It’s the Digital Security Training team at Freedom of the Press Foundation (FPF), with security news that keeps you, your sources, and your devices safe. If someone has shared this newsletter with you, please subscribe here.

In the news

Signal just introduced a new feature that may have an outsized impact on your ability to speak securely: call links. This feature allows you to create a unique meeting URL that you can share with anyone, much like Google Meet or Zoom links. This meaningfully changes how Signal works, because you no longer have to join a group to start a call and therefore anyone can join a call more easily — including strangers. Read Signal’s blog here.

What you can do

  • If you are not already using Signal, now’s a great time to get started. Read our guide to Signal for beginners, and if you use it already, learn how to lock it down.
  • You can try it out right now! Make sure your Signal app is up to date, and then go to the “Calls” tab at the bottom of the app. At the top of the screen, tap “Create a Call Link.” From here you can customize your call name and link. The link can be reused, so if you want to keep it on a calendar event for regularly scheduled calls, you can.
  • Our digital security training team often talks to journalists about the benefits of Signal’s end-to-end encryption, but it’s important to remember that the “ends” — the devices in conversation — can see all of the data just fine, so you need to trust everyone in conversation. That’s why you really need to understand who you’re talking to in advance, and whether you can trust them.
  • We recommend being careful where you share call links, and carefully vet everyone you allow into your calls. You can always deny unfamiliar users who have your call link. If you post your call link to a public space (e.g., Bluesky) and are allowing anyone to join, be mindful of what you’re willing to say in this conversation.
  • If you get the chance to verify someone is who they say they are on Signal (ideally in person), you can also use “safety numbers” to verify that the encryption that protects your conversations is working as intended and isn’t being tampered with by a third party. Safety numbers just represent the encryption used in your conversation. So if you and the person you’re talking to see the same safety numbers, boom, Signal’s encryption is working as expected. I’ve never had an instance where I saw a mismatch in a conversation’s safety numbers so, in my opinion, this is a very low risk. But for extra security, you can open a conversation, click on a person’s name at the top of the conversation, select “View Safety Number,” and compare them. You can also scan your conversational partner’s QR code to automate this. Learn more here.

Updates from our team

  • This week, we’re co-hosting “Source!” the London Logan Symposium, with The Centre for Investigative Journalism on Nov. 14-15 in London, England. Hear from journalists from all over the world about press freedom issues and the challenges they face in protecting themselves and their sources. Register to attend here.
  • Reminder: If you’re a U.S.-based journalist or news outlet covering the U.S. election and need safety support, the team at Election Urgent Care is here to help. FPF has joined forces with the Knight Election Hub and an all-star team of safety and legal experts from the Committee to Protect Journalists, the International Women's Media Foundation, Reporters Committee for Freedom of the Press, PEN America, and Aegis Safety Alliance. We’ll provide support for digital, physical, psychological, and legal concerns, from dealing with doxing, threats, and arrests to preparing for risky assignments. To learn more, or to apply from an eligible newsroom for support, check out Knight Election Hub’s Urgent Care.

Our team is always ready to assist journalists with digital security concerns. Reach out here, and stay safe and secure out there.

Best,
Martin

–

Martin Shelton
Deputy Director of Digital Security
Freedom of the Press Foundation