VPN Threat Modeling for Journalists and Researchers

Journalists, academic researchers, human rights monitors and fact checkers share a problem: their work involves information that other people may want to see, and their tools were built for ordinary users. A VPN is often the first thing they are told to install. It is a legitimate and useful tool, but it covers a narrow slice of the risks that matter in this kind of work.

This guide is about vpn threat model journalists and researchers can build for themselves. It is not a how-to for evading anyone, and it makes no promise about safety in dangerous situations. What it offers is a method: describe what you protect and from whom, see which of those threats a VPN actually touches, and decide where stronger measures or specialist help are needed. It is general education, not legal or security advice for your situation.

What a threat model is, in plain terms

A threat model is a short, honest description of your own situation. Security specialists often ask five questions.

1. What am I protecting? Assets can be data (source names, drafts, raw interviews, datasets), identities, devices, accounts, or the fact that you are working on a story at all.
2. Who am I protecting it from? Adversaries range from an opportunistic thief on a cafe network to a well-resourced organisation, a hostile employer, a litigant or a state.
3. How likely is it? A random thief on airport Wi-Fi is common. A targeted attack is rarer but often more serious.
4. How bad are the consequences if I fail? A leaked draft is a setback. A leaked source can be dangerous for a person.
5. How much trouble can I accept to prevent it? If a measure is too hard to use, you will skip it when you are tired, and it protects nothing.

Writing the answers down for one project takes about twenty minutes. If you want a general walk-through, our article on building a simple privacy threat model covers the method for everyday users, and this one adapts it to newsroom and research work. The EFF Surveillance Self-Defense guides also teach threat modeling in clear language and are worth reading.

Map your assets, adversaries and routes

Start with a table. Fill it with your own details, not examples from other people.

Asset	Where it lives or travels	Possible adversary	What a VPN touches
Source identities	Notes, messages, phone contacts	Anyone with access to your devices or accounts	Almost nothing
Unpublished drafts	Laptop, cloud storage, email	Account thieves, network snoopers	Network exposure only
Raw data and recordings	Disks, backups, shared drives	Thieves, insiders	Transfer on shared networks
Research queries and sites visited	Browser, DNS, network logs	Local network operators, providers	Hides them from the local network, not from the VPN provider
Login sessions	Browser cookies, apps	Phishing, malware	No effect
Your location while travelling	Phone, Wi-Fi, SIM	Network operators, apps	Changes network address, not device signals
Your identity as the author	Accounts, writing style, metadata	Anyone linking accounts	No effect

The right column tells the story. A VPN touches the network path in a few rows and leaves the rest alone. That is not a flaw in VPNs. It is a reminder that this tool is one control among several.

Adversaries and what each can see

Different adversaries sit in different places along the route, so a single tool helps against some and not others.

The local network operator (cafe, hotel, conference, university, newsroom guest network). Can usually see which sites your device contacts and, for unencrypted traffic, the content. A VPN reduces this to an encrypted tunnel. This is where a VPN is most effective, and our guide on staying safer on public Wi-Fi describes the practical side.

Your internet provider. Can see destinations and timing of your traffic. A VPN hides the destinations from it but shows the provider that you are using a VPN, and when.

The VPN provider. Sits where your internet provider used to be. It can see your real network address, when you connect and, depending on its setup, destinations. Claims about its records are statements by the company, not guarantees. Read what a VPN provider can see and VPN jurisdiction explained before putting weight on any provider's promises.

The website or service you use. Knows your account, cookies and device details whatever network you come from. A VPN does not hide you from the service you sign in to.

An attacker targeting your accounts. Uses phishing, reused passwords or SIM swaps. A VPN is irrelevant, and strong authentication matters. See the CISA guidance on multi-factor authentication and on recognising phishing.

An attacker with access to your device. Reads files and keystrokes before any tunnel exists. A VPN is irrelevant.

An adversary who can observe both ends of a connection. Can sometimes link activity by comparing timing and volume at the entry and exit. A single VPN does not defend against this. Tools designed for stronger network-level privacy exist, but they have trade-offs of their own, and you should read their documentation. Our article on VPN vs Tor explains the differences at a high level.

What a VPN contributes in this kind of work

Within its limits, a VPN is genuinely useful for professional work.

• Reporting from shared networks. Press rooms, conferences, trains, hotels and field locations often depend on networks you cannot vet. A VPN protects the traffic between you and the VPN server from the local network.
• Reducing casual exposure of research interest. On a shared university or office network, a VPN hides which sites and services you visit from the network around you. It does not hide them from the VPN provider.
• Consistency while travelling. The same protection follows you from airport to hotel to cafe.
• Separating personal and professional browsing at the network level. It is a modest help when combined with separate browser profiles and accounts.
• A basic layer for remote access. When your institution or employer supplies its own VPN for internal resources, use that. It serves a different purpose than a personal VPN. See business VPN vs personal VPN.

Being honest about the limits matters as much as listing the benefits. For many reporting tasks, the network is not where the risk is.

What a VPN does not do for journalists and researchers

This list is longer than the benefits, and every item is worth understanding.

• It does not protect message content. Use end-to-end encrypted messaging for sensitive conversations, and agree with your contact on settings such as disappearing messages. Both sides must set it up.
• It does not protect your device. Keep it updated, use full-disk encryption, a strong passcode and a screen lock, and consider what happens if the device is lost, searched or seized.
• It does not protect your accounts. Use unique passwords, a password manager and two-factor authentication, preferably with a security key or an authenticator app rather than text messages.
• It does not remove metadata. Documents, photos and recordings carry data such as author names, locations and timestamps. Check files before sharing them.
• It does not hide your identity from services you log in to. If you use your real account to look at a sensitive topic, the account holder is visible to that service.
• It does not stop phishing, which is a leading route to compromising reporters. A message that appears to be from an editor, a source or a conference organiser may carry a malicious link. See how to recognize phishing websites.
• It does not make you anonymous. Read can a VPN make you anonymous.
• It does not defeat an adversary who can compel or compromise the VPN provider.
• It does not make illegal activity legal, and it does not guarantee that a site or app will work. Laws and workplace rules still apply.

Sensible practices by situation

These suggestions are deliberately modest and focus on everyday exposure. They are not instructions for evading anyone.

Covering a local story from a cafe or press room. Connect to the VPN before opening your mail or document tools. Use a separate browser profile for work. Keep two-factor authentication on. Do not leave devices unattended.

Travelling for an assignment. Update devices before you leave. Back up important files in an encrypted form in a place you trust. Carry only what you need, and be aware that rules for devices and data at borders differ widely between countries. Check official guidance for your route and your organisation's travel policy.

Academic research with sensitive participants. Follow your institution's ethics and data-protection rules first. Store identifying data separately from analysis files, limit who has access and use the institution's secure storage. A personal VPN does not replace those rules, and some institutions require the use of their own tools.

Verifying a suspicious message or file. Do not open it on your main device. Ask the sender through a different channel. If you handle many suspect files, ask your organisation's security contact about a safe review process.

Working with a source at risk. This is where a VPN alone is inadequate. Ask your organisation for support, or contact a recognised digital-security helpline for journalists. They can assess your actual situation, which no general article can do.

Evaluating a VPN provider for professional use

If you decide that a VPN is a sensible layer, evaluate it with the same care you would apply to any source. Questions to ask:

1. Who runs it? Is the company identifiable, with a contact address and a published privacy policy?
2. What does it say it records, and for how long? Read the actual text, not the marketing page. Be wary of absolute promises.
3. Where is it based, and what obligations might apply there? Jurisdiction tells you which legal orders could reach the company.
4. How does it handle payment and accounts? A prepaid model without automatic renewal means fewer recurring records, though payment details still exist with the payment processor.
5. Does it publish technical detail or independent review? Transparency reports and audits are useful signals, though they never guarantee future behaviour.
6. Are the apps maintained? Look at update history and whether support responds.
7. Does it overclaim? Language such as untraceable, unhackable or military-grade is a reason to look elsewhere. Read how to compare VPN providers for a scorecard.

Free apps deserve extra caution when your work is sensitive. See are free VPNs safe. If you choose XPASS, remember that you connect through the free VPNclient app using the username and password on your My Pass page, and the download page lists the official apps. We make no claims about how any VPN handles records or about anonymity; read the terms before you rely on any service.

A one-page plan you can write today

Copy this outline into a note and fill it in for your current project.

1. Project: one sentence.
2. Assets: the three things whose loss would hurt most.
3. Adversaries: who might want them, and how capable they are.
4. Likely routes: shared Wi-Fi, phishing, device loss, account takeover, an insider, a forwarded message.
5. Controls I already use: updates, unique passwords, two-factor authentication, encrypted storage.
6. Controls I will add: one or two at most, with a date.
7. Where a VPN fits: which networks I will use it on, and which risks it does not cover.
8. Who I will ask for help: a named colleague, my organisation's security contact or a digital-security helpline.
9. Review date: three months from now, or when the project changes.

Revisit the plan whenever your circumstances change. A story that begins as routine can become sensitive.

Summary

For journalists and researchers, a VPN is a sensible layer on shared and unfamiliar networks, but it covers only the network path. It does not protect message content, devices, accounts, metadata or identity at the services you use, and it moves some trust to the provider. Build a short threat model, list your assets and adversaries, and use a VPN for the risks it actually addresses. For serious risks, rely on wider practices and specialist support rather than any single tool.

If a simple prepaid option fits the networks you use for your work, you can look at the pricing page at your own pace.