Richard Medhurst is writing a guide to help journalists safeguard their networks and devices to protect themselves and their sources. Photo: ComputerWeekly.com/file photo.
By Stefania Maurizi – Jul 22, 2026
How can journalists protect confidential data and sources on their phones when crossing borders?
Richard Medhurst is a well-known independent British journalist covering international affairs who has been highly critical of Israel, which has been accused of war crimes in its conflict with Gaza by the United Nations and the International Criminal Court.
In August 2024, Medhurst was arrested upon landing at London’s Heathrow Airport. He was the first reporter to be arrested by the British police under Section 12 of the Terrorism Act, which makes it an offence to invite support for a proscribed group.
British authorities interpreted his analyses and comments as supportive of organisations proscribed in the UK, such as Hamas or Hezbollah.
He says the experience has inspired him to write a comprehensive security manual to help other high-risk journalists safeguard their devices and networks.
Detained for almost a full day and interrogated for two hours, his two phones, microphones, wired headsets, wireless headphones, cables, adapters and a Faraday bag, which ensures that electronic devices cannot give out or receive signals, were seized.
A few months after his arrest at Heathrow, he was raided in Vienna, where he is based, by the Austrian security services.
The British investigation into Medhurst was closed in October 2025 with no charges, but the Austrian investigation is still ongoing. He has remained under investigation without charges for almost two years now.
“The state uses this uncertainty to keep a threat hanging over you, which chills your work and sends a message to other reporters,” Medhurst tells Computer Weekly.
He has decided to speak to us about his approach to security. Before this legal case, Medhurst kept his digital security setups private, but after his devices were seized, he says he is now free to speak openly.
The “cyber security revolution”, as he calls it, is his large-scale effort to create a comprehensive cyber security manual to train other high-risk journalists on how to protect themselves and their sources by safeguarding their networks and devices.
Medhurst promises a text “spanning several thousand pages”, which will be “the largest and most comprehensive book ever written on the topic”.
More specifically, “only the first volume is on phones, the others are about computers, networks, Qubes and Tails [secure] operating systems, disk encryption, how to move files properly to avoid leaving forensic trails,” he says.
Medhurst has decided to speak to Computer Weekly in part to analyse the key measures he took to protect his sources in the event of extreme circumstances, such as arrest or the risk of imprisonment for refusing to share his phone password with the anti-terror police.
Arrest criticised by journalism bodies
Search and seize operations and arrests by police forces expose journalists to the serious risk of compromising their sources, since phones and other electronic devices can contain the names and contact information of individuals who speak to reporters confidentially and thus require protection.
The right to protect sources lies at the heart of journalism. If journalists don’t protect the people who talk to them confidentially, then no one will be willing to do so anymore. Indeed, the right to protect journalistic sources has been confirmed by numerous rulings from the European Court of Human Rights.
Medhurst’s arrest at Heathrow by British anti-terrorism police and the raid by Austrian security services have been condemned by the general secretaries of the British National Union of Journalists (NUJ) and the International Federation of Journalists (IFJ).
After the raid in Vienna, both of these press freedom organisations issued statements of support, with the secretary general of the IFJ, Anthony Bellanger, stating: “We stand in unwavering solidarity with Richard and all journalists who face persecution for doing their job.”
In addition, four UN special rapporteurs wrote to the British government expressing concern about “the vagueness and overbreadth of the offence in section 12(1A) of the Terrorism Act 2000”. The British government, however, defended its counter-terrorism laws.
How secure is GrapheneOS?
“They took everything I had on me,” Medhurst tells Computer Weekly, recounting his arrest at Heathrow. “I had two phones, both for work: one was a GrapheneOS device, and the other was an iPhone used for recording video and audio interviews.”
Medhurst credits the open source Graphene operating system with protecting his work and his confidential sources, to the extent that he still uses GrapheneOS and “will not use anything else”.
A project founded by Daniel Micay in 2014, GrapheneOS currently relies on several developers, along with donations and support from companies, according to its website.
GrapheneOS bills itself as a privacy- and security-hardened operating system, according to the Graphene Foundation, which handles the donations. In 2019, even US National Security Agency (NSA) whistleblower Edward Snowden endorsed GrapheneOS.
“I was using a Pixel 7 Pro running GrapheneOS, which I installed myself and kept fully updated,” says Medhurst. “To protect my data, I compartmentalised the device into multiple isolated user profiles, effectively giving me multiple phones in one.”
Can a Google device be secure?
Some find it problematic that a journalist seeking to protect their sources should use a phone that relies on Google. In fact, one of the very first revelations from the Snowden files by Glenn Greenwald and by the Guardian’s defence correspondent, Ewen MacAskill, related precisely to Google, Apple and other internet giants.
According to the files, the NSA ran a program called Prism which allowed the agency direct access to the servers of Google, Apple and others. Moreover, the program was also run with assistance from these companies. When the details of Prism were published, however, Google and other companies denied it.
Another puzzling episode regarding Google was recounted by Pulitzer Prize winner James Risen. After meeting a journalistic source through an intermediary, Risen began doing some searches on him. An hour later, the intermediary called him on the phone, telling Risen to “stop Googling his name”.
Google has also been called out by the UN special rapporteur for the Occupied Palestinian Territories, Francesca Albanese, for providing cloud computing services to the Israeli forces, together with Microsoft and Amazon.
“In July 2024, an Israeli colonel described cloud tech as a weapon in every sense of the word, citing these companies,” Albanese wrote in her report, From economy of occupation to economy of genocide.
Why journalists should use encrypted messaging services
Harlo Holmes, director of digital security at Freedom of the Press Foundation, recommends that journalists use the encrypted messaging service Signal and, where necessary, WhatsApp.
When Computer Weekly points out that Signal and WhatsApp are far from perfect, Holmes agrees, but says they offer a step up in protection from text messages.
WhatsApp, in particular, is “not perfect at all”, but in some jurisdictions it’s more accessible than Signal. “I would rather have somebody using WhatsApp than text messages,” she says.
Holmes advises journalists to check their notifications for encrypted messaging services to minimise the risk that a notification doesn’t arrive outside the end-to-end encrypted vault of Signal or WhatsApp, where it could be accessed.
Recently, that became incredibly contentious because that’s exactly what was used in an investigation against an activist in the US.
People were shocked to learn that even though content is end-to-end encrypted within the app itself, if you receive a notification that says, “Harlo wants to talk to Computer Weekly at 3 o’clock, over Signal”, that is also in the device’s notifications database, and could be retrieved.
Holmes says she has been able to recover disappearing messages by hacking the notification system. “It’s just the way phones work, because the phone is not your friend,” she says.
It is up to the journalist to look at the phone, find these points of contention, and eliminate them, to increase their ability to protect their sources
Harlo Holmes, Freedom of the Press Foundation
Signal, WhatsApp and other services that are end-to-end encrypted are built with the best intentions for privacy, but ultimately the phone that you put them on is not. “It is up to the journalist to have a look at the phone and be able to find these points of contention, and eliminate them, to increase their ability to protect their sources,” she says.
Another bit of metadata that people aren’t necessarily aware of, according to Holmes, is the three dots that appear when someone is typing a message. “That’s what is called telemetry data; that’s metadata also,” she says. “This telemetry data can be tapped, especially from WhatsApp.”
In terms of phone passcodes themselves, she recommends having a strong, unique and long passcode for a mobile device. It does not have to be to the same level of complexity as the password you would use in a password manager, but it should still be complex.
Strong, unique and long passwords inevitably bring up the question of whether you should use biometrics, such as Touch ID or Face ID, to unlock your phone.
Holmes says: “The trade-off is: yes, if my passphrase is really, really good to encrypt my phone, I might not be typing that every 90 seconds to keep my phone usable; maybe why not have your Touch ID or your Face Unlock?”
But having biometrics might make the handset really vulnerable in certain situations, such as if someone seizes your phone or it is stolen by a mugger.
“But if your phone enters into a court order or process where they are trying to break in, then it is going to be so much harder to break. You have to think not only about the trade-off, but also exercise what tools you have if you are using biometrics,” she says.
“And so if you do find yourself like, ‘OK, I am about to step out of my house and meet my source’, perhaps that is time when you say, ‘There’s no biometrics on my phone, I am clearing it out, and when I feel I am in a safer situation, I can turn it on again’. So people should just be aware of the choices they have,” she adds.
All phones are vulnerable when turned on
However, Medhurst argues that Google’s consumer hardware is secure. He says the objective is to take advantage of that hardware without trusting Google’s software, by wiping the original operating system and replacing it with a stripped-down, hardened version of Android where each app is entirely isolated.
He explains that a phone is at its most vulnerable after you turn it on and enter your passcode. When you unlock the phone, you are placing your encryption keys in the device’s memory. This is necessary to use the phone, but also risky, as the keys can be extracted by actors who want to access your data.
To my knowledge, this is the first publicly recorded instance of the auto-reboot feature saving a journalist in a real-life situation against a state actor
Richard Medhurst, journalist
his is known as After First Unlock (AFU) mode. When you shut down or restart the device, but have not yet typed in the passcode, it is instead in Before First Unlock (BFU) mode, which is the most secure state. In BFU mode, the encryption keys cannot be taken from the memory, and all the data on the phone is fully encrypted.
Police always try to obtain a device while it is being used, says Medhurst. In his case, they snatched the locked phone out of his hands before he could hit the power button.
Medhurst said his confidential information was protected because of a feature in GrapheneOS. If you do not enter the correct passcode within an 18-hour window, the phone automatically reboots, plunging it straight back into BFU mode, he says.
“This countdown cannot be stopped, and it works flawlessly. To my knowledge, this is the first publicly recorded instance of the auto-reboot feature saving a journalist in a real-life situation against a state actor.”
Where is the evidence?
But what factual evidence does Medhurst have that the police were unable to access his data on the Graphene devices? He replies that, for months, the police repeatedly submitted requests for his passcode.
“Every single one was denied,” he says. “They then tried to offer me journalistic privilege,” which he also flat-out refused.
“The idea was that you tell an ‘independent’ policeman what the passcode is, and where all the privileged documents and contacts are, then they sift through them to decide what to pass to the prosecution,” he says.
“If they had bypassed the encryption, they would not have spent months begging for a password or pretending they were locked out,” he says.
Views from the experts
Computer Weekly asked Steven Murdoch, professor of security engineering at University College London, and Harlo Holmes, director of digital security at the Freedom of the Press Foundation (FPF), for comment.
Murdoch is head of the Information Security Research Group at University College London, and also sits on the board of directors of the Open Rights Group, a UK-based digital rights organisation that campaigns to protect privacy rights.
Holmes works to secure communications between journalists, their newsrooms and sources for FPF, a non-profit organisation protecting journalism, whose board of directors includes Edward Snowden.
Graphene is good, but not impossible to crack
What does Murdoch think about GrapheneOS?
“I would not go as far as to say the hardware is impossible to crack, but experience has shown that even some of the best forensic software currently is incapable of obtaining data from GrapheneOS devices without knowledge of the passcode, particularly if the device has been freshly rebooted,” says Murdoch.
“GrapheneOS offers enhanced security compared to Android because Google doesn’t consider these features worth the resulting inconvenience to users, performance loss, or development effort,” he adds.
Additionally, GrapheneOS disables user-tracking features that Google wants to retain to support its business and that of its partners. “The users of GrapheneOS prioritise security, so are willing to make sacrifices in other aspects, and its business model does not depend on user tracking,” he says.
Murdoch continues: “Richard Medhurst notes that smartphones are very challenging to compromise before they are first unlocked, because only after this point is most data accessible in unencrypted form.”
GrapheneOS takes advantage of this fact by automatically rebooting the smartphone after a certain period of inactivity, a feature enabled since 2021, he says. Apple iOS implemented auto-reboot in 2024, and Google offered it as part of standard Android in 2025.
In this way, GrapheneOS sometimes acts like a testing ground for new security features before they are adopted by other phones.
He says GrapheneOS also restricts biometrics more than standard Android phones. “In particular, there are various circumstances in which someone might be compelled to use their biometrics to unlock a device, whereas it could be much harder to force someone to disclose a secure passcode [as required by GrapheneOS],” he says.
There is no technical silver bullet
Holmes agrees that “Graphene is the best protection you can have using an Android device, as long as it is up to date and as long as the Android device that you installed Graphene on is of a modern variety”.
But she also agrees with Murdoch’s cautious approach when he says that he would not go as far as to say the hardware is impossible to crack. “There is absolutely no silver bullet, and because there isn’t any technical silver bullet, we advise people to be extra vigilant about their situational preparedness, and that means properly compartmentalising,” Holmes tells Computer Weekly.
“Even if you have the best operating system in the world, that is kept up to date, and you are using the best passphrase, and you have your phone in Before First Unlock, anything can happen, and this technology becomes adversarial over time, so it is a cat and mouse scheme. The safest data is data that does not exist and is not available to an adversary. You definitely have to think very, very hard about how to compartmentalise.”
Holmes says that operating systems like Graphene make it more cost-effective to have a secondary device in an adversarial situation, so she definitely recommends it “for a person who is going into the field in a way where there is a high risk of the device’s seizure, or loss or theft, whatever it is, because that is your best chance”.
Other Graphene security features
A useful feature of the Graphene phone operating system, according to journalist Richard Medhurst, is two-factor authentication for unlocking a Graphene phone with a fingerprint.
“With this enabled, every time you use your fingerprint, you must enter an additional four- to six-digit PIN. This should be a different PIN from the main passcode. This stops someone from being able to access the device by physically holding your finger down to the sensor,” he says.
“Additionally, you can also do things like completely disable the USB port – even charging while on – which definitively blocks data transmission or physical tampering, or enable a scrambled PIN layout on screen so no one can shoulder-surf your code while you enter it.”
Recent Pixel handset devices feature something called hardware memory tagging. “This essentially makes it very difficult to remotely hack a device using the RAM, which is where the overwhelming majority of hacks happen through memory buffer overflows. This is useful against state-sponsored cyberweapons like Pegasus,” says Medhurst.
Advice for crossing international borders
What would Holmes recommend to journalists when travelling and crossing borders? “I personally think it is wise for people to have their devices turned off when they cross the border,” she replies. “You don’t need them, and you can wait an hour to clear immigration and customs before turning on your phone again. I think that is just kind of standard.”
But she adds that there are likely to be occasions, depending on where you are crossing, when that would be challenging. “There will be situations where someone would say, ‘I see your phone is turned off, but I need you to turn it on’, in which case you have to decide if you are going to comply or if you are going to turn around and go back home. Most people will [comply], and this is why compartmentalisation matters if you feel that is a risk.”
Journalists can keep their work compartmentalised by having one phone for work, for example, and a separate phone for travel or personal use.
Turning off his phone before arriving at Heathrow Airport is precisely what Medhurst failed to do, as he acknowledges when Computer Weekly asks him whether, in hindsight, he made any mistakes in his approach to protecting his journalistic sources.
“From a strictly technical standpoint, my only operational oversight was not turning the phone completely off before the plane landed. I did not expect the police to come inside the aircraft to get me, which was obviously intended to take me by surprise,” he replies.
He believes his sources and confidential information were nonetheless protected because the Graphene phone automatically reboots after 18 hours if you don’t enter the correct password.
Medhurst has decided to go public about his experience insofar as it goes beyond his personal case, to the core of journalism. “We are seeing unprecedented physical and digital attacks on members of the press, whether independent reporters are persecuted and harassed in Western democracies, or physically targeted and losing their lives in places like Gaza and southern Lebanon,” he insists.
He acknowledges that, unfortunately, many journalists today do not even implement the absolute basics, and admits that dedicating so much time and energy to complex cyber security is an exhausting process. “But it has become a non-negotiable job requirement anyway,” he says.
