Journalists & Cyber Threats

CNTI’s Assessment

The digital security of news organizations, journalists and their sources is under threat in many parts of the world. Digital security attacks can range from spyware, account hacking, distributed denial of service (DDoS) and malware, among many other threats. These threats, in addition to their intrusive nature, can also violate journalists’ sense of safety and security, creating a chilling effect and harming the broader information environment.

Policy deliberation: At the governmental level, it is important for policymakers to recognize the very real threats impacting journalists and sources and ensure that digital policy initiatives protect them. However, at the same time, these policies must not threaten freedom of expression, basic privacy rights or encryption and virtual private network (VPN) protections. Additionally, it is often governments that are using spyware against journalists. Governments must not surveil journalists or sources but instead foster an environment that encourages free speech.

Professional support: News organizations must proactively educate their journalists and other staff on cyber threats and provide support for those who are targeted. Journalists need to adopt strong digital security practices, such as multi-factor authentication and basic digital hygiene. Additionally, by sharing experiences of cyberattacks, journalists and news organizations have the opportunity to learn from each other and reduce the impact of these events.

Government: While technology companies can establish and protect human rights and privacy safeguards, they also must navigate challenging state demands. At times, governments pressure companies to provide private data and other information on their users, sometimes through legislation. Although this data may help governments with national security issues, there is a difficult balancing act, as complying with these state demands can also facilitate governments’ abuses of power, and refusing to comply can result in bans or market losses. Technology companies need to ensure that working with governments to protect people does not put fundamental rights at risk.

The Issue

Journalists and their sources face digital security threats globally from a variety of actors, including states, corporations and criminal organizations. As cybersecurity concerns evolve and become a part of everyday life, they are becoming a critical concern for policymakers: as of 2025, 90% of countries have enacted cybercrime legislation.

These threats can take a variety of forms. Malware is a broad term for malicious software designed to disrupt systems, steal data or gain unauthorized access. Spyware, a type of malware, is designed to enter and steal data from a computer system to a different party.  Ransomware is a different kind of malware that encrypts the victims’ files, making them inaccessible. Often, attackers will demand a ransom in exchange for restoring access. Phishing attacks use fraudulent messages through email, SMS or other methods to trick individuals into revealing sensitive information like passwords or financial information. Distributed denial-of-service (DDoS) attacks overwhelm a website or server with a flood of traffic from multiple sources and cause it to slow down or crash, making it unavailable to most users. In man-in-the-middle attacks (MitM), perpetrators intercept communication channels to capture sensitive information. Social engineering attacks exploit publicly available personal information or information gathered through deception and manipulate users into providing unauthorized access. 

Digital threats are often linked to physical threats and can result in significant mental health concerns for journalists. This connection highlights the critical need for a holistic approach to security for journalists and news organizations. Governments’ use of spyware and “lawfare,” the weaponization of legal systems against journalists, further complicates the landscape. Beyond the safety risks, digital security challenges can damage public trust in the news media. Cyberattacks can disrupt operations and business models, driving away audiences. A lack of digital security training, especially in smaller newsrooms, can cause sources and whistleblowers to fear being unintentionally exposed. These threats are difficult and expensive for news organizations to manage alone, making collaboration among policymakers, tech platforms and civil society essential to protecting a free press.

What Makes It Complex

The effectiveness of cybercrime policies depends on how “cybercrime” is defined. There is no internationally accepted definition of cybercrime or cyberattacks. Some policies may include crimes dependent on the use of technology, crimes facilitated by the use of technology, or both. The definition can also be based on the seriousness of the crime or the type of case. Too broad or ambiguous a definition raises the potential for abuse of government power and can negatively impact journalists’ safety, freedom of expression and human rights. Due to the limited existing case law, it is unclear how cybercrime laws apply to the spyware industry, which poses threats to press freedom. Furthermore,  the term “cybercrime” must adapt as technology, such as AI, continues to evolve.

Digital policies sometimes lead to unintended consequences that impact the digital security of journalists and the general public. When creating digital policies, lawmakers must be careful not to inadvertently create new vulnerabilities or undermine existing protections. Certain policies, such as laws passed under the guise of protecting national security, can weaken digital security by making it easier for spyware to be deployed against journalists. Other measures may compromise the integrity of end-to-end encryption, a tool that helps keep communications private and is an essential part of press freedom. Additionally, policies that restrict or ban the use of VPNs directly endanger journalists who rely on these tools to bypass censorship, protect their IP addresses and conduct sensitive research. 

Policymakers must recognize and address these potential cyberthreats. Ensuring that new regulations do not create loopholes for surveillance technology, weaken encryption or limit access to essential security tools can help fortify the digital security of the independent press.

Governments and non-state actors are using spyware to surveil and intimidate journalists. The use of spyware against journalists represents a serious threat to the free flow of information and the safety of journalists. Recent incidents in countries like Poland and Italy illustrate the real-world danger of this technology and demonstrate that it is not limited to authoritarian contexts. The technology has the ability to infiltrate a target’s entire digital life without their knowledge. Journalists may be left with the uncertainty of whether their device has been compromised, a fear amplified by “zero-click attacks” where receiving a message is enough to infect a phone. The constant threat of surveillance fosters a climate of fear, creating a chilling effect on reporting. When journalists are afraid their sources will be revealed or their private communications censored, they may self-censor to avoid covering sensitive topics.

The ability to mitigate digital security risks differs across countries and across newsrooms. Despite the need for robust digital defenses to protect journalists, the widespread adoption of digital security tools remains low. A major factor is the significant lack of resources, funding, and technological infrastructure. Many news organizations, especially those in developing regions, do not have the budget to invest in security software, hire cybersecurity experts or maintain up-to-date hardware. The complexity and the lack of user-friendly technologies are another deterrent.

This problem is particularly pronounced in environments with unevenly developed infrastructure, where systems may be a patchwork of old and new technologies. This lack of a cohesive, modern foundation makes it difficult to implement and manage a comprehensive security strategy, leaving holes that cybercriminals can easily exploit.

Journalistic practices and norms can, at times, be in tension with digital security practices. Journalism is inherently public-facing and accessible, giving rise to high risk for those in the industry. Cybersecurity attacks can take many forms, including doxxing, man-in-the-middle attacks and online harassment. Journalists become even more vulnerable when their contact information is easily accessible online, such as  through social media. At the same time, removing such information is fundamentally at odds with newsroom efforts around audience interactivity and engagement.

CNTI’s own research has found that journalists do not always feel supported by their newsrooms when it comes to digital security. However, there are ways to improve this environment. It is important that news organizations implement policies and provide training and psychological support so their employees are better equipped to handle these situations. Journalists themselves need to adapt their technology habits and use available security tools.

State of Research

In the wake of prominent attacks and among a growing concern about AI’s broader threats to journalism, academic and public attention to the impact of cybercrime, ransomware and spyware on journalists has increased.

Research has depicted the unique threats of digital surveillance to investigative journalists and marginalized people and communities, including women, queer and gender-nonconforming people, and people of color. As noted earlier, there is a relationship between journalists’ digital presence and offline safety.

This research speaks to the global nature of digital security threats to an independent press. Future research should continue to examine how journalists, technology companies, researchers and policymakers can collaborate to defend against these threats, by tracking trends and sharing practices.

State of Legislation

Cybercrime has become a growing concern among policymakers in many parts of the world. However, cybercrime policy does not always account for — and at times directly threatens — the digital safety of journalists. Often, cybercrime policy efforts are led by countries’ security or banking sectors, leading to policymaking that may be at odds with international standards for press freedom and privacy. Research has found that many cybercrime laws can be used to target journalists, thus threatening an independent press and free expression.

Over the past two decades, legal frameworks established to protect an independent press and the confidentiality of journalistic sources and information have been threatened in many parts of the world. New legislation and policies, including national security legislation, override and/or contradict existing protections. Other policies pressure or force digital intermediaries to provide private user data. When legislation does not adequately account for new digital data or new technological tools used by journalists and sources, it cannot provide them with necessary legal protections. Thus, forward-thinking policymaking is critical.

Finally, it is critical to have open legislative processes around cybercrime or cybersecurity at both the supranational and national levels so that the voices of the news media, journalists and civil society more broadly are taken into account from the start.

Notable Legislation