Somewhere in your inbox there is a message that starts with "I work at…" and ends with a request you cannot answer casually. The person on the other end has probably already taken a risk by typing it. They may also have used a work laptop, a company phone, and a subject line that names their department. Before you reply with the words "you'll be completely anonymous," slow down. That sentence is the cheapest thing to give away and the most expensive thing to take back.

Confidentiality is not a mood. It is an agreement with terms, limits, and consequences on both sides. What follows is the order in which I try to establish those terms, and the questions I want answered before I commit to anything.

Safety Comes Before the Story

The first conversation is not about what they know. It is about what has already happened. Ask what devices they have used to reach you, whether anyone at work suspects something, and whether their name has already appeared next to a question they shouldn't have asked. A source who contacted you from a monitored work account has a different problem than one who walked into a café with a paper folder.

Be honest about the limits of what you can offer. Anonymity in print protects a name. It does not protect someone from an employer who knows that only three people had access to a particular file. If the source's job title is unusual, their team is small, or the document is dated to a week when they were the only person on shift, a careful reader — or a determined lawyer — can narrow the field fast. Say that out loud, early, while the person can still decide to stop.

Ask about jurisdiction too. Retaliation against whistleblowers is treated very differently from country to country, and sometimes from state to state. If the person's livelihood, visa, or liberty is on the line, suggest they speak to a lawyer or a local whistleblower support organisation before they hand anything over. You are not their lawyer, and you should not pretend to be one.

Motive Is Information, Not a Verdict

New journalists treat motive as a character test — as if a source with a grudge is tainted and a source with pure intentions is reliable. That is backwards. Motive tells you what the person wants from the story, which tells you what they might exaggerate, omit, or push you toward. A grudge does not make a document false. A noble cause does not make it accurate.

Listen for the source who has already written the article in their head and needs you to type it. That person will resist every check you propose and will read your questions as disloyalty. It is better to find that out in week one than in week six.

Evidence: What You Can Actually Show

Ask to see originals. Not a summary, not a screenshot of a screenshot, not a photo of a screen taken at an angle. Ask where the material lives now and who else can access it. Ask them, plainly, not to forward it around, not to reorganise the folder, and not to delete anything after it has been shared — that last instruction has saved more stories than any other single sentence I know.

Ask the uncomfortable question as well: what in this material cuts against your account? A source who can name the weak point in their own case is worth three who cannot. And ask whether the files contain other people's personal data — client names, patient records, staff lists. Redaction is part of the job, and it is easier to plan early than to unpick later.

Say Precisely What Anonymity Means

"Anonymous" means different things to a reporter and to a frightened employee. To you it may mean a name withheld from the published piece while two editors and a lawyer know it. To them it may mean nobody, anywhere, ever. Spell out the difference before they tell you anything they cannot untell.

Cover the identification risk, who inside the newsroom will know their identity, how their words will be attributed, and what happens if you are asked in court to reveal them. Explain what you cannot promise: that the story will run, when it will run, how it will be framed, or what will happen to the people named in it. Then write the agreement down in a short message and keep it.

The 20 Questions

Safety

1. Who else knows what you know, and what do they stand to lose?
2. Has anything changed since you decided to talk — odd emails, a changed workload, unexpected questions from a manager?
3. What would realistic retaliation look like where you work: a demotion, a lawsuit, a criminal complaint, a visa problem?
4. Have you told anyone you are speaking to a journalist — a partner, a colleague, a group chat?
5. Do you have a plan for the next few days if this becomes known: somewhere to stay, someone to call, access to legal advice?

Motive

1. What outcome do you actually want — a correction, an investigation, a resignation, an apology, or simply for someone to know?
2. What would disappoint you about how this story turns out?
3. Is there a separate dispute running alongside this: a demotion, a missed promotion, a pending claim?
4. Would you still talk to me if the story ran and nothing changed?

Evidence

1. What do you have in your hands right now, and where is it stored?
2. Are you permitted to have all of it — is anything covered by a confidentiality agreement, a court order, or someone else's privacy?
3. Can you show me the original rather than your account of it?
4. What in this material contradicts what you have told me?
5. Who else could confirm one specific detail — a date, a meeting, a payment?
6. Have you already given this to a regulator, a lawyer, a parliamentarian, or another newsroom?

Consent

1. Which parts of your identity would still be visible to a careful reader: your role, your team, your years of service?
2. Whose safety depends on your anonymity besides your own — a colleague, a family member, a source of yours?
3. What should I do if a lawyer or a court asks me to name you?
4. How should I contact you, on which device, and at what hours?
5. If I cannot verify this, what would you prefer: that I drop it, run your account alone, or wait?

Before You Say the Word

Do not answer question twenty in the first email. Take the call, ask the questions, and sleep on it. Then send one short message that sets out what you will do, what you will not do, and what could still go wrong — and keep a copy where you can find it in a year. Revisit the agreement before publication, because identities become easier to guess once a story is live and readers start counting desks.

The call after publication matters as much as the one before. Attention fades in a fortnight; the source's job does not. Check in when the piece is a month old, and again when it is forgotten by everyone but them. That is the part of the promise most people never think to make.

Photo: George Milton / Pexels