How Bangladeshi journalists can protect devices, data, and themselves in cyberspace

In Part 1 of this article, we discussed how a journalist can assess risks, protect their online accounts and devices, and basics to scrutinize their smartphones for Pegasus, Predator or Graphite infections.

The final installment of the series will discuss some more serious and in-depth topics for securing their physical devices, communication channels, and sources.    

Device Seizure, Keep in Mind

Sometimes, in home and abroad, there might be situations where a phone or laptop can be examined without any usual legal safeguards. It might happen at a checkpoint, during a protest, or in the course of an investigation.

Before any sensitive assignment, we can take the following measures.

● Backing up important files securely, then removing confidential materials from the devices we are carrying.

● Signing out of accounts we do not need for the assignment. We can create a one-time account if needed. 

● Considering a separate "travel device" holding minimal sensitive and personal data for genuinely high-risk reporting.

● The final goal is, if a device is copied or seized, there is little or no data on it.

Protecting Our Communications

Committee to Protect Journalists, Reporters Without Borders, and Electronic Frontier Foundation recommend journalists to use Signal application for communications. It offers real end-to-end encryption, which is safer than SMS and phone calls for anything sensitive.

Being aware of behaviour pattern is another corner case keeping in mind. Encryption hides message contents from a man in the middle. But the patterns that we contacted someone, when, how often, or roughly from where remains intact. This pattern can hint a source relationship even if no message is ever read between us. We need to randomize how and when we contact sensitive sources and relying on multiple accounts and devices for such communications.

Browsing the Internet Safely

We should strictly avoid using public Wi-Fis. If we badly need one, we must use it with protection. Using a reputable VPN on public or office networks, especially when accessing sensitive accounts is a good practice.

We always need to check for the URL and HTTPS before entering any password even on a trusted website.

We should use Tor Browser for sensitive researches like corruption, organized crime, extremist groups, surveillance. We need to keep in mind that simply visiting a site can reveal our IP address and device information as metadata.

For a high-risk investigations we should consider Tail OS. It runs from a USB drive, leaves minimal traces, and routes traffic through Tor by default preserving anonymity of the person behind the keyboard as much as possible.

Documenting and working around censorship

Bangladesh has a documented history of internet shutdowns during the July Uprising in 2024, according to a joint report by Digitally Right and the Open Observatory of Network Interference (OONI). The report also found that authorities extended efforts to block VPN services.

We need to keep in mind that one VPN will always work. We need backup circumvention options like Tor Browser or Psiphon if our primary VPN is blocked during a crisis.

OONI Probe is a free app for Android, iOS, Windows, and macOS. It lets us test whether a specific website or app is being blocked on our network. 

RSF recommends it to journalists as a way to gather evidence of censorship rather than relying on guesswork. 

However, running OONI Probe can draw attention in high-surveillance contexts. So, RSF proposes to weigh that if we are already under scrutiny.

Phishing

Sometimes we are compromised by a fake link that looks like an original site, for example, a Gmail log in page. 

Before entering a password anywhere, we should-

● Check the actual website address, not just the display text.

● Not click attachments or links from unknown senders.

● Verify unusual or urgent requests through a second channel. We should call the person rather than just reply.

Urgency is often the attack, not a side effect of it.

Keeping Operating System, Software Updated

Keeping our device OS, browser, and apps updated is a good security practice. Security patches close vulnerabilities that are actively being exploited by cyber criminals before any public reports surface.

Protecting Our Sources

Before sharing a digital data like images, videos, documents, or audio files, we need to consider the following things - 

- Does a photo contain embedded GPS location data? Both Android and iOS let us strip this before sharing. Dedicated tools like ExifTool can delete metadata from documents and images.

- Does a document carry hidden author or edit-history metadata?

- Are recordings stored securely, separate from notes that identify the source?

If we remove metadata of the files received from our sources, it will lower their risk.

It's also worth running a self-doxxing audit on our own digital footprints occasionally.  Here is a four-part article to get the basics to preventing ourself from doxing. [https://resources.rsf.org/series/whats-up-doxx/]. 

Protect Ourself from Online Harassment

In the Digitally Right/Fojo study, 50% of female journalists feared sexual harassment while covering the 2026 elections.

If we face coordinated harassment, smear campaigns, or doxxing, we can seek help from the following places

- Online Violence Response Hub (onlineviolenceresponsehub.org):  This organisation is run by the International Women's Media Foundation (IWMF) and the International Center for Journalists (ICFJ) under the Coalition Against Online Violence. This consolidates step-by-step guidance for journalists, specifically built around the tactics used against women, and minority journalists.

- Reviewing our social media privacy settings and disabling location tagging before it becomes relevant.

- If we face harassment, we should document all the evidences and preserve them for legal use. 

Newsroom-Level Preparedness

For editors and news leads, CPJ and International Press Institute provides some practical steps for assigning risk levels to stories, supporting targeted staff, and setting a baseline like encrypted and disposable devices. 

You can read CPJ's Editors' Checklist [https://cpj.org/wp-content/uploads/2022/07/CPJ_online_abuse_checklist.pdf] and IPI’s newsroom protocols for online harassment  [https://newsrooms-ontheline.ipi.media/wp-content/uploads/2020/02/IPI_newsrooms_protocol_address_online_harassment_ok_022020.pdf] here.

Weekly/Monthly Routine Check

Security is a myth. So, relying on false assumptions of security, we can adopt some weekly or monthly habits to save ourselves from cyber criminals.  

- Reviewing passwords on our most important accounts and check for unrecognized logged-in devices.

- Confirming 2FA is active everywhere it should be.

- Checking Have I Been Pwned for any new breach involving our email.

- Installing pending updates and security patches.

- Verifying our backups are current and still encrypted.

- Uninstalling unnecessary apps.

Where Bangladeshi Journalists Can Learn More

Bangladesh

- Digitally Right (digitallyright.org): It is a Dhaka-based organisation that runs Digital Safety School. It provides hands-on training for journalists, activists, and CSOs, plus Dismislab, its disinformation research unit.

- VOICE (Bangladesh): This organisation hosted privacy and data-protection training workshops for media professionals.

International: training and guides

- Committee to Protect Journalists (CPJ): Digital Safety Kit (cpj.org)

- Electronic Frontier Foundation (EFF): Surveillance Self-Defense (ssd.eff.org)

- Global Investigative Journalism Network (GIJN): Digital Security resource hub

- Reporters Without Borders (RSF): Digital Helpdesk (helpdesk.rsf.org)

Emergency and forensic help

- Access Now Digital Security Helpline: This is a 24/7 free and realtime incident response including assessing spyware cases. [email protected]

- Amnesty International Security Lab: A free digital forensics support for journalists and human rights defenders. (securitylab.amnesty.org/get-help)

- The Citizen Lab (University of Toronto): This lab investigates spyware abuses and surveillance targeting civil society.

- Coalition Against Online Violence / Online Violence Response Hub: They support specifically for journalists facing gendered harassment and doxxing. Doxxing in plain English: Public release of an individual's private or identifying information online without their consent, with the intent to harass, humiliate, intimidate, or harm them.

Journalism depends on trust and ethics. Sources trust journalists with sensitive information because they believe it will be handled responsibly.

None of this requires becoming a cyber security engineer except sharpening our senses and keep an eye on evolving technologies. 

A password manager, app-based 2FA, encrypted devices, Signal for sensitive conversations, a risk assessment before high-stakes assignments, and knowing where to turn if something goes wrong will stop the overwhelming majority of attacks aimed at us.

In an environment where information is both a public resource and a target, digital security protects not only journalists, but the people courageous enough to speak to them.