How to Leak to a Journalist
By Laura Hazard Owen writing for Nieman Lab…
There’s a lot out there to leak.
The second Trump administration, historically unfriendly to the press, has thrown Washington into chaos. Tens of thousands of federal employees have been placed on leave or fired as billionaire Elon Musk’s DOGE tries to gut the government. And taxpayer-funded data is being destroyed.
Amid the confusion, news organizations and individual journalists are changing how they try to attract would-be tipsters. Larger publishers have beefed up their “How to contact us” pages (The Guardian offers a veritable choose-your-own adventure of secure options). And increasingly, Signal, the free, open-source, encrypted messaging app, is seen as one of the best and most secure ways to share information with reporters — whether those reporters work independently, have the backing of a large publisher, or are inadvertently added to a war plans thread.
I spoke with eight journalists about how to leak in a safe, smart way. Disclaimer you probably knew was coming: No method of leaking is 100% secure, and the tips here reduce risk but cannot eliminate it completely. “I know it’s appealing to be instrumental in helping a reporter break a story, and god knows reporters love breaking stories,” says Marisa Kabas, an independent reporter and writer of The Handbasket who’s been breaking one scoop after another about DOGE and the Trump administration. “But in almost all cases, your safety and physical and mental health should come first.”
— Personal devices only
— Don’t leak from work, on a work device, or from work Wi-Fi
— Use Signal and Signal’s camera
— The reporter should recreate any image you leak before displaying it to the public
Why Signal?
SecureDrop, the encrypted, anonymous communication software maintained by the Freedom of the Press Foundation, is still a good option for sources who “don’t want their identities to be known and don’t want to be involved beyond sending the information,” said Ryan Mac, a technology reporter for The New York Times.
Still, there are a lot of reasons why “just sending something to a news outlet” with software like SecureDrop may be unappealing to a would-be tipster who has “concerns about how the documents are going to be used or presented,” says Jeff Horwitz, a technology reporter for The Wall Street Journal whose Bluesky thread on leaking inspired this story.
Mac stressed that many sources “want to have direct communication with a reporter and help them understand: ‘Here’s how this document should be used. This is connected to this other thing I’m about to send you.’ They want that personalized experience, and as reporters and news organizations, we’re at their service, in a way.”
Signal is much more secure than other messaging apps — even those, like WhatsApp, that also offer encryption and vanishing messages. Signal, unlike WhatsApp, “retains only your phone number, when you first registered with the service and when you were last active,” The New York Times notes on its Tips page. “No metadata surrounding communications is retained. The app also allows messages to self-destruct, removing them from the recipient’s and sender’s phones (once it’s been seen) after a set amount of time.”
For the rest, click here.