In recent years, Signal has become one of the most popular ways for newsrooms to accept story tips. While it’s not designed to fully protect anonymity, Signal’s track record on security, approach to legal requests, and ease of use make it a strong choice.
It’s easy enough to get started with Signal on your personal device. But in our experience helping newsrooms to set up confidential tiplines, the process of creating an organizational account involves more consideration for budgeting and for reliance on technologies that are sometimes unpredictable. In this blog post, we want to talk about the specific challenges we’ve encountered setting up Signal tiplines, using a recent case study to help illustrate why this space is always changing and to explore some strategies you could use to respond.
Every newsroom has different needs
We’ve worked with dozens of newsrooms, each with diverse constraints, to help set up confidential tip pages using Signal. Typically, we’ve seen that key concerns and considerations are tied to one or more of the following: budgeting constraints, regional availability, preferences when choosing devices and phone plans, and decisions about who will have access.
Budgeting constraints
In order to successfully create a Signal account, users need to register a phone number to attach to it. While there are alternatives, the easiest and most secure way to use Signal is with an Android, iOS, or iPadOS device. For a personal Signal account, that phone number would simply be the number for your personal mobile device. But if you’re a newsroom trying to set up a secure tipline, you’ll want a dedicated mobile device for newsroom-only use and that isn’t tied to anyone's personal accounts or personal phone numbers.
If you have the resources, you can simply buy a new phone and purchase a phone plan from a major service provider like T-Mobile or Verizon. Research from WhistleOut suggests a typical single-line phone plan costs about $76/month ($912/year). But what if your newsroom, like many of the small nonprofit newsrooms we serve, has a very limited budget and you need a less expensive approach? There are still plenty of options for getting a phone number, but they may require some extra work and technical know-how. We’ll talk about that more below.
Regional availability
Each country has differing constraints around registering phone numbers. For example, in the European Union and the U.S., Google Voice works well for registering a phone number. But we work with many newsrooms around the world that could not take advantage of this service.
Preferences when choosing devices and phone plans
Each organization may also have strong preferences about what kind of phone plan they want to use. We’ve worked with many organizations that do not want to use a traditional phone plan with a SIM card, whether because of cost, a preference for an internet-accessible number (like Google Voice), or its threat model (e.g., the inability to purchase a phone number anonymously in their country).
Deciding who will have access
Finally, who’s actually going to manage the phone? What if multiple people want to access it? How do you balance security concerns with the need for accessible workflows? The way each organization chooses to address this will be different, so we work with media organizations to help them determine a workflow that will address their specific needs.
A case study in organizational Signal setup snags
In our experience working with newsrooms, there are a few things that can go wrong when attempting to set up new Signal phone numbers for a newsroom tipline. Recently, we worked with PublicSource (a local public-interest nonprofit newsroom serving Pittsburgh, Pennsylvania) to help it set up a tipline. PublicSource’s case demonstrated a number of the same issues we’ve laid out above. The core issues were tied to how service providers handle Signal registration codes, as well as the cost of devices and phone services.
How service providers handle Signal registration codes
Some service providers that offer phone numbers do not play well with Signal registration codes — the code a user receives via text to confirm a service has been activated. So identifying a phone provider that will serve your needs can be somewhat unpredictable. To understand this more deeply, let’s talk about the different sources of phone numbers.
Virtual numbers
Virtual numbers are phone numbers you can set up through online services such as Twilio or Google Voice. Because they are tied to online accounts, attaching them to a specific device is optional.
Virtual numbers are inexpensive and easy to get ahold of. However, whether or not they will deliver the Signal registration code necessary to begin using the app is unpredictable. From our interactions with the team at the Signal Foundation — which is responsible for the app — we understand that Signal does not prevent the delivery of registration codes. However, to limit fraud and abuse, the virtual phone service will sometimes decline to deliver registration codes. So, in practice, depending on what phone provider you use, you may not receive your registration code at all.
Our senior digital security trainer, David Huerta, put together a chart comparing how different virtual number providers treat Signal registration codes.
Because it’s important to have persistent access to a phone number, we think it’s important that the service provider has responsive customer service to help troubleshoot problems. For example, in our experience, phone numbers set up with Twilio often appear to block registration codes when signing up for Signal. Indeed, this is exactly what happened when PublicSource attempted to use Twilio to create its number. However, because Twilio has customer support staff, we were able to work with them to make an exception for PublicSource. (If you need help with navigating Twilio customer support, you can contact us and we will assist as best we can!)
The blocker we encountered with Twilio and registration codes tells us that registering a virtual phone number on Signal is a moving target. Who may block registration codes next year? We don’t know. This is why, though it may be one of the least expensive options, choosing a virtual number is not always a straightforward choice.
Landlines
You can pick up a landline phone and register a Signal number to that phone. How does this work? During your Signal registration flow, you can request that Signal call you with a registration code instead of sending you an SMS text message to verify you hold the number. However, in recent years we’ve noticed landline phones no longer consistently deliver Signal’s calls. Your mileage may vary.
SIMs and eSIMs
The most consistent way to get a new phone number is with a SIM or eSIM phone through a traditional phone provider (e.g., T-Mobile), but this will likely be much more expensive than a virtual number.
Tiplines ain’t free!
Signal requires a phone or tablet for registration. These devices should be specifically used only for tips — with no other apps installed that could potentially compromise your privacy.
Organizations will need to purchase a dedicated device, ideally one able to receive long-term updates. While we appreciate hardened alternatives, recent flagship devices from Apple (iPhone) and Google (Pixel phone) are a straightforward choice for most newsrooms with the necessary budget. They aren’t the cheapest options out there, though, so it’s an investment.
Our friends at OpenNews helped PublicSource secure funding for a phone. While we have had some success finding grants to help newsrooms get new hardware, funding isn’t always certain.
Unless you use Google Voice to get a Signal number, the phone number is likely also going to require a modest fee each month. For example, if you disable calls and texts in your account, a Twilio number in the U.S. generally runs about $1 a month.
With some funding from OpenNews, and with some coordination assistance from Twilio, we were able to get PublicSource fully set up with its dedicated Signal tipline on a secure device.
It helps to have a team
While the technologies newsrooms depend on for their work change regularly, for safe and sustainable work, having partners to monitor these trends is critical. That’s why we always encourage media organizations with hands-on assistance setting up secure communications and confidential tip pages.
Learn more about security considerations for setting up confidential tip pages and how to lock down Signal. If you work in journalism, we'd be happy to help you find the secure tipline solution that works best for you. Get in touch with us for assistance.