Reporter ohne Grenzen

Are you in need of assistance after a digital security attack? Visit our international homepage for information on how we can help you and on how to contact us! https://rsf.org/en/digital-security-lab

We analyze digital attacks on journalists

Are you a journalist wondering if you’ve been the victim of a spyware attack? Then please contact us if

you or people close to you have been arrested and/or charged in connection with your journalistic work,
confidential source information has been leaked to the public or to authorities under unexplained circumstances,
your cell phone was compromised while crossing an international border,
when crossing an international border, your cell phone or laptop was in the hands of border authorities for an extended period of time, or you were forced to reveal your PIN or password
if you have received messages (via text or messaging apps) with personalized content, links, or attachments that seem suspicious to you (See an example here.)
if you’ve received a message from Apple, Google, WhatsApp, or similar companies stating that there have been hacking attempts targeting smartphones (e.g. Apple Threat Notification)

How to contact us

Email: [email protected]

ProtonMail: [email protected]

Via Signal: +49 1515 3994960 (Viktor Schlüter)

If you’d like to contact us, please let us know the following:

Who are you, and what field do you work in?
In which country are you currently working and/or residing, or have you worked and/or resided in the past?
Why do you suspect you may have been infected with spyware?

Our Mission

Journalism in the digital age poses new dangers to a free press. To help journalists confidently confront digital threats, Reporters Without Borders launched the Digital Security Lab in 2021.

The DSL is based in Berlin and is thus able to assist, among others, the many media professionals who have sought refuge there, but it also offers its services globally. Thanks to our close ties with Reporters Without Borders’ emergency aid efforts and its political advocacy work, we have a comprehensive perspective on journalism and IT security.

Our Work

Forensic Analyses

The DSL focuses on detecting and investigating government-sponsored spyware on mobile devices (primarily smartphones, rarely laptops).

We do this through our close collaboration with journalists worldwide who reach out to us because they’ve noticed suspicious changes on their devices, are investigating sensitive topics, or are being threatened. We place great emphasis on trust and security and provide personal support to those affected.

Practical Tips

We are part of a large network of organizations with extensive experience in cybersecurity and media safety. When needed, we share guidelines and practical tips to empower media organizations and media professionals to take charge of their own security and serve as advocates.

The Forensic Analysis Process

Step 1: Initial Contact

We are aware of the security risks and potential concerns associated with contacting us, and we offer various ways to get in touch: See the top of the website.

Step 2: Eligibility Review

We must first verify whether your case falls within our scope of responsibility. Our mandate is limited to journalists and media company employees who are facing threats because of their work.

Step 3: Device Inspection

If you have a valid concern that you may have been infected with a government Trojan or similar spyware, we will guide you through the necessary steps to verify this.

We understand that it takes trust to share personal data with us—especially when that data is the reason for potential espionage. Data and server security are therefore our top priority. We regularly review our security measures to ensure that no data is stolen in unencrypted form.

We’ve found something unusual. What now?

First, we’ll take a very close look at the potential finding to identify exactly what kind of anomaly it is.
Once we can make a specific determination, we’ll contact you to ask follow-up questions and put the finding into context.
We’ll advise you on how to secure your device and your data.
With your explicit permission, we’ll forward the finding to other NGOs, such as Amnesty or Citizens
Of course, with your permission, the findings can also be made public.

We haven’t found any anomalies. What now?

Since companies that develop and sell government Trojans are constantly updating their software, we can never give a 100% guarantee that everything is safe. We can only check your data against currently known indicators.

If no anomalies are found, we’ll send you an email informing you of this.

The data you have entrusted to us will be deleted after 30 days. Should there be further evidence of surveillance, you can contact us at any time.

What can’t we do?

RSF’s mandate limits our work to media professionals. Accordingly, we must unfortunately refer requests for analysis from individuals outside this scope to other organizations.

We know that journalists’ social media channels and websites are often the targets of attacks. However, that is not our area of expertise. For what is known as “incident response”—such as when an account is hacked or a website is attacked—other digital rights organizations like Access Now or our RSF Project Collateral Freedom are the appropriate points of contact.

Since we are a small team and focus primarily on working with individuals, we are unable to analyze attacks on corporate networks or similar systems.

Our Team

Our team consists of two forensic specialists and an assistant who are responsible for research, communication, and IT support.

Digital Security Lab