The first message from a new source usually arrives badly. A direct message on a personal account. A work email with a company signature at the bottom. A call to the newsroom line from a number that will sit in a phone bill for years. The instinct is to answer straight away, and that answer is where protection either begins or quietly ends.

Source protection is not a piece of software you install once. It is a set of agreements, habits and small decisions made before anything sensitive is exchanged. This guide is for people handling their first sensitive source, or their fifth, who want a plan that is realistic enough to follow on a bad day.

Start With the Person, Not the Platform

Before you think about apps, think about what your source is actually risking. Their job. A professional licence. A custody arrangement. Their immigration status. Relationships with colleagues who will be questioned if an internal investigation starts. The answers change everything about how you should talk to each other.

Ask directly, early, and without drama: what happens to you if your name becomes known? Who would be angry, and what could they do? Some people will shrug; others will go quiet. That silence is information.

The second question is more practical: what can you actually use? A tool the source cannot operate reliably is not protection, it is theatre. If someone checks their messages on a shared family tablet, an elaborate encrypted setup will fail at the first notification. Better a modest method used consistently than a fortress abandoned after a week.

Build a Small Threat Model

You do not need a security consultant. You need ten minutes and a piece of paper. Write down four things.

• Who might want this information. An employer's IT department? A litigation team? A regulator? A colleague with a grudge?
• What they can realistically do. Demand records, seize a device, serve a subpoena, read a shared inbox, review building access logs, or simply ask around.
• What already exists. Old emails, calendar invites, phone records, badge swipes, a shared drive with version history.
• What happens if it fails. Not in the abstract. For the source specifically.

Most protection work is about the third item. People agonise over encryption and forget that a meeting already sits in two calendars and a coffee receipt. Match your effort to the risk you have written down. Over-engineering has its own cost: complicated routines create mistakes and get dropped.

Choosing a Channel That Fits

Channels differ in who can read the content, who can see that the conversation happened, and how long traces last. Roughly, from strongest to weakest for sensitive material:

• In person, with care. No digital record of the conversation, provided you leave phones out of the room and are not meeting somewhere cameras or colleagues make you memorable.
• End-to-end encrypted messaging. Good for coordination, arranging meetings, and short exchanges. The content is protected in transit, but message timing and contact patterns still exist on both devices.
• Encrypted email. Workable if both people are disciplined, tedious if they are not. Key mistakes are common and often silent.
• Ordinary email and work chat. A record on at least two servers, usually backed up, often retained after deletion. Fine for "can we speak this week", wrong for documents.
• Voice and video calls. The content is not stored by default, but the fact of the call is, in call logs and billing records.
• Post. Slow, unglamorous, and still the right answer for some physical documents.

Pick one primary channel and one fallback. Tell each other exactly which is which, and what a switch from one to the other means.

Set the Rules Before the First Document

A short, explicit conversation at the start prevents most disasters later. Agree on the channel, the hours you will use it, and what should never be sent through it.

Agree on a signal for trouble: a phrase, a missed check-in at an agreed time, a message that means "stop and call me from a different line". Agree on what to do if one of you goes silent unexpectedly, and how long silence should last before the other person acts.

Agree on retention. Who keeps the messages, on which device, for how long, and when they get deleted. If you are keeping material for a story that may take a year, say so now rather than surprising the source later.

You cannot promise a source that they will never be identified. You can promise that you will not be the reason they are.

That framing matters. Be precise about what you can offer, and do not inflate it. Vague assurances feel kind in the moment and become a betrayal when they fail.

Reduce Exposure in Daily Practice

Most leaks of source identity are mundane. A phone left face up. A contact saved under a real name. A screenshot with a meeting time in the corner. A notebook photographed for a colleague. The fix is boring and effective.

• Turn off message previews on your lock screen. A name in a notification is enough.
• Save contacts under neutral labels that will not read as a source to anyone scrolling your phone.
• Keep sensitive notes off shared drives and out of collaborative documents with version history.
• Do not photograph documents in a way that captures a desk, a badge, a window or a reflection.
• Meet somewhere that is not your usual café, arrive separately, and avoid paying by card for two.
• Keep the number of people who know the source's identity as small as the work allows, and say so out loud when briefing colleagues.
• Update devices and lock screens. Obvious, and skipped constantly.

One habit worth building early: a written note of what you have agreed, kept securely and away from the newsroom systems that other people can browse. Memory is unreliable when a story runs for months.

Plan for the Day Something Goes Wrong

Assume a lost phone, a seized laptop, a message sent to the wrong thread, or a colleague mentioning a detail in a meeting. Decide now what happens next, while you are calm.

Who do you tell first? What do you say to the source, and in which channel? What do you not say, because it would confirm something? If a device is taken or requested, who handles that conversation with the organisation, and who checks what the law requires? Rules on source protection, and on what can be compelled from a journalist, differ widely between countries and even between courts. Take advice from a lawyer or your editor's legal contact before you improvise.

Write the answer down in three lines. An emergency plan you cannot remember is not a plan.

The One-Page Version

Put all of this on a single sheet you can find in thirty seconds: the primary channel, the fallback, the trouble signal, the retention rule, the emergency steps, and the short list of people who know the source exists. Review it when the story changes shape, and again when it gets published. Then keep the sheet somewhere that does not sync anywhere by accident.

None of this requires expertise. It requires deciding, in advance, that the source's safety is part of the reporting rather than something to think about afterwards. That decision is the whole plan; everything else is paperwork.

Photo: Danny144 / Pixabay