,
18 tweets,
8 min read
Read on Twitter
We had an important discussion at #wcsj2019 about how to protect your sources, your data, and yourself. Here’s a thread of highlights from the session with lots of digital security advice & links. wcsj2019.eu/Sessions/Data-…
Thanks to @deborahblum for organizing the session and to Julien Martin, @weskandar & @danapriest for generous and useful advice and to @theWCSJ and @Wcsj2019Eu for a fantastic conference.
Here are some of the ways people can share information confidentially with The @WashingtonPost Note that number five is: Drop it in the mail, from a mailbox. This was a theme throughout the session: Don't use technology if you can avoid it. washingtonpost.com/anonymous-news…
Julien Martin from @ICIJorg started with some must-dos: two-factor authentication, pass phrases, encryption. And the basic of basics: Beware of the danger of a false sense of security. You can see his presentation here: washingtonpost.com/anonymous-news…
A lot can be figured out from metadata. "We kill people based on metadata." More advice: Turn your devices off. Don't use them or bring them. Turn off any location information. nybooks.com/daily/2014/05/…
He's working on a project called DataShare for collaborative and secure investigative journalism. brown.columbia.edu/portfolio/data…
Next @weskandar talked about Ismail Alexandrani, an Egyptian journalist living in Berlin who was detained when he returned and in custody since 2015. His prosecutors were able to restore some deleted files from a device they took at the airport. cpj.org/data/people/is…
He talked about the differences between data security "after a fire" (how to restore data that authorities are trying to destroy) or "after a raid" (when you need to hide data to protect people from authorities). "Being overcautious is not bad."
He works with Tactical Tech and has a kit here of techniques for beginners or experienced investigative journalists. tacticaltech.org/#/news/exposin…
The surveillance systems we're dealing with now, @DanaPriest pointed out, grew out of US & Western efforts to catch terrorists after 9/11. Now they're being used all over by military, law enforcement and corporate powers. "Think of yourself as a target," she said.
She said if you're up against a state intelligence service, there's not much hope of using technology to evade surveillance or decryption. She emphasized the basics, including investigative techniques used by Woodward & Bernstein.
Like moving a flower pot on your balcony to send a message to a source that you need to meet. washingtonpost.com/business/2019/…
If you need to call someone, don't use your own phone--go to a library or bar or hotel and use theirs. Use code names for anonymous sources so you don't slip up and hae their names overheard (even if you're in your news room).
Meet in places that are natural for conversations: Museums, university campuses, busy streets. "Parking garages are actually places I've used a lot" -- @danapriest, bringing the house down.
Rather than storing notes electronically, write them by hand -- in scribbly handwriting -- so it'd be very hard for anyone else to read them.
Don't share too many details when you publish your story. Call things "internal documents" so it's hard to figure out what they are and who gave them to you. Avoid specifying dates or places if they're distinctive.
Security is a way of thinking about the world, not a technological feature. Be aware of the risks are people taking to share information, and protect them and your readers and yourself. Thanks again to @weskandar @deborahblum @DanaPriest Julien Martin & @theWCSJ
And here's the link to the excellent data security presentation from Julien Martin at @ICIJorg docs.google.com/presentation/d…
