Skip to main content

State-Actor Threats for UK Journalists

The Investigatory Powers Act 2016 gives UK intelligence agencies significant surveillance capabilities. This guide explains the legal framework, what is documented, and how to recognise indicators of surveillance without paranoia.

General guidance, not professional security advice. For high-risk threat models involving state actors, consult a qualified security professional or the Access Now Digital Security Helpline. For legal matters contact the NUJ legal team.

Last reviewed: Next review due:

The legal landscape

The Investigatory Powers Act 2016 (IPA) consolidates and extends UK surveillance law. It authorises: bulk collection of communications data; targeted interception warrants; equipment interference warrants (device hacking); bulk personal datasets; and National Security Notices compelling UK companies to maintain surveillance capabilities. The Act also created the Investigatory Powers Commissioner’s Office (IPCO) to provide independent oversight.

Before the IPA, the Regulation of Investigatory Powers Act 2000 (RIPA) governed most surveillance. RIPA is still relevant: RIPA s.49 can compel a person to provide an encryption key to law enforcement. Refusing can be a criminal offence (up to two years imprisonment for most cases, five years in national security cases).

Documented cases involving UK journalists

GCHQ bulk interception

The Investigatory Powers Tribunal found in 2015 that GCHQ had unlawfully retained communications intercepted under bulk collection programmes, including communications of journalists and NGOs.

Metropolitan Police CHIS operations

The undercover policing inquiry (Mitting Inquiry) has documented cases where undercover officers from the Special Demonstration Squad gathered intelligence on journalists covering protest and activism stories.

Foreign state spyware

Forensic investigations by Amnesty Tech and Citizen Lab have documented Pegasus spyware (developed by NSO Group and sold to state clients) on devices in the UK, including devices linked to journalists covering foreign government stories.

Production orders against newsrooms

UK police have served production orders on newsrooms and journalists under PACE, seeking sources and unpublished materials. The NUJ has contested several of these orders.

Red flags (without paranoia)

  • Unexpected, significant battery drain on your phone — some spyware is highly battery-intensive.
  • Elevated mobile data usage you cannot account for.
  • Contacts who seem unusually well-informed about details of your unpublished work.
  • Unusual login alerts on accounts, or accounts accessed from locations you do not recognise.
  • Legal threats from well-resourced government-connected parties that reference unpublished information.
  • Your sources tell you they have been approached by people asking about their contact with you.

State-actor threat checklist

  • I have assessed whether my current beat makes state-actor surveillance a realistic (not just theoretical) threat.
  • I use Signal for source communications and have disappearing messages enabled.
  • I use full-disk encryption on all devices.
  • I do not rely on SMS or standard email for communications with sensitive sources.
  • For suspected device compromise: I have contacted the Access Now Digital Security Helpline rather than attempting to clean the device myself.
  • I know the NUJ legal team's contact details and have notified my editor of any legal demands.
  • I have not complied with any RIPA s.49 encryption key demand without taking legal advice first.

Source protection tools

Assess your source protection posture against a state-actor threat model.

Source Protection Checklist

Common mistakes

  • Dismissing state-actor risk entirely — it is documented and real for specific beats.
  • Confusing normal phone battery behaviour with spyware indicators — context matters.
  • Attempting to clean a device suspected of spyware infection without forensic imaging first.
  • Complying with a RIPA s.49 encryption key demand without taking legal advice.
  • Not informing sources that state-actor surveillance is a realistic threat for their story.

Related guides

Threat Modelling
Assessing whether state-actor threat applies to your work.
Travel Security & UK Border
Schedule 7 and device preparation for border crossings.
Crisis Response Playbook
What to do if you suspect your device has been compromised.
Encrypted Messaging
Signal and encrypted email for high-risk communications.

Primary sources

Frequently asked questions

Does the UK government actually surveil journalists?
Yes, in some documented cases. UK intelligence agencies (GCHQ, MI5) have conducted surveillance of journalists under the Regulation of Investigatory Powers Act 2000 and the Investigatory Powers Act 2016. The Investigatory Powers Tribunal has found that GCHQ unlawfully intercepted communications of journalists in some cases. The Metropolitan Police was found to have used undercover officers (CHISs) to gather information about journalists. State surveillance of UK journalists is not hypothetical — but it is concentrated on specific beats.
What is a Targeted Equipment Interference Warrant?
Under the Investigatory Powers Act 2016, the Secretary of State can authorise a Targeted Equipment Interference Warrant allowing intelligence agencies to covertly hack into a specific device. This can include installing spyware that records everything on the device — keystrokes, messages, photos, microphone. The target must be named or described, and a Judicial Commissioner must review the authorisation. For most journalists this is not a realistic threat, but for those covering national security beats it is a known capability.
What is a CHIS and why does it matter for journalists?
A CHIS (Covert Human Intelligence Source) is an undercover agent or informant authorised under RIPA 2000 (now also CHIS Act 2021). Police forces and intelligence agencies can authorise CHISs to befriend, infiltrate, or gather intelligence on targets — including journalists and their sources. The Metropolitan Police's CHIS unit (the Special Demonstration Squad) was found to have targeted journalists and activists. If you are covering sensitive domestic political stories or protest movements, be aware that your contacts may include authorised CHISs.
How do I know if I am being surveilled?
In most cases, you will not know. Targeted surveillance under the IPA is conducted covertly, often with non-disclosure requirements on the service providers served with warrants. However, some indicators can raise concern: unexpected battery drain on phones (potential spyware); elevated data usage; anomalous login alerts; contacts who seem unusually well-informed about your unpublished work; or legal challenges to your stories citing information that was not in the public domain. If you have genuine concerns, contact the Access Now Digital Security Helpline or a specialist in spyware forensics.

Related guides

Digital SecurityThreat Modelling for UK JournalistsRead →Digital SecurityEncrypted Messaging: Signal & ProtonMailRead →InvestigativeProtecting Sources Against State SurveillanceRead →Media LawLegal Source Protection & IPA 2016Read →SafetyJournalist Wellbeing Under Surveillance ThreatRead →

Primary sources