activist Boniface Mwangi, per Citizen Lab, February 2026), and Jordan (against pro-Gaza activists, per Citizen Lab, January 2026).
Quick wins for your phone
Setting | Why it matters |
Lockdown mode (iPhone) | Blocks the attack surface used by extraction tools; stops many spyware entry points |
Advanced Protection (Android) | Equivalent hardening for Android devices |
Remove the SIM card (newsroom devices dedicated to tips) | Many zero-day exploits (software vulnerabilities sold to governments) specifically target SMS and MMS |
GrapheneOS: a hardened Android for high-risk situations
GrapheneOS is a modified version of Android designed for security. It runs on Google Pixel phones. It is not a replacement for your everyday phone, it is a dedicated device for receiving sensitive tips. Its additional protections beyond standard Android include:
Setting | Why it matters |
Auto-reboot | If the phone is not unlocked within a set number of hours, it automatically reboots, returning to the harder-to-extract BFU state |
Disable USB port on lock screen | Closes a physical attack vector used by extraction tools |
Sandboxed Google Play | Runs Google’s services in an isolated container, limiting what they can access |
User profiles | Separate environments – personal, tips, archived files – each with its own password and apps |
Hardware attestation | Protection against “evil maid” attacks (someone tampering with your device while you’re away from it) |
Duress password | A second password that, if entered under physical intimidation, wipes the device |
Physical Security - What the Room Knows
Walls have ears. Literally
Two tools are worth knowing about for high-risk environments:
- Rayhunter – An open-source device that can detect IMSI catchers in your vicinity (https://efforg.github.io/rayhunter/).
- Faraday bag – A pouch that blocks all radio signals to and from a device inside it. Useful when crossing borders, attending sensitive meetings, or storing devices long-term.
What is an IMSI catcher?
An IMSI catcher (also called a “Stingray”) is a device that impersonates a mobile phone tower. Law enforcement and intelligence agencies use them in crowds and at specific locations. They can:
- Collect records of which phones were in the same area as a specific person.
- Intercept calls and data.
- Act as radio jammers, blocking communications.
- Downgrade a phone’s connection to older, weaker protocols like 2G or 3G, which are easier to intercept.
GrapheneOS includes protections against protocol downgrade attacks. Standard Android and iPhone do not, to the same degree.
Compartmentalization: Qubes OS and SecureDrop
What happened to the Washington Post reporter’s laptop
The FBI did not only seize Hannah Natanson’s phone (Hannah is a narrative enterprise reporter for Washington Post who won a Pulitzer Prize in 2026). They also seized her MacBook, a portable hard drive, and an audio recorder. Unlike the phone, they gained access to the laptop. From it, they were able to photograph and record her conversations and attachments, because they noticed disappearing messages were turned on and moved quickly by raking pictures of the messages.
The consequences: the FBI then knew the display names and avatars of her Signal sources. They could theoretically work backwards and subpoena Signal for the phone numbers linked to those identities. Bear in mind also that in many countries the phone numbers are linked to ID cards (required for registration of the phone number) which increases the risk significantly.
Source https://freedom.press/digisec/blog/wapo-raid-security-lessons/
SecureDrop: a fundamentally different system
SecureDrop is designed for sources with a higher threat model than Signal, situations where even knowing that a specific person contacted a newsroom would be dangerous.
How it works for sources: A source visits a special Tor-only website (not accessible from a normal browser). They receive a long, randomly generated codename. They can send messages and files. They can only receive a reply by visiting the site again and checking. There is no notification, no push alert, nothing that leaves a trace on their device.
How it works for journalists: Traditionally, journalists accessing SecureDrop needed two separate laptops and four USB drives, creating a cumbersome workflow. This is where Qubes OS addresses a real practical problem.
Qubes OS: everything isolated, on one machine
Qubes OS is a Linux-based operating system where every activity runs in a separate virtual machine (VM), a self-contained computer environment that cannot see or affect the others. Think of it as running several completely separate computers simultaneously on one physical device, with different colored window borders to tell them apart at a glance.
Qubes OS is not a daily driver for ordinary work. It is a dedicated, special-purpose machine. Its value for SecureDrop is that it can replace the two-laptop setup while maintaining the same security separation: your personal environment, your work environment, your tips environment, and your secure file vault are all isolated from each other. A malicious file opened in one environment cannot reach the others.
After Verification - Storing, Sharing, and Publishing Without Burning Your Source
Storing sensitive files offline
VeraCrypt is free, open-source software that encrypts a USB drive. It works on Windows, macOS, and Linux, with third-party support on Android and iOS.
Its most important feature for journalists is plausible deniability: a VeraCrypt drive can contain two separate encrypted volumes inside the same file.
- Outer volume: Visible when you enter the first password. Fill it with plausible but non-sensitive files like old tax records, previous published investigations, anything credible.
- Hidden volume: Visible only when you enter a second, different password. This is where sensitive material lives.
If someone compels you to hand over your password under duress, you give them the outer volume password. They see the decoy files. They cannot prove a hidden volume exists.
Making physical storage tamper-evident
If you need to ship a USB drive, cross a border with one, or store one for a long period, you need to know if someone has physically accessed it without your knowledge.
One documented method: wrap the USB drive in plastic wrap, place it in a vacuum bag with a mix of dried beans or lentils, seal it, and photograph both sides. The randomness of the bean pattern cannot be reproduced. On retrieval, compare the current pattern against your photograph using an app called BlinkComparison (Android). Any physical interference will have disturbed the pattern.
Note: tamper-evident bags are commercially available, but if your threat model includes law enforcement, they may have methods to defeat standard commercial bags (demonstrated with a syringe of acetone).
Storing files online
Proton Drive offers end-to-end encrypted cloud storage. For higher-risk situations, it is possible to create an anonymous Proton account using Tor Browser, meaning no IP address is linked to the account at registration.
Sharing files with others, safely
Receiving a file securely in Qubes OS or GrapheneOS does not make it safe for others. Files must be sanitized before being shared — stripped of metadata and any hidden payloads. The tool for this is Dangerzone.
Also worth noting: not every whistleblower is genuine. Since April 2025, Chinese state actors have been impersonating whistleblowers to target ICIJ journalists — sending emails with links to supposed “confidential records” that were actually credential-harvesting attacks. [Detailed account: www.icij.org/investigations/china-targets/fake-journalists-cyber-spies-china-targets-reporters/]
Publishing: the eight ways you can burn a source
Even after safe receipt and verification, publication itself can expose a source. There are eight documented categories of risk:
A. Simple metadata in photos and multimedia. Photos contain EXIF data – GPS coordinates, camera model, time of capture, sometimes the author’s name. Publishing a leaked photo without stripping this data can reveal where and when it was taken, and with what device. [Example: www.wired.com/2012/12/oops-did-vice-just-give-away-john-mcafees-location-with-this-photo/]
B. Complex metadata in documents. PDFs and Microsoft Office files contain nested metadata: embedded photos with their own EXIF data, tracked changes showing edit history, author names, and organization names stored in file properties. A document that looks clean on screen may carry identifying information in layers invisible to the reader. [Example: www.theregister.com/on-prem/2008/05/30/metadata-ruins-googles-anonymous-ebay-australia-protest/1285606]
C. Redactions that do not work. Placing a black box over text in a PDF does not remove the text; it covers it. If the redaction is a layer rather than a permanent alteration, anyone can remove it. Always flatten and verify redactions. [Example: www.theverge.com/2023/6/28/23777298/sony-ftc-microsoft-confidential-documents-marker-pen-scanner-oops]
D. Physical watermarks (printer dots). Printed documents often contain invisible yellow dot patterns placed by the printer. These patterns encode the printer’s serial number and the time of printing. The FBI used exactly this method to identify Reality Winner in 2017. [Example: https://www.theatlantic.com/technology/archive/2017/06/the-mysterious-printer-code-that-could-have-led-the-fbi-to-reality-winner/529350/]
E. Digital watermarks. Organizations that share sensitive documents with a limited group of people may embed invisible, unique watermarks in each copy, different for each recipient. If the document is leaked, the watermark identifies who leaked it. If your source is the only person who received that specific copy, there is no technological defense. [Example: https://theintercept.com/2022/12/15/elon-musk-leaks-twitter/]
F. Canary tokens. A canary token is a hidden element in a document (an image, a link, a tracking pixel) that “phones home” (it contacts a remote server) when the document is opened. This tells the document’s creator that the file was opened, when, and from what IP address. Most secure document viewers block these silently. Microsoft Office asks users to enable macros (enabling macros triggers the token). Adobe Acrobat asks permission to connect to a site. One click is all it takes. [Example: https://blog.amartinsec.com/blog/canary/]
G. Fingerprinting (cameras, microphones, and writing style). Camera sensors have microscopic manufacturing imperfections that create a unique “noise pattern”, a fingerprint that can be extracted from photos and matched to a specific camera. Microphones can be similarly fingerprinted. Additionally, an individual’s writing style like word choice, sentence structure, punctuation habits is a fingerprint that can be analyzed computationally (this is called stylometry). Unlike watermarking, fingerprinting requires a second known sample to compare against.
H. The surrounding environment. Cameras and microphones capture more than the intended subject. Reflections in eyes or glasses have been used to identify locations. Background sounds, visible landmarks, reflective surfaces, all can inadvertently reveal where and who.
The tool that addresses most of this: Dangerzone
Dangerzone is a free, open-source desktop application maintained by the Freedom of the Press Foundation. It converts potentially dangerous documents into safe ones by: opening the original file in an isolated environment, rendering it to pixels (as if printing it to a flat image), and rebuilding a clean PDF from those pixels, stripping all metadata, all embedded code, all hidden layers, all canary tokens.
It supports over 20 file types: PDFs, Word documents, Excel files, images, and more. It runs on Windows, macOS, Linux, Tails, and Qubes OS.
Download: https://dangerzone.rocks
OPSEC works - documented cases
Two recent cases demonstrate that careful operational security actually protects sources:
KRIK (Serbia): Prosecutors demanded that the investigative newsroom hand over the original recording of an incriminating conversation, threatening journalists with fines. KRIK refused — specifically, they did not provide the original recording, protecting the forensic trail that would have identified their source. [Source: https://www.occrp.org/en/news/serbian-prosecutors-threaten-krik-with-fine-if-it-fails-to-submit-recording-of-a-conversation
Radio New Zealand: An investigation into a budget leak interviewed over 40 people. The investigator specifically asked to speak to the RNZ journalist to determine “the file format and version of the Budget Report disclosed to him.” The journalist and RNZ’s lawyers declined. Without knowing the file format, investigators could not determine which specific copy had been leaked and could not identify the source. [Source: https://www.rnz.co.nz/news/education/574602/ministry-of-education-s-20-000-inquiry-fails-to-find-budget-leak-to-rnz]
Instead of conclusions
Protecting a source is not a single decision. It is a chain of decisions across the entire lifecycle of a tip, from the moment a source decides to come forward, to the moment you publish. Every link matters:
- Advertise your tipline – sources need to find it before they have something to share.
- Sources must act safely – public devices, public locations, no conversations about the leak.
- Use Signal correctly – Registration Lock, Sealed Sender, no link previews.
- Harden your device – Lockdown mode, dedicated tip-receiving phone, consider GrapheneOS.
- Store carefully – VeraCrypt with hidden volumes, offline when possible.
- Sanitize before sharing – Dangerzone removes what you cannot see.
- Publish carefully – strip metadata, verify redactions, understand watermarks, never describe the file you received.
The tools exist. The cases show they work. The question is whether you use them before you need them, because by the time you need them, it is too late to set them up.