A secure phone for journalists — honest about what it does.

The journalist's threat model in Australia

Australian journalism operates under a specific set of legal and operational pressures. The National Security Legislation Amendment (Espionage and Foreign Interference) Act 2018 expanded the circumstances under which journalists and their sources can face legal exposure. The Telecommunications (Interception and Access) Act 1979 gives law enforcement agencies access to telecommunications metadata — who called whom, when, from where — without requiring a warrant for the metadata itself.

This metadata is often more revealing than the content of communications. Knowing that a journalist called a particular government department's HR line at 3pm on a Tuesday, then a known whistleblower's personal mobile at 3:15pm, and then their editor at 3:30pm tells investigators a great deal — even if they never read a single message. Source protection on a stock phone is substantially undermined by the metadata that the phone generates automatically, regardless of what apps you use for messaging.

The risks that matter specifically for journalists:

• Metadata exposure. Who contacted whom and when — carrier-level data available to law enforcement under existing legislation.
• Message and note content. If a device is physically accessed or a cloud account compromised, the content of working files, messages, and notes is exposed.
• Device examination during travel or after seizure. A device that leaves your hands — at a border, during arrest, or after a court order — exposes everything on it if it is not properly protected.
• Background telemetry. Stock phones send location data, app usage, contact information, and identifiers to Apple, Google, and advertising networks continuously. This builds a detailed picture of movements and relationships.
• Cloud account compromise. An iCloud or Google account compromise gives an attacker access to messages, photos, notes, and location history going back years.
• Network interception. On public Wi-Fi at a court, parliament, or press conference, unencrypted traffic is exposed to anyone monitoring the network.

What a hardened device actually fixes

A GrapheneOS device prepared for journalistic use addresses most of these risks in a way that a stock phone cannot. Here is a direct account of what it fixes and how:

Background telemetry — removed at the OS level

GrapheneOS removes Google Services from the base operating system. There is no account silently backing up your contacts, location history, and search queries to a server. The advertising identifier is absent. Sensor access (location, microphone, camera, accelerometer) is controlled per-app and can be toggled off entirely. The background data flows that make a stock phone a persistent telemetry device are gone.

Source contact — metadata-minimal messaging

Signal is the standard tool for journalist-source communication. It provides end-to-end encryption for calls and messages and collects almost no metadata — the only information Signal retains is account creation date and last connection date, which has been confirmed in US federal court proceedings. For initial contact with a source who should not know your phone number, Threema provides messaging with no phone number required on either side. We pre-configure both on prepared devices.

See our private messaging apps guide for a full comparison of Signal, Threema, WhatsApp, and iMessage for journalists.

Profile separation — isolate the sensitive work

GrapheneOS supports fully isolated user profiles at the OS level — separate storage, separate encryption, separate apps, separate network identity. A journalist can maintain a work profile with only the tools and contacts for sensitive work, a personal profile for everyday life, and a "clean" profile for devices that might be handed to a source or taken through a border inspection. A compromise of one profile cannot access data in another.

Network protection — VPN on every connection

Mullvad VPN with a kill-switch ensures that every packet of data leaving the device travels through an encrypted tunnel, regardless of which network you are connected to. This prevents local network monitoring at court buildings, parliamentary press galleries, hotel networks, and conference venues. The kill-switch means the device will not connect to any network at all without the VPN active — there is no window during which unprotected traffic can leak.

Physical device protection — encryption and duress

GrapheneOS enforces full-disk encryption with verified boot relocked to GrapheneOS's own keys. A powered-off device — or one that has auto-rebooted to its before-first-unlock state — requires the passcode to decrypt the data. Physical access to the device hardware alone is not sufficient to read the contents.

The Phantom Protocol adds a duress PIN that triggers silent deletion of sensitive profiles, an auto-reboot interval that automatically returns the device to before-first-unlock state after a set period of inactivity, and remote wipe capability via a trusted contact. These are lawful preparedness tools, not obstruction — see our guide on whether encrypted phones are legal in Australia.

Cloud independence — no vendor holds your keys

There is no required Google account on a GrapheneOS device. Backups, if used, are local or encrypted end-to-end. A government agency cannot serve a cloud provider with a request that returns your notes, messages, and contacts because those things are not in a cloud account under your name.

What it does not do — being honest

It is worth being direct here, because false confidence is its own risk:

• It does not hide which cell tower you connect to. The carrier always knows which tower your SIM is connected to. This is inherent to how mobile networks function. A private eSIM with a different identity helps separate your data traffic from your voice/SMS identity, but does not eliminate carrier-level location data for the SIM itself.
• It does not protect a conversation if the source is careless. If a source uses WhatsApp on a stock Android phone, the metadata of your Signal conversation is still protected on your end, but the source's metadata — the fact that they were in regular contact with a phone that then called your newsroom — is not.
• It does not make you legally untouchable. Journalists have some protections under Australian law, but they are qualified and contextual. A device with strong encryption does not create legal immunity. For your specific circumstances, consult a qualified lawyer.
• It does not protect you if you unlock the device voluntarily. Physical access to an unlocked, booted device means access to data. Lock habits and auto-reboot intervals reduce the exposure window, but good physical security habits remain essential.
• It does not anonymise you. A privacy-hardened phone makes you significantly harder to monitor at scale, but it does not make you untraceable. Operational security — how you behave, not just what device you carry — remains the most important factor.

Recommended setup for a journalist secure phone

Source contact protocols — the practical steps

A secure device is part of a source contact protocol, not a substitute for one. The following steps are based on standard recommendations from press freedom organisations and applied to the Australian context:

Initial contact from an unknown source

Provide a Threema ID or Signal username (not your primary phone number) as a contact method for initial secure contact. This is published in your byline, your outlet's secure contact page, or provided in a physical setting. A source can contact you on Threema without knowing your phone number and without you knowing theirs — the metadata profile of the first contact is near-zero.

Ongoing source communications

Use Signal for ongoing communications with established sources. Set disappearing messages to a sensible interval — long enough to maintain the conversation thread you need, short enough to limit exposure if the device is accessed later. Confirm the Signal safety numbers (fingerprint verification) with a trusted source out-of-band — in person, via a known phone call, or via a secondary channel — to guard against interception attacks.

Sensitive document handling

Documents received from sources should be handled on the isolated work profile. Do not open them on the same profile that runs social media, email, or other apps — a malicious attachment that exploits a vulnerability in a document viewer should be contained to that profile's sandbox, not given access to your entire device.

After publication

Review what remains on the device after a sensitive story publishes. Consider whether source contact information, working documents, or message histories should be retained or deleted. On GrapheneOS, deleting a user profile is a complete cryptographic wipe of that profile's encrypted storage.

Journalism travel — specific considerations

Reporting trips — particularly to countries with authoritarian governments, active censorship, or foreign intelligence programs — carry risks that domestic work does not. The following principles apply to international travel for journalists:

Australian legal context for journalists

Australian journalists have qualified shield law protections under federal and state legislation, but these protections have limits and exceptions — particularly in national security contexts. The full legal picture is complex and continues to evolve. Key points for this guide:

• Using encrypted phones and messaging apps is legal in Australia. There is no law that prohibits a journalist from using Signal, Threema, or a hardened phone.
• A court can order a journalist to reveal a source in certain circumstances, but that order operates against the person, not only the device. A device that cannot produce the information because it was never stored there is a different matter from a device that contains the information but whose owner refuses to produce it.
• Police and border force can compel a person to provide their device passcode in some circumstances under Australian law. The device seizure preparation guide and phone search powers guide cover the detail — but neither is legal advice. For your specific situation, your outlet's legal team is the right starting point.
• Metadata — call records, message timestamps, and communications metadata — is accessible to law enforcement under the Telecommunications (Interception and Access) Act 1979 without a warrant for the metadata itself. This is the primary reason a secure messaging app on a standard phone, while better than nothing, is not a complete source protection measure.

Device recommendations for journalists

The recommended device for a journalist secure phone is a Pixel 10 Pro or Pixel 9A running GrapheneOS, prepared with encrypted messaging, Mullvad VPN, isolated profiles, and Phantom Protocol. The Pixel 9A is the more discreet choice — it is a standard-looking mid-range phone that does not attract attention — while the Pixel 10 Pro offers the Titan M2 security chip and a longer supported lifecycle.

For journalists who need a travel-only device, a second Pixel 9A configured as a clean travel device is an effective and relatively inexpensive solution. We configure travel devices specifically for reporting trips on request.