Secure Source Handovers for Investigative Journalists

Why handover security matters as much as communication security

Most journalists focus on securing their communications with sources. But the handover moment — when a document or dataset physically or digitally changes hands — is one of the most forensically visible points in an investigation. A document carries metadata that can reveal who created it, when, and on which device. A USB drive can be tracked. An email attachment leaves server logs. A cloud upload creates a copy that may never be fully deleted.

UK journalists operate in a legal environment where the Investigatory Powers Act 2016 gives agencies broad powers to obtain communications data, and where police can seek production orders under PACE 1984 Schedule 1 for journalistic material. If a source is identified through a document handover — not through anything you said or wrote, but through metadata, server logs, or a physical trail — you have failed in your core duty of source protection.

This guide covers the practical protocols for digital and in-person handovers, metadata hygiene, chain of custody documentation, and the decisions you need to make about what to retain, what to delete, and when.

Handover methods: digital and physical

When secure handover protocols are essential

• 1Any handover from a source who could face serious employment, legal, or personal consequences if identified.
• 2Documents that were printed or exported from internal systems — printer metadata and document tracking may identify the source.
• 3Large datasets where internal tracking codes or unique formatting might identify the source even after apparent anonymisation.
• 4Handovers from sources in the public sector, particularly police, intelligence, defence, or civil service.
• 5Any handover involving national security, organised crime, or matters subject to court reporting restrictions.
• 6When your source has already been warned that the organisation is monitoring for leaks.

Red flags that increase exposure risk

• ⚠Using your personal or work email for sensitive document transfer — email servers log metadata.
• ⚠Opening source documents directly on a device connected to the internet before stripping metadata.
• ⚠Cloud sync services (iCloud, Google Drive, OneDrive) enabled on the device used for secure document work.
• ⚠Receiving large files over standard email which creates logs on both sending and receiving mail servers.
• ⚠Meeting a source near your workplace, their workplace, or any location with CCTV coverage of your regular movements.
• ⚠Using a phone in the vicinity of a sensitive in-person handover — location data can be subpoenaed.
• ⚠Forgetting to check a document for embedded printer steganography (yellow dot tracking) before publication.

Secure handover checklist

• I have chosen a handover method proportionate to the risk — highest-risk sources use SecureDrop or in-person.
• I have advised the source to use Tor Browser for any digital submission.
• I have opened received documents on a device not connected to cloud sync services.
• I have stripped metadata from all received documents using ExifTool or MAT2 before storing or sharing them.
• I have checked for printer steganography if documents appear to have been printed from an internal system.
• I have documented the chain of custody: when, how, and in what form I received the material.
• I have stored the original documents in an encrypted folder (VeraCrypt or equivalent).
• I have deleted from my regular devices any copies of sensitive documents that are not needed for ongoing work.
• I have consulted my NUJ rep or a media lawyer about my obligations to retain or delete material if legally required.
• I have talked to my outlet's IT team or NUJ security adviser about the specific security profile of this investigation.

Common mistakes

• ›Opening source documents on a regular work or personal device before stripping metadata.
• ›Forwarding documents to colleagues over regular email to get a second opinion — creating additional server log records.
• ›Not realising that cloud sync was running silently in the background when working with sensitive documents.
• ›Using WhatsApp instead of Signal — WhatsApp's metadata (who communicated with whom) is not end-to-end encrypted.
• ›Conducting sensitive in-person meetings with a mobile phone present — even in flight mode, some location data may be logged.
• ›Assuming that deleting a file also deletes all copies — check cloud sync, email sent items, backup drives.
• ›Not maintaining a chain of custody document — if the investigation is later challenged, you need to show provenance.

Related guides

Primary sources

• Freedom of the Press Foundation — SecureDrop directory and documentation
• OnionShare — anonymous file transfer tool
• Signal — encrypted messaging (iOS and Android)
• ExifTool — metadata reading and stripping (free, cross-platform)
• MAT2 — Metadata Anonymisation Toolkit
• Committee to Protect Journalists — digital safety guides
• NUJ — digital security resources for journalists

Frequently asked questions