Protect Confidential Sources: Shield Laws for Journalists

What does it mean to protect a source?

Protecting a source is two jobs. One is legal: can anyone force you to name a source or hand over your notes? The other is technical: can anyone find the source without asking you at all?

This guide covers both. It is general information, not legal advice. Rules change, and your state's law controls your situation.

The two jobs overlap. A legal privilege is one layer of protection. Your cloud contact list is another place a source's name can sit, and it can be reached through legal orders instead of through you ^[1].

What are shield laws and reporter's privilege?

Reporter's privilege is the right to refuse to testify so you can keep a source confidential. The Reporters Committee for Freedom of the Press (RCFP) says most states and federal circuits have some form of it ^[2].

A shield law is a state statute that creates this kind of privilege. RCFP reported that as of 2021, 40 states and the District of Columbia had enacted shield laws ^[2]. These give journalists some form of privilege against compelled production of confidential or unpublished information ^[2].

That count is dated 2021. Check your own state's current law before you rely on it.

Absolute or qualified?

Shield laws are not all alike. In 16 states and the District of Columbia, RCFP says the privilege for confidential sources is absolute. That means it cannot be overcome whatever the circumstances ^[2].

In the remaining states, the privilege is qualified rather than absolute ^[2]. Find out which kind your state gives you before you promise anyone confidentiality.

Does a shield law cover freelancers and independent journalists?

Not always. Some shield statutes define "journalist" so narrowly that they protect only people who work full-time for a newspaper or broadcast station ^[2].

RCFP says freelance writers, book authors and non-traditional journalists can be left to rely on the First Amendment alone ^[2]. If you work independently, read your state's definition closely.

Proving that you do journalism is a separate question from the law. You can see how a press credential can document your work. An NPA credential is not government-issued, and it does not give you legal rights or access.

State rules differ, and a recorded example helps. The video below is a California-focused workshop on how one state's shield law and federal protections work in practice. Your state may differ.

Video from First Amendment Coalition (YouTube channel, 1:30:19). Open at youtube.com. Content from youtube.com loads only if you click.

Where do shield laws stop?

A shield law is not a wall. Several limits can leave you exposed.

Exceptions inside the law. RCFP notes that broad exceptions for eyewitness testimony or for libel defendants can remove protection from journalists ^[2].

Witnessing a crime. RCFP describes the Supreme Court's decision in Branzburg v. Hayes as holding that the First Amendment does not protect a journalist who has actually witnessed criminal activity from revealing information to a grand jury ^[2].

Federal court. RCFP says that if a case is in federal court on a federal question, the court will likely apply federal law ^[2]. It adds that a state shield law may not be available to the reporter ^[2].

Federal appeals courts. RCFP says most federal appellate courts have recognized some form of qualified privilege for journalistic materials ^[2]. It says the Seventh and Eighth Circuits are the only circuits that have not yet definitively done so ^[2].

Lawsuits from sources. RCFP warns that a confidential source whose identity is revealed may try to sue the reporter and news organization under a theory of promissory estoppel ^[2]. It notes the U.S. Supreme Court has held that such suits do not violate the media's First Amendment rights ^[2].

The practical lesson is simple. Do not promise more than you can deliver. Know your state's rules first ^[2].

What federal protections exist?

There is no federal shield law. RCFP's analysis states that Congress has never passed a federal reporters' privilege law ^[3].

Two federal tools still matter. Neither one is a shield law.

The Privacy Protection Act

The federal Privacy Protection Act makes it unlawful for a government officer to search for or seize work product materials in connection with a criminal investigation or prosecution. It covers people reasonably believed to have a purpose to disseminate a newspaper, book, broadcast, or similar public communication ^[4].

The law has exceptions. A search or seizure may proceed if there is probable cause to believe the person holding the materials committed the offense they relate to ^[4]. It may also proceed if immediate seizure is necessary to prevent death or serious bodily injury ^[4].

RCFP summarizes the structure this way: unless an exception applies, work product cannot be seized even with a warrant. Documentary materials must be pursued with a subpoena first ^[3].

The Justice Department's news-media rule

The Department of Justice has a regulation on obtaining records from journalists. It treats search warrants and similar tools aimed at non-consenting members of the news media as extraordinary measures, not standard practice ^[5].

Under the rule, department members must get the Attorney General's authorization to issue a subpoena to a member of the news media ^[5]. The same approval is required to apply for a warrant to search a journalist's premises, property, or communications records ^[5].

This rule is a policy, not a right. It states that it does not create any right or benefit enforceable at law against the United States ^[5].

The rule also changed recently. RCFP concluded that the latest revision, which reverted to the earlier version, gives the department greater powers to hunt for leakers of both classified and unclassified information ^[3]. You can read the rule text yourself below.

Document · U.S. Department of Justice (copy hosted by Reporters Committee for Freedom of the Press)

DOJ final rule, 28 CFR Part 50 (AG Order No. 6251-2025): Policy Regarding Obtaining Information from, or Records of, Members of the News Media (as published May 2, 2025; PDF hosted by RCFP)

Open at rcfp.org

Document from U.S. Department of Justice (copy hosted by Reporters Committee for Freedom of the Press). Open at rcfp.org. Content from rcfp.org loads only if you click.

How do you set up basic digital security?

Legal protection only matters after something goes wrong. Digital habits can keep a source's name from leaking in the first place. Freedom of the Press Foundation (FPF) lays out a starting set.

Work through these steps in order:

1. Do a risk assessment. FPF calls this a simple framework to identify the threats to your data so you can tailor your defenses ^[6]. Ask who might want to learn your source's identity and what they could access.
2. Use a password manager. It stores your passwords in an encrypted database, unlocked with one password only you know ^[6].
3. Turn on two-factor authentication. FPF says 2FA over SMS text messages is better than nothing. It recommends app-based options whenever possible ^[6].
4. Encrypt your devices. Full disk encryption scrambles the data stored on your device as soon as you power it down ^[6].
5. Use end-to-end encrypted messaging. On such a channel, neither the service provider nor eavesdroppers can read the content of your message ^[6].
6. Review your contacts. See the address book section below ^[1].

No single step is enough. Each one closes one door.

The podcast below features FPF's digital security director discussing tools and the idea of keeping information separate to protect sources.

What is the first-contact problem?

FPF describes a trap it calls the first contact problem. The very first time someone reaches out, they need to know how to do so safely. Otherwise they may have already created a data trail that leads back to them ^[7].

You can help before the first message arrives. FPF says the most important thing a news organization can do with a secure tip page is advertise it over as many channels as possible, long before anyone plans to use it ^[7]. As an independent, you can do the same with your own contact page.

Tell worried sources what not to do. FPF's advice for anyone concerned about retaliation is not to reach out from the office or through any channel their workplace can access, such as work email, phone calls, or social media ^[7].

FPF is also honest about limits: there are no bulletproof solutions here ^[7]. Tell sources that, too.

How do metadata and your address book expose sources?

Encryption hides message content. It does not hide everything.

FPF notes that end-to-end encrypted email cannot conceal the email addresses of a sender or recipient. Phone calls also generate metadata that telephone companies can log ^[1].

Your contact list is another weak spot. If you sync contacts to Google or Apple, FPF warns those copies can be obtained through a variety of legal orders. Investigators would not need to extract the data from your phone ^[1].

FPF recommends adjusting your Apple iCloud and Google settings so contacts do not sync to the cloud before you add sensitive sources ^[1]. Do this first, not after.

What should you do if you are subpoenaed or contacted by investigators?

Call a lawyer early. RCFP advises journalists to consult an attorney before negotiating with a party who wants their testimony, and before appearing in court to quash a subpoena or to testify ^[2].

Do not assume you have no options if your state lacks a shield law or your court recognizes no privilege. RCFP says journalists are sometimes able to persuade courts to quash subpoenas under generally applicable rules against unduly burdensome subpoenas ^[2].

Notice also matters. RCFP says the federal regulation requires notice to the affected journalist or news organization. That notice is essential to permit negotiation over the scope of the demand or a court challenge ^[3].

Before you respond to any demand for your notes, devices or passwords, ask a lawyer what applies to you ^[2]. This is not legal advice. A lawyer who knows your state and court can tell you what is required.

A recorded session from the National Press Foundation features a former New York Times reporter and a lawyer who protects whistleblower sources. They discuss how journalists approach confidential sources.

Checklist and resources

Use this list as a starting point:

• Look up your state's shield law and note whether it covers freelancers ^[2].
• Check whether your state's privilege is absolute or qualified ^[2].
• Do a risk assessment before you take on a sensitive source ^[6].
• Set up a password manager, app-based 2FA and device encryption ^[6].
• Stop syncing contacts to the cloud before you add sensitive sources ^[1].
• Publish a safe way for sources to reach you before anyone needs it ^[7].
• Find a media lawyer before you need one ^[2].

For state-by-state detail, start with RCFP's Reporter's Privilege Compendium ^[2]. For tools and training, see Freedom of the Press Foundation's guides ^[6].

If you report on your own, you may also want to join the National Press Association (it is free to apply) to connect with other independent reporters. Membership does not change your legal protections.

If you need legal help, the Reporters Committee for Freedom of the Press runs a Legal Hotline for journalists and media lawyers ^[8].