The privacy hardware kit for journalists and reporters

Journalists face a specific and serious set of privacy risks: source protection, communication security, device seizure at borders, and network surveillance. The stakes are higher than for most people — a compromised device or leaked source can end careers, endanger people, and kill stories. This guide covers the hardware layer: the four physical devices that form the foundation of a serious journalist's privacy setup.

Why hardware first?

Most privacy advice for journalists focuses on software — Signal, encrypted email, secure drop. That advice is correct but incomplete. Software privacy tools run on hardware. If the hardware is compromised — or if it's reporting your activity to its manufacturer — the software layer is weakened regardless of how carefully you use it.

The hardware layer determines what data leaves your device without your knowledge, what happens when a device is seized, and how much of your activity is visible to network observers. Get the hardware right first.

1. The phone: a device with no Google

A standard Android phone sends a continuous stream of data to Google and app developers by default — location history, app usage, device identifiers, and communications metadata. This happens at the OS level, regardless of which apps you've installed or what permissions you've restricted.

A journalist's phone should run an operating system with no Google services, no advertising identifiers, and no background telemetry. GrapheneOS provides this. It runs on Google Pixel hardware (for hardware security reasons covered in depth here), but with Google's software entirely removed.

The practical difference: your phone stops being a location tracker, app-usage logger, and communications metadata collector. It becomes a phone that makes calls, runs Signal, and doesn't report your activity to anyone.

The Norypt Phone arrives with GrapheneOS installed, configured, and the bootloader re-locked. No setup required.

2. The laptop: full-disk encryption with no vendor telemetry

A laptop for sensitive work needs two things that most consumer laptops don't provide by default: hardware-backed full-disk encryption and an OS that doesn't phone home to its manufacturer.

Windows sends telemetry to Microsoft by default — including typed text via SmartScreen, location data, and diagnostic information. BitLocker, Windows's built-in encryption, backs up your encryption key to your Microsoft account on consumer versions, which means Microsoft has a copy of the key to your encrypted drive.

A properly configured Linux laptop with LUKS encryption stores the encryption key nowhere but in your head (as a passphrase). The OS sends no telemetry. If the laptop is seized without your passphrase, the contents are inaccessible — to anyone.

The Norypt Secure Laptop ships with full-disk LUKS encryption, a hardened Linux OS, TPM 2.0 hardware-backed security, and hardware webcam and microphone controls. Configured and tested before it reaches you.

3. The router: network-level protection at home and in the office

Your home or office network is where all your devices — including your phone and laptop — connect to the internet. A standard router has no interest in protecting what passes through it. An ISP-provided router actively logs DNS queries and may sell that data.

A privacy router does three things relevant to journalists: it encrypts DNS queries so your ISP can't see which domains you're visiting, it blocks known tracking and telemetry domains at the network level (protecting every device on the network), and it supports VPN routing to encrypt all outgoing traffic.

The protection is whole-network — including devices you can't individually configure, like smart TVs or IoT devices that might be vulnerable to network-level surveillance.

The Norypt Privacy Router ships with NextDNS pre-configured, ad and tracker blocking active, and WireGuard VPN support ready to use. No command line required.

4. The eSIM: connectivity without a registered identity

When you travel for a story — particularly to countries with active surveillance programs — your SIM card is a liability. A physical SIM is tied to your registered identity. Every cell tower you connect to logs your presence. Roaming agreements mean this data travels across carriers and jurisdictions.

A privacy-focused eSIM can be activated with minimal personal data and no government ID, purchased prepaid, and discarded when the trip is over. No long-term carrier account. No persistent identity tied to your travel pattern.

The Norypt eSIM covers 180+ countries, supports anonymous activation, and delivers instantly — no physical SIM, no ID registration required.

The complete picture

None of these tools is a silver bullet. Operational security — how you behave — matters as much as what hardware you use. But hardware is the foundation. If the devices themselves are leaking data, the software layer cannot compensate. Start with the hardware. Get it right. Then build your operational practices on a solid, verified foundation. The Committee to Protect Journalists and Reporters Without Borders both publish operational security guides specifically for journalists — these are worth reading alongside any hardware decision. Explore Norypt's full range to see what a correctly configured journalist's device setup looks like in practice.