{"id":8539,"date":"2026-01-15T10:39:25","date_gmt":"2026-01-15T15:39:25","guid":{"rendered":"https:\/\/cntiwpedev.wpenginepowered.com\/?p=8539"},"modified":"2026-01-15T10:45:33","modified_gmt":"2026-01-15T15:45:33","slug":"journalists-cyber-threats","status":"publish","type":"post","link":"https:\/\/cnti.org\/issue-primers\/journalists-cyber-threats\/","title":{"rendered":"Journalists & Cyber Threats"},"content":{"rendered":"\n
\n

CNTI’s Assessment<\/h2>\n\n\n\n

The digital security of news organizations, journalists and their sources is under threat in many parts of the world. Digital security attacks can range from spyware, account hacking, distributed denial of service (DDoS) and malware, among many other threats. These threats, in addition to their intrusive nature, can also violate journalists\u2019 sense of safety and security, creating a chilling effect and harming the broader information environment.<\/p>\n\n\n\n

Policy deliberation: <\/strong>At the governmental level, it is important for policymakers to recognize the very real threats impacting journalists and sources and ensure that digital policy initiatives protect them. However, at the same time, these policies must not threaten freedom of expression, basic privacy rights or encryption and virtual private network (VPN) protections. Additionally, it is often governments <\/a>that are using spyware against journalists. Governments must not surveil journalists or sources but instead foster an environment that encourages free speech.<\/p>\n\n\n\n

Professional support: <\/strong>News organizations must proactively educate their journalists and other staff on cyber threats and provide support for those who are targeted. Journalists need to adopt strong digital security practices<\/a>, such as multi-factor authentication and basic digital hygiene. Additionally, by sharing experiences of cyberattacks, journalists and news organizations have the opportunity to learn from each other and reduce the impact of these events.<\/p>\n\n\n\n

Government: <\/strong>While technology companies can establish and protect human rights and privacy safeguards, they also must navigate challenging state demands. At times, governments pressure <\/a>companies to provide private data and other information on their users, sometimes through legislation. Although this data may help governments with national security issues, there is a difficult balancing act, as complying with these state demands can also facilitate governments\u2019 abuses of power, and refusing to comply can result in bans or market losses. Technology companies need to ensure that working with governments to protect people does not put fundamental rights at risk.<\/p>\n\n\n\n

<\/div>\n<\/section>\n\n\n\n
\n

The Issue<\/h2>\n\n\n\n

Journalists and their sources face digital security threats<\/a> globally from a variety of actors, including states, corporations and criminal organizations. As cybersecurity concerns evolve and become a part of everyday life, they are becoming a critical concern for policymakers: as of 2025, 90%<\/a> of countries have enacted cybercrime legislation.<\/p>\n\n\n\n

These threats can take a variety of forms. Malware<\/a> is a broad term for malicious software designed to disrupt systems, steal data or gain unauthorized access. Spyware<\/a>, a type of malware, is designed to enter and steal data from a computer system to a different party.  Ransomware<\/a> is a different kind of malware that encrypts the victims\u2019 files, making them inaccessible. Often, attackers will demand a ransom in exchange for restoring access. Phishing attacks use fraudulent messages through email, SMS or other methods to trick individuals into revealing sensitive information like passwords or financial information. Distributed denial-of-service<\/a> (DDoS) attacks overwhelm a website or server with a flood of traffic from multiple sources and cause it to slow down or crash, making it unavailable to most users. In man-in-the-middle attacks<\/a> (MitM), perpetrators intercept communication channels to capture sensitive information. Social engineering<\/a> attacks exploit publicly available personal information or information gathered through deception and manipulate users into providing unauthorized access. <\/p>\n\n\n\n

Digital threats are often linked to physical threats<\/a> and can result in significant mental health concerns<\/a> for journalists. This connection highlights the critical need for a holistic <\/a>approach to security for journalists and news organizations. Governments\u2019 use of spyware<\/a> and \u201clawfare<\/a>,\u201d the weaponization of legal systems against journalists, further complicates the landscape. Beyond the safety risks, digital security challenges can damage public trust<\/a> in the news media. Cyberattacks can disrupt operations and business models, driving away audiences. A lack of digital security training<\/a>, especially in smaller newsrooms, can cause sources and whistleblowers to fear being unintentionally exposed. These threats are difficult and expensive for news organizations to manage alone, making collaboration among policymakers, tech platforms and civil society essential to protecting a free press.<\/p>\n\n\n\n

<\/div>\n<\/section>\n\n\n\n
\n

What Makes It Complex<\/h2>\n\n\n\n

The effectiveness of cybercrime policies depends on how \u201ccybercrime\u201d is defined.<\/strong><\/strong> There is no internationally accepted definition <\/a>of cybercrime or cyberattacks. Some policies may include crimes dependent on the use of technology, crimes facilitated by the use of technology, or both. The definition can also be based on the seriousness of the crime or the type of case. Too broad or ambiguous a definition raises the potential for abuse<\/a> of government power and can negatively impact journalists\u2019 safety, freedom of expression and human rights. Due to the limited existing case law, it is unclear how cybercrime laws apply to the spyware industry<\/a>, which poses threats to press freedom. Furthermore,  the term \u201ccybercrime\u201d must adapt as technology, such as AI<\/a>, continues to evolve.<\/p>\n\n\n\n

Digital policies sometimes lead to unintended consequences that impact the digital security of journalists and the general public.<\/strong> When creating digital policies, lawmakers must be careful not to inadvertently create new vulnerabilities or undermine existing protections. Certain policies<\/a>, such as laws passed under the guise of protecting national security<\/a>, can weaken digital security by making it easier for spyware<\/a> to be deployed against journalists. Other measures may compromise the integrity<\/a> of end-to-end encryption, a tool that helps keep communications private and is an essential part of press freedom<\/a>. Additionally, policies that restrict or ban<\/a> the use of VPNs directly endanger journalists who rely on these tools to bypass censorship, protect their IP addresses and conduct sensitive research. <\/p>\n\n\n\n

Policymakers must recognize and address these potential cyberthreats. Ensuring that new regulations do not create loopholes for surveillance technology, weaken encryption or limit access to essential security tools can help fortify the digital security of the independent press.<\/p>\n\n\n\n

Governments and non-state actors are using spyware to surveil and intimidate journalists.<\/strong> The use of spyware against journalists<\/a> represents a serious threat to the free flow of information and the safety of journalists. Recent incidents in countries like Poland <\/a>and Italy <\/a>illustrate the real-world danger of this technology and demonstrate that it is not limited to authoritarian contexts. The technology has the ability to infiltrate a target\u2019s entire digital life without their knowledge<\/a>. Journalists may be left with the uncertainty of whether their device has been compromised, a fear amplified by \u201czero-click attacks<\/a>\u201d where receiving a message is enough to infect a phone. The constant threat of surveillance fosters a climate of fear, creating a chilling effect<\/a> on reporting. When journalists are afraid their sources will be revealed or their private communications censored, they may self-censor<\/a> to avoid covering sensitive topics.<\/p>\n\n\n\n

The ability to mitigate digital security risks differs across countries and across newsrooms.<\/strong><\/strong> Despite the need for robust digital defenses to protect journalists, the widespread adoption of digital security tools remains low.<\/a> A major factor is the significant lack of resources, funding, and technological infrastructure. Many news organizations, especially those in developing regions, do not have the budget to invest in security software, hire cybersecurity experts or maintain up-to-date hardware. The complexity and the lack of user-friendly technologies are another deterrent.<\/p>\n\n\n\n

This problem is particularly pronounced <\/a>in environments with unevenly developed infrastructure, where systems may be a patchwork of old and new technologies. This lack of a cohesive, modern foundation makes it difficult to implement and manage a comprehensive security strategy, leaving holes that cybercriminals can easily exploit.<\/p>\n\n\n\n

Journalistic practices and norms can, at times, be in tension with digital security practices.<\/strong> Journalism is inherently public-facing and accessible<\/a>, giving rise to high risk for those in the industry. Cybersecurity attacks can take many forms, including doxxing<\/a>, man-in-the-middle attacks and online harassment<\/a>. Journalists become even more vulnerable when their contact information is easily accessible online, such as  through social media. At the same time, removing such information is fundamentally at odds with newsroom efforts<\/a> around audience interactivity and engagement.<\/p>\n\n\n\n

CNTI\u2019s own research has found that journalists do not always feel supported<\/a> by their newsrooms when it comes to digital security. However, there are ways to improve<\/a> this environment. It is important that news organizations implement policies and provide training and psychological support<\/a> so their employees are better equipped to handle these situations. Journalists themselves need to adapt their technology habits and use available security tools.<\/p>\n\n\n\n

<\/div>\n<\/section>\n\n\n\n
\n

State of Research<\/h2>\n\n\n\n

In the wake of prominent attacks<\/a> and among a growing concern about AI\u2019s broader threats<\/a> to journalism, academic and public attention to the impact of cybercrime, ransomware and spyware on journalists has increased.<\/p>\n\n\n\n

Research has depicted the unique threats of digital surveillance<\/a> to investigative journalists <\/a>and marginalized<\/a> people and communities, including women, queer and gender-nonconforming people, and people of color. As noted earlier, there is a relationship between journalists\u2019 digital presence and offline<\/a> safety.<\/p>\n\n\n\n

This research speaks to the global nature of digital security threats to an independent press. Future research should continue to examine how journalists, technology companies, researchers and policymakers can collaborate to defend against these threats, by tracking trends and sharing practices.<\/p>\n\n\n\n

<\/div>\n\n\n\n
\n

Notable Studies<\/h3>\n\n\n\n
<\/div>\n<\/div>\n\n\n\n