| SERIES | Methods |
| TOOLS | Signal, Proton Mail, SecureDrop, source protection protocols |
| LEVEL | Intermediate |
| BEFORE THIS | ICIJ Offshore Leaks database: what is there, what is not, and how to use it |
THE CASE
A source is not a contact: the relationship requires active maintenance
Non-journalist sources bring information investigators cannot obtain through open sources alone. They take personal and professional risks to share what they know. The relationship that makes this possible is not automatic and does not maintain itself. It requires the investigator to actively manage trust, communication security, legal exposure and the source's ongoing welfare throughout the investigation and after publication.
This tutorial covers the practitioner-level discipline of building and maintaining investigative relationships with sources who are not journalists: whistleblowers, former insiders, current employees, civil servants, experts and community contacts. Each category has different motivations, different risk profiles and different needs from the investigator. The approach that protects one may expose another.
Source relationships in high-stakes investigations are not casual exchanges. They involve legal exposure for both parties, ongoing security obligations and a duty of care that extends beyond publication. Getting them right is as technically demanding as any OSINT workflow covered elsewhere in this series.
IN THE FIELD
ProPublica's investigation into the Supreme Court's undisclosed gifts in 2023 relied substantially on sources inside legal and financial circles who provided documents and context that were not publicly available. The investigation required sustained source relationships maintained over months, with secure communications, clear agreements about what would and would not be published, and ongoing contact to verify and extend findings as new material emerged.
| • | Secure communication: Sources provided documents and context through channels that did not expose their identity to institutional monitoring. |
| • | Sustained contact: The investigation extended over multiple publication cycles; maintaining source trust across that period required consistent, careful communication and clear updates on how their information was being used. |
| • | Legal coordination: Sources with potential legal exposure required the investigation team to coordinate with legal counsel on what could be published and how to characterise information without identifying its origin. |
ProPublica · Supreme Court investigation · 2023
Learning outcomes
By the end of this tutorial you will be able to:
| • | Assess a source's motivation, risk profile and legal exposure before establishing a formal relationship |
| • | Establish and maintain secure communication channels appropriate to the source's threat model |
| • | Define and document the terms of the relationship including what will and will not be published |
| • | Manage the ongoing welfare and security of a source through the investigation and after publication |
| • | Recognise when a source relationship has become unsafe and take appropriate protective action |
The rest of this tutorial is for Signal subscribers.
What remains: the decision framework, the tool configuration, the failure modes, and the evidentiary standard required to use the finding defensibly.
Join SignalA Signal subscription gives you:
- Full OSINT Reference Card library, 21 domains
- Methods, every tradecraft tutorial in full
- AI in OSINT, every tutorial and field report
- OSINT Hub community access