Source Protection for UK Journalists: Legal Framework & Practice

What is source protection and why does it matter?

Source protection is the journalist’s obligation — professional, ethical, and in many cases legal — to keep the identity of confidential sources secret. When a source speaks to you on terms of confidence, they are extending trust that can have significant consequences for their career, safety, or liberty if broken.

The legal framework in England and Wales rests primarily on section 10 of the Contempt of Court Act 1981, which states that no court may require a person to disclose the source of information contained in a publication unless disclosure is necessary in the interests of justice, national security, or for the prevention of disorder or crime. The threshold is “necessary” — not “useful” or “relevant”.

Above the domestic law sits ECHR Article 10, protecting freedom of expression. The European Court of Human Rights held in Goodwin v United Kingdom [1996] that source protection is one of the basic conditions for press freedom. Without it, sources dry up and journalism loses the oxygen it needs to expose wrongdoing. UK courts must read s.10 compatibly with that right.

The NUJ Code of Conduct Clause 7creates a professional obligation: members must protect confidential sources of information. This is reinforced by the Investigatory Powers Act 2016, which — while primarily an intelligence-gathering statute — contains specific procedural safeguards (an independent judicial commissioner review) before journalistic material can be targeted.

When does source protection become legally critical?

Source protection issues crystallise most sharply in the following situations:

• ›A court issues a disclosure order requiring you to name your source — typically via a PACE Schedule 1 production order or a Norwich Pharmacal application.
• ›Police seize your devices, notebooks, or cloud accounts as part of a criminal investigation.
• ›You receive a civil litigation subpoena requiring you to produce notes or communications.
• ›A government department or intelligence agency seeks access to your communications under the Investigatory Powers Act 2016.
• ›A source is arrested and police believe your material could identify co-conspirators or corroborate their case.
• ›You publish a story and a third party — not police — attempts to use civil proceedings to compel disclosure.

Red flags that your source may be at risk

• ●You have received a letter from solicitors asking you to preserve communications relating to a specific story.
• ●A colleague has been approached by police or investigators asking about your reporting methods.
• ●You notice your source has been suspended, arrested, or is subject to an internal leak inquiry.
• ●You are served with any court order, notice, or production order — even one that appears unrelated to your source.
• ●You receive an unexpected request from your employer's legal team to hand over notebooks or emails.
• ●Your source contacts you in a panic saying they think they have been identified by their employer.
• ●You are asked informally by police to "help" with an investigation into a matter you have reported on.

Practical source protection checklist

• Agree confidentiality terms explicitly before any sensitive conversation begins — “off the record”, “on background”, or “deep background”.
• Use Signal with disappearing messages for digital contact with sensitive sources; enable screen-lock and disable cloud backups.
• Do not store a source's real name against their messages — use a codename or pseudonym in your notes.
• Use SecureDrop or a similar encrypted submission system if your outlet operates one.
• Strip metadata from documents before sharing or analysing — use ExifTool or a PDF sanitiser.
• Avoid calling sources from your registered mobile number; consider a dedicated prepaid SIM for the most sensitive contacts.
• Keep physical notes in a secure location; avoid photographing handwritten notes and uploading to cloud services.
• Do not discuss source identity on work email, Slack, or any corporate messaging platform.
• Brief your editor on a need-to-know basis only; document your public interest rationale in a separate file.
• If devices are seized, do not unlock them voluntarily — assert your right to legal advice immediately.
• Review your legal insurance (NUJ, Hiscox, or your outlet's policy) to understand what is covered before you need it.

Common mistakes that expose sources

• ⚠Publishing details specific enough that anyone familiar with the organisation can identify the source, even without naming them.
• ⚠Using regular SMS or WhatsApp without disappearing messages enabled — metadata and backups persist.
• ⚠Storing source contact details in a shared work calendar or address book.
• ⚠Forwarding a confidential document by email without stripping metadata showing who created it.
• ⚠Discussing source identity with other journalists in a social setting or on social media.
• ⚠Assuming that deleting messages removes all forensic trace — deleted data can often be recovered.
• ⚠Agreeing to "help" police informally without realising the conversation is being recorded.

Related guides

Primary sources

Frequently asked questions