Contact methods and account separation for journalists

Contact Methods and Account Separation

Mixing contact methods used for reporting with everyday personal accounts weakens source protection.

Real-name email, a personal phone, personal social media, an everyday cloud account, work chat. These are convenient, but if they are used to contact sources, notifications, histories, contacts, login state, and sharing history get mixed together.

For journalists, account separation is not only for protecting yourself.

It is a basic practice for keeping contact with sources from being left in unnecessary places.

Why separation is necessary

When contact methods are mixed, unintended correlation is created.

Exchanging messages with a source through personal email. Sending DMs from an everyday social media account. Storing materials in a personal cloud account. Pasting screenshots into a work chat. These actions create traces in multiple places.

Without separation, you lose track of where points of contact with sources remain.

Reporters often work under their real names. They routinely use public email addresses, social media, accounts from their media organization, personal phones, and newsroom chats. If contact with a high-risk source is mixed into that environment, traces spread through notifications, histories, files, contacts, and cloud sharing.

The purpose of contact separation is not only to hide the reporter's identity. It is to leave contact with sources only where it needs to remain. It helps you keep track of where traces are left.

Units to separate

Separation does not mean simply changing the account name.

Separate email, devices, browsers, cloud accounts, contacts, storage locations, and notifications.

For high-risk reporting, consider a dedicated device or dedicated environment.

Even for lower-risk reporting, at minimum you need a habit of not mixing it with everyday personal accounts.

The depth of separation depends on the risk of the reporting. For an ordinary request for comment, a work email address may be enough. For whistleblowing, labor issues involving fear of retaliation, political repression, crime victimization, minors, or immigration status, consider a dedicated environment.

Strong separation takes more work. But when the harm to a source could be serious, that work is part of source protection.

Guide sources to separate their side too

Even if the journalist's environment is separated, traces remain if the source contacts you from their everyday environment.

If they contact you from real-name email, a workplace device, company Wi-Fi, a work cloud account, or personal social media, records are created at that point.

Not guiding a source toward dangerous contact methods is also the journalist's responsibility.

Before saying "send it here," think about what traces will remain.

Sources are not always familiar with the technical side of providing information. If you only say "please send the materials," they may use a workplace device, real-name email, a work cloud account, or personal social media. At that point, strong traces remain.

Journalists need to explain in the first contact what should not be sent. For example: do not send from a workplace device, do not attach internal materials to real-name email, do not upload them to an ordinary cloud account, and first discuss only the outline.

Do not relax just because separation is in place

Even if accounts are separated, writing style, posting times, devices, IP addresses, browser information, and file handling can still connect them.

Separation is not something you configure once and finish.

What matters is not mixing environments during daily operation.

Operational mistakes still happen in a separated environment. Opening personal email in a dedicated browser. Installing personal social media on a reporting device. Moving reporting materials to an everyday cloud account. Capturing a source's name or a notification in a screenshot. These failures happen through everyday use, not through settings.

Separate where reporting materials are stored

Even if contact methods are separated, risk remains if storage locations for materials get mixed. If files received from a source are placed in a personal cloud account or a general newsroom shared folder, more people can access them. Filenames, thumbnails, sync history, and revision history can also reveal a source.

Handle reporting materials by deciding who can view them, where they are stored, how they are backed up, and when they should be deleted. For high-risk materials, do not place them in an ordinary work folder. Separate them into a location that only necessary people can access.

Review the separation regularly

When reporting continues for a long time, the separation created at the beginning can break down. Using ordinary email for an urgent confirmation. Temporarily sending materials to a personal device. Moving files into a normal cloud account for editing. When these exceptions accumulate, points of contact with the source spread.

Separation is not an initial setting. It is an operation maintained until the reporting is complete.

Summary

Separating contact methods and accounts is a basic part of source protection.

If personal email, real-name social media, personal phones, everyday cloud accounts, and work chats are mixed with source contact, traces spread.

Separate email, browsers, devices, cloud accounts, storage locations, and notifications.

Sources also need guidance about options that do not use real-name email, workplace devices, or work cloud accounts.

Separation is an operation, not a setting.

Related tools

Related articles