The FIFA World Cup will take place June 14 to July 15 at 12 venues in 11 different cities across Russia.
Under FIFA rules, it will be difficult for the Russian authorities to bar individual reporters or deny visas for specific media, but those who do cover the tournament may come under surveillance. Journalists are at risk of being harassed and followed if reporting on anything other than sports.
The major concern for any journalist covering the World Cup is a digital security breach and the potential for data theft.
Journalists should take these steps to tighten up on digital security before traveling:
- Check your online profile. Have you been involved in any work in the past that might have upset the Russian government? What about the story on which you are currently working? If so, then your risk is higher. If possible, take steps to remove this information.
- Review the security of your email and social media accounts. Create strong and long passwords (known as passphrases) that are unique for each account or consider using a password manager. Activate 2-step verification for your accounts, but make sure you are familiar with how this feature works while traveling abroad. You may wish to consider creating a throwaway email account to use only on your trip to cover the World Cup.
- Ideally, take clean devices with you to Russia. These are devices that have been bought specifically for the trip. On these devices, you should only carry documents that are relevant for your coverage there. If you are not able to take a clean device you should ensure that you have removed both personal and work-related documents from your devices, including photos. You should back up all your information before traveling. We recommend you use a burner phone for your trip instead of a personal device.
- Consider encrypting your devices. Be aware, however, that the Russian government has recently passed legislation relating to encryption and the use of virtual private networks (VPNs), and banned the use of Telegram. Consider using Signal or WhatsApp. Familiarize yourself with the security vulnerabilities and risks of communication tools before traveling. (Please see the HP Risk Management guide for further details.)
- Power off all your devices when going through security and immigration checks at the airport. Log out of all your accounts, including apps on your phone, and clear your browser history before traveling.
While in Russia journalists should be aware of the different ways that their devices could be compromised and follow procedures to protect themselves:
- Avoid leaving your equipment unattended or letting others carry your equipment. Hotel rooms and the hotel safe should be considered insecure. If you must leave your devices, set safeguards to tell if your belongings have been tampered with. For example, take a photo of their exact positioning before you leave so that you can compare on your return.
- Do not connect your devices to unknown computers and do not use phone chargers offered to you by others.
- It is common for hotel rooms and public areas to be bugged for sound and/or video; bear this in mind when in conversation or using a laptop.
- Avoid logging into personal accounts or any accounts that are not relevant for your work when in Russia.
- Russian hackers carry out highly sophisticated phishing attacks. These are emails or messages sent to your accounts, including social media accounts, that contain malware hidden in links or documents. Journalists will need to be extremely vigilant to these attacks even when the message appears to be from someone they know.
- Public Wi-Fi spots, including in your hotel room and at media centers, are highly likely to be compromised. Use a mobile hotspot when possible. If using a VPN, be aware of the restrictions and legalities on their use in Russia. (Please see the HP Risk Management guide for further details.)
Upon returning home, journalists will need to take important steps to ensure the security of their data and devices:
- If you have access to tech support, take your devices to be examined before connecting to any network. The support staff will be able to scan your equipment and advise accordingly. If you do not have access to IT support, scan your own devices for malware and follow procedures to clean any infected devices.
- It is advisable to change all passwords for any accounts accessed while on your trip to Russia.
If you would like more information about the risks covering the World Cup, please see this report compiled by HP Risk Management.
For more information on basic preparedness, assessing and responding to risk, or technology security, we encourage journalists to review CPJ’s Journalist Security Guide. For details on resources available to journalists, please see CPJ’s Resource Center.
- Journalists who require assistance can contact CPJ via report_violation@cpj.org.