The increasing seizure of journalists' digital devices by authorities using advanced forensic tools and spyware poses a severe threat to source confidentiality and press freedom, forcing reporters to rely on strict digital hygiene and minimised data storage to mitigate risk.
Are you a journalist? Do you investigate powerful corporations, expose alleged government corruption, document human rights abuses in conflict zones or report critically on an authoritarian government? You could be working in a Western democracy, far from any conflict. Yet one day, because of your reporting, you may be stopped at an airport or find police raiding your home in the middle of the night.
They may demand your phone and ask you to unlock it. You may refuse, believing that withholding your passcode will protect the source who spoke to you the night before about corruption within the government. But refusing to unlock your phone does not necessarily mean your information is safe or that the people who trusted you to protect their identities are out of reach.
In October 2023, Indian police raided the homes of journalists and others associated with NewsClick, one of India’s independent news websites. The raids were part of an investigation into allegations that the outlet had received foreign funding linked to China and disseminated Chinese propaganda. NewsClick denied the allegations.
Among those whose homes were raided was Paranjoy Guha Thakurta, a veteran Indian investigative journalist and then a NewsClick consultant. Speaking to Al Jazeera Journalism Review (AJR), he recalled that officials arrived at around 6 am and seized his digital devices, including his mobile phone, which was subsequently examined.
According to Guha Thakurta, investigators extracted data from his phone, including files, photographs and text messages. After nearly five decades in journalism, he had built relationships with many people who spoke to him on the condition of anonymity. During the investigation, officials wanted to know whom he had been communicating with. He recalled an incident in which an officer questioned him about a person named S. Bhatnagar, with whom he had communicated through the encrypted messaging platform Signal. Guha Thakurta told the officer that Bhatnagar was his brother-in-law.
The experience left him concerned about the privacy of his communications. He now switches off his microwave and places his phone inside it when speaking to someone at home, a precaution he believes may help protect his conversations.
When a phone is seized, what happens to its data?
Guha Thakurta is not alone. Around the world, journalists face the seizure of their digital devices, whether during police raids or at international borders. And even when a device is returned, questions can remain about whether its contents were accessed or copied while it was out of its owner's hands.
Earlier this year, Max Blumenthal, editor of the news website The Grayzone, travelled to Iran on a press trip to cover the aftermath of the US-Israeli war with Iran and the funeral procession of the country’s Supreme Leader. On arriving at Dulles International Airport in Virginia, US Border Patrol agents stopped him, questioned him about his trip, including who had funded it, and seized two of his mobile phones.
The phones were returned about 24 hours later. But their return left a crucial question unanswered: had officials accessed or copied the data stored on them?
According to Blumenthal, the government stated in an affidavit that officials tried to access the phones but were unsuccessful. He questioned that account and sought further details through the courts about who handled his devices while they were in government custody and what, if anything, was done to them. He wanted evidence establishing whether officials had accessed his data, rather than relying solely on the government’s account.
For journalists, the uncertainty itself is troubling. A phone can hold contact details and conversations involving hundreds of sources worldwide. If that information is extracted, people who spoke to a journalist in confidence could come under scrutiny, potentially putting their safety at risk.
Even less sensitive information can reveal a great deal. Location history, for example, could help investigators reconstruct a journalist’s movements and identify places they have visited, including meetings they may have deliberately avoided discussing over the phone.
A device could also contain traces of an investigation that has yet to be published, communications with a source, documents exchanged through an encrypted messaging service or evidence of work submitted to a publisher. Access to that material could expose a story before publication and reveal the people who helped bring it to light.
How forensic tools access data
When law enforcement officers gain physical access to a phone, whether during a raid on a journalist’s home, as in Guha Thakurta’s case, or at an airport, as in Blumenthal’s, they may use specialised technology to examine its contents. Known as mobile forensic data extraction tools, these systems retrieve and analyse information from digital devices.
What investigators can access depends on the phone, its operating system and security settings, and the capabilities of the tool being used. They may attempt to unlock the device and, depending on whether that succeeds, extract available information, create a forensic image of accessible data or retrieve specific items, such as a file, text message or contact.
Some tools exploit software vulnerabilities to access information that would otherwise be protected. Their capabilities vary, however, and they cannot be assumed to unlock every device or defeat every form of encryption.
Investigators can then organise the extracted information into a report they can examine and potentially submit as evidence in criminal proceedings. In effect, a phone containing years of personal and professional communications can become a searchable collection of information about a journalist’s work, contacts and movements.
Companies supplying this technology include Cellebrite, which makes the UFED product line, and Grayshift, associated with GrayKey. Costs vary by product, licence, and contract, ranging from thousands of dollars to much larger sums for specialised systems and packages.
US Immigration and Customs Enforcement reportedly purchased around $3 million worth of this technology in 2025, illustrating the scale of government investment in digital forensic capabilities.
The dangers might go beyond preliminary analysis. Spyware has also been installed in some cases following forensic access, possibly enabling surveillance to continue even after the device has been returned.
That concern arose in the case of Serbian investigative journalist Slaviša Milanov. In 2024, police detained him following a traffic stop and took his phone, which was switched off at the time. After his release, Milanov suspected that his device had been tampered with and submitted it to Amnesty International’s Security Lab for analysis.
Researchers found forensic evidence that Cellebrite UFED had been used to unlock his phone and that spyware known as NoviSpy had subsequently been installed. Amnesty International reported that the spyware could collect sensitive information and access the phone’s microphone and camera.
What does the law say?
The legality of seizing and examining a phone varies by country and depends on the circumstances. A police search at someone’s home, an examination of a device following an arrest and a search at an international border may be governed by different rules. The authority to seize a device and the authority to examine its contents are not necessarily the same.
In the United States, the Supreme Court ruled in Riley v. California in 2014 that police generally need a warrant to search the digital contents of a mobile phone seized during an arrest. Border searches raise separate legal questions and are subject to different rules.
In India, Delhi High Court lawyer Nishant told AJR that police cannot compel someone to provide access to their phone without a warrant. He said there should also be a seizure memo documenting the confiscation and reasons to believe that the phone was connected to a crime. The precise legal requirements depend on the circumstances, including the legal authority under which authorities seize and examine the device.
In other countries, laws governing digital searches may not clearly address the capabilities of modern forensic technology. Even where legal safeguards exist, journalists may not know what authorities accessed, whether they retained copies of their data, or how information about their sources might be used.
For journalists, understanding the law matters, but so does preparing for the possibility that a device may be seized. Consider what information a phone contains before reaching a checkpoint or finding officers at the door.
How can journalists reduce the risk?
No single measure can guarantee protection against every forensic extraction tool. Eva Galperin, director of cybersecurity at the Electronic Frontier Foundation (EFF), describes digital security as a continuing contest: device manufacturers strengthen security, while companies and other actors look for ways to overcome it.
One practical step is to reduce the amount of sensitive information carried on a device. Galperin advises journalists to think carefully about which devices and accounts they take with them, particularly when crossing borders or anticipating scrutiny from authorities.
Rather than travelling with their primary phone, which may contain work email, social media accounts, source communications and other sensitive information, journalists at heightened risk can consider carrying a separate device containing only what they need for the trip. This will not eliminate the risk, but it can limit the amount of information immediately available if the phone is seized.
A strong passcode is another important safeguard. Journalists should avoid easily guessed combinations and keep their device’s operating system and apps updated. Updates often address security vulnerabilities that attackers could otherwise exploit. They should also understand the encryption and security features available on their particular device.
Apple’s Lockdown Mode is designed for people who may face highly sophisticated digital attacks. It restricts certain features and connections to reduce potential avenues of compromise. Journalists at elevated risk may consider enabling it, but it should not be treated as a guarantee against forensic examination or as a substitute for other precautions.
Android users should check their devices' security settings and confirm whether device encryption is enabled. Many modern phones encrypt stored data by default, but protection depends on the device, its configuration and its state when accessed. A strong passcode and up-to-date software help, but neither guarantees that a specialised tool can't access data.
These precautions cannot eliminate every risk. No single guide can guarantee protection against every forensic extraction tool or spyware. For journalists travelling in situations where they may face scrutiny, using a separate device containing only essential information, while keeping their primary device securely stored, may help limit the potential exposure. It may sound extreme, but in an age when a seized phone can reveal confidential sources, unpublished investigations and years of private communications, the damage can extend far beyond the device itself and, in some cases, may be harder to undo than the seizure or even the journalist’s imprisonment.
