In August, a Filipino journalist was shot to death as he rode his motorcycle in Mindanao. It’s the latest death in a country that the Committee to Protect Journalists (CIJ), a global advocate for press freedom, ranks as one of the deadliest countries in the world for journalists.

Nor is Indonesia far behind. Regular cases of assault are reported in this country and violence against journalists is on the rise, according to the Alliance of Independent Journalists (AJI), a nongovernmental union.

It is clear that journalists in both these countries are at risk and need to better protect themselves, so EngageMedia conducted research to better understand the current status of digital security for Indonesian and Philippine journalists, and to compare the difference between these countries.

This work was done as part of the Cyber Stewards Network and involved interviewing over 40 Indonesian and Philippine journalists about their awareness of digital security issues, and what they were doing to keep safe.

We have shared the results of these interviews in two previous blog posts: one on Indonesia and the other one on the Philippines. You can also watch our short video that explains the Indonesian context.

In this new blog post, we will outline and comment on some of the most important issues that came up, and provide more insight into how journalists perceive and practise digital security.

Online Data Storage

Today, journalists predominantly use mobile phones and digital recording devices to record interviews. All these photographs, video clips and audio files require a considerable amount of storage space, and that data storage needs to be secure so that people can’t access these files without permission.

If a journalist saves data by attaching it to an email, anyone hacking his or her email account can access those files. Stored data is slightly safer when journalists use popular cloud storage providers like Dropbox, Google Drive or Onedrive. The data is encrypted and separate passwords are needed.

However, none of these cloud storage providers can guarantee the safety of your data. Governments and the entertainment industry are also putting increasing pressure on these companies to search for anything deemed “illegal”, which means there are certain provider employees that can access the stored data.

Edward Snowden has even stated that “Dropbox is hostile to privacy” and he also urges users to “avoid Google” and switch to cloud storage services like Spideroak, which encrypts all data and guarantees that it can’t access the files of its users.

Finally, journalists should be aware of the laws in their respective countries regarding cloud storage.

Strikingly, Indonesian journalists are generally unaware of the online safety of their data storage. Only one of the interviewed journalists put some effort into protecting their collected data.

Most journalists work on their personal laptops or mobile phones and use the internal phone and/or laptop memory to store data. Others save the information by storing it inside the archives of chat applications like WhatsApp or Line.

A journalist working for a media company told us that employers often ask journalists to save their data at the office and/or back it up on an internal computer. However, these media companies have no standards or systems for storage and archives. Furthermore, the journalists who stored data at the office didn’t really know what happened to it or whether it was stored safely.

At one particular office, computer passwords are also shared amongst colleagues, which means stored data can easily be accessed, used and/or altered. Other journalists confirmed that sharing passwords is a common practice at their workplaces.

Overall, Philippine journalists were more aware of data security and took better care of their data than their Indonesian counterparts although they still struggled with the day-to-day challenges of ensuring secure data storage.

Most veteran journalists in the Philippines do not keep any sensitive information on electronic devices, because they feel they might be hacked. In general, journalists in the Philippines find it challenging to ensure better filing and storage systems, as it requires more time and resources, which they usually do not have.

Data Encryption

One of the best ways to secure data is through encryption. In Indonesia, we didn’t find any journalists encrypting data although they had some basic knowledge of encryption. Their reluctance to encrypt is usually due to a lack of understanding about what encryption actually is and how it works. And none of their employers are encouraging the practice.

It seems unlikely that Indonesian journalists will incorporate data encryption practices into their everyday working habits, anytime soon.

In the Philippines, we found some journalists using data encryption tools. However, they didn’t do it consistently and these processes were not integrated into their working practices.

Digital Surveillance

Journalists in both countries are generally unaware of what digital surveillance entails. Surveillance is mostly perceived as physical surveillance i.e. government officials or company security officials following them around.

An example of digital surveillance awareness was found in a remote area of Indonesia. One interviewed journalist in the Eastern part of Indonesia reported turning off his mobile phone when he was heading to a certain region because he was afraid of being harassed or intimidated. He would only turn it back on after returning. By doing so, the journalist tried to make sure the government and the military were not aware of his whereabouts.

Another journalist in Indonesia’s capital, Jakarta, reportedly stopped using all social media accounts to protect himself from intimidation or threats by politicians and/or their followers.

In the Philippines, some journalists prefer to meet face to face with sensitive sources, and they don’t use any devices when meeting them, as they know they are vulnerable to being compromised.

However, it is clear that journalists in both countries are still hugely unaware of how the internet works, and so they don’t understand how digital surveillance works or the impact of their own internet usage on their digital security.

Although journalists are aware that governments conduct surveillance, they are not aware of the sophisticated surveillance methods and tools that states have at their disposal.

Communication Between Journalists and Sources

In Indonesia, practicality is the most important quality for journalists when it comes to communicating with sources. Journalists need to contact their sources quickly and easily, so they use existing easy-to-use, well-known platforms (e.g. WhatsApp, Facebook, Twitter, Line) to communicate.

Almost all Indonesian journalists record interviews on mobile phones, which are also for personal use. Even though they are aware of the security risks, ease of use is deemed more important. All the interviewed journalists said they would be willing to use safer communication channels so long as they were simple to use.

Currently, media companies in Indonesia encourage their journalists to use social media and insecure channels to communicate, so there is little incentive for Indonesian journalists to switch to safer platforms.

In the Philippines, journalists are more conscious of safer communication practices, but do not generally use encrypted communication channels. An often-heard complaint is that they cannot force their sources to use certain kinds of communication channels.

If the journalists use different protocols or safer ways of communication, the sources have generally initiated their use. And if the source does not suggest a secure manner of communicating, the journalist does not usually offer safer measures.

Overall, practicality is pivotal for journalists in both countries. If a tool or platform does not have a large user base and is not easy to use, journalists will not be interested in using it, even if it supports more secure communication.

Communication Among Journalists and With Their Agencies

Apart from receiving information directly (e.g. in person or through a phone call) from their employers (agencies/media companies), Indonesian journalists get the bulk of their information through WhatsApp groups.

These WhatsApp groups have a large number of members and they’re mostly journalists who discuss just about anything. In Indonesia, many journalists said they learned a lot through these groups. Most of the important conversations between journalists take place through social media and WhatsApp groups.

Some Indonesian media companies are using WhatsApp to coordinate with reporters on the ground, and journalists told us it is the fastest and most practical way to communicate. Emails are also becoming obsolete because they are generally regarded as unreliable in the era of live chat and streaming. Indonesian journalists complain that emails often receive no response or they have to wait too long for an answer.

But there’s an ongoing debate about the safety of WhatsApp. Since the platform’s owner, Facebook, introduced end-to-end encryption to WhatsApp in 2016, the general consensus is that the product has become a lot safer.

For a simple overview of the differences between encryption and end-to-end encryption, as well as valuable practical advice on how to keep your chats secure, read this NetAlert article.

Just like the journalists we interviewed, developers of online communication tools must strike a balance between usability and security, and thankfully changes are constantly being made. At best, journalists stay up to date on the terms and privacy policies of the online communication services they are using.

Meanwhile, in the Philippines, most of the interviewed reporters primarily use Facebook to communicate. There is even a media outlet that uses Facebook Groups to send reporting assignments to their teams. Most of the journalists use the same account on Facebook to communicate for both work and personal reasons. For them, it’s easier to use Facebook as it’s faster.

Freelance Journalists Versus Agency-based

Several news agencies in the Philippines impose standards on their journalists for social media use. However, we found hardly any standards on digital security. Sharing of devices is still commonplace and little is done to safely manage the data stored on them.

During our public event in Manila, a strong recommendation was made for major news agencies to start focusing on digital security. According to participants in the forum, news agencies currently have no accountability mechanisms. They argue that bigger agencies should start imposing safe working standards on their journalists and become the front-runners of digital security policies.

The situation in Indonesia is similar. Agencies have no digital security policy in place, and they are not enforcing the few rules relating to digital security. Journalists share passwords to computers, devices are used both personally and professionally, and more than once we heard of interview transcripts and the documentation of sources being saved in WhatsApp chats. Interviewed journalists did not see this as a problem.

In the Philippines, freelance journalists did not have any standards at all. They just try to stay safe according to their own judgement. In Indonesia, we did not interview any freelance journalists.

Training

In the Philippines, all interviewed journalists said they wanted to strengthen their digital security. Our interview results show there is interest among journalists to undergo digital security training. Currently, the organisations offering training are digital rights advocacy groups that address digital security issues in ways that do not relate to the everyday reality of journalists.

Digital security training should, therefore, be more practical and focus on the working reality of journalists. For instance, in a situation where a journalist has just finished an interview and recorded it on his/her phone, what should they do before going online again with that device? Or how should this data be transmitted safely to the office?

A veteran journalist we interviewed suggested that bigger media companies and universities should set the trend and offer digital safety and security trainings to reporters and aspiring journalism students.

In Indonesia, none of the journalists were offered training before or during their employment. They were simply sent into the field to start working. These journalists usually learn by sharing experiences and tips with their peers.

Surprisingly, few journalists were actually interested in learning more about digital security. The general feeling is that things are safe. Moreover, journalists in Indonesia were largely unaware of the possibility of training themselves in digital security and that such trainings existed.

In both countries, we found no journalists educating themselves. Many were surprised to learn that there is a wealth of information available online about digital security.

Education

In the Philippines, around 50 percent of journalists have not received any formal education in journalism. Instead, they entered the field through their activities as writers for university newspapers and magazines.

Digital security is not part of journalistic education although a new post-grad course on media and technology at the University of the Philippines does discuss digital security issues, albeit not in any structured form.

In Indonesia, almost 90 percent of the interviewed journalists received formal education that focused on journalism or they attended journalism schools. However,  information and teaching on digital security were absent in all programs.

Our desktop research in Indonesia also shows that there is no attention given to digital security at the major higher education institutions offering degrees in journalism. One journalist also told us that more advanced journalistic skills were gained by attending workshops or by joining student press clubs in university.

In general, a degree in journalism is not always required to become a journalist in both these countries; it’s more about the mindset and passion for writing stories. It is, therefore, best to give any additional education to journalists already in the field.

Conclusion

Journalists’ awareness of digital security is low in both Indonesia and the Philippines. This situation is reflected in their often-unsafe working practices – although awareness of digital security issues is better among journalists in the Philippines than among Indonesian journalists.

Journalists are vulnerable and do not receive much support from their agencies. There is online information on how to digitally protect yourself, but journalists are generally unaware of these opportunities or don’t make use of them. Most of the online resources are in English so the language barrier could also be a factor.

Journalists are also in a difficult position to make changes. Agencies have no digital security policies and do not feel obliged to start pushing for better digital security practices within their organisations.

Sources and networks influence journalists’ choice of communication and storage tools, but these popular tools may not have secure communication protocols. WhatsApp, a popular tool, has become safer to use since end-to-end encryption was introduced in 2016. This is especially important for Indonesia where the majority of interviewed journalists are highly dependent on WhatsApp for communication and storage.

Besides training, more effort should be put into raising awareness of digital security, and we hope our research is a step in the right direction. Please feel free to contact us or leave a comment below with your thoughts, as we are keen to continue this important conversation.