Lesson 6 of 9 · about 17 minutes

Talking to Sources Safely

You'll be able to

Configure Signal with disappearing messages, a hidden phone number, Registration Lock and safety number checks
Explain what metadata is and why it can expose a source even when content is encrypted
Describe the limits of email and the purpose of SecureDrop
Strip location data from photos and documents before sharing or publishing

When a source talks to you, they are trusting you with their job, sometimes their safety. Most sources who get exposed are not caught by brilliant hacking. They are caught by a forwarded email, a phone bill, a photo with GPS coordinates, or a reporter who said too much in a text. Your job is to make the trail short and boring.

Content versus metadata

Encryption protects what you say. It usually does not hide that you said it. Metadata is the envelope: who contacted whom, when, how often, from what location. Investigators often care more about the envelope than the letter.

Example: a pattern with no words in it

The invented Harlow County water district has 40 employees. A reporter publishes a story about falsified meter test results on a Thursday. The district reviews its phone logs.

Employees whose phone records show calls to the reporter's number in the prior month: 1.
That one employee called 9 times in 14 days, all between 9:00 and 10:00 p.m., starting two days after the internal audit memo circulated.

Nobody needs the content. One out of 40, with timing that lines up, is enough. Had the source used Signal on a personal phone, the district's logs would show nothing, and Signal itself keeps almost nothing to hand over.

Channel	Content protected from the provider?	Metadata exposed	Notes
Phone call or SMS	No	Numbers, times, duration, cell location in carrier records	Shows up on bills and in subpoenaed records
Regular email (Gmail, Outlook, work)	No, the provider can read it	Sender, recipient, subject line, times, often IP address	Work and government email belong to the employer
Encrypted email (PGP, provider-to-provider)	Body yes	Sender, recipient, times; subject often not encrypted	Hard to use correctly; one mistake sends plain text
Signal	Yes, end-to-end	Signal says it can produce only account registration date and last connection date	Contacts and groups are not visible to Signal
SecureDrop	Yes	Designed to hide the source's identity from the newsroom too	For documents, not chat
In person	Yes	Whatever your phones, cars and cameras record	Leave phones behind

Setting up Signal properly

Signal is free, open source, and run by a nonprofit. Its published subpoena responses say the only data it could provide was the date an account registered and the last date it connected (Signal). That is the right tool for most source conversations. The defaults are good, and a few settings make it better.

Disappearing messages. Settings, Privacy, Default timer for new chats. Pick a timer (Signal allows presets or a custom time up to 4 weeks). One week works for many reporters: long enough to finish the story, short enough that a seized phone holds little. You can set a different timer per chat (Signal help).
Hide your number. Settings, Privacy, Phone Number. Set "Who can see my number" to Nobody. Create a username (3 to 32 characters, ending in at least two digits) to give sources instead of your phone number. If you also set "Who can find me by my number" to Nobody, people must have your username to reach you (Signal help).
Registration Lock. Set a strong Signal PIN and turn on Registration Lock under Settings, Account. If someone SIM-swaps your number and tries to register Signal on it, they need the PIN. Signal cannot recover a forgotten PIN for you, so store it in your password manager.
Screen lock and notifications. Turn on Signal's screen lock and set notifications to show no name or content.
Verify safety numbers. With an important source, compare safety numbers in person or on a call. It confirms nobody is impersonating either of you.
Check linked devices. Settings, Linked devices. Remove anything you do not recognize. A linked desktop you forgot about is a copy of every chat.

Signal says disappearing messages are "not for situations where your contact is your adversary." Anyone can photograph a screen. The timer protects both of you if a phone is lost or seized later. It does not protect you from the person on the other end.

Help the source protect themselves

Your settings do not cover the source's side. Gently explain, the first time:

Use a personal phone, never an employer-issued one, and never the employer's Wi-Fi.
Do not use work email, work chat or work computers to contact you, search for your stories, or save documents.
For government employees, messages on agency accounts may be public records that anyone can request.
Photographing a document with a personal phone leaves fewer traces than printing it or emailing it to yourself, but printers and document systems may log who opened what. If only five people had the document, they are the five suspects.
Do not tell coworkers, even trusted ones.

SecureDrop, the concept

SecureDrop is an open-source submission system maintained by Freedom of the Press Foundation. Each news organization runs its own copy, on a server it owns, inside its own building. Sources reach it through Tor Browser, which hides their network location, and upload files without creating an account in their name. The site lists "over 60 news organizations worldwide" using it (SecureDrop). Running one takes dedicated hardware and staff time, so it is usually beyond a solo writer. The concept still teaches something: the safest submission channel collects as little as possible about the person submitting. If a source has documents that are too hot for you to handle, pointing them to a larger outlet's SecureDrop page can be the right call.

Meeting in person

For the most sensitive conversations, meet. Choose a place neither of you visits regularly, without cameras pointed at tables, and get there without your phones or with them powered off and left in the car. Phones report location to carriers and apps whether or not you call anyone. Pay cash if you buy coffee. Do not post that you are "meeting a great source today," which is a thing people actually do.

What never goes in writing

A source's real name next to their information, anywhere: notes, drafts, shared documents, texts with your editor. Use a code name and keep the key on paper.
Speculation about who leaked something, in any channel.
Promises you cannot keep, like "nobody will ever know," which can come back in a dispute.
Jokes, venting or opinions about the subject of the story. If messages are ever subpoenaed or leaked, tone becomes evidence.
Passwords, codes or financial details, even in Signal, unless the timer is short and there is no other way.

Strip metadata from files before sharing

Photos carry EXIF data, which can include the camera model, the exact time and GPS coordinates. A source who sends you a photo of a memo taken at their kitchen table may be sending you their home address. Documents carry author names and edit histories. Before you publish or pass along a file, strip it.

AVPrep can strip location and camera data from photos in bulk in its Images tab, and its Metadata tab has a "Strip all metadata" button for audio and video files. Everything runs in your browser, so no file leaves your machine. The Images module covers the publishing side in Before publishing. For text documents, the safest move is to retype the key passages or export a fresh PDF from a clean file rather than forward the original.

Common mix-ups

Claim: "WhatsApp and Signal are the same because both are encrypted." What the evidence shows: Both encrypt message content. They differ in how much metadata the company collects and keeps. Signal's subpoena responses show it holds almost none.
Claim: "Deleting a text deletes it." What the evidence shows: The other person, phone backups and carrier records may still have it. Disappearing messages set ahead of time are far more reliable than deleting afterward.
Claim: "Using a private browser window keeps a source anonymous." What the evidence shows: Private mode only stops your own browser from saving history. Your employer's network, internet provider and the site still see the visit.

Reporting angle

Your own messages to public officials can become public records. If a source emails you from a government account, a records request from anyone, including the agency's critics or the subject of your story, could turn up that email. Before you correspond with officials on sensitive matters, check your state's public records law for what counts as a record and which exemptions exist. The Idaho FOIA / Public Records Letter Generator at jeffapierson.com shows how requests are framed, which also shows you what someone else could ask for.

Checklist

Signal default disappearing timer set
Phone number hidden; username created for sources
Registration Lock and PIN on; PIN in password manager
Notifications show no name or content
Linked devices reviewed
Source names kept off every digital document
Photos and files stripped of metadata before sharing

Try it

Set up Signal with every setting in the numbered list, then create a username and test it with a friend: have them find you by username with your number hidden. Next, take a photo with your phone's location turned on, run it through AVPrep's Images tab to strip the location and camera data, and compare the before and after files in your computer's file information panel. Finally, write a short note you could send a new source explaining, in plain words, how to contact you safely.

Check yourself

1. What is the longest custom timer Signal's help page lists for disappearing messages?

2. What information has Signal said it could produce in response to a subpoena?

3. Why is a source's work email a poor channel for talking to a reporter?

4. Which of these is metadata?

5. What does SecureDrop let a source do?

6. Signal says disappearing messages are not meant for which situation?

Terms in this lesson

End-to-end encryption: Encryption where only the sender's and recipient's devices hold the keys, so the service in the middle cannot read the content.
Metadata: Data about a communication, such as who, when, how often and from where, as opposed to what was said.
Disappearing messages: A Signal setting that deletes messages from both devices after a timer runs out.
Safety number: A code in Signal that two people can compare to confirm no one is impersonating either of them.
SecureDrop: Open-source software news organizations run on their own servers so sources can submit documents through Tor.
EXIF: Metadata stored inside photo files, which can include camera model, date and GPS location.

Full glossary

Sources

Signal Support, Set and manage disappearing messages checked 2026-10
Signal Support, Phone Number Privacy and Usernames checked 2026-10
Signal Support, Signal PIN (Registration Lock) checked 2026-10
Signal, Government Communication (subpoena responses) checked 2026-10
SecureDrop Overview, Freedom of the Press Foundation checked 2026-10
AVPrep (browser converter with metadata stripping) checked 2026-10