CC BY | Jon Rawlinson
By Taryn Blanchard
Journalists have a lot to worry about when they find themselves the target of state and non-state actors, including loss of livelihood, dangers facing their friends and families, threat of assault, spurious prosecution and imprisonment, as well as disappearance or murder. When journalists are compelled to contact emergency assistance programs that are operated by international human rights organizations, in an overwhelming majority of cases they are asking for help to reestablish their physical safety. This can mean relocation, funds for lodging and food, or medical expenses and legal fees.
In the face of these many traumatic circumstances, it would hardly be surprising if journalists in distress did not prioritize their digital security as much as other concerns.
This is precisely what CJFE has found in a study of the digital security of journalists who have received assistance grants through our Journalists in Distress program. The study assesses the digital practices and vulnerabilities of at-risk journalists—ranging from their access to the Internet and use of cyber devices, their use of the Internet at cafés and libraries, their concerns and orientations to their own digital security, and their practices when communicating with emergency assistance programs.
The digital vulnerabilities to journalists in distress revealed in this study are numerous. In some instances they are worrying for what they indicate about the journalists and their situations, whereas in other instances they are related more to the vulnerabilities inherent in digital technologies rather than to anything over which users have direct control.
Read the executive summary.
Download the full report.
Download the full list of digital practices employed by journalists in distress during their work, personal lives and search for assistance. Together, they reveal a number of vulnerabilities to which journalists in distress can be exposed in cyberspace—but they also suggest some strengths and indicate their particular concerns and reasons for behaviours that put them at risk.
Specifically, they show that in certain contexts journalists in distress are often not able or willing to fully mitigate those risks. Given that all the journalists surveyed think it is possible to improve their digital security, this inability or unwillingness is not attributable to negligence or indifference but instead to a host of other factors, such as financial constraints and concerns about family and friends.
The importance of communication for journalists in distress cannot be understated. When they are being persecuted by extremely powerful actors and fear for their lives on a daily basis, a crucial tool that can help combat that sense of suffocating isolation, not to mention provide avenues for assistance, is open lines of communication. More than telephone or mail, the Internet is—not surprisingly—the main mode of communication that journalists in distress use to connect with their friends, families, colleagues and professional contacts, as well as with foreign human rights organizations that may be in a position to help improve their situations.
More than three quarters of the journalists surveyed use the Internet each and every day. But by communicating over the Internet, journalists in distress can put themselves at greater risk of being tracked, monitored, harassed and intimidated by state actors and their allies, as well as by other powerful non-state actors that can gain access to journalists through their online lives and activities.
Journalists in distress access the Internet via their mobile phones more often than computers. Unfortunately, mobile phones today come with so many functions and features that they are subject to the insecurities of mobile networks, the Internet and computers alike.
How do journalists in distress access the Internet?
Mobile phones are physically smaller than computers and they are most frequently carried on the person rather than stored at home or in an office. This means that relying on mobile phones to access the Internet and store data increases the opportunity for a journalist’s device to be stolen or lost in public spaces. The data also shows that journalists’ devices are more likely to be stolen in public spaces than from their private residences or offices.
The infrastructure of mobile phone networks is significantly different than the infrastructure of the Internet. This makes communication via mobile phone less secure because the provider has full access to all text and voice messages sent over its network. Risks to journalists’ privacy and the integrity of their data also increase because it is more difficult on mobile phones than on computers to secure address book information, photos, video clips and text files—and therefore the personal information of both the device’s owner and his/her friends, family and colleagues.
In addition, mobile phones are in fact designed to distribute information about their location in ways that computers are not. This is particularly important to recognize in the context of journalists in distress who are being persecuted by governments that have access to mobile network infrastructure:
“Mobile networks are private networks run by commercial entities, which can be under the monopoly control of the government. The commercial entity (or government) has practically unlimited access to the information and communications of customers, as well as the ability to intercept calls, text messages, and to monitor the location of each device (and therefore its user).” – Security in-a-box
In general, journalists in distress orient to and worry about their digital security quite a lot. A full 60 percent think about their digital security frequently or all the time, while an additional 32 percent think about it sometimes. This is comparable to the almost 90 percent who worry all the time or frequently that their Internet communications are being monitored.
How often do journalists in Distress think about digital security?
Do journalists in distress worry their Internet communications are being monitored?
When asked who they think is monitoring their Internet communications, the journalists have a number of suspects in mind—with the government from their home country at the top of their list, intelligence agents coming in second, followed by the government of the country in which they are exiled, and finally the police. Although the study found that police represent the biggest threat to physically confiscating or tampering with journalists’ devices, foreign governments (when journalists have fled into exile) are the most feared source of remote surveillance.
Who is suspected of monitoring Internet communications?
Who Confiscates Journalists’ Cyber Devices?
The data also indicates that even when journalists are aware of digital risks, they do not always take necessary precautions or measures to mitigate or eliminate those risks. Journalists in distress frequently disregard their sense of insecurity even when they feel unsafe in public or cyberspace—including when they communicate with the staff of emergency assistance programs.
Do journalists in Distress feel safe at Internet Cafés?
Do journalists in Distress leave Internet cafés when they feel unsafe?
Do journalists in Distress communicate with organizations even when they feel unsafe?
Journalists continue to communicate over the Internet despite their strong worries about being monitored and tracked by state or other powerful actors who threaten not only their livelihoods but also their lives. Moreover, almost 40 percent of the journalists surveyed report having passwords that are weak or probably weak, indicating that they are aware of the security risk but have not taken steps to rectify it. Similarly, almost a third of journalists in distress do not clear the browser history and cache on the computers they use at Internet cafés—despite knowing what they are.
Are strong passwords used?
Are the browser history and cache cleared?
With respect to communicating with international human rights organizations, a majority of journalists do withhold information because of safety concerns, representing a basic security precaution they take to minimize the amount of confidential and sensitive information they reveal to strangers from whom they are seeking assistance. The information they typically withhold includes their plans to flee their home country, their real names or the names of family members, and their current locations. Journalists seeking assistance are approximately twice as likely to withhold the names of their family members as their own name.
Do journalists in Distress withhold information because of safety concerns?
What type of information is withheld?
If journalists in distress are withholding sensitive information in the context of their efforts to secure assistance for themselves and frequently their dependents, it bodes well that they may also be withholding sensitive information in their other Internet communications. Interestingly, it appears that the most consistent safety practice that journalists engage in is not sharing their cyber devices with other people.
This may also be a countermeasure to protect their friends and family in case the devices they own are compromised, rather than a security measure meant to protect themselves. This possibility is supported by the finding that 70 percent of the journalists surveyed worry all the time or sometimes about endangering their friends or family if they borrow their cyber devices to use.
Do journalists in distress share their cyber Devices?
Do journalists in distress worry about endangering others?
Taken together, this suggests that when journalists disregard their own safety it is likely due to other concerns they judge to outweigh their security and/or their need to earn a living, which by the nature of their profession relies on communicating and existing in cyberspace.
There is a flipside to this discussion of journalists disregarding their safety concerns. In contrast to many journalists being aware of digital risks and dangers but not taking measures to mitigate or eliminate them, there is also a significant percentage of journalists whose major digital vulnerability is their lack of knowledge about the threats they are facing.
First, and perhaps most worryingly, a full 41 percent of the journalists surveyed do not know what encrypted email is at all. Second, almost 20 percent are unaware of whether their cyber devices have security software installed. Third, and similarly, 71 percent do not know if their devices are free of malicious software—although this may also indicate that some journalists realize malware can be installed on their devices without them knowing.
Is email encryption used?
Is security software used?
Are journalists’ Cyber Devices free of malicious software?
Fourth, when asked about their visits to Internet cafés, more than a third of the journalists surveyed have never looked to see whether surveillance cameras are pointed at the computer screens. Fifth, 20 percent do not know what a browser history and cache are and therefore have never thought to clear them before (see figure above). Lastly, seven percent of the journalists surveyed have never thought about the strength of their passwords (see figure above).
Are surveillance cameras pointed at computer screens?
With increasing digital surveillance of journalists (and activists more broadly)—whether in conflict zones, authoritarian regimes or physically safe countries such as the United States, United Kingdom and Canada—poor understanding of the digital technologies being used, their connectivity and their vulnerability to exploitation limit journalists’ ability to perceive digital security threats and protect themselves. Journalists must understand that any weaknesses in their digital security can lead to very real physical consequences.
Today, even the act of reaching out through cyberspace for help, whether it is formally applying for assistance or informally making contact with a potential source of support, can increase the vulnerability of already at-risk individuals. The protection strategies and actions of the human rights community must be adapted to ensure that the people, organizations and networks trying to help are not contributing to the problem in their efforts to solve it.
Professor Wolfgang Schultz, co-author of “Human Rights and Encryption,” part of UNESCO’s Series on Internet Freedom, states that “encryption and anonymity empower journalists to browse, read, develop and share opinions and information without interference.” Beyond this essential role to their work, encryption and anonymity can also literally save the lives of journalists. The importance of this cannot be understated. Today, digital security is without a doubt fundamental to the protection of freedom of expression and speech, as well as press freedom, and inextricably linked to human rights more broadly.
Article 12 of the United Nations’ Universal Declaration of Human Rights specifies that “no one shall be subjected to arbitrary interference with his privacy, family, home or correspondence.” Upholding this human right is no longer possible without digital security. This means that protecting and improving digital security should not rest solely on the users who make use of various protocols, software, hardware and other technologies that defend their privacy and safety in cyberspace.
Communicating the risks of cyberspace and spreading knowledge of digital security technologies must also be maximized by the human rights community and media outlets of all types and sizes (who are responsible for the staff and freelance journalists they employ), as well as incorporated into the national and corporate policies responsible for monitoring and regulating the ever-growing Internet of Things. The task is as large as the Internet, but it starts with protecting the lives of journalists and activists more broadly—both online and offline.
Qualitative and quantitative research methods were used to develop this report. Between September 1 and October 15, 2016, a survey about digital practices and security was disseminated to 54 journalists who received assistance through CJFE’s Journalists in Distress program between 2011 and 2016. A total of 35 journalists replied to the author’s invitation to participate and completed the survey, representing a significant cross-section of CJFE’s grant recipients from the years 2012 to 2016. Survey respondents included journalists from Latin America, the Middle East and North Africa, East Africa, Europe and Central Asia, and South Asia.
The survey was divided into five sections of questions: 1) use of the Internet, 2) use of cyber devices, 3) use of Internet cafés, 4) digital security, and 5) communicating with CJFE and other international organizations. The questions combined multiple choice and open-ended answers that allowed the author to collect both structured data for quantitative analysis and unstructured data for qualitative analysis. In total, the survey contained 50 questions, a portion of which were accessible only if a participant chose a specific answer to a previous multiple choice question.
Taryn Blanchard is CJFE’s Programs Coordinator.