How can journalists and researchers keep themselves safe while reporting online

By Sara Sheridan

Last week, the world watched as a violent mob of protestors overtook law enforcement and attempted to stop the certification of votes for the incoming President of the United States, Joseph R. Biden Jr. The Constitutionally mandated ceremony is usually an uneventful one. Instead, thousands of President Trump’s supporters — amped up by a speech he gave early Wednesday morning in which he continued to spread baseless allegations of voter fraud and electioneering — descended upon the Capitol.

The mob rushed through the halls as Members of Congress and journalists were whisked into hiding by an ill-equipped and underprepared Capitol police force. Members of the mob were angry. They were armed. Plastic gas masks were handed out as tear gas was released inside of the rotunda. Outside the building, photographers and reporters on assignment were harassed, assaulted and, in at least one instance, had their equipment destroyed by Pro-Trump supporters.

Last September, a document by the Department of Homeland Security, as reported by Politico, identified white supremacists as the biggest threat to national security. And for years, journalists who cover the far right, white supremacy, and other extremist groups have reported on the growing threats of violence, especially on online forums. In recent months, these calls to arms have grown in both intensity and scope, attracting new recruits from the Qanon universe and mega-MAGA adherents by way of fringe social media platforms such as Parler, Gab and Spreely, as well as on more popular platforms like Twitter and Facebook over the past four years.

With the removal of President Trump from Twitter, Facebook and other major platforms last week, the news’ attention turned to the more obscure platforms that provide a place for far-right conservatives to gather and organize. Soon after Trump’s ban, came the downfall of Parler after its removal from major app stores and Amazon’s web hosting services. Free speech evangelists were outraged. Big Tech critics were cautiously vindicated. But ultimately, the events that prompted such drastic tech decisions last week were the culmination of years of unfettered misinformation spread. Most importantly, it took the needless deaths of five people last week to spur a widespread, critical conversation about the role of social media platforms in the shaping of our democracy.

The platforms may be splintering, but we know that seditious organizing continues. So what should journalists do when the powerful turn violent or are beholden to dangerous conspiracy theorists and extremists? How do they keep themselves safe while reporting online?

The Tow Center asked a group of experts — reporters on the ground, a media lawyer, researchers who specialize in online extremism — to provide their tips and takes on these questions. The resounding theme: if you must venture, exercise an abundance of caution.

Their answers have been condensed and edited for clarity.

Respondents:

Jennifer Henrichsen: Visiting Fellow, Yale’s Information Society Project; author of “War on Words” Who Should Protect Journalists?”

Ben Collins: NBC News reporter covering disinformation, extremist and the Internet

Susan McGregor: Associate research scholar, Data Science Institute; former professor at Columbia Journalism School

Stuart Karle: Partner and general counsel, North Base Media; adjunct professor of media law, Columbia Journalism School

Priyanjana Bengani: Computational journalism fellow, Tow Center for Digital Journalism

Razzan Nakhlawi: National security researcher, Washington Post

Michael Edison Hayden: Senior investigative reporter, Southern Poverty Law Center

Megan Squire: Professor of Computer Science, Elon University; researches online extremism

Sharon Kann: Research director, Media Matters for America

What are the basic safety precautions journalists need to follow when reporting on fringe or extremists groups online?

Jennifer Henrichsen: I’d encourage everyone to use a password manager so that they are better positioned to use complex and distinct passwords for their accounts. Using two-factor authentication to secure your accounts is also important, especially before reporting on groups that you think might target you. Not all two-factor authentication solutions are created equal, so it’s best to use more robust mechanisms like authenticator apps rather than text messages, when possible.

Ben Collins: Number one thing is use a throwaway email address and password that you’ll never use again. It is unclear where this data is going or if it’s at all secure [on the platforms]. Treat every moment like you’re about to hand your phone over to a stranger with bad intentions. Don’t trust anyone, don’t post anything, behave as if everything you do, including your password, is public information. Did I mention to use a burner email and password?

Susan McGregor: You really need to make sure that you prepare before you go into these spaces and before you start reporting on these topics. The biggest thing these days is compartmentalization: separating your work and personal profiles. You do not post where you live, who your friends and family members are, or the physical location of where you work on Twitter, Instagram, Facebook, LinkedIn or any social profile (LinkedIn being one that people often overlook.)

I also wouldn’t go into any of these spaces without a VOIP number (such as Google Voice or Skype), so you’re not ever giving out your sim-attached number.

Stuart Karle: Minimize or omit personal details. If you can’t set up an account without details like a birthdate or a credit card number, then my advice would be not to register. To every extent possible, use office addresses, corporate credit cards, non-personal information to establish accounts or gain access. Don’t lie about who you are, but offer only the information that doesn’t mean someone can show up at your door or misuse your personal details to harm you.

Also, clean up your current social accounts and check them regularly. Go through and get rid of the stuff you wrote when you were 16 and mad; 21 and drunk, 25 and mad at your ex. This doesn’t mean the information disappears, as others may have saved it, but the farther you get from the clean up, the harder it will be for someone who isn’t talented to abuse your past.

Priyanjana Bengani: In this brave new world where political actors and militant groups are running social networks, extra caution is recommended, especially when you don’t know who the actors are, where the funding comes from, how data is stored, what the security practices are, and whether data is being siphoned elsewhere. If reporting on these networks is vital, at the very least, use a VPN, a disposable phone number and a disposable e-mail address. Using a VPN to access these platforms provides a layer of anonymity as you connect to them via a middleman thereby masking your actual IP address.

At the Tow Center, we use ProtonVPN and ProtonMail for VPN access and email, respectively. ProtonMail is designed to be privacy-first. Amongst other things, this means that by default, tracking pixels and remote loading of images is disabled. For most other commercial email providers, not only do users have to go in and manually disable tracking pixels, but they might also inadvertently end up connecting their account to other services.

We use burner SIM cards for phone numbers, but often a Skype or Google Voice number will suffice. If you are using a browser to access any of these services, we recommend not using your default browser in case it reveals any information about you. If Safari is your default browser, use Brave or FireFox for any investigative work involving alternate platforms.

Razzan Nakhalwi: I spent a day a couple months ago deleting any sensitive information about myself online. It shows up in the weirdest of places, like a phone number or address on an old resume uploaded online. I set up Google alerts for my phone number and address so that in case they are published somewhere that Google crawls frequently, I get almost instant notification. Also, going through the dozens of data brokers (those online white pages) to find my profile and requesting deletion helps to calm my concerns about doxxing.

Michael Edison Hayden: Get off Facebook. If you must, lock it up to the utmost privacy settings. Pare it down to as few friends as possible. You may need access to it to report, but no one needs to know what your family or loved ones look like. The nature of the site is about sharing your personal life and reporters don’t need to do that.

Make sure that if you’re reporting on the type of matter that might create a mob reaction (and it’s hard to tell these days what that is) to ensure that your friends and family are aware. It’s smart to quietly educate the people who might be affected by that reporting and encourage them to get two-factor authentication on their own profiles. Pay for Privacy Duck or Delete Me to get your address offline. Better yet, make sure your employer pays for it.

On Twitter, avoid giving people an idea of where you are. Do not talk about your favorite bar. Do not provide a digital trail to help people piece together where you are. Lastly, be wary of the wifi you’re using. Your home is one thing, but if you’re working at a hotel or at a coffee shop, it can be a nightmare. Don’t use any public wifi without a VPN ever.

Okay, I’ve cleaned up my digital footprint. How do I manage security maintenance as I report?

Susan McGregor: Because journalists often operate within an ethical framework, we forget that there are no rules, no limits to what people will do if they’re coming after you. They will post about your friends and family, they will post about your kids’ school. They will make use of anything they can get their hands on, which makes it important for all of us to engage with our friends and family about this stuff. Your mom can’t follow you on your professional profile, she has to stick to your private one. Nothing is worth compromising your safety or the safety of loved ones over. And I say this now as someone who’s also a parent: I don’t have pictures of my kids online.

Priyanjana Bengani: As more organizing and conversations move to these alternative platforms, which can be hostile to journalists and researchers, it’s important to construct a threat model prior to investigating. The risks are different and vary based on factors specific to the platform, including ownership and the content you are engaging with.

WhatsApp and Telegram, for example, are both messaging applications not owned by a political entity or militia group but used widely by both. When you join a group on WhatsApp, your phone number is exposed to all members of the group; on Telegram, only your username is. (However, if someone already has your phone number in their contacts, Telegram will map the user ID to that phone number).

Therefore, if you’re doing reporting on closed groups, using a separate mobile number is the sensible approach. On both these platforms, unless you volunteer the information yourself, your IP address, location, device information, and other potentially personally identifiable information is not exposed to other users.

When you’re deep in the weeds, screenshot or archive anything relevant to your story in case the post is deleted, the user account suspended, or the platform itself goes down. But, if you start pulling in personally identifiable information of other users (phone numbers, for example), make sure your security protocols are bulletproof so you don’t leak their information inadvertently either.

Razzan Nakhlawi: It’s important to remember that the vast majority of threats are from keyboard warriors who are trying to scare journalists into silence. Of course, there are a few cases that need to be relayed to authorities, and it’s crucial you have that support from either your close circle or your news organization.

Megan Squire: I use a different technology for different situations. Some of it includes three different VPN services, multiple standalone browsers, a separate computer, Tor, and so on.

Since much of my work is automated programs that collect data, the security considerations I used inside my software may not be broadly applicable to a general audience, but I always stay passive. I do not engage in any way. I don’t even answer security questions for Facebook groups, and I do not answer “vetting” questions.

How do I protect myself from online harassment? What do I do if I’m harassed or doxed?

Jennifer Henrichsen: If you are harassed following something you’ve written, try to disconnect from the internet until the outrage dies down a bit and have a friend or colleague monitor your social media so you don’t have to see the vitriol. During this time, also be wary of links from people you don’t know as they could be phishing attempts. Even though it’s unsavory and emotionally depleting, plan to archive the hate so you have evidence to show if it escalates to a point in which law enforcement needs to be involved. Also engage in self-care rituals — whatever those are for you — during and following harassment.

PEN America and The New York Times have good resources with more specific tips on how to battle online harassment and doxing.

Susan McGregor: Avoiding harassment is not about covering different things or writing differently or representing differently. It’s about feeling safe and confident that you are prepared and protected to the best possible degree. Harassment is not criticism or critique. The fact that women face more harassment isn’t a reflection on women’s behavior, it’s a reflection on who’s doing the harassing. [McGregor is currently researching and developing tools to identify online harassment of women and women-identifying journalists]

Ultimately, I think we need to talk about engaging our organizations and editors more. How is the organization prepared to support a journalist who is attacked? Harassment is not something you deserve. A lot of women I talk to have a squad — people in the profession and/or people on a similar beat. There’s a huge psychological toll associated with this stuff. You need to talk to people who have been through it. It is a trauma. The idea that you would continue to do your job in the face of pervasive, gendered, sometimes violent harassment is an extraordinary thing. So if you need to do it differently or just do something else, that’s not a failing on your part. If you wanna be in it for the long haul, taking care of yourself is essential.

Razzan Nakhlawi: Since I still haven’t quite figured it out, I would love to know how to care for your mental health while researching and reporting on these spaces. You subject yourself to the most abhorrent content on a daily basis and it does mess with you, even if, like me, you consider yourself thick-skinned.

So far, I’ve found making a clear delineation between work and play helps — on the weekends I try not to touch anything extremism or even politics-related and focus on other interests like music, culture and gaming. It hits different when you’re covering people who’d like to see you dead! You have to be pretty pragmatic; I know that I’ll probably receive tons more heat from a hypothetical right-wing mob online than a white colleague and it makes me more exacting and careful with my work. Also, I think an even larger emphasis on mental health is needed for those of us with targeted identities.

Michael Edison Hayden: All journalists have a responsibility to themselves and their loved ones to protect themselves whether or not they venture into the alt-right beat. But if you are going on these fringe websites, you need to be extra careful. You wouldn’t go into a bee’s nest as a beekeeper with bare hands. I would urge people to preemptively block anyone they think is going to logroll them or stir up a harassment campaign. It’s a way to blunt the negative trajectory of a story, but it’s also for your sanity’s sake.

I’ve been deluged with violent threats. There were people threatening to kill my father on specific dates and times. It felt like I had a kind of rain cloud following me around all the time. This stuff is not a game. This isn’t something people should do without some level of self-protection.

Sharon Kann: We try to have an open door policy about instances of doxing or harassment. If something makes someone uncomfortable, even if it’s “not that bad,” we encourage them to report it. Depending on the level of severity, we will either support that person in getting some supplemental security set up, have someone else help monitor their mentions, or give them the space to work on something else for a bit.

I don’t think there are any guaranteed ways of avoiding [harassment] wholesale, but that means we have a responsibility to provide a full range of support to those who are on the frontlines.

What are the ethical considerations of reporting down the rabbit hole?

Susan McGregor: The question of reporting with leaked or hacked information is its own conversation, but one that’s important to have especially now that Parler is gone but being archived. I wrote a report back in 2019 about this — there are genuine journalistic uses of leaked info, but it has to be really carefully considered.

Stuart Karle: You should not [use a pseudonym in your reporting]. Use your middle name, your nickname, your handle if that’s all that’s needed. But if someone asks for your name, give your name, or don’t give it and see whether that is really a block. Even for research purposes, it’s a mistake if you pretend to be someone else.

If you’re at the start of or begin to see a story, you need to disclose that [you’re a journalist] and give anyone whose comments you’ve recorded an opportunity to explain them. You’re balancing two interests here: Keeping yourself away from the greatest vulnerabilities by someone with a vendetta, and keeping your work professional and defensible as journalism.

Think of it this way: If you’re sitting at a dinner at a friend’s house, and the person next to you starts explaining how they are in fact the brains at Apple and Tim Cook is an empty suit, it may be true, but it’s more likely that they’re just trying to impress you. Once they know you’re a journalist and working, they are likely to say, “Nevermind,” or words to that effect. At that point they realize it’s potentially for publication, not to impress a new acquaintance.

Razzan Nakhlawi: Aside from non-identifiable usernames for certain spaces, I announce myself to anyone I actively contact. The vast majority of work I do is simple observation, but if I want to confirm an identity or interview someone from an online space I’ll reach out and identify myself as a journalist in my initial correspondence. At the same time, the work is too important to let threats have a chilling effect, and some of the best investigative work I’ve seen in this field is done by nameless accounts on Twitter.

Michael Edison Hayden: Be careful about what details you reveal with extremists. It’s important to establish trust and remember that they’re putting themselves at risk, too. Do not provide information that can make you vulnerable further down the road.

I encourage people to ask questions, to be curious, to be yourself. Don’t get outraged when you’re speaking to them. Report aggressively and ethically and get comments from everyone. Just tell the truth. And when you don’t know, consult with experts. Your reporting is not weakened by seeking that expertise. It only strengthens it. The more voices you put in your reporting, the more thorough and complex your story will be.

Don’t ever make the mistakes of going too light because you’re afraid of calling someone a white nationalist. Go to the expert and ask. Reporting fairly and without insulting or demonizing is the greatest punishment. That’s why they target journalists. And that’s why the people they target the most are the journalists unearthing the most.

Sharon Kann: I think it’s valuable and necessary to get insights in these groups, especially when these conversations become focused on specific threats and on organizing events/protests/harassment activities. But the line we’ve drawn is that beyond answering questions to get admitted into private groups, researchers don’t actively engage.
We view our role as observers. If something is dangerous or speaks to a trend of organizing, we’ll sometimes write it up for our site, but with redacted identifying information about the individuals involved and an emphasis on the larger narratives and media ecosystems at play in enabling or fueling these conversations.

What are unique reporting considerations that journalists need to take into account when entering these groups?

Jennifer Henrichsen: I would caution against using their own terminology [to describe the groups]. By using an euphemistic label (i.e. alt-right), it serves to hide people’s identities as white supremacists. Joan Donovan at Harvard calls this the “re-branding” of white supremacy.

Susan McGregor: I like to do ethical substitutions. For every thoughtful profile of someone who went to the Capitol armed, are we spending the same energy on investigations into corruption or racism within police departments? I’m not saying that we shouldn’t empathize with certain people — it’s that we should question who we are challenging ourselves to empathize with. Part of the job of journalism is to draw attention to things, so there is an ethical component to how we use our time.

Razzan Nakhlawi: It’s tough because I’d argue that all people subscribed to conspiracist worldviews are “accidental,” aside from those spinning up the theories for clout or money, of course. I don’t necessarily think it’s harmful to report on these people, especially on the process behind how they picked up their beliefs. I totally believed in the Illuminati as a teenager and I’d pay good money to see a copy of my search history back then, just to know how I ended up neck-deep in conspiracies about Beyonce and Denver International Airport. It was probably YouTube’s fault, to be honest.

Michael Edison Hayden: Far right extremists are often liars. That’s just the way it is, it’s not a judgment call. They frequently lie and try to manipulate the media to amplify their propaganda. So when they tell you something like, “My audience is 30 million people,” understand that it’s always in their interest to puff up their worth. Do not give them space to exaggerate their importance or their power. And don’t give them room to promote propaganda that seeks to eliminate entire groups of people as part of its end game. There’s no reason to allow an anti-Semite to spread conspiracy theories about Jewish people. You want to get their point of view in your reporting, but their point of view might equate basic content moderation with the type of censorship that goes on in Communist China.

Sharon Kann: Something we wrestle with a lot, especially as the alternative platforms become more fragmented, is how we find the balance between amplification and awareness. There are real reasons why journalists and the public should be aware of the organizing and rhetoric occurring on these platforms, but sometimes that attention (even in the service of debunking) can elevate the lie or the misinformation.

What should organizations take into consideration when asking its reporters and researchers to do this type of work?

Susan McGregor: In today’s media ecosystem, news (like literally “new”) is not is not what journalism is for. No one needs us to tell them that there was a mob in the Capitol. They probably saw it on social media before they saw it on a major news outlet. The job of journalism today is to provide context, accuracy. We need to use our time and efforts to make the world make sense.

There’s a great speech by Gary Younge, formerly at the Guardian, and he said, “Sometimes dog bites man really is the story.” Just because something happens all the time doesn’t mean it’s not worthy of attention. And just because something remarkable happens doesn’t mean it requires all the attention. I think of the thousands of people who don’t receive front page coverage because they didn’t pick up a gun.

Razzan Nakhlawi: I think journalists of all stripes need to have a better ambient awareness of these spaces. If you report on mainstream politics, you absolutely should have been on Parler (R.I.P.) or on right-wing Twitter learning how huge swathes of the population are consuming information and building their own political framework from that.

Right-wing extremism doesn’t exist in a vacuum and the root causes need to be investigated. It’s easy to get distracted by the novelty of fringe ideologies and platforms, but I think mainstream political parties, figures and frameworks often present more of a threat to the average American.

Michael Edison Hayden: After last week, it should be a wake up call to every American, especially journalists, that this is not a game. They mean what they say. You might have seen someone talking on Thedonald.win about constructing gallows and thought they were kidding. And then we saw it on live television. It’s not a joke. If they’re willing to take a chance at killing Mike Pence, they’re willing to take a chance at killing you.

Sharon Kann: I don’t know if all journalists need to be on the platforms, but I think we should all have a sense of what conversations are animating these spaces — whether through direct monitoring, or by following the work of other trusted journalists and extremism researchers who are.

To access resources available to journalists who face online harassment, view these lists from the Dart Center for Journalism and Trauma at Columbia Journalism School, the International Journalists’ Network, and these reports in the Columbia Journalism Review by Susan McGregor and Jennifer Henrichsen.

If you or someone you know needs to talk with someone about any harassment or mental health issues you’re currently dealing with, text TALK to 741–741 to text with a trained crisis counselor from the Crisis Text Line for free, 24/7 (Provided by the American Foundation for Suicide Prevention).