Secure source communications is the practice of exchanging information with confidential sources across channels that resist adversarial interception at every layer: message content, network metadata, and device integrity. The threat model is not theoretical. State-sponsored spyware capable of zero-click device compromise, carrier-level traffic analysis, and metadata harvesting from unencrypted platforms are all documented and deployed against journalists. Tool selection addresses only one layer of that threat surface. Operational discipline, device hygiene, and the compartmentalisation of source identity address the rest.
The methodology applies whenever a source operates in a jurisdiction where phone and email are monitored, when documents must be received without exposing the submitter's identity, or when an active investigation involves state or organised crime actors capable of traffic analysis. A clean device scan does not confirm the device is secure. A source's use of encrypted messaging does not confirm their device is uncompromised. Each indicator, individually, is ambiguous. The pattern, corroborated across tools and behavioural checks, is not.
HUM-002 sets out the methodology for establishing, maintaining, and documenting secure communications with confidential sources to evidentiary standard.
Eight workflow steps, six tooling sources, five false-positive checks, six chain-of-custody requirements.
|
01
Required Tools
Six platforms covering messaging, document submission, device forensics, and censored-environment comms.
|
02
OPSEC
Device segregation, metadata exposure risks, and disappearing-message discipline.
|
|
03
Workflow
Eight-step sequence from threat modelling to post-publication device destruction.
|
04
False Positives
Clean scans, encrypted apps, and device symptoms that do not confirm device security.
|
|
05
Chain of Custody
Six requirements covering contact logs, scan records, source identity handling, and retention.
|
06
Key Queries
Five operator commands across MVT, SecureDrop, Signal, and Citizen Lab.
|
Download the card.
A PDF version of HUM-002 is available below for Signal subscribers.
This reference card is for Signal subscribers.
Signal subscribers get the full OSINT Reference Card library, plus every Methods tutorial and Forensic Dossier.
Join SignalA Signal subscription gives you:
- Full OSINT Reference Card library
- Methods, all tradecraft tutorials in full
- Shadow Analysis, all evidence-based reporting
- Forensic Dossiers, full access
- Discord access included
