Tips for protecting your work in a vulnerable world

By Stacy Kess

Equal Access Public Media, a fiscally sponsored project of ANF  

As a journalist, if you weren’t thinking about the security and legal risk of exposing your data, notes and communications before, now is a good time to start. The good news is that it can be easy to keep your information secure. Here are some tips. 

Start with your internet connection.

Choose a VPN (virtual private network) to encrypt your internet connection. A VPN routes your internet connection through a different location or locations. This is most important when you are working from your phone or on a public connection, but can be equally important when you are working on something sensitive on your home internet connection. Proton, known for its end-to-end encrypted mail service, offers a discount to journalists and nonprofits, including fiscally sponsored programs. To take advantage of the discount, send the same documentation you would send any grant maker.

Make sure your email is end-to-end encrypted.

Again, consider Proton. This Swiss-based company is known for its high security and anonymizing information. It offers everything from free individual accounts to business accounts, and packages with the VPN. 

Encrypt your work chat.

If you work with a remote team and use a chat program such as Slack, be aware that Slack is not encrypted. (Slack is also not accessible to all screen readers, cannot be navigated by keyboard and has a few other accessibility concerns.) An alternative is Swiss-based Wire. It’s an end-to-end encrypted communication and collaboration app like Slack, and comes with a free version. You can create rooms for your team, invite guests to specific rooms, or chat one-on-one. You can also video call your teams.

Encrypt your texts.

Did you know that WhatsApp is owned by Meta and collects usage and contact data from users? If you’ve been considering a switch, Signal is an alternative to WhatsApp, made by a nonprofit. It is end-to-end encrypted and is used throughout the world by journalists, NGOs and others for private communications. It’s available at your app store.

Encrypt and diversify document storage.

Have you been storing documents on your Google Drive and OneDrive? You’re not alone, but both Alphabet and Microsoft must reply to subpoenas to turn over customer data – and anything stored in their clouds. Consider using alternatives such as LibreOffice. It’s free from the website or from your app store. 

Here’s where thinking old school comes in very handy: start saving your notes and other sensitive information on thumb or external drives. 

If you can’t stand the thought of going old school, there are a few encrypted options. Proton offers more features with its higher tier VPN and mail options, including Proton Drive for storage, and it includes a document editor. 

Other online options include CryptPad, is a France-based end-to-end encrypted open source suite of office products and document storage with file-sharing capabilities. You can get 1 GB of storage for free without an email address. For about $5 to $15 a month, you can sign up with an email address and get up to 50 GB of storage. 

Is your browser tracking you?

Ensure your preferred browser is set to the right security settings to minimize the number of cookies websites drop; that it warns you if you are about to go on a malicious website;  and that it gives you a warning before you download anything dangerous. 

Check your tracking and ad settings too. DuckDuckGo promises to do the least amount of tracking automatically and it might be the safest browser. But be forewarned, not all forms or websites are built to work with DuckDuckGo as it’s a new kid on the block.

You can do all of these things and still be at risk.

Remember that security starts with your passwords:

• Use two-factor authentication wherever possible.
• Randomize your passwords and save them using a key.
• Never give up your passwords, your sensitive information, or anything else that could give access to someone you don’t know.
• Never trust an email that warns you your account will be suspended unless you “click here immediately” or “reply immediately with your information,” because these are phishing scams.