Anonymous and Confidential Sources Policy

Principle

Cyber Insight EU prefers named and on-the-record sources because identification helps readers evaluate expertise, knowledge, interest and accountability. There are circumstances in which important public-interest information cannot be obtained or published safely under a source’s name. Anonymity may be justified where a source faces a credible risk of retaliation, employment loss, legal exposure, harassment, discrimination, professional harm, physical danger or another serious consequence.

Anonymity is an editorial protection, not a convenience. It is not granted merely because a source prefers not to be challenged, wishes to attack another person without accountability or seeks to circulate unsupported speculation.

Scope and Terminology

This policy applies to anonymous sources, confidential sources, whistleblowers, background briefings, non-attributable information, off-the-record communication, embargoed information, protected contributor identities, leaked materials, source documents and personal information capable of identifying a source.

Because usage differs across countries and professions, source terms are clarified rather than assumed. On the record means information may be published and attributed to the identified source. On background means information may be used under an agreed description rather than the source’s name. Not for attribution means information may be used without naming the source under an agreed attribution. Confidential means identity or supplied information is protected under agreed conditions. Off the record means information is not for publication or attribution unless a later agreement permits use or it is independently obtained. Embargoed information may be prepared in advance but not published before an agreed time.

Decision to Grant Anonymity

Anonymity is considered when the information has meaningful public value, the source has direct or reliable knowledge, naming the source creates a credible risk, the information cannot reasonably be obtained on the record, identity can be verified internally, motivation can be assessed, corroboration is available or realistically possible, the publication can protect the information proportionately and the editor approves the arrangement.

The editor considers whether a less restrictive solution is available, such as delaying identification, using a narrower source description, protecting only part of the information, publishing documents without naming the source, corroborating the information independently or anonymizing the subject rather than the source.

When Anonymity Is Refused

Anonymity is normally refused where a source seeks to make a personal attack, offers only opinion or speculation, refuses to explain the basis of knowledge, conceals a commercial client, seeks political advantage without evidence or wants to avoid responsibility for an ordinary public statement. It is also normally refused where the source requires publication of unsupported claims, attempts to control the article, seeks payment for unverified information, materially misrepresents identity, provides evidence that cannot be examined or requests protection after already publishing the information publicly under the source’s name.

Seniority, celebrity or access does not itself justify anonymity.

Internal Identity Verification

The responsible editor ordinarily knows the source’s real identity and verifies current or former role, access to relevant information, relationship to the subject, chronology, motivation, possible financial or political interest, history of reliability and risk requiring protection. Where the author knows the identity but the editor does not, the article does not rely materially on the source unless an exceptional arrangement is approved.

Identity is verified proportionately. Cyber Insight EU does not collect more personal documentation than necessary, and source-identifying records are separated from ordinary article files where appropriate.

Basis of Knowledge

The publication understands how the source knows the information. The basis may be direct participation, observation, access to records, professional responsibility, technical access, communication with a decision-maker, employment, official position, personal experience or documented secondhand information. A source who heard a claim from another person is not presented as having direct knowledge. The article describes the basis of knowledge as accurately as safety allows.

Motivation and Conflicts

A source may be motivated by public interest, conscience, concern for safety, professional disagreement, political interest, financial interest, personal grievance, employment dispute, commercial competition, legal strategy, retaliation, reputation, ideology or mixed motives. Motive does not automatically establish truth or falsehood. Editors understand and test the motive rather than assume altruism or dishonesty. A material interest may be described to readers without exposing identity.

Corroboration

Information from an anonymous source is normally corroborated through another independent source, documents, data, recordings, public records, direct observation, technical testing, contemporaneous communication, physical evidence or an admission or response from the subject. Two anonymous sources are not independent where one obtained the information from the other. Several employees repeating a workplace rumor do not necessarily provide multiple confirmation. The article does not imply stronger corroboration than actually exists.

A single anonymous source may support publication only in exceptional circumstances where the source has direct knowledge, the information is of substantial public importance, the source is demonstrably credible, the risk of identification is serious, corroboration is limited for defensible reasons, available records or circumstances support the account, motive has been examined, the subject receives a meaningful opportunity to respond, uncertainty is reflected and the decision receives high-level approval.

Description and Explanation to Readers

A protected source is described as specifically as possible without increasing identification risk. Suitable descriptions may identify a current employee with direct knowledge, a former official involved in a decision, a contractor with access to a system, a person present at a meeting or an individual directly affected by a policy. Descriptions are not made more prestigious or authoritative than the source’s actual position.

Where anonymity materially supports a central claim, the article explains the reason, such as risk of dismissal, contractual retaliation, legal exposure, physical danger, professional consequences or harassment. The explanation does not contain a combination of details that allows the subject to identify the source by deduction.

Source Agreements

Source terms are agreed before publication wherever possible. The agreement addresses permitted attribution and use, confidentiality, documents, recordings, independent confirmation, future contact, timing, embargo, security expectations and limits of protection. Cyber Insight EU does not promise absolute technical secrecy, immunity from law, control over the final article, deletion of accurate records on demand, payment for a favorable account, concealment of material deception or protection that the publication cannot realistically provide.

An unsolicited message is not automatically confidential merely because it contains sensitive information or the sender labels it confidential. Cyber Insight EU nevertheless handles apparently sensitive material carefully while determining whether an agreement can be made. A source is encouraged not to send highly sensitive records until an appropriate method has been agreed.

Payment

Cyber Insight EU does not ordinarily pay sources for information. Payment may create incentives to exaggerate, fabricate or withhold evidence. Reimbursement of reasonable and necessary expenses may be considered exceptionally when it does not purchase the substance of the account, receives prior approval and is disclosed where material.

Legal and Technical Limits

Source confidentiality may be affected by legal orders, device compromise, provider access, metadata, account recovery, human error, malware, cross-border law, unauthorized access, physical seizure, third-party disclosure and information already known to others. Cyber Insight EU takes proportionate measures but does not claim that confidentiality is absolute. Sources facing serious legal, employment or security risk are encouraged to obtain independent professional advice. Cyber Insight EU is not the source’s lawyer, security provider or employer representative.

Secure Communication and Document Handling

Communication methods reflect risk and may include separate addresses, encrypted messaging, encrypted email where available, secure file transfer, avoidance of workplace devices, strong authentication, metadata removal, controlled access and separation of identity from article files. No method is described as perfectly secure, and a source is not asked to use technical measures the source cannot understand safely.

Source documents are stored with access limited to those who need them. Files are checked for author metadata, revision history, hidden comments, file paths, usernames, printer identifiers, device data, location information, embedded objects and other identifying information. Redactions are tested to ensure hidden text or metadata cannot be recovered easily. Original evidence is preserved separately from publication copies where necessary.

Internal Access and Draft Hygiene

Source identity is shared only with people whose access is necessary for verification, editing, legal review, security, publication approval or source protection. Commercial personnel, advertisers and unrelated contributors do not receive confidential source information. Protected names do not appear unnecessarily in public content-management fields, titles, file names, comments, revision history, shared commercial folders, social drafts, email subject lines or routine analytics systems.

Confidential Sources and Artificial Intelligence

Confidential material is not entered into a third-party artificial intelligence system without authorization and an assessment of provider retention, training use, access, international transfer, account security, contractual terms and exposure risk. AI systems are not used to infer or reconstruct the identity of a protected source.

Source Review and Editorial Control

An anonymous source does not approve the final article. Cyber Insight EU may verify quotations, technical explanations, chronology, source description, safety-sensitive detail and potential identifying information. The source may identify accuracy or safety concerns but may not require removal of relevant contrary evidence or control the conclusion.

Withdrawal and Source Deception

A source may later seek to withdraw information. Cyber Insight EU assesses the original agreement, evidence already obtained, independent confirmation, publication status, safety, fairness, public interest, legal obligations and whether the source was deceptive. Withdrawal does not automatically require removal of independently verified information, but a credible new safety risk may justify delay, modification or cancellation before publication.

If a source materially deceives Cyber Insight EU, the publication assesses what was false, whether evidence was fabricated, whether the article remains reliable, whether other sources were affected and whether correction or retraction is required. Source protection is not withdrawn casually or as punishment. Any decision concerning identity remains exceptional and governed by safety, ethics, law, public interest and the original commitment.

Complaints and Whistleblowers

A person challenging an anonymous-source article is not entitled to the source’s identity merely because the article is disputed. Cyber Insight EU assesses the challenge using underlying evidence while protecting confidential information and may explain the number and category of sources, basis of knowledge, corroboration, reason for anonymity, documents reviewed and limitations.

Potential whistleblowers may contact editorial@cyberinsighteu.com and are encouraged not to send highly sensitive records until an appropriate communication method has been agreed. Concerns that Cyber Insight EU misused anonymous sourcing or breached a confidentiality commitment may be sent to complaints@cyberinsighteu.com.