Skip to main content

Device Security for UK Journalists

Encrypted communications are only as secure as the device they run on. This guide covers full-disk encryption, strong passphrases, secure boot, and when to use a separate source phone.

General guidance, not professional security advice. For high-risk threat models involving state actors or organised crime targeting, consult a qualified security professional or the Access Now Digital Security Helpline.

Last reviewed: Next review due:

Why device security is foundational

End-to-end encrypted messaging, SecureDrop, VPNs — all of these protections depend on the device being secure. If your laptop can be opened and read without authentication, your encrypted Signal messages are visible in the app. If your phone has no screen lock, your source’s contact details are accessible to anyone who picks it up.

Device security has two dimensions: protecting data at rest (when the device is off or locked) and protecting data in use (when the device is on and logged in). Full-disk encryption addresses the first. Strong authentication, auto-lock, and physical security address the second.

Full-disk encryption by platform

macOS — FileVault 2

System Settings → Privacy & Security → FileVault → Turn On. Store the recovery key securely offline, not in iCloud.

Windows — BitLocker

Control Panel → System and Security → BitLocker Drive Encryption. Home edition: use Device Encryption. Store the recovery key offline.

Linux — LUKS

Enable during OS installation (recommended) or use cryptsetup post-install. LUKS is the standard full-disk encryption layer for most Linux distributions.

When this matters most

  • 1Your device contains unpublished investigation notes or source contact details.
  • 2You are travelling internationally or covering events where device seizure is a realistic risk.
  • 3Your newsroom has received legal threats related to stories you are working on.
  • 4You have sources who face serious consequences if identified.
  • 5You use a work device that IT can access remotely — source communications should not be on it.

Red flags

  • Full-disk encryption is not enabled on your primary work device.
  • Your device uses no screen lock, or uses a 4-digit PIN.
  • Biometrics are enabled and you are about to cross an international border with sensitive material.
  • You store investigation notes in plain text on an unencrypted drive.
  • Your device auto-connects to open Wi-Fi networks.
  • You have not enabled automatic OS security updates.

Device security checklist

  • Full-disk encryption is enabled on my laptop (FileVault/BitLocker/LUKS).
  • My phone storage is encrypted (enabled by default on modern iOS and Android — verify in settings).
  • I use a strong passphrase (not a PIN) to unlock my devices.
  • My screen locks automatically within 2 minutes of inactivity.
  • I power off (not just close the lid) when my device may be at risk.
  • Automatic OS security updates are enabled on all devices.
  • I have a BIOS/UEFI password set on my laptop (for high-risk work).
  • Secure Boot is enabled in firmware settings (Windows/Linux).
  • For high-risk source work: I have a separate source phone with a separate SIM, not linked to my identity.

Story risk register

Log device security risks alongside editorial risks using our story risk register tool.

Story Risk Register

Common mistakes

  • Enabling encryption but storing the recovery key in iCloud — defeats the purpose.
  • Using sleep/hibernate instead of powering off before a border crossing.
  • Relying on biometrics in situations where coerced unlocking is a risk.
  • Doing sensitive source communications on a work device that IT can access.
  • Not updating the OS — most device compromises exploit known, patched vulnerabilities.

Related guides

Travel Security & UK Border
Device preparation for international travel and Schedule 7 stops.
Password Managers & 2FA
Strong authentication for accounts and services.
Encrypted Messaging
Signal and secure email — protected by your device security.
Threat Modelling
Assessing which device security measures are proportionate.

Primary sources

Frequently asked questions

Does full-disk encryption really protect me if my laptop is seized?
Full-disk encryption — FileVault on macOS, BitLocker on Windows, LUKS on Linux — encrypts all data on the drive. Without the decryption passphrase or key, the data is effectively unreadable. However, encryption only protects a powered-off device. If your laptop is seized while logged in (sleep or hibernate without screen lock), the encryption may not protect you. Always power off, not just close the lid, when your device might be at risk.
Should I use biometrics (Face ID, fingerprint) or a password?
Biometrics are convenient but legally and practically weaker in some scenarios. In the UK, a court can compel you to provide a biometric but cannot compel you to reveal a password (though refusing to decrypt can be an offence under RIPA s.49 in some circumstances). More practically, a passphrase is resistant to coercion at a border stop, while your face or finger can be pressed to a sensor. For high-risk work, consider disabling biometrics when travelling or in potentially coercive environments.
What is a BIOS/UEFI password and do I need one?
A BIOS/UEFI password prevents someone from booting your computer from an external drive, which could be used to bypass the operating system and attempt to extract data. It is a useful additional layer for high-risk journalists, particularly against physical attacks. Set it in your computer's firmware settings. Note that it provides minimal protection if the attacker can remove and access the hard drive directly — full-disk encryption remains the essential control.
Do I need a separate phone for source communications?
For journalists doing high-risk investigative work involving sensitive sources, a dedicated 'source phone' is a proportionate precaution. Register it with a separate SIM (ideally purchased with cash), use it only for Signal conversations with sources, and keep it off when not in use. Your main work phone has your contacts, emails, calendars, and apps — all of which can identify sources indirectly. A clean source phone reduces this risk significantly.

Related guides

Digital SecurityTravel Security & UK Border CrossingsRead →Digital SecurityPassword Managers & Two-Factor AuthenticationRead →InvestigativeProtecting Sources: Operational SecurityRead →Media LawLegal Source Protection in the UKRead →SafetyJournalist Wellbeing & Digital StressRead →

Primary sources