The Safety’s Thirteen: 13 Safety Rules for Investigative Journalists

The most important safety aspect during the investigation is information security. Therefore, we should create strong passwords for all our devices: phones, computers, tablets, and other equipment that we use in the process.

What does a strong password mean? Such password contains capitalization, numbers and symbols.

In your password, you should never use combinations of numbers or letters, or both, that can be associated with you personally. The date of birth is the worst way to protect your data from a hacker.

The access to data on Google Drive or on other servers should only be granted after entering a passwords and two-factor authentication.

The two-factor authentication is a method of identifying a user on a service by requesting two different types of identifying data, which provides more effective two-layer account protection against unauthorized access. In practice, it usually looks like this: the first factor is a login and password, the second is a special code that is sent via SMS or e-mail.

At the same time, an SMS code is not the best way to protect your social networks and mail accounts, so it is recommended to link the two-factor authentication to Google Authenticator.

You should remember the passwords, even the strongest ones. However, this can be difficult. Moreover, a strong password assumes an absence of associations. There is a solution: you can entrust your passwords to one of the services like LastPass or 1Password and remember only one key password.

Do not leave your gadgets that are not password-protected in public places.

If you enter the password in your phone in a public place, try to do it so that the person watching you from the side (via the security camera or in person) cannot reproduce it.

For correspondence, you should use mail servers that are linked to your website domain. If it is not possible, then Gmail or Protonmail is recommended.

The rule of strong passwords and two-factor authentication also applies here.

For interaction with sources of information or members of the investigation team, it is better to use instant messengers that encrypt data. The messenger Signal is preferable. To send voice messages, you can also use Telegram or WhatsApp. You can call via any of these messengers.

Do not publish geotags on social networks that show where you are at the moment. Avoid publishing photos, which can help attackers discover your location.

The less people know your regular routes, the better. It also helps to change your travel habits: challenge yourself to find a new way to get to work at least several times a week.

It is better not to tell everyone the address of your office or coworking location where you work.

You cannot protect yourself from everything, of course, but if you are an investigator, try to share as little information as possible about where you spend your free time.

You must always stay alert. Avoid crowded places, and secluded places such as closed alleys or backstreets.

Do not disclose information about your loved ones. Today, this is the only way to protect your family.

The most dangerous period is from the beginning of the investigation until the moment of its publication.

The risk level is increased if information is leaked, since the subject of the investigation becomes aware that material is being produced. For the same reason, the risk becomes greater when an investigator contacts a second party to receive a comment.

After an investigation is published, the risk level generally decreases.