State of Uncertainty: Digital Security of Journalists in Indonesia and the Philippines
According to the Committee to Protect Journalists (CIJ), a global advocate for press freedom, the Philippines ranks as one of the deadliest countries in the world for journalists. Just a few months ago, a journalist was shot to death in Mindanao. In Indonesia, being a journalist is not safe either. Regular cases of assault are reported and according to the Alliance of Independent Journalists (AJI), a nongovernmental union, violence against journalists is on the rise. Clearly journalists in these countries are at risk and must therefore better protect themselves.
EngageMedia, as part of the Cyber Stewards Network, conducted research on the state of digital security for journalists in Indonesia and the Philippines. In over 40 interviews, journalists discussed their level of awareness on digital security issues and what, if any, they are doing to keep themselves safe.
We previously presented the results of the interviews on the EngageMedia website in two blog posts: one focused on Indonesia and the other one on the Philippines. You can also watch a short video we produced to help explain the Indonesian context. The research conducted between the two countries offers a good opportunity for comparison. In this new blog post, we will outline and comment on some of the most important issues that came up, to provide more insight on how journalists there perceive and practice digital security.
Online Data Storage
Today, journalists predominantly use mobile phones and digital recording devices to record interviews. All these photographs, video clips, and audio files require a considerable amount of storage space. It goes without saying that data storage needs to be done securely, without risking outsiders being able to access these files. If data is saved by attaching them to emails, that means anyone hacking a journalist's email account can have access to the files. When using popular cloud storage providers like Dropbox, Google Drive or Onedrive, stored data is slightly more safe. The data is encrypted and separate passwords are needed.
Nonetheless, none of the previously mentioned companies can guarantee the safety of your data. Governments and the entertainment industry (looking for copyrighted material) are putting pressure on cloud storage providers to search for anything deemed “illegal” and certain employees of the aforementioned companies can access the stored data. Edward Snowden has even stated that “Dropbox is hostile to privacy” and he also urges users to “avoid Google” and switch to cloud storage services like Spideroak which encrypts all data and guarantees that it can’t access the files of its users. Finally, journalists should be aware of the jurisdiction in their respective countries regarding cloud storage.
Strikingly, Indonesian journalists are mostly unaware about online safety when it comes to data storage. Only one of the journalists we interviewed put some effort into protecting their collected data. Most journalists work using their personal laptops or mobile phones and use the internal phone and/or laptop memory to store data. For others, the way they save information is by storing it inside the archives of chat applications like WhatsApp or Line. A journalist working for a media company told us that employers often ask journalists to save their data at the office and/or back it up on an internal computer.
However, there are no standards or systems for storage and archives that are being used at the media companies that our interviewed journalists work for. Furthermore, the journalists who stored data at the office didn’t really know what happens with it or whether it’s stored safely. At one particular office, passwords to computers are also shared amongst colleagues, meaning that stored data can easily be accessed, used, and/or altered. Various other journalists confirmed that sharing passwords is a common practice at their workplaces.
Most veteran journalists in the Philippines do not keep any sensitive information on electronic devices as they feel that they might be hacked. There are a few journalists who know how to encrypt the files in their devices, but they do not do it consistently with all of their files. In general, journalists in the Philippines find it challenging to ensure better filing and storage systems, as it requires more time and resources, which they usually do not have.
One of the best ways to secure data is through encryption. In Indonesia, we didn’t find any journalists actively encrypting data, although some basic knowledge around encryption was present. Their reluctance to encrypt is usually caused by a lack of knowledge of what encryption actually is, and how it works. A reality where Indonesian journalists would incorporate data encryption practices as part of their everyday working habits seems unlikely to happen anytime soon. On top of this, none of the interviewed journalists’ employers are encouraging the practice.
In the Philippines, we found some journalists who were using data encryption tools. However, they didn’t do it consistently and these processes were not integrated in their working practices. Overall, it appeared that journalists in the Philippines take better care of their data or do not save sensitive data digitally.
Journalists in both countries are mostly unaware about what digital surveillance entails. Surveillance is mostly perceived as physical surveillance, being followed around by government officials or company security officials. An example of the awareness of digital surveillance was found in a remote area of Indonesia. One interviewed journalist in the Eastern part of Indonesia, afraid of being harassed or intimidated, reported turning off his mobile phone upon heading towards a certain region and only turning it back on after returning. By doing so, the journalist tried to make sure the government and the military were not aware of their whereabouts. Another journalist in Indonesia’s capital Jakarta, reportedly gave up using all social media accounts in order to be safe from being intimidated or threatened by politicians and/or their followers. In the Philippines, some journalists prefer to meet face to face with sensitive sources and not use any devices when meeting them as they know they are vulnerable to being compromised.
What shows clearly is that in both countries, journalists are still hugely unaware of how the Internet works, and so they also do not know how digital surveillance works, and the impact of their own Internet usage on their digital security. Although journalists are aware that governments conduct surveillance, they are not aware of the level of sophisticated methods and tools for surveillance that states currently have at their disposal.
Communication between journalists and sources
Practicality is the most important quality that journalists look for when it comes to communicating with sources in Indonesia. Journalists have to be able to contact their sources quickly and easily. Therefore, they use existing easy-to-use, well-known platforms (e.g., WhatsApp, Facebook, Twitter, Line) to communicate. Almost all journalists record interviews on mobile phones which they have for personal use as well. Even though they are aware of the security risks involved, ease of use is deemed more important. All the journalists we spoke to stated that they would be willing to use safer communication channels, so long as they are simple to use. Currently, media companies in Indonesia actually encourage their journalists to use social media and insecure channels to communicate, so there is little urge or motivation for Indonesian journalists to switch to safer platforms.
In the Philippines, journalists are more conscious of safer communication practices, but do not necessarily use encrypted communication channels. An often heard complaint is that they cannot force their sources to use certain kinds of communication channels. If different protocols or safer ways of communication are used, they are mostly initiated by the sources themselves. And if the source does not suggest a secure manner of communicating, the journalist does not usually proactively offer safer measures.
Overall, we observe that practicality is pivotal. If a tool or platform does not have a large user base and is not easy to use, journalists will not be interested in using it, even if it aids in more secure communication.
Communication among Journalists and with their Agencies
Apart from receiving information directly (e.g. in person or through a phone call) from their employers (agencies/media companies), Indonesian journalists get the bulk of their information through WhatsApp groups. These WhatsApp groups have large amounts of members, mostly journalists, and are used to discuss just about anything. In Indonesia, many journalists stated that they learn a lot through these groups. Most of the important conversations between journalists take place through social media and WhatsApp groups.
Some Indonesian media companies are using WhatsApp to coordinate with reporters on the ground. Again, journalists told us that this is because it is the fastest and most practical way to communicate. The usage of e-mail is becoming obsolete. Emails are generally regarded as unreliable in the era of live chat and streaming. Indonesian journalists complain that emails are often not replied to or they have to wait too long for an answer.
There’s an ongoing debate regarding the safety of WhatsApp. The general consensus seems to be that since Facebook, who owns WhatsApp, introduced end-to-end encryption to it in 2016, the product has become a lot safer. For a simple overview of the differences between encryption and end-to-end encryption, as well as valuable practical advice on how to keep your chats secure, read this NetAlert article. Just like the journalists we interviewed, developers of online communication tools must strike a balance between usability and security, and thankfully changes are constantly being made. At best, journalists stay up-to-date on the terms and privacy policies of the online communication services they are using.
Meanwhile, in the Philippines, most of the reporters we interviewed primarily use Facebook to communicate. There is even a media outlet that uses Facebook Groups to send reporting assignments to their teams. Most of the journalists interviewed use the same account on Facebook to communicate for both work and personal reasons. For them, it’s easier to use Facebook as it’s faster.
Freelance Journalists versus Agency-based
Several news agencies in the Philippines impose standards on their journalists regarding their use of social media. However, hardly any standards on digital security were found. Sharing of devices is still commonplace and little is done to safely manage the data stored on them. During our public event in Manila, a strong recommendation was made for major news agencies to start focusing on digital security. According to participants in the forum, news agencies at present have no accountability mechanisms. Therefore, bigger agencies should start imposing safe working standards to their journalists and become the front-runners of digital security policies.
The situation in Indonesia is similar. Agencies have no digital security policy in place and the few rules relating to digital security are not being enforced. Journalists share passwords to computers, devices are used both personally and professionally, and more than once we heard of interview transcripts and the documentation of sources being saved in WhatsApp chats. Interviewed journalists did not see this as a problem.
In the Philippines, freelance journalists did not have any standards at all. They just try to stay safe according to their own judgement. In Indonesia, no freelance journalists were interviewed.
In the Philippines, all interviewed journalists stated that they wanted to strengthen their digital security. Our interview results show there is interest among journalists to undergo digital security training. Currently, the organizations offering training are digital rights advocacy groups who address digital security issues in ways that do not necessarily relate to the everyday reality of journalists.
Digital security trainings should therefore be more practical and focus on the working reality of journalists. For instance, in a situation where a journalist has just finished an interview and recorded it on his/her phone: what should they do before going online again with that particular device? Or how should this data be transmitted safely to the office? A veteran journalist we interviewed even suggested that bigger media companies and universities should set the trend and offer digital safety and security trainings to reporters and aspiring journalism students.
In Indonesia, none of the journalists were offered training before or during their employment. They were simply sent into the field to start working. The learning that takes place among journalists in Indonesia is usually peer-to-peer, through the sharing of experiences and tips. Surprisingly, few journalists were actually interested in learning more about digital security. The general feeling is that things are safe. Moreover, journalists in Indonesia were largely unaware of the possibility of training oneself in digital security and whether such trainings existed. In contrast, we observed a high interest for digital security training among the journalists we interviewed in the Philippines.
In both countries, we did not find journalists who are actively educating themselves. Many were surprised to learn that there is a wealth of knowledge available online regarding digital security.
In the Philippines, around 50 percent of journalists have not received any formal education in journalism. Instead, they entered the field through their activities on campus as writers for university newspapers and magazines. In the Philippines, digital security is not part of journalistic education, although a new post-grad course on media and technology at the University of the Philippines does discuss digital security issues, albeit not in any structured form.
In Indonesia, almost 90 percent of the journalists in our research sample have received formal education that focused on journalism or attended journalism schools. Nonetheless, information and teaching on digital security was absent in all programs. Our desktop research in Indonesia also shows that even today, there is no attention given to digital security at the major higher education institutions offering degrees in journalism. One journalist also told us that more advanced journalistic skills were gained by attending workshops or by joining student press clubs in university.
Therefore, to become a journalist, a degree in journalism is not required. It’s more about the mindset and passion for writing stories. Any additional education on digital security is thus best given to journalists already in the field.
Overall, we can conclude that both in Indonesia and the Philippines, journalists’ awareness around digital security is low. This situation is reflected in their often unsafe working practices; although overall, awareness around digital security issues is better among journalists in the Philippines when compared to Indonesia.
Journalists are vulnerable and do not receive much support from their agencies. Opportunities and knowledge to digitally protect oneself are widely available online, but journalists are hardly aware or make use of them. As most of the online resources are in English, the language barrier could also be a factor.
Journalists are in a difficult position to make changes. Agencies have no digital security policies and do not feel obliged to start pushing for better digital security practices with their organizations. The choice of communication and storage tools that journalists use is influenced by sources and general network effects. Popular tools may not necessarily have secure communication protocols. Since WhatsApp’s introduction of end-to-end encryption, it has become much safer to use. This is especially important for Indonesia where the majority of interviewed journalists are highly dependent on Whatsapp for communication and storage.
Besides training, more effort should be put into awareness-raising around digital security, and we hope our research is a step in the right direction. Please feel free to contact us or leave a comment below with your thoughts, as we are keen on continuing this important conversation.