Journalism’s Missing Safety Stack

During Uganda’s 2026 election blackout, freelance journalist Godfrey Badebye sent a Google Drive file to an editor and discovered that the editor did not have permission to open it. Correcting the mistake should have taken seconds. Instead, Badebye had to travel for two hours to reach a connection and approve access. Elsewhere, television crews moved footage by motorcycle and bus because the digital path between field and newsroom had disappeared. The work continued, but the software stack had stopped being a stack.

These details come from interviews published by the Reuters Institute, not from a story about obsolete technology. They come from a modern election in which reporters had cloud storage, smartphones, editors, and publishing systems. What they lacked was continuity between those pieces when the operating assumptions changed.

Most journalism software begins after a reporter has obtained the information. It helps write, edit, collaborate, publish, distribute, measure, and monetize. In an adversarial environment, the harder problem begins earlier. Someone has to decide what data to carry, how to check in without creating a location trail, how to capture evidence without exposing a source, how to move a file through a failing network, and what the newsroom must do if the reporter or device does not return.

Journalists under violence, surveillance, and network failure do not lack isolated security tools. They lack a coherent safety stack protecting the reporting mission from preparation through recovery.

That missing stack is a technology opportunity. It is also an unusually unforgiving one: a product built to protect a journalist can become the most useful surveillance system in the room.

Danger Is A Systems Condition, Not A Place

“Danger zone” suggests a point on a map. The useful definition is operational instead. An environment becomes adversarial when normal assumptions about connectivity, institutional protection, device custody, freedom of movement, or good-faith platform behavior can no longer be trusted.

That includes armed conflict, but it also includes reporting on organized crime in Mexico, a protest under curfew in Bangladesh, an election during a shutdown in Uganda, a natural disaster that destroys communications, or an online campaign that publishes a reporter’s home address. The hazards differ, yet the system failures rhyme: the network disappears, the device changes hands, the source becomes identifiable, the newsroom loses contact, and the online attack crosses into physical life.

The scale is not abstract. The Committee to Protect Journalists documented 129 journalists and media workers killed in 2025, its highest annual total since it began collecting data in 1992. Access Now and the #KeepItOn coalition documented 313 internet shutdowns across 52 countries that year; conflict was the leading trigger. Different organizations use different definitions and methodologies, but the direction is clear: physical risk and information control increasingly arrive together.

Bangladeshi reporter Zyma Islam described the consequence in a 2024 Reuters Institute interview. During an internet blackout and curfew, the loss of information was itself a physical hazard: she entered an area without knowing that security forces were firing there. Her newsroom prepared stories offline and kept print distribution running until connectivity returned. The reporting system degraded into people, paper, vehicles, and judgment.

Risk is also distributed unequally. A visiting correspondent may leave when an assignment ends. A local reporter, fixer, driver, or source remains inside the political and social consequences of the story. Elena Cosentino, director of the International News Safety Institute, described the persistent protection gap between international staff and local journalists, even as global outlets depend more heavily on local reporting.

No application resolves that inequality. Technology can complement training, protective equipment, insurance, legal support, psychological care, and responsible commissioning. It cannot replace them. The product opportunity begins by accepting that boundary.

The Journalism Stack Starts Too Late

The field is not empty. ACOS Alliance provides JESS for assignment planning along with resources on insurance, trauma, commissioning, and digital security. SecureDrop gives news organizations a purpose-built system for anonymous submissions and newsroom handling, backed by an explicit threat model. The Freedom of the Press Foundation maintains current guidance on Signal, metadata, devices, documents, and source channels.

There are tools for disrupted networks and trustworthy media, too. Briar was designed for decentralized, offline-capable communication. ProofMode attaches cryptographic proof data to media. eyeWitness supports capture and chain of custody for legal evidence. C2PA defines an interoperable provenance standard. Each solves a real part of the problem.

But a list of secure tools is not an operational system. The reporter still has to translate a risk assessment into device policy, decide which communication mode survives which failure, move evidence into an editorial workflow, and trigger help when a check-in is missed. Every handoff creates a seam. Every seam becomes one more decision made under fatigue, fear, low bandwidth, or incomplete information.

The sustainability seam matters as much as the technical ones. In 2026, the Briar team explained that a lack of funding had pushed development into spare time before the project continued in maintenance mode, limited for now to essential security updates and bug fixes. That is not a failure of Briar. It is evidence that critical public-interest software can attract users, prove a need, and still struggle to finance the unglamorous work that keeps it trustworthy.

The missing category is therefore not one universal app. It is a safety stack organized around the mission:

Prepare → Coordinate → Capture → Transfer & Verify → Respond & Recover

Across every phase run the same constraints: threat modeling, data minimization, degraded operation, stressed-user design, auditability, interoperability, and long-term maintenance.

Mission phase	Product thesis	Likely buyer	Failure it must not create
Prepare	Assignment safety orchestration	Newsrooms, networks, NGOs	A centralized map of vulnerable people
Coordinate	Resilient field coordination	Newsrooms and media consortia	Observable or misleading check-ins
Capture	Safe capture and provenance	Newsrooms and rights organizations	Identity or location leakage
Transfer & Verify	Privacy-preserving handoff	Investigative and local newsrooms	False confidence or retained source data
Respond & Recover	Incident response workflows	Newsrooms, assistance networks, funds	A high-value database of crises

These are product theses, not validated companies. Published testimony demonstrates the failures; it does not prove who will pay or which interface will win.

1. Assignment Safety Orchestration

User. A reporter, editor, freelancer, or small team preparing an assignment where risk can change quickly.

Failure today. Planning exists, but often as documents, training memories, chat messages, and personal judgment. In CPJ interviews about Mexican election coverage, Proceso correspondent Isaín Mandujano said reporters were often left to assess where violence might occur because their organizations had not prepared them sufficiently. El Noroeste editor Adrián López pointed to a parallel deficit around disinformation, hacking, and denial-of-service attacks. Their comments appear in a broader CPJ safety kit for journalists in Mexico.

Product thesis. Build an orchestration layer that turns a contextual risk assessment into a minimal mission plan: roles, equipment, communication windows, fallback channels, escalation ownership, and an offline copy that remains understandable when the service is unavailable. It should integrate established resources such as JESS instead of inventing its own universal risk score.

The important feature would not be a dashboard. It would be selective disclosure. The field team might need the next check-in time without carrying the newsroom’s contact graph. An editor might need confirmation that a protocol was acknowledged without receiving a continuous location stream. Sensitive details should expire by design, with visible retention rules and a way to produce a paper fallback.

Buyer hypothesis. Newsrooms, journalist networks, commissioning organizations, and NGOs—not the freelancer facing the highest risk.

Danger introduced. A perfectly synchronized mission plan can become an adversary’s itinerary. A numeric risk score can create false permission to proceed. Continuous tracking can turn duty of care into worker surveillance.

Validation. Run tabletop exercises with real editorial teams. Measure whether participants can execute the plan with the server offline, whether every escalation has a human owner, and how little sensitive data remains afterward. Do not use a live crisis as the first usability test.

2. Resilient Field Coordination

User. Field reporters, editors, fixers, drivers, and trusted outside contacts trying to preserve a shared picture under partial connectivity.

Failure today. Encrypted messaging protects content only while a usable path exists. Standard calls, cloud permissions, authentication prompts, and media uploads fail differently. Even encrypted systems expose some metadata and usage patterns. A network outage can therefore become both a communication problem and a visibility problem.

Uganda’s election coverage showed the range of degradation. In the Reuters Institute’s interviews, Kamana Ivan Walunyolo described television footage traveling physically by motorcycle and bus. He also explained why reporters moved in groups: colleagues could witness and report a detention rather than allowing someone to disappear from the information system. The resilient network was partly technical and partly human.

Product thesis. Build coordination that can move between available transports without pretending they are equivalent: an encrypted message when data works, a compact store-and-forward packet when it does not, and an explicit offline protocol when no digital channel is safe. The interface should communicate uncertainty. “Not received” and “received but not acknowledged” are different states, especially when silence may mean detention, dead battery, deliberate radio discipline, or ordinary delay.

Abeer Saady, a conflict reporter and safety trainer, emphasized in an ICFJ forum summary that devices may be seized and communication infrastructure may collapse. The less sensitive information a reporter carries, the smaller the blast radius. Resilience cannot mean replicating everything everywhere.

Buyer hypothesis. News organizations, regional media consortia, and assistance networks that already coordinate multiple field teams.

Danger introduced. Mesh discovery, radio regulation, traffic analysis, battery drain, and overconfident delivery indicators can expose or mislead users. Satellite connectivity is not an invisible or universally legal escape hatch.

Validation. Test throttling, intermittent links, device loss, clock drift, and long offline periods. Audit content and metadata. Success is not maximum message volume; it is predictable degradation and a team that still knows what the system does not know.

3. Safe Capture And Evidence Provenance

User. Photojournalists, videojournalists, local witnesses, editors, and investigators who need both publishable material and confidence in its history.

Failure today. Authenticity and safety can demand opposite metadata. Time, location, device identity, and an unbroken chain of custody can strengthen evidence. The same fields can identify the person who stood behind the camera.

Existing projects show different parts of the design space. eyeWitness embeds metadata and maintains a secure chain of custody for material intended as legal evidence. ProofMode produces separate proof data and cryptographic signatures without modifying the original file; its own goals explicitly distinguish proof from encryption. C2PA can preserve signed assertions about origin and edits through a media workflow.

The distinctions matter. C2PA can make provenance tamper-evident, but its specification is clear that provenance alone cannot determine whether the depicted event is true or factual. A valid signature proves a relationship between an asset and assertions, not the honesty of the camera operator, the completeness of the frame, or the meaning of the scene.

Product thesis. Build capture around separate disclosure modes. A newsroom may need an encrypted original, an editorial derivative stripped of identifying fields, and an evidentiary package whose richer metadata is released only to an authorized investigator. Those outputs should share integrity links without forcing every recipient to receive every fact.

Buyer hypothesis. Newsrooms, human-rights organizations, evidence archives, and investigative collaborations. The product may be an interoperable component rather than another camera app.

Danger introduced. Automatic location, persistent identity, cloud backup, or a visible “secure camera” can put the operator at risk. A provenance badge can also become a misleading proxy for truth.

Validation. Verify integrity after common newsroom edits, exports, crops, and recompression. Test that unauthorized recipients cannot recover withheld metadata. Ask whether the safest output is sometimes an ordinary-looking file with proof held elsewhere.

4. Secure Handoff And Privacy-Preserving Verification

User. The source, field reporter, receiving editor, security specialist, and verifier who touch material before publication.

Failure today. A file does not simply move from A to B. It may pause on a phone, enter a cloud sync queue, generate thumbnails, cross an AI transcription service, land in a shared drive, and expose metadata in an editorial tool. Encryption in transit protects only one segment of that path.

SecureDrop demonstrates what serious workflow design looks like: isolate roles, minimize third parties and metadata, treat incoming files as potentially malicious, and define adversaries and assumptions. Its strength also demonstrates why a generic upload button is not enough. Smaller newsrooms need usable handoff patterns without being told that one specialized system solves every source, field, and publication scenario.

Product thesis. Build a resumable, low-bandwidth handoff that separates media, source identity, provenance, and editorial notes into independently authorized objects. Perform preview generation and redaction locally where possible. Let the sender understand what will leave the device before transmission, and let the newsroom prove when sensitive derivatives were deleted.

AI can assist with transcription, translation, duplicate detection, or proposed redactions. It must not silently become a new recipient. Provider logs, model retention, prompt injection inside documents, incomplete redaction, and hallucinated verification all expand the threat model. High-risk material should default to local processing or an explicitly approved environment, and every consequential output should require human confirmation.

Buyer hypothesis. Investigative outlets, local newsrooms, documentary teams, and organizations that already operate secure source channels.

Danger introduced. Central storage becomes a target; resumable transfer can leave recoverable fragments; automated redaction can miss a reflection, voice, filename, or contextual identifier. “AI verified” is not a defensible editorial state.

Validation. Transfer large files through simulated interruption, then test recovery, deletion, malware isolation, and re-identification. A successful system must reveal its residual risk rather than compress it into a green shield icon.

5. Incident Response And Recovery

User. A freelancer, editor, security lead, legal contact, and support organization responding to a missed check-in, detention, device seizure, doxxing, account compromise, or trauma after publication.

Failure today. The emergency plan is often a phone tree assembled during the emergency. Digital access may remain open while colleagues debate who can revoke it. A newsroom may document abuse but have no path from evidence to platform escalation, legal help, relocation, or psychological support.

Online harm also persists after the notification stops. In Reuters Institute interviews with independent journalists, Rachel Gilmore described harassment as a force that can push women away from entering or remaining in journalism. French journalist Salomé Saqué described how even intermittent serious threats remain with the recipient. Recovery is not an inbox-cleaning problem.

Product thesis. Build an incident runner, not an automated savior. It should execute a pre-agreed runbook: identify the accountable human, revoke scoped credentials, preserve only necessary evidence, assess which sources may be exposed, and connect the team to legal, medical, relocation, or psychological assistance. The reporter should be able to see and contest what the organization records about the incident.

Buyer hypothesis. Newsrooms, press-freedom organizations, emergency funds, and journalist assistance networks. Existing rapid-response programs show that support already spans equipment, legal needs, medical care, and mental health; software should route to that ecosystem, not pretend to replace it.

Danger introduced. A central incident console is a directory of vulnerable people. A missed check-in can have benign causes. An automatic escalation or remote action may make coercion worse, destroy evidence, or alert an adversary. Psychological care cannot be reduced to a chatbot.

Validation. Rehearse revocation and notification with named human owners. Measure time to action, false escalations, data retained, and the ability to operate when the primary administrator is unavailable. Recovery ends when people regain agency, not when a ticket closes.

The Safety Product Can Become The Threat

Safety products accumulate authority. They ask for location because location helps rescue. They ask for contacts because contacts help escalation. They retain evidence because evidence helps accountability. Each request is reasonable in isolation. Together they can create a surveillance system more complete than the one a newsroom would tolerate anywhere else.

That possibility should define the category’s design doctrine.

First, publish the threat model and the non-goals. “Encrypted” is not a threat model. Builders should state which adversaries, device states, network observers, insiders, coercion scenarios, and user errors the design addresses—and which it does not.

Second, collect less. Prefer expiring capability over permanent identity, coarse state over continuous coordinates, and local computation over centralized telemetry. Continuous GPS and dead-man switches should not be defaults. Under coercion, an automatic alarm can be as dangerous as silence.

Third, design for stress and degradation. A feature that requires remembering a hidden gesture, reading a long warning, or completing an unfamiliar recovery flow may fail at the only moment it matters. Interfaces need clear language, localization, accessible offline instructions, paper-compatible fallbacks, and drills.

Fourth, make institutional responsibility visible. Cosentino argues that editorial and safety leaders must make risk decisions together. A product should encode ownership without transferring the ultimate decision to an algorithm or to the reporter standing in the dangerous place.

Fifth, finance maintenance before expansion. Security audits, localization, dependency updates, incident response, user support, and vulnerability remediation are the product. A grant-funded prototype that cannot patch a critical flaw is not durable safety infrastructure.

Finally, ban business models that conflict with the mission. Safety telemetry should not feed advertising, worker performance scoring, data brokerage, or government sales. The people being protected cannot also be the product.

Who Pays For A Public-Interest Stack?

The person at greatest risk is often the least plausible customer. Local reporters and freelancers may lack institutional backing, insurance, safety equipment, or predictable income. Charging them individually for the complete stack would reproduce the protection gap the technology claims to close.

A more credible model is hybrid.

Open protocols, core libraries, independent audits, translations, and public threat research can be funded as shared infrastructure. The Open Technology Fund offers one existing pattern: public and mission-aligned funding, including support aimed specifically at FOSS sustainability.

Newsrooms and institutions can pay for the operational layer: managed deployment, administration, training integration, support, audit logs, and incident coordination. Large organizations can subsidize common infrastructure while paying for service levels and private deployment. Regional media consortia can share costs that no small outlet could justify alone.

Philanthropy and emergency networks still have a role where no commercial buyer exists. CPJ and IWMF’s rapid-response funding illustrates how journalist safety already crosses equipment, health, psychological care, and services. Technology can make those networks easier to reach and operate, but it should not force every kind of care into software.

These are buyer hypotheses, not market sizing. The next step for any founder is not a larger platform diagram. It is discovery with local journalists, commissioning editors, trainers, security maintainers, and assistance organizations about one narrow failure they already own.

Build With Journalists, Not Around Them

Journalism’s missing safety stack will not be built by declaring journalists another vertical SaaS market. The environment is adversarial, the buyers are fragmented, the consequences of failure are asymmetric, and some of the most important components should remain public goods.

That is precisely why the category deserves serious builders.

Start with one seam: the plan that cannot survive offline, the file whose provenance exposes its maker, the handoff that leaks into a cloud service, or the emergency protocol that exists only in one editor’s head. Build with local reporters and safety experts. Test in simulations before crises. Publish the limits. Measure reduced exposure, predictable degradation, and response quality—not engagement.

The current stack optimizes the distance between draft and audience. The next one must protect the longer path between assignment and return.

The most important journalism technology of the next decade may not help a story publish faster. It may help the story, the source, and the journalist reach the other side at all.