Protecting Source Photos on iPhone: For Journalists

For journalists, the photo vault is not the hard part — it is one layer in a larger practice. The highest-value steps are: strip metadata before anything leaves your device, keep source material out of synced photo libraries, separate it behind a secret that is not your phone passcode, and carry as little as possible into situations where your phone may be inspected. Know the legal limits where you work, and get specialist help when the stakes are high.

The situation and the real risk

Photos from sources are unusually revealing. A screenshot of an internal document can carry a distinctive layout. A photo of a whistleblower's evidence can include GPS coordinates, the camera model, and a time stamp. A protest photo can identify faces in the background. And the phone that stores all this is also the phone you use for everything else — synced to the cloud, unlocked in meetings, carried through checkpoints.

The threat varies enormously. A local reporter covering a school board faces a different threat model than an investigative journalist working on organized crime or state abuses. The advice below is a baseline; it is not a substitute for a security assessment from people who do this professionally.

What you can do with built-in iOS tools

• Remove location before sharing. In the share sheet, tap Options and turn off Location. For a complete picture of what a file contains, see how to check photo metadata.
• Turn off location for the Camera. Settings > Privacy & Security > Location Services > Camera > Never. See turning off location on iPhone photos.
• Mind the sync. If iCloud Photos is on, source photos taken with the Camera upload automatically. Advanced Data Protection end-to-end encrypts iCloud Photos where available, but your library is still in the cloud and still on every signed-in device.
• Lockdown Mode. Settings > Privacy & Security > Lockdown Mode is designed for people who may be personally targeted by sophisticated attacks. Journalists are among the intended users.
• Quickly require the passcode. Pressing and holding the side button and either volume button until the power-off slider appears, then tapping Cancel, disables Face ID until the passcode is entered.
• Use end-to-end encrypted messengers with disappearing messages for source communication.

Where built-in tools fall short

Every iOS photo protection opens with the device passcode, so source material is only as separate as your phone is locked. There is no built-in way to take a photo that skips the library. And iOS cannot help with a cloud copy you forgot existed.

How sigil. fits

• Capture without the library. The private camera writes directly into an encrypted vault. Nothing reaches the Camera Roll or iCloud Photos.
• Metadata removed. EXIF and location data are stripped on import and export. Still check exported files with the photo metadata viewer, and review the visible content of the image yourself.
• Compartments. Multiple hidden vaults let you keep each story or source in its own vault, each behind its own sign, with no visible list of vaults.
• Encryption you can reason about. A 256-bit key per vault, unlocked by your sign, hardened with Argon2id and bound to the phone's secure chip, so it can't be guessed off the device. See pattern encryption.
• Local-first, no account. We do not hold your data, so there is nothing for us to hand over.

About the decoy vault: its decoy pattern opens a vault with harmless photos and erases nothing, while your real vault stays hidden on the phone. It is designed for coercion by people with no lawful authority, such as a robbery. Using it to mislead police or border officials may be treated as obstruction, and it does nothing about copies made before. If you are considering it, talk to a lawyer or press-freedom organization first. Our explainer on plausible deniability covers the general limits of the concept.

Source-protection checklist

1. Before publishing or forwarding any image, strip metadata — the in-browser EXIF remover works on a laptop too.
2. Review the image itself: faces, reflections, screens, documents, landmarks.
3. Keep source material out of iCloud Photos; capture it with a camera that does not save to the library.
4. Separate each source's material into its own encrypted space.
5. Carry only what you need into risky situations, especially border crossings.
6. Keep recovery phrases offline and away from the device.
7. Get a professional security review if your sources face serious risk.