Secure File Sharing for Journalists: Protect Your Sources

Protecting a source starts before the first document is shared. The journalist's threat model includes compelled disclosure, subpoenas, device seizure at borders, state-level surveillance, and the simple risk that a source's metadata — IP addresses, file hashes, login timestamps — survives long after the story runs. Practical tools: SecureDrop for anonymous intake, Signal with disappearing messages for ongoing conversation, a zero-knowledge transfer service like HexaTransfer or OnionShare for documents, and Tails OS or Qubes for the handling device. The Committee to Protect Journalists documented 363 journalists jailed globally in 2023 — source protection isn't abstract.

The baseline threat model

Most journalists won't face GCHQ or MSS, but everyone faces something. Three tiers to plan for:

• Civil subpoena risk. Prosecutors and civil litigants seeking communication records. Affects every journalist in democratic jurisdictions. The 2021 Justice Department subpoenas to the New York Times, Washington Post, and CNN for reporter phone records made the threat concrete.
• Targeted surveillance. A specific actor actively trying to identify your source. Requires operational discipline: separate devices, VPN or Tor, encrypted messengers, careful metadata hygiene.
• Nation-state surveillance. Rare but real for national security, human rights, and cross-border reporting. Pegasus spyware has been deployed against 45+ journalists confirmed by Citizen Lab.

Tooling decisions scale with the tier. A local court reporter needs basic encryption; a foreign correspondent covering an authoritarian regime needs Tails, air-gapped review, and compartmentalized devices.

SecureDrop for anonymous intake

SecureDrop, maintained by Freedom of the Press Foundation, is the professional standard for anonymous source submission. Used by The Guardian, New York Times, Washington Post, ProPublica, The Intercept, and 80+ other newsrooms.

How it works:

1. Sources access the newsroom's .onion address via Tor Browser.
2. They generate a random codename and submit files or messages.
3. Journalists access submissions from a separate air-gapped viewing station running Tails.
4. Files are decrypted only on the viewing station, which never touches the internet.

What makes it strong: Tor hides source IP, the air-gap prevents malware exfiltration, GPG encryption means no server-side plaintext, and automatic deletion after retrieval limits the forensic footprint.

Install is nontrivial — it requires dedicated hardware and a week of careful setup — but for any newsroom accepting sensitive submissions, it's the only credible option.

OnionShare for peer-to-peer drops

When SecureDrop is overkill, OnionShare (developed by Micah Lee) offers simpler Tor-based file sharing. It runs a one-shot hidden service on your own machine, gives you a .onion URL, and shuts down after download.

Properties journalists care about:

• No third-party server holds the file.
• Tor hides both endpoints' IPs.
• The URL contains a random authentication token, so the file isn't publicly listed.
• Works on macOS, Windows, and Linux; bundled with Tails.

Best for one-off exchanges with a source who can install Tor Browser. Not great when the source is on a work laptop with software restrictions — in that case, browser-based services become necessary.

Browser-based E2EE when Tor isn't an option

Some sources can't run Tails or Tor. They have a work computer, a borrowed laptop, or they're in a situation where installing new software looks suspicious. For them, a browser-based end-to-end encrypted service is the pragmatic choice.

What to look for:

• Client-side AES-256-GCM encryption in the browser.
• Key in the URL fragment (after #), never sent to the server.
• Expiring links with configurable TTL (24 hours or less).
• Password protection on top of the link.
• No account required — signup itself generates metadata.

Services that qualify: HexaTransfer, SwissTransfer E2EE tier, Tresorit Send, Proton Drive shared links. Services that don't: WeTransfer standard, Google Drive, Dropbox share links — these all give the provider visibility into file contents.

Signal for the conversation

Files rarely arrive without context. The conversation about "what is this" and "how do I verify" needs its own channel.

Signal, maintained by the nonprofit Signal Foundation, is the journalist default:

• E2EE by default with the Signal Protocol (Double Ratchet, X3DH).
• Disappearing messages with configurable timers (5 seconds to 4 weeks).
• No phone number required to message once you have a username (since early 2024).
• Deletes messages on both devices when a timer expires.
• PIN-protected backups, no cloud backup unless explicitly configured.

Avoid iMessage for source work. Apple can see metadata, and iCloud Messages sync means backups may exist on Apple servers subject to legal process.

Metadata is the assassin

The Intercept's 2017 Reality Winner case is the canonical example: printer tracking dots on a leaked document, combined with the newsroom's handling, led to source identification within days. Metadata to scrub before publishing or sharing:

• EXIF on images — exiftool -all= photo.jpg removes GPS, camera serial, timestamps.
• PDF metadata — author name, creation date, editing software. exiftool -all= doc.pdf plus qpdf --linearize for good measure.
• Microsoft Office metadata — File → Info → Inspect Document → Remove All.
• Printer microdots — visible under blue light on many color laser printers. Air-gap printing to B&W laser, or use the EFF's detection guide.
• File timestamps — touch to a neutral time before sharing if relevant.

For documents that must preserve authenticity (legal evidence), hash the original, work from a copy, and preserve a chain of custody. The Citizen Lab and Forensic Architecture guides are worth reading.

Device hygiene for high-risk reporting

Dedicated hardware for sensitive work pays for itself the first time a laptop gets seized. Recommended stack:

• Work device: locked-down Mac or ThinkPad with FileVault/LUKS, OS updates within 7 days, no personal software, no sync to personal accounts.
• Review device: Tails USB for air-gapped document review. Boots from USB, leaves no trace.
• Personal device: entirely separate, never used for source work, doesn't sync with anything on the work device.
• Burner phones for travel in high-risk jurisdictions, wiped on return.

Pegasus and similar spyware exploit zero-click vulnerabilities in iMessage and WhatsApp. Keep iOS and Android current; enable Lockdown Mode on iPhone for targeted subjects.

Border crossings

Journalists crossing borders face device searches. US CBP has legal authority to inspect devices at entry. UK border officials can compel disclosure under Schedule 7 of the Terrorism Act. The practical response:

• Travel with a clean device — no source material, no Signal history, no browser login cookies.
• Send necessary materials to a secure cloud (Proton Drive, Tresorit) encrypted with a password not in the device's keychain, retrieve on arrival.
• Consider a second device shipped separately.
• Know your jurisdiction's rules — some countries treat refusal to unlock as a crime, others don't.

Freedom of the Press Foundation publishes updated border-crossing guides. Review before travel.

A reporting workflow that holds up

A routine that works for most sensitive stories:

1. Initial contact via Signal from a dedicated work number, or through SecureDrop.
2. Verify identity out of band if possible — public records, mutual contact, prior work.
3. Move to HexaTransfer, OnionShare, or Tresorit for document exchange with 24-hour expiration and password from a shared secret.
4. Review documents on Tails or an air-gapped Mac. Never on a networked device for high-sensitivity material.
5. Scrub metadata before any copy leaves the review environment.
6. Delete Signal thread and shared keys after publication, with a retention policy agreed with editors.
7. Document your own process for shield-law and editorial protection.

Putting it to work

If you're starting: install Signal, set up a password manager, turn on FileVault or BitLocker, and pick a browser-based E2EE transfer service for routine sharing. Graduate to SecureDrop and Tails as your reporting demands. The gap between "secure enough for most stories" and "secure enough for nation-state adversaries" is wide but learnable.

Try it at hexatransfer.com — free, no account, 10 GB max.