Last reviewed: Next review due:
9 min readSection 10 CCA 1981: the statutory shield
Section 10 of the Contempt of Court Act 1981 provides that no court may require a person to disclose, nor is any person guilty of contempt of court for refusing to disclose, the source of information contained in a publication for which they are responsible, unless it is established to the satisfaction of the court that disclosure is necessary in the interests of justice, national security, or the prevention of disorder or crime.
The four exceptions — justice, national security, disorder, and crime — are significant. Courts have compelled disclosure in cases involving serious crime and national security. The landmark case of Goodwin v United Kingdom [1996] ECHR established that source protection is a core press freedom right under Article 10 of the European Convention on Human Rights. The ECHR held that an order to reveal a source must be justified by an overriding requirement in the public interest, proportionate to the aim pursued, and supported by adequate and relevant reasons.
The practical lesson from Goodwinand subsequent cases: s.10 is a shield, not an impenetrable wall. The strength of the protection depends on the seriousness of the competing interest. A source exposing minor corporate misconduct has stronger protection than a source involved in serious terrorism. The legal right must be backed by operational measures that make the source's identity unknowable even if the journalist is ordered to disclose what they know.
PACE 1984 production orders
Schedule 1 to the Police and Criminal Evidence Act 1984 gives police the power to apply to a circuit judge for an order compelling a journalist or media organisation to produce “special procedure material”. Journalistic material held in confidence — notes, recordings, unpublished photographs, source correspondence — qualifies as special procedure material and attracts enhanced protection compared to ordinary evidence.
For a production order to be granted over special procedure material, the police must satisfy the circuit judge that:
- A serious arrestable offence has been committed.
- The material is likely to be of substantial value to the investigation.
- The material is likely to be relevant evidence.
- Other methods of obtaining the material have been tried and failed, or have not been tried because it appeared that they were bound to fail.
- It is in the public interest to produce the material, having regard to the benefit likely to accrue to the investigation and the circumstances in which the material is held.
The journalist is entitled to notice of the application and can make representations to the circuit judge. Instructing a media lawyer immediately on receiving notice is essential. If the order is granted and the journalist does not comply, they are in contempt of court. The application process itself offers a meaningful opportunity to contest disclosure before it is ordered.
Investigatory Powers Act 2016 and surveillance
The Investigatory Powers Act 2016 replaced and expanded the Regulation of Investigatory Powers Act 2000 (RIPA). It governs the use of targeted investigatory powers — including targeted interception warrants, bulk interception, targeted equipment interference, and communications data acquisition — by intelligence agencies and law enforcement.
The IPA 2016 introduced a “double-lock” authorisation system: targeted warrants must be approved by a Secretary of State and then reviewed by a Judicial Commissioner. Where a warrant is sought to obtain confidential journalistic material, the Judicial Commissioner applies a higher level of scrutiny. However, the journalist will typically have no knowledge that a warrant has been sought or granted.
The greatest threat from the IPA 2016 to source protection is metadata: communications data showing who called or messaged whom, and when, can identify a source even if the content of all communications is encrypted. Phone records, cell-site analysis, and IP address logs can reconstruct contact between a journalist and a source without reading a single message. This is why encryption of content, while important, is insufficient on its own.
Norwich Pharmacal orders
A Norwich Pharmacal order (NPO) is a civil court order requiring a third party who has, even innocently, been involved or mixed up in the wrongdoing of another, to disclose information that identifies the wrongdoer. The jurisdiction derives from Norwich Pharmacal Co v Customs & Excise Commissioners [1974] AC 133.
In the media context, NPOs have been used to compel social media platforms, internet service providers, email providers, and hosting companies to reveal the identity of anonymous accounts. They can also target journalists directly where the journalist holds information identifying a source or leaker. Unlike PACE Schedule 1 applications — which are brought by police — NPOs are civil applications brought by private parties. Any person or company that claims to have been wronged by a source can apply.
The court must be satisfied that: a wrong has been carried out or arguably carried out by an ultimate wrongdoer; there is a need for an order to enable action to be brought against the ultimate wrongdoer; and the respondent is mixed up in the wrongdoing, even innocently. The respondent's Article 10 rights and the source's Article 10 rights are relevant considerations. Resist NPOs with legal advice — they are not automatic.
Operational security: handover protocols
The most robust source protection is architectural: do not create records that can be compelled in disclosure. This requires disciplined handover protocols from the first contact with a source.
- 1Meet sources in person wherever possible. Physical meetings leave no digital log. Choose locations away from CCTV-dense areas and public spaces with known data-retention obligations.
- 2Never discuss source identity or meeting details over standard mobile calls, SMS, or unencrypted email.
- 3Do not use your work email or phone for initial contact from a source who wishes to remain anonymous.
- 4Ask sources not to use their own work devices or workplace networks when making contact.
- 5Compartmentalise source identity: only the journalist and, where essential, the editor should know who the source is. Do not record the name in any document connected to the story.
- 6Do not keep source materials — notes, documents, recordings — beyond the period of operational need. Securely destroy what you no longer require, subject to your legal obligations not to destroy documents under a live court order.
Device and communications security
Encryption of communications content is necessary but not sufficient. Metadata — who communicated with whom, when, and from where — can be as revealing as content. A layered approach is required.
- Signal: use Signal for communications with sources. Enable disappearing messages. Verify safety numbers with the source in person. Signal metadata (who contacted whom) is still accessible to signals intelligence agencies with the right warrant, but message content is end-to-end encrypted.
- Air-gapped devices: for the most sensitive material, use a device that has never been connected to the internet and is used only for that investigation. Store it securely when not in use.
- PGP/GPG encrypted email: a viable option for asynchronous communication, but requires both parties to manage keys correctly. Key management failures are common.
- Metadata stripping: use ExifTool (command-line, free) to remove EXIF metadata from images and documents before handling or storing them. Documents can carry authorship, edit history, and location data.
- Secure file destruction: use verified secure deletion tools (e.g. srm on macOS/Linux, Eraser on Windows) rather than simply moving files to the bin. Deleted files remain recoverable without secure overwrite.
- VPN limitations: a VPN shifts the point of trust from your ISP to the VPN provider. It does not make you anonymous. Do not rely on a VPN alone to protect source communications.
What to do when served with a production order
If you receive notice of a PACE Schedule 1 application, or are served with a production order or Norwich Pharmacal order, the following steps are essential.
- 1Do not comply without legal advice. A production order is not self-executing — you have legal rights and the order may be challengeable.
- 2Do not destroy material. Destroying documents subject to a court order is a separate contempt offence. Preserve everything in its current state.
- 3Preserve the original order. Note exactly when it was received and in what form.
- 4Contact the NUJ legal team or a specialist media lawyer immediately. The NUJ operates a legal helpline for members: +44 (0)20 7843 3700.
- 5Notify your editor and your organisation’s legal counsel. Do not handle this alone.
- 6Seek to challenge the order before complying. For PACE Schedule 1, there is an inter partes hearing before the circuit judge at which you can make representations.
Key threats to source confidentiality
PACE production orders
Police apply to a circuit judge. Journalist material is "special procedure material" with enhanced protection. You can make representations. Non-compliance is contempt.
IPA 2016 surveillance
Targeted warrants can capture metadata without the journalist knowing. Judicial Commissioner oversight applies for journalistic material — but the warrant is secret.
Norwich Pharmacal orders
Civil orders brought by private parties — not just police. Platforms, ISPs, and journalists can be compelled. Resist with legal advice; they are not automatic.
Digital metadata
Phone records, IP logs, EXIF data, and document edit history can identify sources even when message content is encrypted. Strip metadata and avoid creating logs.