How to leak to a journalist
There’s a lot out there to leak.
The second Trump administration, historically unfriendly to the press, has thrown Washington into chaos. Tens of thousands of federal employees have been placed on leave or fired as billionaire Elon Musk’s DOGE tries to gut the government. And taxpayer-funded data is being destroyed.
Amid the confusion, news organizations and individual journalists are changing how they try to attract would-be tipsters. Larger publishers have beefed up their “How to contact us” pages (The Guardian offers a veritable choose-your-own adventure of secure options). And increasingly, Signal, the free, open-source, encrypted messaging app, is seen as one of the best and most secure ways to share information with reporters — whether those reporters work independently, have the backing of a large publisher, or are inadvertently added to a war plans thread.
I spoke with eight journalists about how to leak in a safe, smart way. Disclaimer you probably knew was coming: No method of leaking is 100% secure, and the tips here reduce risk but cannot eliminate it completely. “I know it’s appealing to be instrumental in helping a reporter break a story, and god knows reporters love breaking stories,” says Marisa Kabas, an independent reporter and writer of The Handbasket who’s been breaking one scoop after another about DOGE and the Trump administration. “But in almost all cases, your safety and physical and mental health should come first.”
TL;DR
— Personal devices only
— Don’t leak from work, on a work device, or from work Wi-Fi
— Use Signal and Signal’s camera
— The reporter should recreate any image you leak before displaying it to the public
Why Signal?
SecureDrop, the encrypted, anonymous communication software maintained by the Freedom of the Press Foundation, is still a good option for sources who “don’t want their identities to be known and don’t want to be involved beyond sending the information,” said Ryan Mac, a technology reporter for The New York Times.
Still, there are a lot of reasons why “just sending something to a news outlet” with software like SecureDrop may be unappealing to a would-be tipster who has “concerns about how the documents are going to be used or presented,” says Jeff Horwitz, a technology reporter for The Wall Street Journal whose Bluesky thread on leaking inspired this story.
Mac stressed that many sources “want to have direct communication with a reporter and help them understand: ‘Here’s how this document should be used. This is connected to this other thing I’m about to send you.’ They want that personalized experience, and as reporters and news organizations, we’re at their service, in a way.”
Signal is much more secure than other messaging apps — even those, like WhatsApp, that also offer encryption and vanishing messages. Signal, unlike WhatsApp, “retains only your phone number, when you first registered with the service and when you were last active,” The New York Times notes on its Tips page. “No metadata surrounding communications is retained. The app also allows messages to self-destruct, removing them from the recipient’s and sender’s phones (once it’s been seen) after a set amount of time.”
Planning your leak
Decide which reporter you want to leak to. You may already have someone in mind; if not, read around to see which reporters and outlets have covered stories on topics like yours before. Many large news organizations now include reporters’ Signal contacts alongside stories, and many reporters list them in their social media bios.
If you know which outlet you want to leak to but aren’t sure which reporter to connect with, you can message the organization’s Signal and ask for the tip to be directed to the right person.
Don’t do any of this research on a work device. Don’t follow the reporter you plan to leak to on social media (unless you already follow them); don’t connect with them on LinkedIn. “Don’t go to my author page on your work laptop. Don’t search on Google for my name and latest stories from your work phone,” Mac says. Some companies have teams that look for signs of employees talking to reporters. “They can comb web traffic, search email contacts, look at social media connections.” Keep it all on your personal device and do it from home, not the office.
You may want to look into whistleblower support services before you leak. Organizations like Whistleblower Aid and The Signals Network’s1 Whistleblower Protection Program can advise on your individual situation and help you make sure your communication is secure as possible. In some cases, they may also be able to assist with legal support.
Think in advance about who could verify your leak, says Julia Angwin, an investigative journalist and founder of Proof News and The Markup. This could be a trusted person who has direct experience with the document or information you plan to share.
Install Signal on your personal device and familiarize yourself with it. The Freedom of the Press Foundation has a good guide to getting started with Signal. Set a username if you want to keep your phone number private and turn on disappearing messages.
Getting in touch
You may want to initiate contact with a reporter on Signal from a public space, using either a public Wi-Fi network or cellular data. “Keep in mind that sending things from work computers, through work email addresses or on work Wi-Fi networks can create additional risks because many corporate and government accounts log web traffic,” ProPublica notes on its tips page.
Your initial outreach message should include just basic information, says Amanda Becker, Washington correspondent at The 19th and a 2023 Nieman Fellow. It could read something like: “Hello, I’m a federal employee and have information I’d like to share about turmoil within CMS (Medicare & Medicaid) that could cause enrollees to be dropped from the program.”
After that, Becker says, she’ll find a time to connect with you on the phone. (The call can take place within the Signal app.) “The number one thing people should know is that a reporter will need to confirm their identity even if they want to remain anonymous in print,” she says. “A tip from someone whose identity I cannot confirm is not really actionable information in most cases.”
Asawin Suebsaeng, a senior politics reporter at Rolling Stone, agrees. “This is nothing personal, but I have to vet who you are,” he says. “In some hypothetical scenario, if you wanted to put the screws to Rolling Stone or some other publication, or if you’re doing some shadowy leak investigation, or you just want to play a prank on a reporter — I have to make sure that’s not the case here. Anyone on Signal can claim to be someone who they’re not.”
Becker and Suebsaeng recommend you give the reporter a way to confirm your identity that doesn’t leave a paper trail. That might be a phone number that’s been publicly linked to you in some way, or screenshots of emails to you at your work email address.
On the journalists’ end, Suebsaeng says, “it is incumbent upon us to be very careful how we go about” verifying somebody’s identity, “and to remind the people we’re talking to that we’re being very careful about this.”
Once the reporter has verified your identity, you can discuss terms for how you’re willing to be identified in a piece, or if you want to remain totally anonymous in the story.
“I’ve had a number of conversations where sources realize midstream that they actually don’t feel comfortable talking to a reporter,” says Kabas. “I handle these situations gingerly and do everything I can to make them feel secure, but not every reporter is so understanding. To that end, making sure you establish the terms of your conversation at the start — on the record, off the record, on background — is essential for the reporter to accurately do their job as well as properly protect your identity.”
Leak time
If you’re leaking a document, take pictures of it with the camera within Signal, which doesn’t save photos to your camera roll, and then send them to the reporter. If the document is on a screen, take pictures of the screen with the Signal app; don’t print anything out. And, again, don’t do any of this in your office or on work Wi-Fi. “You don’t know how these office spaces are being surveilled or what cameras are watching you,” Mac says. Leak on your own data plan or from public Wi-Fi.
A news organization should rebuild documents before displaying them to the public. To help protect your identity, they should not run any of the actual photos or screenshots you send them.
“Sometimes leak hunters will provide different versions of documents to different individuals to see which version leaks and identify the culprit,” says Benjamin Mullin, a media reporter for The New York Times. “To avoid this, you can instruct your correspondent not to quote directly from the document.”
Signal can’t handle documents larger than 100 MB; for those, OnionShare is an option for sharing big documents directly with a reporter without trace.
“It can make a difference”
“I’m biased here, but my advice for leakers is to consider the public benefits as well as the risks of leaking,” said Max Tani, media reporter at Semafor. “Many people have crazy and fascinating stories to share about important people and institutions, but are too frightened by the risk of personal or professional blowback to leak, which is very understandable. But I personally have been on the receiving end of leaks that have led to positive outcomes and greater accountability within companies and institutions. It can make a difference.”
Your leak may encourage other people to come forward. Kabas finds that when she posts leaked information to The Handbasket or on Bluesky, she often gets “a slew of new related tips.”
“My only other advice,” Tani said, “is to leak your good stories to me instead of some other journalist.” Indeed, every journalist I spoke with wanted me to remind you: Reach out to them with tips.
Adobe Stock
- No connection with Signal the app.