Digital Security Toolkit for UK Journalists

Yes. UK journalists face a spectrum of threats depending on their work. Investigative reporters covering organised crime, corporate fraud, or government corruption face risks from commercial actors willing to use private investigators, malware, or social engineering. Those covering terrorism, intelligence, or foreign state actors face more sophisticated threats. Even reporters covering local government or sensitive social issues may have their phones or laptops examined at UK borders under Schedule 7 of the Terrorism Act 2000. Good digital security is proportionate to your threat model, not one-size-fits-all.

Signal is the gold standard for encrypted messaging for journalists. It uses end-to-end encryption with open-source, independently audited code. Messages cannot be read in transit even by Signal itself. However, Signal is not magic: your device's physical security matters, disappearing messages should be enabled for sensitive conversations, and sources should understand that metadata (who you contacted, when) may still be visible to network observers in some threat models. For extremely high-risk sources, consider SecureDrop over Tor instead.

Schedule 7 gives police and border officers at UK ports and airports the power to stop and examine any person to determine whether they are or have been involved in the commission, preparation, or instigation of acts of terrorism. Crucially, they do not need to have any suspicion. Journalists can and have been stopped under Schedule 7 and had their devices examined or seized. The NUJ has guidance on this. Travelling with a clean device and leaving sensitive material encrypted and off-device is prudent for journalists covering certain topics.

A VPN (Virtual Private Network) encrypts your traffic and hides your IP from the sites you visit, routing it through a server run by the VPN provider. The provider can see your traffic. Tor routes your traffic through three volunteer-operated nodes, with encryption at each hop — no single node can see both who you are and what you are doing. Tor is slower but provides stronger anonymity. A VPN is good for hiding your activity from your ISP or casual observers; Tor is better for high-anonymity browsing or accessing .onion sites like SecureDrop.

Do not use the device for any sensitive communications. Do not delete anything — preserve it as evidence. Disconnect from Wi-Fi and mobile data. Contact your editor and legal team immediately. For serious suspected compromises (e.g., state-actor spyware such as Pegasus), contact the Access Now Digital Security Helpline or a specialist security consultant. Do not attempt to 'clean' the device yourself — a forensic image should be taken first. Notify any sources who may have communicated with you via the device.

No. Proportionality is the key principle. If you are a local reporter covering planning disputes, you probably do not need SecureDrop. If you are working on a story involving organised crime or intelligence agencies, basic tools are not enough. Start with your threat model — who might want your data, what they could do with it, and what it would cost them to get it. Then choose tools that match that risk level. The threat modelling guide on this hub is the right starting point.