“Digital safety is part of the journalistic process”: a cybersecurity expert on the importance of planning for digital risks

In June 2025, a reporter at the International Consortium of Investigative Journalists (ICIJ) received the kind of email that is hard for an investigative journalist to ignore. A man claiming to be a former judicial assistant in Beijing said he had fled China with secret documents exposing an alleged $10 million embezzlement scheme. He offered to share the evidence through a link.

The whistleblower was fake, ICIJ reported in April. The organisation concluded the link was likely a clumsy attempt to steal the reporter’s login details. She did not click. Researchers at Citizen Lab, who analysed the emails, found it was part of a wider campaign that began after ICIJ’s China Targets investigation. They said they were highly confident it was linked to China. The bait was a tip any investigative journalist would want to follow.

That kind of attack, phishing, which uses deceptive emails, messages or websites to trick people into revealing sensitive information or installing malicious software, is hardly new. But digital threats against journalists are becoming more varied and difficult to predict. Mercenary spyware, state-backed surveillance, coordinated online attacks, and AI-powered scams have created new risks for journalists, their sources, and their reporting. Yet many newsrooms and journalists continue to treat digital security as a technical issue rather than a core part of the journalistic process.

Runa Sandvik, founder of cybersecurity consultancy Granitt and former director of information security at The New York Times, has spent years helping journalists navigate that reality. She advises reporters and newsrooms around the world on how to protect themselves, their sources, and their work. During her tenure at The New York Times, she helped strengthen the organisation’s digital defences as cyberattacks against journalists and news organisations became increasingly frequent and sophisticated. Today, her work ranges from security assessments and newsroom training to helping reporting teams prepare for assignments in high-risk environments.

I spoke to Sandvik to find out how journalists and newsrooms can best protect themselves in this evolving threat landscape. The conversation has been lightly edited for clarity and length.

Q. You work directly with reporters, some of whom are under active digital attack. What surprises people most about what they’re up against?

A. When people express surprise, it’s often about what actually triggers a reaction from an adversary. It might be a social media post that really upsets someone, a story that angers someone, or an account that somebody tries to access even though, from the journalist’s perspective, there’s nothing particularly interesting there.

The other thing is the extent to which an adversary can respond to a story. The ICIJ published a major investigation a year ago relating to China, and then a follow-up article about the response to that reporting—a range of different types of attacks.

What may surprise people is that an attack isn’t always someone trying to access your email, trying to access your social media, denying you entry to a country, or deporting you from a country. It could be all of the above, and then some.

So it’s always really interesting, because you are dealing with humans, and humans can be fairly unpredictable. It’s hard to figure out exactly what’s going to happen once you reach out for a comment or publish the story.

Q. How has the threat landscape shifted in the last five years?

A. In some cases, journalists are facing online threats, harassment, impersonation, and intimidation. The rise of social media, the ability to create bots, the existence of large bot farms, and the ease with which content can be manipulated online all make those types of attacks easier for an adversary to carry out than before.

In other cases, it’s scams and phishing, which have been around forever. We’ve always talked about being wary of emails from strangers, and checking links before clicking them. But now, with AI and how quickly attackers can create phishing pages that look exactly like legitimate login pages, those attacks have become easier to craft and harder for us to detect.

So I think these types of attacks have always been there. What’s changed is the scale, the look and feel, and the way we defend against them. That’s constantly evolving.

Q. Having worked with journalists in newsrooms across the world, how different are the threats and the ability to respond to them between a newsroom in New York or London and a newsroom in Nairobi, for example?

A. Newsrooms with more money generally have more resources and, in some cases, an easier time responding to threats. That said, the threats themselves can look very different. For example, in the US, one of the biggest threats might be law enforcement serving Google a legal order to obtain someone’s email records. In the UK, it could be a lawsuit. In Kenya, there could be personal threats and harassment. Different countries experience different kinds of risks.

One thing I’ve noticed is that journalists outside the US, the UK, and Europe are often more aware of the threats they face. They’re less surprised by them because those risks are already part of their day-to-day reality.

Q. Beyond differences in resources, how do large and small newsrooms differ in the way they approach digital security? Are there things each can learn from the other?

Large and small newsrooms often differ in staffing for digital security; equipment and support; and proactive versus reactive security guidance. In some cases, this gap allows the journalists to be more agile… and in other cases, it becomes the thing that holds them back. The security challenges they face are often very similar, which is why all newsrooms – regardless of size – can benefit from discussing recent security events and needs, and learn from each other.

Q. We’ve recently seen cases of forensic analysis suggesting spyware was installed on journalists’ devices. Are we seeing more of this kind of targeting of journalists?

A. Spyware has been around for a while. I don’t know if you remember Hacking Team from years ago. It was an Italian company founded in 2003 that sold hacking tools to governments around the world, which then used them against civil society.

In 2015, Hacking Team itself was hacked, and its tools, emails, and internal documents were leaked online and later published by WikiLeaks. But in the years since, other companies have emerged that are essentially doing the same thing Hacking Team did back then.

We’ve seen NSO Group with Pegasus. We’ve seen Intellexa with Predator. There are other spyware companies that don’t have the same level of name recognition, and some that I’m sure we haven’t even heard of.

Spyware is a real risk. I think it’s something that more journalists are aware of today. It also seems to me that there are more attacks on civil society using sophisticated spyware. At the same time, we’re getting better at both defending against and detecting those attacks.

Q. What are some practical things journalists can do to protect themselves from spyware?

A. Number one, keep your devices up to date. These updates come not just with new features and emojis, but also fixes for security holes that hackers would otherwise leverage. If your device can no longer run the latest version of the software, it’s probably time to buy a new one.

After that, it depends on whether you’re using a PC or a Mac. There are a number of security settings available across Android, iOS, macOS, Google accounts, and apps like WhatsApp that can significantly improve your defenses against spyware.

[Sandvik also recommended this article, which outlines practical steps journalists can take to improve their digital security, including settings for Android, iOS, macOS, Google accounts, and WhatsApp. You can also listen to this 2022 talk by researcher Philip Di Salvo to the Reuters Institute Journalist Fellows for more actionable tips still relevant today.]

Q. Doxxing is a growing risk for journalists. What can reporters do to prepare for that kind of attack?

A. I don’t think you can necessarily protect yourself from doxxing. But it is something you can prepare for. PEN America [a US nonprofit that champions free expression and supports writers and journalists facing harassment] created an Online Harassment Field Manual a few years ago. It contains resources not only for people who are targeted, but also for individuals who are witnesses to the doxxing or to the harassment, helping them understand how they can provide support and what that support might look like.

It also includes guidance for employers. For a long time, journalists were being targeted, harassed, and doxxed, but the organizations around them often didn’t have a framework for thinking about it, talking about it, or responding to it.

Unfortunately, like many forms of online harassment, doxxing isn’t something you can completely prevent. Historically, what I’ve seen is that when someone is harassed online or doxxed, the thing that feels most violating and upsetting is the amount of personal information that becomes public.

One way to navigate that is simply to understand how much information about you is already available online. Take some time to Google yourself and see what’s out there. Are there things you can remove? Are there things that you can lock down or hide or redact in some way? Are there old accounts that you don’t want to have, and can you delete them?

At the very least, be aware of what’s available so that if someone starts digging through your online footprint and using that information in a targeted harassment campaign, you’re not surprised by it. I think that awareness leaves you feeling more in control.

Beyond that, whether you’re a freelancer, an independent journalist, or part of a newsroom, the more you can talk about this with team members, with colleagues, with your employer, the better equipped you’ll be to take action or support each other if and when something does happen.

Q. Can you give an example of how workflow can create security risks, even when a journalist is using the right tools?

A. One example is the Washington Post reporter whose home was raided by the FBI. She used Signal with disappearing messages to communicate with sources. That is the gold standard. So in that sense, it is the right tool, the right setting. But where the risk popped up was the workflow.

Because she linked Signal on her phone to Signal on her work laptop, and because the work laptop used biometric authentication, investigators were able to gain access to the device and to Signal. That I think comes back to; how are you planning your work? How are you ensuring that you’re using the right tools and the right settings in the right way at the right time? And I think that is something that it is really hard to do alone. It requires brainstorming with other people and taking the time to slow down and think through what you’re doing and how to do it safely.

Q. How do you get journalists to adopt more secure tools and workflows when speed and informality are such a big part of newsroom culture?

A. I think it comes down to two things. First, to change a habit, you need to fully understand why you’re changing it and why you’re changing it in a particular way. Second, you need a setup that allows you to make that change and stick with it. It’s like going to the gym or taking your vitamins in the morning. We all know that it’s good for you, but actually doing it and making it a habit can be really hard.

What I’ve found is that for 99% of the work we do, it’s fine to continue working in the ways we’re already used to. But the important part really comes down to knowing how to plan our work, so that when we have something that we sense requires a higher level of security, we know how to go about doing that. Because it is easier to do something more secure that will then slow down our workflow for that one story, source, or project, than to do it for everything we do every day. Because it is really going to slow us down, and it’s going to add a lot of friction. Working safely is really about finding the balance between what’s usable, fast, and convenient, and what’s highly secure but slower and more cumbersome. Not every project requires the highest possible level of security.

Q. What do you wish more editors and newsroom leaders understood about digital security that they currently don’t understand, or perhaps don’t take seriously enough?

A. Two things come to mind. First, I’ve talked a lot about planning your work, but planning takes time and it requires brainstorming.

Editors are in a really good position to help journalists do that brainstorming and to help enforce that part of the workflow. They’re already meeting with reporters, discussing stories, and helping shape coverage. An editor can ask questions like: “Have you thought about this? Have you enabled this setting? I recently learned about this way of defending against spyware. There’s a training I’d like you to take.” IT teams, business-side staff, and newsroom leadership can all also support digital security planning.

The second thing is recognising that planning for safety is part of the journalistic process. Just as you’re thinking about sources, reaching out for comment, gathering information, and incorporating different voices into a story, you should also be thinking about safety. This should be from a digital, physical, emotional, and legal perspective. Those considerations need to become part of the reporting process itself. I think that’s still a shift from what many newsrooms consider their default way of working.