Home / Traffic / OW-0006
Journalist OPSEC — primaries, not theater
OW-0006 · LIVE · unclassified packet
OW-0006LIVE
This packet is a map of published press-freedom guidance. It is not a spy novel, not a leak dump, and not legal advice. CPJ, Freedom of the Press Foundation, and EFF wrote the primaries. If this page disagrees with them, they win.
Start with a threat model, not a shopping list. EFF’s security-plan questions, which FPF remixes for newsrooms: what are you protecting, from whom, how bad if you fail, how likely, how much friction you will actually sustain, who your allies are. A high-risk exile reporter and a metro beat reporter do not buy the same stack. Capability is not likelihood.
Comms. Signal is the default E2EE messenger in current FPF/CPJ kits; harden it, use usernames, disappearing messages, safety-number verify. Signal is not anonymous. WhatsApp encrypts content and still hands Meta a metadata problem — FPF says lock it down or don’t use it for sources. Email is PGP or same-provider E2EE (Proton/Tuta); Proton’s E2EE does not magically cover Gmail on the other end. Anonymous files go through SecureDrop or OnionShare, not a web form that logs IP. Metadata survives encryption. Minimize it.
Devices. Full-disk encryption on (FileVault, BitLocker, LUKS, phone defaults). Long unique passcode. 2FA with an app or hardware key, not SMS. Power down so the disk is actually at rest — FPF and CPJ both repeat this for raids and border crossings. Disable biometrics before a protest or a checkpoint; a finger unlocks what a PIN would refuse. Compartmentalize: work machine, work accounts, work identity. Personal photos do not live next to source notes. Cloud backups that are not E2EE are copies you no longer control.
Identity and sources. Legal name, home address, and family do not belong on a work channel. Cover names and work mail stay in their compartment. CPJ’s source-protection notes are blunt: mix work and personal and a single seizure or phish takes both. After the 2026 U.S. Journalist Assistance Network memo on device seizures: audit what you hold, encrypt it, power down, have a deletion and backup process before you need one. Border: CPJ’s April 2025 checklist — consider clean devices, log out, FDE on, biometrics off, powered down. That is published journalist guidance, not a dare.
What this node will not do: run your sources, promise anonymity it cannot keep, or replace a lawyer. The dead-drop is mailto plus a published PGP key. Encrypt to the key. Don’t put a legal name on a drop. If your threat model is above that, use a newsroom SecureDrop and talk to CPJ or FPF. Primaries, not vibes.