How journalists’ sources get exposed, and how to stop it

When a confidential source gets exposed, people imagine a sophisticated break-in. The reality is duller and more dangerous. Most sources are not unmasked by a brilliant attack. They are unmasked by the ordinary tools both sides were already using.

The cloud is a subpoena away from anyone

If your notes, recordings, and contact list live in a mainstream cloud account, they are reachable by anyone who can compel that company to hand them over. A journalist does not have to be hacked for their files to be read. A court order to the provider can do the same job, and you may never be told it happened. The weak point is not your password. It is the fact that a third party is holding your material at all.

Metadata talks even when content does not

Say you and a source both use an encrypted messenger. Good. The words are protected. But the record of when you spoke, how often, and from which devices often is not. Investigators rarely need the transcript. The pattern is enough. A single timestamp lining up with an internal event can be all it takes to point at the right person.

Devices get seized, and cloud accounts come along for free

When a laptop or phone is taken, the data on it is the obvious risk. The quieter risk is everything that device is signed into. One unlocked session can open a whole cloud account, which means years of material, not just what was on the disk that day.

Closing the gaps

Source protection comes down to a simple principle: the fewer places your material exists, and the fewer third parties hold it, the fewer ways it can leak. That means keeping sensitive notes and files off general-purpose cloud accounts, and using communication where the connection metadata is not sitting on a company server waiting to be requested.

This is one of the reasons we built The Ark the way we did. Your files and your messaging live on a device in your possession, with on-device encryption, instead of on a platform that can be served with a request you never hear about. We go deeper into the source-protection case here.

No tool makes you untouchable, and anyone who promises that is selling something. But you can remove the easy paths, which are the ones that get used. Most exposure is not clever. It is convenient. Take away the convenience and you take away most of the risk.