Security Intelligence

Security for Journalists and Media in Hostile Environments | CloseProtectionHire

Q: "How dangerous is journalism globally in 2026?"

"The Committee to Protect Journalists (CPJ) recorded 320 journalists imprisoned worldwide and 45 journalists killed in the course of their work in 2024 -- the organisation's annual census, which captures only confirmed cases, has consistently recorded 40-70 deaths per year for the past decade. UNESCO's Safety of Journalists framework notes that impunity for crimes against journalists remains the defining pattern: 89% of killings of journalists since 2006 have gone unpunished according to UNESCO's impunity index. The most dangerous countries for journalists in 2024 were Gaza/Israel, Myanmar, Mexico, the Philippines, and India according to CPJ data. The risk is not limited to conflict zones -- Mexico and the Philippines represent criminal threat environments rather than conventional warfare."

Q: "What is the difference between HEAT training and specific journalist security training?"

"HEAT (Hostile Environment and Emergency Aid Training) covers the physical safety skills relevant to conflict and crisis environments: first aid under fire, IED awareness, checkpoint and detention behaviour, convoy procedures, and casualty evacuation. It is the baseline hostile environment preparation that any journalist, NGO worker, or security professional deploying to a conflict zone should have. Journalist-specific security training goes further: it covers the particular threat profile of press work (surveillance by state and non-state actors, digital surveillance risks specific to investigative journalism, source protection, kidnap prevention for press), the ethical and legal dimensions of working in environments where the press is specifically targeted, and the newsroom decision-making framework for deploying journalists to high-risk assignments."

Q: "How should media organisations vet fixers in high-risk assignments?"

"A fixer -- the local journalist, guide, translator, or facilitator who supports a visiting media team -- is both a critical operational asset and a potential security vulnerability. The vetting framework for fixers should include: verification of identity and background through the local journalist community (not just the individual's own references), confirmation of their standing with local authorities or armed groups relevant to the story (whether they are known positively or negatively), assessment of their digital security practices (a fixer who communicates with the media team via unencrypted channels creates an interception risk), and a clear briefing on the security protocols the media team will operate under. Fixers with relationships with multiple competing armed groups, security services, or press operations in the same area require careful assessment of whose interests they may primarily serve."

Q: "What are the specific digital security risks for investigative journalists?"

"Investigative journalists face digital security risks that are more targeted and sophisticated than standard corporate espionage. The specific risks are: phone compromise via commercial spyware (Pegasus/NSO Group, Predator, and similar systems have been documented against journalists in over 45 countries by Citizen Lab between 2016 and 2024); social engineering attacks targeting journalist accounts to identify sources; metadata in documents and photos that reveals source identity or location; communication interception in countries where state actors monitor journalist activities; and device seizure at borders or checkpoints that exposes unpublished material and source communications. The standard digital security protocol for investigative journalists -- promoted by Freedom of the Press Foundation, EFF, and CPJ -- includes Signal for communications, Tor or VPN for browsing, encrypted full disk storage, and compartmented devices for sensitive source communications."

Q: "What should a media organisation's security policy require before deploying a journalist to a P1 city?"

"Before deploying a journalist to a P1 city, a media organisation's security policy should require: a current threat assessment for the assignment location (city, specific neighbourhood, specific story context), a pre-deployment security briefing covering the relevant threat environment and operational protocols, confirmation of the insurance position (kidnap and ransom coverage, hostile environment medical evacuation cover, life and accidental death coverage), the communications check-in protocol (frequency, method, what constitutes a missed check that triggers escalation), the emergency contact chain both in-country and at the newsroom, and a decision framework for when the editor has authority to order withdrawal. An organisation that deploys a journalist to Lagos, Karachi, or Manila without completing all of these steps is in breach of its duty of care under ISO 31030:2021 Travel Risk Management and may have legal liability under the Working at Height Regulations or general HSW Act 1974 duty of care framework."

Security for journalists, reporters, and media teams in hostile environments: CPJ data, fixer vetting, digital security, kidnap risk for press, hostile environment training, and P1 city media safety protocols.

4 May 2026

Written by James Whitfield

Speak to the Team

Journalism in hostile environments is one of the most consistently dangerous civilian occupations in the world. The Committee to Protect Journalists (CPJ) has recorded over 1,500 journalists killed globally since 1992. The pattern is not primarily conflict-zone casualties – though those are significant – but the systematic targeting of journalists by criminal organisations, authoritarian governments, and non-state armed groups who operate in environments where impunity for violence against the press is the norm rather than the exception.

This guide covers the threat environment facing journalists and media teams in hostile environments, the security protocols required for deployment to high-risk assignments, the digital security dimension that is inseparable from physical safety in press work, and the framework for media organisations managing journalist safety as a duty of care obligation.

The Threat Landscape

CPJ’s annual census captures the documented cases – it is known to under-represent the actual total. The 2024 figures (45 killed, 320 imprisoned) are consistent with the decade-long trend of 40-70 journalists killed annually in direct relation to their work.

The geographic distribution is revealing. The most dangerous environments for journalists in 2024 were:

Gaza: The conflict beginning October 2023 produced the highest journalist death toll of any conflict in the CPJ’s tracking history for a comparable period. Committee to Protect Journalists and Reporters Without Borders both documented over 100 journalist deaths in Gaza between October 2023 and May 2025, with ongoing documentation.

Mexico: Mexico is the most dangerous country for journalists in the Western Hemisphere and frequently ranks in the top three globally. CPJ data shows at least 12 journalists killed in Mexico in 2024, the majority directly targeted by criminal organisations. The threat is concentrated in states with documented cartel control – Guerrero, Tamaulipas, Sinaloa, Veracruz – and in reporters covering organised crime, corruption, and politics.

Myanmar: Following the 2021 military coup, Myanmar has become one of the most dangerous countries for journalists in the Asia-Pacific. The military junta has systematically imprisoned journalists covering the post-coup resistance. CPJ documented 40+ journalists imprisoned in Myanmar in 2024.

The Philippines: The Philippines has a documented history of journalist killings linked to political and criminal interests at local and regional government level. The Maguindanao massacre (November 2009 – 34 journalists killed in a single incident) remains the largest single attack on journalists in recorded history. CPJ data shows 3-6 journalists killed in the Philippines annually in the 2020-2024 period.

For journalists deploying to P1 cities in these threat environments, the security framework is not academic – it is a direct operational necessity.

Pre-Deployment Requirements

Threat assessment: The assignment-specific threat assessment should cover the city-level threat environment, the specific story or subject being reported, the track record of the specific individuals or organisations being covered (history of targeting journalists), and the current incident picture in the deployment window. General country-risk ratings are insufficient – a story on organised crime in Bogota creates a different threat profile than a story on business development in the same city.

Training: HEAT training is the baseline for any deployment to a conflict or high-risk environment. The Freedom of the Press Foundation, CPJ Journalist Security programme, and RISC Training (Reporters’ Instructed in Saving Colleagues) offer journalist-specific programmes. HEFAT (Hostile Environment and First Aid Training) typically includes IED awareness, checkpoint behaviour, vehicle security, first aid, and basic digital security awareness.

Insurance: K&R (kidnap and ransom) insurance, hostile environment medical evacuation coverage, and life and accidental death coverage are the minimum insurance stack for a hostile environment deployment. Freelancers who cannot access institutional K&R insurance can arrange independent coverage through specialist brokers including AKE Group, Control Risks, or specialist K&R underwriters.

Communications protocol: The check-in protocol should specify: frequency (typically twice daily for high-risk environments), method (Signal, satellite phone, or a defined backup), the missed check threshold that triggers escalation, and the in-country and newsroom emergency contact chain. The missed check protocol must be briefed to both the journalist and the newsroom contact before departure.

Fixer Security

The fixer relationship is the most consequential security decision on most hostile environment assignments. A fixer provides access, translation, cultural navigation, and local intelligence. They also have knowledge of the media team’s location, schedule, contacts, and story direction – information that has significant value to any party with a hostile interest.

Vetting: References from other journalists who have worked with the fixer in the same environment, not just the fixer’s own network, are the starting point. The local press freedom organisation (Reporters Without Borders, CPJ local correspondent, or equivalent) can often provide additional context on a fixer’s standing and reputation. In environments where the fixer has relationships with armed groups or security services relevant to the story, the nature and implications of those relationships must be assessed.

Digital security alignment: A fixer who communicates with the media team via standard SMS, WhatsApp without disappearing messages, or unencrypted email creates an interception risk. Briefing the fixer on the team’s digital security protocol – and confirming they can and will follow it – is part of the pre-deployment preparation.

Contingency plan: A clear protocol for what the media team does if the fixer is detained, becomes unreachable, or is identified as compromised must exist before the assignment begins. An over-dependence on a single fixer, without a contingency plan for their unavailability, is a significant operational vulnerability.

Digital Security for Journalists

The digital threat to journalists has been documented in detail by Citizen Lab (University of Toronto), which has identified the deployment of commercial spyware against journalists in over 45 countries between 2016 and 2024. The specific tools documented include NSO Group’s Pegasus, Intellexa’s Predator, and various other commercial surveillance systems. The targets have included journalists at major international outlets, local investigative reporters, and citizen journalists in authoritarian states.

The practical digital security framework for journalists in hostile environments:

Device compartmentation: A travel device that has never been used for source communications and does not contain unpublished materials reduces the risk at checkpoints and from device compromise. Source communications should occur on a separate, compartmented device that does not cross checkpoints.

Communications encryption: Signal (end-to-end encrypted, with disappearing messages set) is the standard for source communications. Email communication with sources should use PGP/GPG encryption. The Freedom of the Press Foundation’s Secure Drop is the standard for document submissions from sources.

Metadata scrubbing: Documents and photographs carry metadata that can reveal source identity, location, and editing history. Metadata should be stripped from all materials before publication or transmission. Tools including ExifTool (for photographs) and the Metadata Anonymisation Toolkit (MAT2) are freely available.

Border crossing protocol: Devices crossing checkpoints should be encrypted with full disk encryption. Any device that has been seized at a checkpoint and returned should be treated as potentially compromised and replaced before being reconnected to source communications.

P1 City Assignments

The P1 city group presents distinct journalist security challenges:

Mexico City and Bogota: Organised crime-related journalist targeting is the primary elevated risk. Stories on cartel activity, drug trafficking, corruption, and political-criminal connections carry the highest targeting risk. Operating profile discipline – not publicising the assignment in advance, using unmarked vehicles, varying schedule and accommodation – is a primary protection measure.

Manila: The Philippines has a history of journalist killings at local and regional political level. Stories on local government corruption, land disputes, and extrajudicial killings carry elevated risk in regional areas outside Manila. NUJP (National Union of Journalists of the Philippines) can provide current security intelligence for assignments in the Philippines.

Karachi: Journalists in Pakistan face threats from multiple directions – criminal organisations, state intelligence services, and non-state militant groups – depending on the story. CPJ Pakistan Correspondent provides current security intelligence for Pakistan assignments.

Istanbul: Turkey imprisoned more journalists than any country globally in 2016-2019 (over 150 at peak) and remains in the top 10 for journalist imprisonment according to CPJ 2024 data. Assignments involving the Kurdish conflict, political opposition, or coverage of state institutions carry specific legal risk under Turkey’s broad anti-terrorism laws.

For the broader security framework for media teams operating in conflict zones, see our close protection in conflict and crisis zones guide. For the digital security framework applicable to all international travel, see our executive digital security guide.

Sources

CPJ (Committee to Protect Journalists): Journalist Imprisonment and Death Census 2024. UNESCO: Safety of Journalists Programme – Impunity Index 2024. Reporters Without Borders: Press Freedom Index 2025. Citizen Lab: Pegasus Project and Commercial Spyware Reports 2016-2024. Freedom of the Press Foundation: Digital Security Training Resources 2024. CPJ: Safety Advisories for Mexico, Philippines, Myanmar, Pakistan 2024. RISC Training: Hostile Environment Programme Overview 2024. Internews: Journalist Safety Baseline 2024. OSAC: Journalist Security in High-Risk Markets 2024. Control Risks: Media Sector Security Advisory 2024. ISO 31030:2021 Travel Risk Management.

For the security considerations specific to authors and public intellectuals whose published work has provoked organised hostile responses – including the long-duration community-based threat model, signing queue vulnerability at literary events, and NFTAC fixated reader escalation pathway – see our security for authors and public intellectuals guide. For NGO and development sector workers who operate in the same high-risk environments as media teams – covering HEAT training, Saving Lives Together, acceptance as a security strategy, and the duty of care framework for both international and national staff – see our security for NGO and development sector workers guide.

James Whitfield is a Senior Security Consultant with 20 years of experience in close protection and security risk management, including hostile environment assignments supporting media teams across high-risk environments globally.

Summary

Key takeaways

The fixer is the single most important security decision on a hostile environment assignment

A well-connected, trusted fixer with good digital security practices and a clear understanding of the security protocol is a force-multiplier for the media team's safety. An unvetted or compromised fixer is the most common single point of failure in assignments that go wrong. Fixer vetting is an operational requirement, not an administrative step.

Digital security is inseparable from physical security for journalists

A journalist in the field whose communications are being monitored has provided their location, schedule, source contacts, and story direction to an adversarial party. Physical safety depends on digital security in hostile environment journalism in a way that has no parallel in most other professional contexts.

Impunity is the defining pattern for violence against journalists

UNESCO's impunity index shows 89% of journalist killings since 2006 have gone unpunished. This impunity creates the threat environment -- the operational conclusion is that neither legal protection nor reactive justice provides meaningful deterrence, and prevention through security practice is the only reliable protection measure.

Freelance journalists face the highest risk with the least institutional support

Staff journalists at major news organisations typically have institutional security policies, security training requirements, and K&R insurance as a baseline. Freelancers, who account for a significant proportion of journalists working in high-risk environments, frequently have none of these. Freelancers should not deploy to P1 city or conflict zone assignments without independent arrangement of at minimum HEAT training, K&R insurance, and a security check-in protocol.

Border crossings and checkpoints are among the highest-risk moments for journalists in hostile environments

Checkpoint and border crossing situations are the most common point of detention or device seizure for journalists in hostile environments. A device that contains unencrypted source materials, unpublished reporting, or communications with sensitive contacts creates a serious source protection risk if seized at a checkpoint. The standard protocol is encrypted full-disk storage, no sensitive materials on travel devices, and a compartmented device for source communications that never crosses a checkpoint.

FAQ

Frequently Asked Questions

The Committee to Protect Journalists (CPJ) recorded 320 journalists imprisoned worldwide and 45 journalists killed in the course of their work in 2024 – the organisation’s annual census, which captures only confirmed cases, has consistently recorded 40-70 deaths per year for the past decade. UNESCO’s Safety of Journalists framework notes that impunity for crimes against journalists remains the defining pattern: 89% of killings of journalists since 2006 have gone unpunished according to UNESCO’s impunity index. The most dangerous countries for journalists in 2024 were Gaza/Israel, Myanmar, Mexico, the Philippines, and India according to CPJ data. The risk is not limited to conflict zones – Mexico and the Philippines represent criminal threat environments rather than conventional warfare.

HEAT (Hostile Environment and Emergency Aid Training) covers the physical safety skills relevant to conflict and crisis environments: first aid under fire, IED awareness, checkpoint and detention behaviour, convoy procedures, and casualty evacuation. It is the baseline hostile environment preparation that any journalist, NGO worker, or security professional deploying to a conflict zone should have. Journalist-specific security training goes further: it covers the particular threat profile of press work (surveillance by state and non-state actors, digital surveillance risks specific to investigative journalism, source protection, kidnap prevention for press), the ethical and legal dimensions of working in environments where the press is specifically targeted, and the newsroom decision-making framework for deploying journalists to high-risk assignments.

A fixer – the local journalist, guide, translator, or facilitator who supports a visiting media team – is both a critical operational asset and a potential security vulnerability. The vetting framework for fixers should include: verification of identity and background through the local journalist community (not just the individual’s own references), confirmation of their standing with local authorities or armed groups relevant to the story (whether they are known positively or negatively), assessment of their digital security practices (a fixer who communicates with the media team via unencrypted channels creates an interception risk), and a clear briefing on the security protocols the media team will operate under. Fixers with relationships with multiple competing armed groups, security services, or press operations in the same area require careful assessment of whose interests they may primarily serve.

Investigative journalists face digital security risks that are more targeted and sophisticated than standard corporate espionage. The specific risks are: phone compromise via commercial spyware (Pegasus/NSO Group, Predator, and similar systems have been documented against journalists in over 45 countries by Citizen Lab between 2016 and 2024); social engineering attacks targeting journalist accounts to identify sources; metadata in documents and photos that reveals source identity or location; communication interception in countries where state actors monitor journalist activities; and device seizure at borders or checkpoints that exposes unpublished material and source communications. The standard digital security protocol for investigative journalists – promoted by Freedom of the Press Foundation, EFF, and CPJ – includes Signal for communications, Tor or VPN for browsing, encrypted full disk storage, and compartmented devices for sensitive source communications.

Before deploying a journalist to a P1 city, a media organisation’s security policy should require: a current threat assessment for the assignment location (city, specific neighbourhood, specific story context), a pre-deployment security briefing covering the relevant threat environment and operational protocols, confirmation of the insurance position (kidnap and ransom coverage, hostile environment medical evacuation cover, life and accidental death coverage), the communications check-in protocol (frequency, method, what constitutes a missed check that triggers escalation), the emergency contact chain both in-country and at the newsroom, and a decision framework for when the editor has authority to order withdrawal. An organisation that deploys a journalist to Lagos, Karachi, or Manila without completing all of these steps is in breach of its duty of care under ISO 31030:2021 Travel Risk Management and may have legal liability under the Working at Height Regulations or general HSW Act 1974 duty of care framework.

Get in Touch

Request a Consultation

Describe your security requirements below. All enquiries are confidential and handled by licensed consultants.