Security Intelligence

Security for Journalists in Hostile Environments | CloseProtectionHire

Q: "What personal security training do journalists need before travelling to conflict zones or high-risk markets?"

"The Committee to Protect Journalists (CPJ) 2024 data recorded 68 journalists killed globally in the course of their work, with 320 imprisoned. Mexico, the Philippines, and Russia consistently appear in CPJ's most dangerous markets rankings. For journalists heading to these environments, the baseline is Hostile Environment and First Aid Training (HEFAT) -- typically a 5-day residential course covering trauma first aid, mine awareness, vehicle ambush response, checkpoint management, and communications protocols. The International News Safety Institute (INSI) provides the sector's foundational safety guidelines for news organisations and freelancers. The Rory Peck Trust offers specific support for freelance journalists, who face a structurally higher risk than staff correspondents because they typically lack the institutional security support that major broadcasters and newspapers provide. HEFAT covers the physical threat spectrum, but increasingly courses also incorporate digital security -- device hygiene, source protection communications, and counter-surveillance -- reflecting the documented convergence of physical and digital threat in hostile reporting environments. Completing HEFAT before a first assignment to a high-risk market is standard practice for staff journalists at major news organisations and should be the baseline for freelancers and stringers operating in equivalent environments."

Q: "What digital security measures are essential for journalists covering sensitive stories?"

"The Citizen Lab and Amnesty Tech's Pegasus Project (July 2021) documented the targeting of at least 180 journalists across 20 countries with NSO Group's Pegasus spyware. Pegasus delivers zero-click device compromise -- the journalist does not need to interact with any link or file. The documented targets included journalists covering Saudi Arabia, India, Mexico, Azerbaijan, and Hungary. The practical implication is that digital security for journalists covering sensitive subjects is not optional hardening; it is part of the threat model. The CPJ's digital safety programme recommends: end-to-end encrypted communications for source contact (Signal is the established standard for message and voice; ProtonMail for email where Signal is not used); device compartmentalisation (a separate device for sensitive source communication that does not carry personal accounts, which limits cross-correlation of contacts); full-disk encryption; and regular operating system and application updates to close known vulnerabilities that government-grade spyware exploits. For journalists travelling to markets where state surveillance is documented -- China, Russia, Iran, Saudi Arabia, UAE -- the NCSC's overseas travel guidance (clean device, AES-256 encryption, power-down at border crossings, no connection to untrusted networks) applies with particular force. Source protection encryption at the file level -- VeraCrypt for sensitive documents -- provides a further layer against device seizure."

Q: "What does the Jamal Khashoggi case mean for the security of journalists and commentators?"

"Jamal Khashoggi, a Washington Post contributing columnist and former Saudi government official, was killed inside the Saudi consulate in Istanbul on 2 October 2018. The UN Special Rapporteur Agnes Callamard's report (June 2020) concluded it was a deliberate and premeditated execution planned and perpetrated by Saudi officials, and that the Saudi Crown Prince bore responsibility. The case established several precedents with direct relevance to journalist security: first, state extraterritorial targeting of journalists operates independently of the journalist's physical location -- Khashoggi's protection in a NATO country did not prevent a state-sanctioned killing inside sovereign diplomatic premises; second, the perpetrators used the victim's own routine (an appointment at the consulate he had previously visited) as the attack vector; and third, the threat profile of a journalist is materially elevated by their prior relationship with a state and the nature of their critical reporting on that state, not simply by being present in a high-risk market. For journalists with a comparable state-exposure profile -- former officials or state-adjacent figures who have become critics of a government -- the threat model must include extraterritorial state action as a specific risk category. The operational response includes avoiding solo visits to diplomatic premises without independent witness confirmation of return, using encrypted communications that cannot be retrospectively accessed by state actors, and varying patterns to avoid predictable appointments."

Q: "How should news organisations manage the security of local fixers and stringers?"

"Local fixers -- the journalists, translators, drivers, and local knowledge providers who make foreign reporting possible -- carry a structurally higher security risk than the foreign correspondents they support. Their local visibility, family ties, permanent residency, and identity known to local officials means they cannot leave when an assignment ends. CPJ's 2024 data consistently documents that local journalists and media workers account for approximately 70% of journalist fatalities globally. The BBC Safety Guidelines and INSI's guidelines both address fixer security as a distinct responsibility: news organisations have a duty of care to local staff that extends beyond the duration of an assignment. Key obligations include: threat assessment for local staff before engagement -- who knows they are working with foreign media, what is their existing exposure, what would the consequences of their identification be in the local environment; digital security briefing specific to the local threat (in Mexico, cartel monitoring of social media is documented; in the Philippines, NBI surveillance; in Russia, FSB); a named support contact at headquarters if the fixer is threatened after the foreign team has left; financial support for evacuation or legal costs where the assignment creates ongoing risk; and access to the Rory Peck Trust's emergency fund for freelance journalists and their local colleagues."

Q: "What are a journalist's legal rights if detained or arrested while reporting?"

"The legal rights available to a detained journalist depend entirely on the jurisdiction and the basis for detention. In democratic rule-of-law jurisdictions, the Vienna Convention on Consular Relations (1963) Article 36 requires that a foreign national be informed of their right to consular notification without delay, and that consular officers have access to detained nationals. FCDO guidance advises journalists to pre-register travel with their home government's traveller registration system and to carry their employer's emergency contact details in physical form separate from their phone. In practice, consular access is not a guarantee of protection -- Greste, Fahmy, and Mohamed of Al Jazeera were detained in Cairo from December 2013 and were not released until February 2015 (Greste) and August 2015 (others), despite sustained diplomatic pressure, consular access, and an international campaign. The operational recommendation is: before travelling, document a clear chain of escalation (editor, foreign desk, legal contact, embassy, employer's security team); carry the relevant embassy's 24-hour emergency number in physical form; agree a check-in protocol with a named person at headquarters; brief a trusted local contact on what to do if check-in is missed. In high-risk markets, the time between detention and outside knowledge of that detention is the most dangerous period -- communications protocols that provide early warning compress this window."

Security guide for journalists, fixers, and news teams in hostile environments. Covers CPJ 2024 data, Khashoggi lessons, Pegasus spyware risk, HEFAT training, detention rights, and P1 city press freedom.

12 May 2026

Written by James Whitfield, Senior Security Consultant

Speak to the Team

Journalists are among the most targeted professionals in the world. The Committee to Protect Journalists (CPJ) 2024 data recorded 68 journalists killed globally in the course of their work and 320 imprisoned. The majority of those killed were local journalists and fixers covering organised crime, political corruption, or conflict in the same markets this site designates as P1: Mexico, the Philippines, Russia, Nigeria, Pakistan, and others.

Journalist security is not a niche concern. It is the leading edge of the question that professional security planning asks in every context: how do you reduce risk for a specific person, with a specific profile, in a specific environment?

The Threat Environment

The Reporters Without Borders (RSF) Press Freedom Index 2024 ranks Mexico 121st of 180 countries, the Philippines 134th, Russia 164th, and Pakistan 152nd. These rankings correlate directly with documented journalist fatalities, imprisonments, and physical attacks. In Mexico, the primary threat to journalists is cartel targeting of reporters covering organised crime – particularly in Sinaloa, Guerrero, and Veracruz states. In the Philippines, the pattern combines political and business interests with organised crime. In Russia, the FSB conducts surveillance of foreign correspondents as a baseline and has targeted Russian journalists who became critical of the government.

The Khashoggi case (Saudi consulate Istanbul, 2 October 2018) established a specific category: journalists with prior state connections, who have become critics of their home government, face extraterritorial state targeting. The UN Special Rapporteur Agnes Callamard’s June 2020 report concluded the killing was a premeditated execution planned by Saudi officials, with the Crown Prince bearing responsibility. Anna Politkovskaya was shot dead in the lift of her Moscow apartment building on 7 October 2006 – a contract killing linked to her reporting on Chechnya for Novaya Gazeta.

These are not outliers. They are documented instances of the highest category of journalist threat: state-sponsored targeted killing of named journalists.

Hostile Environment and First Aid Training

Hostile Environment and First Aid Training (HEFAT) is the sector’s baseline pre-deployment preparation. The standard course (typically 5 days residential, run by RISC Training, INSI-registered providers, or news organisation safety teams) covers:

Trauma first aid: haemorrhage control, airway management, improvised evacuation
Mine and IED awareness: recognition, safe passage, what to do if in a minefield
Vehicle checkpoint management: approach protocol, documentation, driver briefing
Ambush and armed attack response: immediate action drills, taking cover, what not to do
Kidnap response: initial hours (INSI guidelines note these are the most dangerous), communication protocols
Communications: satphone, encrypted messaging, check-in protocols

The Rory Peck Trust provides HEFAT support for freelance journalists who lack the institutional backing of major news organisations – including bursaries for training and emergency support funds.

HEFAT is the floor, not the ceiling. The specific threat environment for each assignment requires additional preparation. A journalist covering cartel territory in Mexico faces different risks than one covering the front lines in eastern Ukraine, even though both require HEFAT.

Digital Security

The Citizen Lab and Amnesty Tech’s Pegasus Project (July 2021) documented the targeting of at least 180 journalists across 20 countries using NSO Group’s Pegasus spyware. Pegasus enables zero-click device compromise – the target does not need to interact with any file or link. Documented journalist targets included those covering Saudi Arabia, Mexico, India, Azerbaijan, and Hungary. The CPJ’s Digital Safety Lab was established specifically to respond to this threat category.

The practical digital security protocol for journalists in high-risk markets follows the same principles as for any professional handling sensitive information in a hostile environment:

Communications. Signal (end-to-end encrypted messaging and voice, with disappearing messages enabled) is the established standard for source communication and team coordination. ProtonMail for encrypted email. Wire or Wickr for institutional team communication. These tools are useless if the source does not also use them – source briefing on secure communication is the journalist’s responsibility, not the source’s.

Device security. Clean travel device for high-surveillance markets – a device that carries only the data required for the specific assignment, connected to no personal accounts. Full-disk encryption (AES-256). Powered down at border crossings, not in sleep mode. The NCSC’s overseas travel guidance applies with particular force for China, Russia, UAE, and Saudi Arabia.

Source protection. Documents and notes from sensitive sources should be encrypted at the file level (VeraCrypt containers, transferred to a secure server and deleted from the travel device promptly). Source identity should never be stored in plaintext on a device that travels through hostile environments.

Fixer and Local Staff Security

Local fixers, translators, drivers, and stringers account for approximately 70% of global journalist fatalities documented by CPJ. Their security exposure does not end when the foreign correspondent leaves.

The BBC Safety Guidelines (the most detailed publicly available framework for news team safety) treat local staff security as a distinct editorial responsibility. Before engagement, the threat assessment for a local fixer should address: who knows they are working with foreign media, what is their existing political or personal exposure, and what the consequences of their identification would be in the local environment.

During an assignment: the fixer should not be the sole point of local knowledge for anything that, if compromised, would endanger the team. Contact details, meeting locations, and source identification should be compartmentalised.

After an assignment: a named support contact at the news organisation should remain accessible to the fixer. The Rory Peck Trust’s emergency fund and the Committee to Protect Journalists’ emergency response can provide support for fixers facing threats after foreign teams have left.

Detention Protocol

Peter Greste, Mohamed Fahmy, and Baher Mohamed of Al Jazeera were detained in Cairo in December 2013 on charges of broadcasting false news and supporting the Muslim Brotherhood. Greste was released in February 2015 after 400 days; the others not until August 2015. Sustained diplomatic pressure, consular access, and an international media campaign did not shorten the detention to the extent that the legal and political barriers permitted.

The minimum pre-departure protocol for any journalist travelling to a market with a documented record of journalist detention:

Register with FCDO Locate, STEP (US), or the relevant home government registration system
Carry the relevant embassy’s 24-hour emergency number in physical form, separate from the phone
Brief a trusted local contact on the check-in protocol and what to do if a check-in is missed
Carry a physical copy of the employer’s emergency contact chain (editor, foreign desk, legal contact, security team)
Brief the employer on the assignment’s travel schedule before departure

The window between detention and outside knowledge of that detention is the highest-risk period. Communications protocols that compress this window – short check-in intervals in high-risk segments, a local contact who can escalate quickly – are the most effective mitigation.

For the terrorism threat landscape that journalists and news teams in P1 cities operate within, see the related article on terrorism awareness for corporate travellers. For the protective intelligence methodology that can be applied to identify threats before they materialise – whether the subject is a journalist, an executive, or a diplomatic official – see the protective intelligence guide.

For those operating in the reconstruction phase after conflict – the distinct threat profile of post-conflict environments, UNDSS and MOSS governance frameworks, INSO briefings, supply chain security, community liaison as a security function, and donor compliance requirements – see our post-conflict reconstruction security guide.

James Whitfield is a Senior Security Consultant with 20 years of experience in executive protection, threat assessment, and corporate security across the UK and internationally.

Summary

Key takeaways

CPJ 2024 data: 68 journalists killed, 320 imprisoned -- Mexico, Philippines, and Russia are the most dangerous markets

The Committee to Protect Journalists 2024 data documents the global journalist fatality and imprisonment figures that should calibrate risk assessment for any news team or freelance journalist planning a P1 city assignment. Mexico (ranked 121st by RSF in 2024) is the deadliest country for journalists outside active conflict zones, primarily driven by cartel targeting of reporters covering organised crime. The Philippines (ranked 134th) has documented state and non-state targeting. Russia (ranked 164th) targeted both its own journalists and foreign correspondents following the February 2022 invasion of Ukraine.

HEFAT training is the baseline, not a ceiling -- digital security is now inseparable from physical security

Hostile Environment and First Aid Training addresses the physical threat spectrum: trauma first aid, checkpoint management, mine awareness, ambush response. The Pegasus Project 2021 demonstrated that a journalist's device can be compromised with zero interaction using state-grade spyware -- before HEFAT's physical scenarios even become relevant. A journalist travelling to a high-risk market with HEFAT training but without Signal, a clean travel device, and encrypted storage has addressed the less likely threat while leaving the more likely one unmanaged.

Khashoggi established that state extraterritorial targeting is a specific journalist risk category

The UN Special Rapporteur's June 2020 report concluded that Khashoggi's killing was a premeditated state execution planned by Saudi officials. The mechanism -- exploiting a routine appointment at a diplomatic premises -- demonstrates that the threat model for journalists with state-exposure profiles must include extraterritorial targeting as an explicit category, not just incidental danger from a hostile operating environment. Journalists who were formerly state officials, intelligence officers, or close observers of authoritarian governments face a threat profile distinct from journalists covering conflict zones.

Local fixers and stringers carry approximately 70% of global journalist fatalities -- their security is a duty of care obligation

CPJ's multi-year data consistently shows that local journalists and media workers account for the majority of journalist fatalities globally. A news organisation that brings in a foreign team, uses a local fixer for the duration of an assignment, and then leaves has created a security exposure for that fixer that outlasts the assignment. The BBC Safety Guidelines and INSI guidelines treat local staff security as a distinct and ongoing editorial responsibility, not a logistical line item. This includes post-assignment threat assessment and support for the fixer's security after the foreign team departs.

Pre-registration of travel and a physical copy of emergency contacts are the minimum pre-departure protocol

FCDO, STEP (US State Dept), and equivalent government registration programmes provide a mechanism for consular services to locate and assist detained nationals. Registration does not provide protection -- the Greste detention lasted 400 days despite consular access -- but it compresses the time between detention and official knowledge of that detention. Physical copies of emergency contacts separate from the journalist's phone provide an information path if the phone is seized. These steps are free and take ten minutes; the failure to take them has materially increased the time journalists have spent detained.

FAQ

Frequently Asked Questions

The Committee to Protect Journalists (CPJ) 2024 data recorded 68 journalists killed globally in the course of their work, with 320 imprisoned. Mexico, the Philippines, and Russia consistently appear in CPJ’s most dangerous markets rankings. For journalists heading to these environments, the baseline is Hostile Environment and First Aid Training (HEFAT) – typically a 5-day residential course covering trauma first aid, mine awareness, vehicle ambush response, checkpoint management, and communications protocols. The International News Safety Institute (INSI) provides the sector’s foundational safety guidelines for news organisations and freelancers. The Rory Peck Trust offers specific support for freelance journalists, who face a structurally higher risk than staff correspondents because they typically lack the institutional security support that major broadcasters and newspapers provide. HEFAT covers the physical threat spectrum, but increasingly courses also incorporate digital security – device hygiene, source protection communications, and counter-surveillance – reflecting the documented convergence of physical and digital threat in hostile reporting environments. Completing HEFAT before a first assignment to a high-risk market is standard practice for staff journalists at major news organisations and should be the baseline for freelancers and stringers operating in equivalent environments.

The Citizen Lab and Amnesty Tech’s Pegasus Project (July 2021) documented the targeting of at least 180 journalists across 20 countries with NSO Group’s Pegasus spyware. Pegasus delivers zero-click device compromise – the journalist does not need to interact with any link or file. The documented targets included journalists covering Saudi Arabia, India, Mexico, Azerbaijan, and Hungary. The practical implication is that digital security for journalists covering sensitive subjects is not optional hardening; it is part of the threat model. The CPJ’s digital safety programme recommends: end-to-end encrypted communications for source contact (Signal is the established standard for message and voice; ProtonMail for email where Signal is not used); device compartmentalisation (a separate device for sensitive source communication that does not carry personal accounts, which limits cross-correlation of contacts); full-disk encryption; and regular operating system and application updates to close known vulnerabilities that government-grade spyware exploits. For journalists travelling to markets where state surveillance is documented – China, Russia, Iran, Saudi Arabia, UAE – the NCSC’s overseas travel guidance (clean device, AES-256 encryption, power-down at border crossings, no connection to untrusted networks) applies with particular force. Source protection encryption at the file level – VeraCrypt for sensitive documents – provides a further layer against device seizure.

Jamal Khashoggi, a Washington Post contributing columnist and former Saudi government official, was killed inside the Saudi consulate in Istanbul on 2 October 2018. The UN Special Rapporteur Agnes Callamard’s report (June 2020) concluded it was a deliberate and premeditated execution planned and perpetrated by Saudi officials, and that the Saudi Crown Prince bore responsibility. The case established several precedents with direct relevance to journalist security: first, state extraterritorial targeting of journalists operates independently of the journalist’s physical location – Khashoggi’s protection in a NATO country did not prevent a state-sanctioned killing inside sovereign diplomatic premises; second, the perpetrators used the victim’s own routine (an appointment at the consulate he had previously visited) as the attack vector; and third, the threat profile of a journalist is materially elevated by their prior relationship with a state and the nature of their critical reporting on that state, not simply by being present in a high-risk market. For journalists with a comparable state-exposure profile – former officials or state-adjacent figures who have become critics of a government – the threat model must include extraterritorial state action as a specific risk category. The operational response includes avoiding solo visits to diplomatic premises without independent witness confirmation of return, using encrypted communications that cannot be retrospectively accessed by state actors, and varying patterns to avoid predictable appointments.

Local fixers – the journalists, translators, drivers, and local knowledge providers who make foreign reporting possible – carry a structurally higher security risk than the foreign correspondents they support. Their local visibility, family ties, permanent residency, and identity known to local officials means they cannot leave when an assignment ends. CPJ’s 2024 data consistently documents that local journalists and media workers account for approximately 70% of journalist fatalities globally. The BBC Safety Guidelines and INSI’s guidelines both address fixer security as a distinct responsibility: news organisations have a duty of care to local staff that extends beyond the duration of an assignment. Key obligations include: threat assessment for local staff before engagement – who knows they are working with foreign media, what is their existing exposure, what would the consequences of their identification be in the local environment; digital security briefing specific to the local threat (in Mexico, cartel monitoring of social media is documented; in the Philippines, NBI surveillance; in Russia, FSB); a named support contact at headquarters if the fixer is threatened after the foreign team has left; financial support for evacuation or legal costs where the assignment creates ongoing risk; and access to the Rory Peck Trust’s emergency fund for freelance journalists and their local colleagues.

The legal rights available to a detained journalist depend entirely on the jurisdiction and the basis for detention. In democratic rule-of-law jurisdictions, the Vienna Convention on Consular Relations (1963) Article 36 requires that a foreign national be informed of their right to consular notification without delay, and that consular officers have access to detained nationals. FCDO guidance advises journalists to pre-register travel with their home government’s traveller registration system and to carry their employer’s emergency contact details in physical form separate from their phone. In practice, consular access is not a guarantee of protection – Greste, Fahmy, and Mohamed of Al Jazeera were detained in Cairo from December 2013 and were not released until February 2015 (Greste) and August 2015 (others), despite sustained diplomatic pressure, consular access, and an international campaign. The operational recommendation is: before travelling, document a clear chain of escalation (editor, foreign desk, legal contact, embassy, employer’s security team); carry the relevant embassy’s 24-hour emergency number in physical form; agree a check-in protocol with a named person at headquarters; brief a trusted local contact on what to do if check-in is missed. In high-risk markets, the time between detention and outside knowledge of that detention is the most dangerous period – communications protocols that provide early warning compress this window.

Get in Touch

Request a Consultation

Describe your security requirements below. All enquiries are confidential and handled by licensed consultants.