Journalists: how to protect sources and files if your laptop is seized
If you report on sensitive stories, your laptop holds more than your work. It holds documents, photos, recordings and the names of people who trusted you. This guide shows how to encrypt that material so a lost, stolen or seized device doesn't expose them, and is honest about what encryption can't do.
Why ordinary passwords aren't enough
- A Windows login password doesn't encrypt your files. Anyone who removes the drive, or boots the laptop from a USB stick, can read everything on it.
- Cloud folders sync copies elsewhere. Files in OneDrive, Google Drive or Dropbox also live on those companies' servers, outside your control.
- Devices leave your hands more often than you think: repairs, travel, theft, an office search, or a seizure during an investigation.
How to encrypt your source material (step by step)
- Download Clavis Encrypt and install it. It needs no administrator rights, no account and no internet connection to work.
- Create a vault with a long, unique password (a sentence of five or more random words is strong and memorable). Clavis shows how long it would take to crack and warns you about weak ones.
- Save the one-time recovery key it shows you, and keep it away from the laptop (printed, in a safe place). It's the only way back in if you forget the password.
- Encrypt your sensitive files: right-click in File Explorer → Clavis → Encrypt, or drag them onto the Clavis window. Each becomes a
.encfile with a random name; the real name is hidden inside. - For a whole investigation folder, Clavis Pro encrypts folders in one go, and a watch folder encrypts every new file you save there automatically, so nothing is left open by mistake.
- When you finish working, lock Clavis. It also locks itself when the PC sleeps or Windows locks.
Habits that matter as much as the tool
- Encrypt early. Encrypt files as soon as you receive them. On SSDs, deleted plain copies can linger in places no app can reliably wipe, so full-disk encryption is your safety net for those.
- Turn on full-disk encryption too. BitLocker (Windows Pro) or Device encryption (many Windows Home laptops) protects the whole drive when the laptop is off. See BitLocker vs Device encryption.
- Shut down, don't just close the lid, before travel or when you expect a search. A running, unlocked laptop is far easier to read than one that's switched off.
- Separate work. Use a separate vault (Clavis Pro) for each sensitive story, each with its own password.
- Send safely. To share a file with an editor, encrypt it for them with their Clavis ID instead of sending a password over chat. See sharing encrypted files without a password.
- Keep encrypted backups on a second drive, so a seized laptop doesn't also mean lost work.
What encryption can and can't do
| Situation | Encrypted files protect you? |
|---|---|
| Laptop lost or stolen | Yes. Without your password the files are unreadable. |
| Drive copied while the laptop is switched off | Yes. A copy of encrypted files is still encrypted. |
| Laptop at a repair shop | Yes, for files you encrypted. |
| Laptop taken while unlocked and in use | Only files that are still encrypted. Lock Clavis and shut down when you can. |
| Malware already on the PC, watching what you type | No. Encryption protects files at rest; keep Windows updated and don't install unknown software. |
| You are legally ordered to reveal a password | That is a legal question, not a technical one (see below). |
The law in India: device seizures and passwords
In Foundation for Media Professionals v. Union of India (W.P. (Crl.) 395/2022), the Supreme Court is considering guidelines for how investigating agencies search and seize digital devices. In November 2023 the bench said media professionals may hold confidential information about their sources on their devices and called the issue serious. As of early 2026 the case was still pending, with no final guidelines.
Whether police can force someone to reveal a password is unsettled. The Karnataka High Court (Virendra Khanna, 2021) held that ordering an accused to unlock a phone does not violate Article 20(3), the right against self-incrimination, while also saying a search warrant is needed to examine such devices and that officers who leak private data should face action. A Special CBI Court in Delhi (2022) took the opposite view on passwords. Legal scholars continue to argue that passwords deserve Article 20(3) protection.
What this means for you: encryption reliably protects your files from everyone who doesn't have your password: thieves, repair shops, careless handling, and leaks of seized data. It does not decide your legal position. If your devices are seized, speak to a lawyer.
Why Clavis Encrypt for this
- Offline by design. No account and no cloud. The app goes online only to check for signed updates, and never uploads files or information about them.
- Strong, standard cryptography: AES-256-GCM for files, Argon2id for passwords, and a post-quantum recovery key. Details on the security page.
- Hidden file names. Encrypted files get random names, so a folder listing doesn't reveal what a story is about.
- Free for single files, on Windows 10, Windows 11 and Linux. Pro adds folders, watch folders and separate vaults.
Questions
How can a journalist protect sources if their laptop is seized?
Keep source material encrypted, not in ordinary folders. A file-encryption app such as Clavis Encrypt seals each file with AES-256-GCM so it can only be opened with your password; anyone who copies the drive gets unreadable files. Add full-disk encryption, shut the laptop down when it isn't in use, and keep encrypted backups elsewhere.
Can the police in India force me to reveal my password?
The law is unsettled. The Karnataka High Court (2021) held that ordering an accused to unlock a device doesn't violate Article 20(3), while a Special CBI Court in Delhi (2022) took the opposite view. The Supreme Court is separately considering guidelines on seizing journalists' devices. Encryption protects your files technically; for your legal position, consult a lawyer.
Is a Windows password enough to protect my files?
No. A Windows login password doesn't encrypt files. Anyone who removes the drive or boots from a USB stick can read them. Use file encryption, full-disk encryption, or both.
Does Clavis Encrypt upload my files anywhere?
No. Everything is encrypted on your own computer. There's no account and no cloud; the app goes online only to download signed updates.
What if I forget my password?
Use the one-time recovery key Clavis showed you when you created your vault. Keep it printed and away from the laptop. Without the password or the recovery key, no one, including the developer, can open your files.
Sources
- Supreme Court Observer — Foundation for Media Professionals v. Union of India (search and seizure of digital devices)
- LiveLaw — Karnataka High Court on accessing an accused's phone and data leaks (Virendra Khanna, 2021)
- NLIU Law Review — compelled disclosure of passwords and Article 20(3)
- Clavis Encrypt — security design (AES-256-GCM, Argon2id)
This guide explains general practice, not legal advice. Laws and rules change; check the current text or ask a lawyer for your situation.