How Bangladeshi journalists can protect devices, data, and themselves in cyberspace

Every journalist in Bangladesh, in the field or at the desk, has to carry at least one digital device that contains confidential sources, information, unpublished investigations, interview recordings, personal photos, fintech apps, email accounts, cloud storage, and years of professional contacts. 

Our laptop, smartphone, desktop etc. may hold leaked documents, evidence of corruption, or whistleblower communications.

In 2025, Digitally Right and Fojo Media Institute of Sweden conducted a joint study before the 2026 national elections. They surveyed 201 journalists across 19 districts and found that 65% feared hacking attempts, 75% anticipated disinformation campaigns against them or their newsrooms, and 80% expressed concern about surveillance, specially for women reporters. 

So, digital security has become an integral part of responsible journalism.

However, most of the risks can be mitigated through a few consistent habits, some routine checks, and utilizing free and open-source tools.

Assessing The Risks

We can start with a digital risk assessment, a practice the Committee to Protect Journalists (CPJ) and others formally recommend. We will ask ourselves- 

What information do I possess, and who might want it?

What would happen if my devices are stolen, or my email hacked?

What beat am I covering- politics, crime, corruption, business, or national security?

Will I travel to checkpoints, borders, protests, or high-surveillance areas?

CPJ recommends separating this into two layers:

Everyday digital risk: The baseline hygiene every journalist needs.

Story-specific risk: Extra precautions for a particular investigation.

Our security should match our beat or working scopes. This is not a generic checklist.

Protecting Our Online Accounts First

Most attacks begin with one compromised account. If someone owns our email, they can often reset passwords for Facebook, WhatsApp, cloud storage, and banking apps linked to it.

We should use separate emails for our professional and personal use. In plain English, we should use separate email IDs banking, cloud storage, social media etc.   

A public facing email ID is more easy targets for cyber criminals. 

But the question is, if we use so many emails, how would we remember the IDs and Passwords.

The answer is using a password manager. A single password must never protect multiple accounts. Bitwarden, 1Password, and KeePass can be used to generate or keeping passwords, urls, user IDs and other essential details of our accounts.

Turning on two-factor authentication (2FA), but we must avoid SMS codes where possible. 

CPJ specifically flags SMS-based 2FA as vulnerable to SIM-swapping attacks. We can use an authenticator app like Google Authenticator or Microsoft Authenticator.

Using passkeys where offered. Passkeys replace passwords entirely and resist phishing by design. We should enable them on Gmail, Apple, Microsoft, or GitHub accounts if available.

For high-risk accounts, we can consider a hardware security key. If we are investigative reporters, or anyone likely to be individually targeted, a physical key, such as a YubiKey, can come in handy. We can use these for the most sensitive and important accounts. This is stronger than any app-based code and it's what Google's Advanced Protection Program requires.

Checking whether our credentials have already leaked. Have I Been Pwned (haveibeenpwned.com) lets us check if our email has appeared in a known data breach. This is a good healthy habit to do each week.

Protecting Our Devices

Our laptop and phone are our makeshift newsrooms. If someone gains physical or remote access to these devices, our entire investigation could be exposed.

First of all, we should refrain from using cracked Operating Systems and software packages. For most of the journalists in Bangladesh, we have to maintain a tight monthly budget. Most of the time we use refurbished laptops that are already five or six years old. Software updates for these devices are often defunct that make our laptops more vulnerable to cyber attacks. If we use Linux-based distribution, by investing some time for becoming an intermediate user, the outcome is manifold.   

Firstly, the devices will give us better performance on older hardware and enterprise level security, if tweaked by us, free of cost. 

Also, Linux systems administration makes a security concern journalist take almost full control over the hardware it is running. 

Turning on full-disk encryption is another important part. Windows: BitLocker. macOS: FileVault. Linux: LUKS. Android and modern iPhones encrypt storage by default once we set a secure PIN or password.

Using a strong screen lock for smartphones and laptops. We must avoid easy to guess passwords like a 4-digit birthday or common swipe patterns. We must never ever leave a device unlocked during interviews or in public places.

Encrypting sensitive files and preserving backups separately. Encrypting external drives, USB drives, and phone backups with confidential data is a must. An unencrypted backup drive can expose years of reporting and confidential documents even if our main device is secure.

If we suspect sophisticated spyware attack on phone

Most antivirus software cannot detect advanced spyware like Pegasus, Predator, or Paragon's Graphite. 

Although these kind of spyware are used against high profile journalists. 

In 2025–26, Paragon's Graphite spyware was confirmed to have compromised journalists' iPhones via WhatsApp with zero user interaction required.

In this case we don’t have not that much options but two measures can be takes.

Apple's Lockdown Mode (Settings → Privacy & Security → Lockdown Mode) and Google's Advanced Protection (built into Android 16) restrict exactly the features spyware exploits, for example, link previews, certain attachments, and unknown connections. 

Security researchers, including Access Now's Digital Security Helpline director, now recommend both as the strongest available defense for journalists and activists. We can also restart our phone regularly and keeping software packages update.

Amnesty International's Security Lab developed Mobile Verification Toolkit (MVT). This Python tool was used in the original Pegasus Project investigation to scan device backups for indicators of spyware compromise. 

Although, MVT requires at least some intermediate forensic expertise to interpret correctly, we can utilize free tutorials available online and use it to scan our devices regularly. 

If there are concrete concerns that we are being targeted, we should contact Amnesty's Security Lab (securitylab.amnesty.org/get-help) or Access Now's Digital Security Helpline ([email protected]). Both of them offer free forensic support to journalists and civil society.

[To be continued…]