Shielding the Fourth Estate: Runa Sandvik on Navigating the Shifting Battlefield of Digital Security in Modern Newsrooms

In the high-stakes world of modern investigative journalism, the digital realm has transformed from a mere distribution channel into a primary battleground. Reporters no longer just face physical intimidation or legal threats; they are up against sophisticated cyber-espionage campaigns, mercenary spyware, AI-driven phishing networks, and coordinated online harassment.

To unpack this shifting threat landscape, we spoke with Runa Sandvik, founder of cybersecurity consultancy Granitt and former director of information security at The New York Times. Sandvik has spent her career helping newsrooms and reporters navigate the complex intersection of journalism and digital defense. In this comprehensive interview, Sandvik breaks down the realities of modern state-sponsored hacking, the invisible risks embedded in everyday newsroom workflows, and why digital safety must be treated as a core pillar of the journalistic process rather than an afterthought for the IT department.

Main Facts: The Escalating Threat to Global Journalism

The threats facing journalists today are systemic, highly sophisticated, and constantly evolving. As investigative reporting routinely exposes corruption, human rights abuses, and authoritarian overreach, those in power are increasingly deploying high-tech measures to silence, track, or discredit the press.

The Rise of Sophisticated Phishing and Impersonation

Cyberattacks are no longer crude, easily recognizable scams. In June 2025, a reporter at the International Consortium of Investigative Journalists (ICIJ) received a meticulously crafted email from an individual claiming to be a former judicial assistant who had fled China with secret documents detailing a $10 million embezzlement scheme.

The whistleblower was entirely fake. Security researchers at Citizen Lab concluded that the malicious link embedded in the email was a targeted attempt to compromise the reporter’s login credentials. This attack was part of a broader, state-linked campaign designed to retaliate against the ICIJ’s landmark China Targets investigation. The bait was precisely tailored to exploit an investigative journalist’s professional instincts.

The Proliferation of Mercenary Spyware

Beyond phishing, journalists are increasingly targeted by commercial, state-grade spyware. Tools like NSO Group’s Pegasus and Intellexa’s Predator—descendants of earlier malware frameworks like Hacking Team—can stealthily infect a device without the user ever clicking a link or opening a file. Recent forensic reports have identified spyware installations on the phones of Kenyan filmmakers and Italian journalists, proving that these invasive surveillance tools are no longer reserved for high-profile dissidents; they are actively deployed against reporters worldwide.

Chronology: A Decade of Evolving Cyber Threats Against the Press

To understand how modern newsrooms arrived at this juncture, it is helpful to examine how cyber-attacks against the press have evolved over the past decade:

• 2003–2015 (The Rise of Commercial Hacking Tools): Companies like Hacking Team emerged, selling invasive cyber-surveillance capabilities to governments globally. The market for commercial spyware operated largely unchecked until a massive 2015 data breach leaked their internal files to WikiLeaks, exposing how repressive regimes used these tools against civil society.
• 2015–2020 (Institutional Awakening): As cyberattacks against media outlets accelerated, major organizations like The New York Times began formalizing dedicated information security directorates. Runa Sandvik joined the Times during this period to reinforce digital defenses against increasingly frequent state-backed intrusions.
• 2020–2024 (The Democratization of Harassment & AI Integration): Social media bot farms, automated doxxing campaigns, and the early integration of generative AI made large-scale online harassment and hyper-realistic phishing attacks cheap and easy to deploy.
• 2025–Present (Zero-Click Exploits and Workflow Vulnerabilities): The threat landscape shifted toward zero-click mobile exploits and complex workflow vulnerabilities. High-profile incidents—such as the FBI raid on a Washington Post reporter who used secure tools improperly linked across devices—underscored that even the best encryption tools can fail if the surrounding workflow is flawed.

Supporting Data and Technical Realities

The mechanics of modern cyber threats require a fundamental shift in how journalists view their digital footprints. According to Sandvik, the misconceptions surrounding who gets attacked—and why—often leave newsrooms vulnerable.

What Triggers an Adversary?

A common misconception among reporters is that they will only be targeted if they handle massive, state-level leaks. In reality, triggers are often unpredictable. A minor social media post, a local corruption story, or even a routine request for comment can draw the ire of a well-resourced adversary. Furthermore, the retaliation rarely stops at digital intrusion; it frequently spans synchronized physical harassment, travel bans, legal threats, and coordinated disinformation campaigns.

Resource Disparities: Global North vs. Global South

The ability to respond to these threats varies dramatically by geography and newsroom budget.

• Well-Resourced Newsrooms (New York, London): Often benefit from dedicated IT and security teams, though their threat profiles frequently involve legal maneuvers, such as law enforcement subpoenas served to tech giants like Google for source records.
• Independent and Global South Newsrooms (e.g., Nairobi): Frequently operate with fewer financial resources but paradoxically display a higher baseline awareness of digital risks. Because threats like physical intimidation, surveillance, and personal harassment are part of their daily reality, they are rarely caught off guard by aggressive adversaries.

Official Responses and Expert Insights: A Q&A with Runa Sandvik

Q: You work directly with reporters under active digital attack. What surprises people most about what they’re up against?

Sandvik: When people express surprise, it’s often about what actually triggers a reaction from an adversary. It might be a social media post that really upsets someone, a story that angers someone, or an account that somebody tries to access even though, from the journalist’s perspective, there’s nothing particularly interesting there.

The other thing is the extent to which an adversary can respond to a story. An attack isn’t always someone trying to access your email or social media, or denying you entry to a country. It could be all of the above, and then some. You are dealing with humans, and humans can be fairly unpredictable. It’s hard to figure out exactly what’s going to happen once you reach out for a comment or publish a story.

Q: How has the threat landscape shifted in the last five years?

Sandvik: In some cases, journalists are facing online threats, harassment, impersonation, and intimidation. The rise of social media, the ability to create bots, and the ease with which content can be manipulated online make those types of attacks easier to carry out.

In other cases, it’s scams and phishing. We’ve always talked about being wary of emails from strangers. But now, with AI and how quickly attackers can create phishing pages that look exactly like legitimate login pages, those attacks have become easier to craft and harder for us to detect. What’s changed is the scale, the look and feel, and the way we defend against them.

Q: We’ve recently seen cases of forensic analysis suggesting spyware was installed on journalists’ devices. Are we seeing more of this kind of targeting?

Sandvik: Spyware has been around for a while. We’ve seen NSO Group with Pegasus, and Intellexa with Predator, alongside other companies that don’t have the same level of name recognition. Spyware is a real risk, and more journalists are aware of it today. While there are more attacks on civil society using sophisticated spyware, we are also getting better at both defending against and detecting those attacks.

Q: What are some practical things journalists can do to protect themselves from spyware?

Sandvik: Number one, keep your devices up to date. These updates come not just with new features, but also fixes for security holes that hackers would otherwise leverage. If your device can no longer run the latest version of the software, it’s probably time to buy a new one. After that, utilize the built-in security settings available across Android, iOS, macOS, Google accounts, and communication apps like WhatsApp.

Q: Doxxing is a growing risk. What can reporters do to prepare?

Sandvik: I don’t think you can necessarily protect yourself from doxxing, but it is something you can prepare for. Organizations like PEN America have created resources like the Online Harassment Field Manual, which contains guidance for targets, witnesses, and employers.

One way to navigate that is to understand how much information about you is already available online. Google yourself. Are there old accounts you can delete? Are there things you can lock down or redact? Being aware of your online footprint means that if someone starts a targeted harassment campaign using your personal information, you won’t be surprised by it.

Q: Can you give an example of how workflow can create security risks, even when a journalist is using the right tools?

Sandvik: Look at the Washington Post reporter whose home was raided by the FBI. She used Signal with disappearing messages to communicate with sources—the gold standard. But where the risk popped up was the workflow. Because she linked Signal on her phone to Signal on her work laptop, and because the work laptop used biometric authentication, investigators were able to gain access to the device and to Signal.

That comes back to planning your work. How are you ensuring that you’re using the right tools and settings in the right way at the right time? It requires brainstorming with other people and taking the time to slow down.

Implications: Rethinking Newsroom Culture and Leadership

The lessons provided by security experts like Runa Sandvik point to an urgent conclusion: digital security cannot remain siloed as a technical checklist managed by IT departments. It must be embedded directly into journalistic methodology.

1. Safety Planning as a Journalistic Standard

Just as reporters vet sources, verify facts, and consult legal counsel prior to publication, digital and physical safety planning must become an organic part of the reporting pipeline. Not every story requires military-grade encryption, but every investigative team must possess the foresight to evaluate risks and adjust their workflows accordingly before sensitive reporting begins.

2. The Critical Role of Editors

Newsroom leaders and editors occupy a unique position to enforce security habits. By asking proactive questions during story pitches—such as, "Have you enabled two-factor authentication?" or "How are we handling communications for this sensitive source?"—editors normalize security as a standard metric of professional rigor.

3. Balancing Usability and Security

Attempting to apply maximum security protocols to every routine email or casual chat creates unsustainable friction, leading journalists to bypass safety measures altogether. The key, Sandvik notes, lies in striking a balance: maintaining normal, convenient workflows for 99% of daily tasks, while reserving disciplined, high-friction security protocols for the specific projects, sources, and investigations that demand them.

As digital adversaries grow bolder and more technologically equipped, the resilience of the independent press will increasingly depend on whether newsrooms can successfully adapt their culture to treat cybersecurity not as a barrier to the news, but as its ultimate guardian.