Publishing workflow

Anonymity for journalists

Journalist anonymity protects sources and people involved through contact separation, file checks, article review, and post-publication handling.

For journalists, anonymity is not a technology that protects only themselves.

It is practical work for protecting sources, people involved, witnesses, people who were at the site, and people who handed over materials.

Even if names are withheld in the article body, people involved may be inferred from communication paths, reporting notes, photos, PDFs, publication time, wording habits, edit history, and cloud sharing logs. The dangerous mistake is thinking, "I did not write the name, so it is fine."

Anonymity is the ability to manage whose information remains where and what it connects with.

This article explains the scope journalists should look at when thinking about anonymity, divided into before reporting, contact, materials, before publication, and after publication.

The protection target is not only yourself

In journalist anonymity, the protection target must be considered broadly.

Think not only about your own identity and communication, but also the source's identity, a witness's routine places, people involved and their affiliations, the path through which materials were obtained, and reactions after the article is published.

Who to protect	Clues that leak easily	Caution
Source	Contact time, origin of materials, internal terms, writing style	Candidates narrow even if names are withheld in the body
Witness	Region, job type, age group, statement content	Stories known only by a few people involved are strong clues
Reporter	Communication environment, reporting location, account, posting time	The reporter's behavior may be used to infer the source
Newsroom	Receiving method, cloud sharing, internal logs	Weak organizational handling breaks protection
People involved	Photo background, part of a material, quoted wording	People around the person also get pulled in

For source protection, the process by which an article is made matters as well as what is written in the article.

Who was contacted? Which device received the materials? Which cloud were they placed in? Who edited them? When were they published?

All of these become material that can later be correlated.

Separate contact paths

In contact with sources, if you use everyday real-name accounts or personal devices as they are, anonymity becomes weaker.

Email, social media, messaging apps, cloud sharing, forms, phone calls, in person. Every route leaves logs and metadata.

What matters is not choosing a contact method only by whether it is convenient.

Contact path	Information visible or remaining	Caution
Ordinary email	Sender, recipient, time, subject, email headers	Easy to connect with real-name or organizational accounts
Social media DM	Account, login state, device, time	Records remain with the platform
Messaging app	Phone number, contacts, device information, backups	Device and cloud backups become weak points
Cloud sharing	Sharer, viewers, access history, filename	Who viewed it and when may remain
In person	Movement history, surveillance cameras, payment, entry/exit records	Real-world records remain, not only online ones

For high-risk reporting, separate everyday contact paths from reporting contact paths.

This does not mean "hiding wrongdoing." It is to avoid pulling sources into unnecessary logs.

Mechanisms such as SecureDrop are used by media organizations and NGOs to receive anonymous submissions. SecureDrop is an open source whistleblowing and submission system maintained by Freedom of the Press Foundation, designed with emphasis on submissions through Tor and reducing communication metadata.

URL : https://securedrop.org/

However, having SecureDrop does not make the process safe by itself. If the user's device, place of use, submitted files, document content, and behavior before and after submission are weak, they can be correlated from there.

Tor Browser is also an important tool for making the originating IP address less visible to the destination. The Tor Project provides Tor Browser and the Tor network.

URL : https://www.torproject.org/

The detailed mechanism and limits of Tor are explained in articles on Tor basics and the differences between VPNs, Tor, and proxies. Here, understand that in source protection, it may be used as a tool for separating communication paths.

Look beyond the body text in materials and files

For reporting materials, checking only the body text is not enough.

PDFs, Office files, images, audio, video, and screenshots may retain creator names, edit history, comments, GPS, capture time, device name, filenames, cloud history, and similar information.

File	Information that remains	Reason to check
PDF	Creator, creation software, embedded text, annotations	The material's creation environment or editor may become visible
Word/Excel	Creator name, revision history, comments, template	Organization names and staff names often remain
Photo	EXIF, GPS, capture time, device information	Shooting location and reporting time are revealed
Audio	Recording time, background sounds, speech patterns, place sounds	The person or place is inferred
Video	Visual background, audio, metadata, reflections	Information other than faces also becomes a clue
Screenshot	Notifications, time, account names, UI language	Device and user information is captured

When you receive materials, first separate the original to preserve from the copy to process for publication or sharing.

It is important not to publish the original directly.

For publication files, remove unnecessary metadata, check proper nouns and internal identifiers, and also look at information captured at the edges of images and screenshots.

Detailed checks of file metadata are covered in articles on EXIF, PDF, Office files, ExifTool, qpdf, MAT2, and similar topics. In this article, understand that in journalistic work, "information beyond the file body also points to the source."

Anonymizing the article body is not just withholding names

In the article body, the source may be identifiable even if names are withheld.

Even if you write "an employee," "a person involved," or "a nearby resident," candidates can be narrowed from timing, department, number of people, statement content, position, and the range of information known.

Clue in the body text	What happens	Direction of countermeasure
Department or role	Narrows to a small number of candidates	Lower the granularity if unnecessary
Date and time	Compared with work shifts or entry/exit records	Blur exact times
Internal term	Organization or department becomes visible	Replace with a general expression
Speech habit	Individual way of speaking remains	Balance the need for quotation and protection
Part of a material	The acquirer is narrowed from distribution scope	Decide carefully which part to disclose

Specificity is necessary to tell readers what happened.

However, specificity can narrow the source. In journalism, transparency and protection must be balanced.

What matters is being able to explain to yourself why you blur something.

Adjust the granularity of time, place, title, number of people, and quotations not to make facts vague, but to avoid unnecessarily endangering the source.

Correlation continues after publication

Publication is not the end.

Inquiries after publication, replies on social media, follow-up stories, corrections, additional materials, and exchanges with readers also become material for correlation.

Only certain people involved react immediately after publication. A reporter posts additional updates only at a certain time of day. Details known only to the source are added on social media. These behaviors become clues separate from the article body.

After publication, check the following points.

Are you carelessly disclosing additional information about the source?
Are you talking about more detailed background on social media than in the body text?
Do correction histories or replacement files contain new metadata?
Are you revealing the reporting path while handling inquiries?
Does the publication time strongly connect with the source's behavior?

Source protection is not only work done before publication.

Think about anonymity including post-publication handling.

Do not decide alone in high-risk reporting

In cases involving whistleblowing, state agencies, organized crime, political persecution, labor issues, sexual violence, minors, immigrants, war, or regions under censorship, anonymity failures can lead to serious consequences.

For this kind of reporting, do not decide based only on knowledge from one article.

There are situations where you should proceed while consulting newsroom security staff, a trusted lawyer, digital security specialists, and support organizations.

The purpose of anonymity is not to accept danger for its own sake.

It is to make public-interest disclosure compatible with protecting people.

Summary

Journalist anonymity is practical work for protecting not only the reporter, but also sources and people involved.

What needs to be reviewed is not only the article body. Contact paths, materials, metadata, cloud sharing, publication time, social media reactions, and post-publication handling must also be checked.

Mechanisms such as SecureDrop and Tor Browser are used for source protection. However, tools alone do not make the process safe. If devices, files, content, time, and real-world behavior are weak, they can be correlated from there.

In high-risk reporting, do not decide alone. Work with the newsroom, lawyers, support organizations, and specialists.

Anonymity is not for hiding reporting, but for delivering necessary information to society while protecting people.

Related tools

Anonymous communication

Tor Project

An external resource related to this article. Open it only when it fits your situation and threat model.