Support us
Independent journalists working around the Russo-Ukrainian war face dangers that extend beyond shelling, detention, and restricted access. Their phones and laptops can become targets for spyware: malicious software designed to monitor communications, collect files, track movements, or quietly activate microphones and cameras.
Surveillance threatens more than an individual reporter. It can expose confidential sources, reveal the location of field teams, compromise unpublished investigations, and place local contributors at risk. In conflict-affected regions, a compromised device may become a map of an entire reporting network.
For media organizations documenting war crimes, occupation, forced displacement, and disinformation, digital security is part of journalistic safety. Understanding how spyware operates helps newsrooms reduce exposure while protecting the public’s right to reliable information.
Spyware differs from ordinary malware because it is built for covert surveillance. Some tools exploit weaknesses in mobile operating systems through malicious links or attachments. Others use highly sophisticated “zero-click” techniques, in which a device may be compromised without the target opening a message.
Attackers can include state agencies, proxy groups, criminal networks, and actors seeking to intimidate or silence critical voices. Journalists investigating military activity or corruption may be targeted because their reporting can challenge official narratives and reveal abuses.
A reporter’s risk increases when working with multiple sources, crossing checkpoints, entering recently liberated areas, or communicating with people under occupation. A seemingly routine message from a colleague, official, or source can carry a malicious payload or lead to a fraudulent login page.
Physical access creates another vulnerability. Devices may be inspected at borders, seized during detention, or left unattended in hotels and temporary offices. Weak passwords, outdated software, unencrypted backups, and shared accounts can allow an initial intrusion to spread across a newsroom.
The damage depends on the spyware’s capabilities and the attacker’s objectives. Even when message content is protected by end-to-end encryption, an infected device can capture information before encryption or after a message is decrypted.
| Exposed information | Potential consequence |
|---|---|
| Contact lists and messages | Sources and colleagues may be identified |
| Location history and metadata | Field teams, safe routes, or reporting sites may be exposed |
| Photos, notes, and documents | Investigations can be stolen or disrupted |
| Microphone and camera access | Private meetings and conversations may be monitored |
| Authentication tokens | Email, cloud storage, and social accounts may be hijacked |
The consequences can be especially severe for journalists reporting from areas affected by occupation or active combat. Digital evidence may be altered, witnesses intimidated, and publication schedules disrupted before a newsroom recognizes that an intrusion has occurred.
Spyware often forms part of a broader campaign to control the information environment. Surveillance can identify journalists who challenge fabricated narratives, while stolen material may be selectively leaked, manipulated, or used to discredit reporting.
Independent newsrooms have an essential role in testing claims against evidence and documenting patterns of manipulation. Coverage of Russian disinformation campaigns shows why journalists need secure channels, careful source protection, and editorial independence when propaganda is designed to travel faster than verification.
No single tool eliminates the risk of spyware. Effective protection combines technical safeguards, clear newsroom procedures, and ongoing training. Security plans should reflect the real conditions reporters face, including unreliable connectivity, shared equipment, emergency evacuations, and limited access to specialists.
Newsrooms should also prepare for the possibility that a device has already been compromised. Suspicious battery drain, unexplained data use, unexpected account alerts, or unusual device behavior deserve investigation, though spyware can remain invisible. Journalists should preserve potential evidence and seek help from a trusted digital security organization rather than immediately deleting everything.
Training should include secure file sharing, identity verification, metadata awareness, and safe handling of sources in occupied or recently de-occupied communities. The challenges of reporting in these locations make preparation especially important, because a careless digital trace can endanger both reporters and residents who provide testimony.
Digital safety cannot be separated from physical and psychological safety. A journalist who fears that every communication is monitored may avoid contacting vulnerable witnesses or abandon an investigation. Editors need to create procedures that allow reporters to raise concerns without blame and to pause publication when source protection requires it.
Independent organizations can strengthen this work by funding security assessments, specialist support, equipment replacement, and practical education. They can also help smaller regional outlets access expertise that would otherwise be unavailable, preserving vital reporting from communities most affected by the war.
Free Press Foundation supports independent journalism, investigative work, election coverage, and reporting from conflict-affected regions. Supporting its programs helps journalists document reality with greater safety and independence. Donate, share its work, and help build a press capable of resisting surveillance, intimidation, and disinformation.
