TRIPOLI – Libyan media professionals don’t feel equipped to deal with digital safety threats, they told the United Nations Support Mission in Libya—so, the Mission organised an online training session on 31 July to teach them how to protect themselves and their data. 

Sixteen media practitioners from across Libya attended the event, which is part of the Mission’s Basirah professional development programme for journalists, fact-checkers, and media professors and students. Ela Stapley, a Digital Safety Adviser with the international non-governmental organisation Committee to Protect Journalists, was the guest speaker and shared tips for limiting online tracking and securing information. 

One hundred per cent of the media professionals who attended, in a post-event survey, said they believed digital threats increase the risk to their physical safety and the physical safety of their sources. Eighty-five per cent said digital security concerns had impacted the way they had conducted their journalistic work, and 92 per cent expressed concern about a lack of training about how to protect themselves. 

“If a journalist writes an opinion on social media or covers events that are not to the liking of a militia leader or the de facto authorities they protect, their freedom will be threatened,” said Ahmed Saleh Al Beriaf, a media professor at The Libyan Academy in Tripoli. “They will be monitored digitally and personally pursued. They may even pass through a checkpoint, be arrested, have their phone confiscated, and have their confidential messages examined. They then face significant risks, including enforced disappearance, abuse and torture.”  

As the world moves increasingly online, everyone is susceptible to digital threats, but the risks are higher for journalists because of their public-facing role, Stapley said.  

“People know who you are; your name appears next to the reports you are writing,” she said. “Your job requires you to be in contact with people who may themselves be at risk. You might well be writing about things that other people do not want made public.” 

Despite the heightened risk, Stapley said, journalists tend to have a low level of digital protection because they don’t have time to invest in learning about technology. 

She said journalists should, first, assess how much information is available about them online and how their activity is being tracked by various websites. Mobile phone companies, internet service providers, social media companies, websites, and governments and authorities may all track data online, she said.  

People may also obtain information through malware, including spyware, hacking and physical access to devices, or phishing, a type of cyberattack that uses fraudulent links to trick individuals into sharing sensitive information. 

To reduce risk, Stapley recommended encryption. Online accounts should be secured by separating work and personal accounts, avoiding linking profiles by agreeing to “log-in” to new websites via Google or Facebook, activating two-factor authentication, and creating passwords of 15 characters or more. She also warned against using facial or fingerprint recognition because people can physically force logins.  

It’s also important to use secure communication lines, she said. Data from mobile phone calls or SMS messages can easily be intercepted or collected at a later date. Unless your email account is end-to-end encrypted it can also be intercepted.  

“If you are having sensitive conversation that you would not want to tell a random stranger, do not use any of these services,” she said.  

Lower-risk options include WhatsApp, which cannot access the content of messages, and, therefore, cannot be legally pressed to release it, and Signal, which retains no personal information aside from your phone number, she said. Journalists can further protect themselves by encrypting their documents using tools such as Cryptomator or Veracrypt. 

In case a device is physically taken, Stapley recommended journalists upload sensitive communications to an encrypted external hard drive or a cloud account that is not linked to their phone. Data should be deleted from the device straightaway. For extra safety, they may carry a second phone containing very little data.  

“Having a phone with very little on it may make you look suspicious, so it’s really important that you understand what you will say should you be detained,” she said. “It could be that you say, ‘Oh. It’s a new phone.’” 

Hadeel Kherr, a freelance journalist based in Tripoli, who participated in the event, said it’s an “absolute necessity” for journalists in Libya to master digital safety “to ensure the continuation of the free media work we aspire to without putting ourselves or our sources at risk.” 

“Any hack of a journalist’s account could reveal the identity of sources, expose them to danger or retaliation, or even expose the journalist themselves to kidnapping or blackmail,” said Hala Abdel, a fact-checker for the non-governmental organisation She Checks. “Journalists need digital verification tools to avoid falling victim to phishing, malware and fake websites.”