Some of the most important stories in journalism begin with tips from individuals who have firsthand knowledge or access to revealing documents. News organizations rely on these confidential sources to uncover information that shapes our understanding of technology, government regulation, and corporate behavior. If you have encountered something that the public should know about, understanding how to communicate securely is essential. This article provides a detailed guide on how to submit tips using email and the encrypted messaging app Signal, along with best practices for protecting your identity and avoiding retaliation.

Why Secure Tipping Matters

In an era of mass surveillance and digital tracking, whistleblowers and sources face significant risks. Using personal email or work devices can expose your identity and the content of your communication. Journalists and news organizations have adopted encrypted tools and procedures to minimize these risks. The Freedom of the Press Foundation has outlined best practices that many outlets now follow, including serving tip pages over HTTPS without third-party analytics or ad trackers. These measures help ensure that your tip reaches the right people without being intercepted or traced. The historical context of whistleblowing, from Daniel Ellsberg to modern-day leakers, underscores the importance of secure channels. Without them, many pivotal stories about government surveillance, corporate malfeasance, and technological overreach might never have come to light.

Email: The Easiest Method

Email remains the most straightforward way to contact editorial teams. Most news outlets provide a general tips address, such as tips@theverge.com. However, sending an email from your regular work account can be dangerous if you are at risk of reprisals. It is strongly advised to use a personal email account, preferably one that is not associated with your employer or your real identity. Consider creating a new, anonymous email account using a service that does not require personal information. Additionally, avoid using work Wi-Fi networks, as they may log your activity. If possible, use a public Wi-Fi connection or a virtual private network (VPN) to further obscure your location. For maximum security, you can also encrypt your email using PGP (Pretty Good Privacy). This requires generating a public-private key pair and exchanging keys with the recipient. While more complex, PGP ensures that even if the email is intercepted, it cannot be read without the private key.

Best Practices for Email Tips

• Do not use your work email or device.
• Use a secure, anonymous email provider such as ProtonMail or Tutanota.
• Avoid including personally identifiable information in the body of the email.
• Encrypt the email if possible using PGP if you are familiar with the process.
• Send the tip to the appropriate staff member if you know their specific email address, but be aware that doing so may make it easier for adversaries to surveil that journalist.

Signal: Enhanced Encryption

Signal is a messaging application that provides end-to-end encryption for text messages and voice calls. It is widely recommended by security experts and used by journalists worldwide. Signal stores only your phone number and the last time you accessed the app, but it does not store messages on its servers or log your contacts. However, to ensure maximum anonymity, you should not use your work phone. Instead, use a secondary device or a prepaid phone. You can download Signal from the official website or app store. The app uses the Signal Protocol, which is considered one of the most secure encryption protocols available, offering forward secrecy and perfect forward secrecy. This means that even if a long-term key is compromised, past conversations remain secure. Signal also supports disappearing messages, which automatically delete messages after a set period, reducing the risk of compromise if your device is seized.

Setting Up Signal for Anonymous Tipping

When you install Signal, you will need to register with a phone number. To avoid revealing your personal number, consider obtaining a temporary phone number using a service like Google Voice or a burner SIM card. Once registered, you can add the journalist's Signal number as a contact. After initiating a conversation, you can delete the contact from your device. This reduces the digital footprint of your communication. The Freedom of the Press Foundation provides additional guidelines for locking down security on Signal, including disabling notifications, using disappearing messages, and verifying safety numbers. It is also advisable to set your profile name to something generic and avoid uploading a profile picture. Keep the app updated to ensure you have the latest security patches.

Contacting Specific Staff Members

Many news organizations list their staff members along with their contact information on author pages. If you have a specific reporter or editor in mind, you can find their email address and Signal number on their individual page. However, be cautious: if your tip is sensitive, it may be better to contact the general tips address first to avoid targeting a specific journalist who may be under surveillance. If you do contact a staff member directly, consider using a separate encrypted channel for coordination. Some journalists also provide a public key for encrypted email or a dedicated Signal number for tips. Always verify that the contact information is current and legitimate.

What Makes a Good Tip?

Evidence is key. Journalists are more likely to pursue a story if you can provide firsthand experience or revealing documents. A hunch or speculation is rarely sufficient. If you have documentation, such as internal memos, contracts, emails, or data, include them in your tip. But always consider the security of the documents themselves. Scan and encrypt files before sending. For highly sensitive material, consider using a secure drop or a dedicated whistleblower platform. Additionally, be prepared to provide context: explain why the information is important and how you obtained it (without compromising your safety). Journalists often work on tight deadlines, so concise and well-organized tips are more likely to get attention.

Background on Whistleblowing and Journalism

Throughout history, whistleblowers have played a crucial role in exposing wrongdoing. From the Pentagon Papers to Edward Snowden's revelations about surveillance programs, individuals who spoke up often faced severe consequences. Modern journalism ethics emphasize the protection of sources. News organizations train their staff in secure communication and legal support for whistleblowers. However, the responsibility also lies with the source to take precautions. Understanding the legal landscape in your country is important. In some jurisdictions, you may be protected by whistleblower laws, but in others, you could face prosecution. For example, the United States has varying protections for federal whistleblowers, but private sector employees may not enjoy the same safeguards. Consulting with an attorney before coming forward is advisable, though it may not always be possible. Organizations like the Electronic Frontier Foundation and the ACLU offer resources for potential whistleblowers.

Technical Details of Encryption

End-to-end encryption ensures that only the sender and intended recipient can read the message. Signal uses the Signal Protocol, which is considered one of the most secure encryption protocols available. It provides forward secrecy, meaning that even if a long-term key is compromised, past conversations remain secure. However, no system is completely foolproof. Metadata, such as the fact that you contacted a journalist, can still be visible to phone companies or internet service providers. Using Tor or a VPN can help, but it also may attract attention. For truly anonymous communication, consider using a dedicated anonymous email service like ProtonMail combined with Tor. Some journalists also use the secure file-sharing service SecureDrop, which is designed specifically for whistleblowers. However, not all outlets have adopted SecureDrop, so email and Signal remain the most common methods.

Another important consideration is operational security (OpSec). This involves not only the technology you use but also your behavior. Avoid discussing your tip with others, and be mindful of your online activity. Social media posts, search history, and even the timing of your communication can be used to identify you. If you are at risk, consider using a separate device dedicated solely to tipping. This device should be kept offline when not in use and should not be connected to your home Wi-Fi.

Journalists themselves take precautions. They often use secure drops, encrypted email, and Signal. They also avoid discussing sensitive stories over regular phone lines or unencrypted email. The trust between a source and a journalist is built on these security measures. By following the guidelines in this article, you can help ensure that your tip remains confidential and that you are protected from retaliation.

The process of tipping a news organization is not just about sending a message; it's about building a relationship of trust. Journalists understand the risks you take, and they will respect your need for anonymity. However, you must also take responsibility for your own security. The landscape of digital surveillance is constantly evolving, and new threats emerge regularly. Staying informed about the latest security tools and best practices is essential. The Freedom of the Press Foundation, the Electronic Frontier Foundation, and other organizations regularly publish updates on secure communication methods.

Ultimately, your willingness to share information can have a profound impact on public knowledge and accountability. Whether it's uncovering a privacy violation, a security flaw, or corporate corruption, your tip could be the start of a story that changes the world. By using the methods described here, you can minimize the personal risk and maximize the potential for your tip to be used effectively. Remember that patience is also important: journalists may take time to verify and report on your tip, especially if it involves complex or sensitive material. But with persistence and careful security, your voice can be heard.

Source: The Verge News