OPERATIONAL SECURITY Journalism, and particularly investigative journalism, often takes place in contested information environments, and the very act of exposing the truth can upset powerful or dangerous individuals and organizations. While the risks of investigating stories in the public interest is not new, social media and digital platforms have emphasised the opportunities - and risks - associated with conducting investigations. To this end, it is important for journalists and open-source researchers to conduct their work online in a manner that keeps themselves and their sources safe. A. CREATING AND USING INVESTIGATION ACCOUNTS Always conduct your investigation using a separate, purposefully created account that cannot be linked back to you. A suite of investigations accounts is trivial to set up, and the benefits are numerous. Set up a dummy email. Create a new email address using any of the free email providers (Gmail, Yahoo and Microsoft are all acceptable) that cannot be linked back to you. ProtonMail (https://protonmail.com/) is a more secure option but will sometimes be flagged as “suspicious” by social media platforms and require you to provide additional information. One can also check if their email account has been exposed through a platform data breach on https://haveibeenpwned.com/ • Set up your investigations accounts. Create your investigation accounts on the various social media platforms using this new email address. Use generic usernames or profile pics that cannot be traced back to you. Make sure you also have setup multi-factor authentication and have reviewed the security settings on all accounts. HaveIBeenPawned is the only reliable tool to use for this. In other cases you’ll usually realise your account has been compromised based off of the fact that you can no longer access the account. • Don’t allow the platforms to find your contacts. In some cases, social media platforms might prompt you to provide it with access to your contacts. Never allow this; not only does it provide a link between your real identity and your investigations account, but it can also suggest your contacts to your investigation target as possible friends. • Engage as little as possible. Follow as few other accounts as possible (if any at all) and never interact with any of the content you’re investigating. This includes liking, sharing or commenting on posts. • Be mindful. While using your investigation account, be mindful of your actions. Ensure you’re using the correct account before sending a DM, and make sure you don’t accidentally reveal your investigation accounts when taking screenshots for your article. Not only does using your personal accounts potentially expose you (and by extension your friends and family) to the subject of your investigation, but it could also alert them to the fact that they are being investigated in the first place. Page A SURVIVAL 12 TOOLKIT FOR JOURNALISTS A SURVIVAL TOOLKIT FOR JOURNALISTS Page 12