Principle

NextGen Privacy strongly favors on-the-record reporting. Transparency regarding who is providing information is fundamental to journalistic credibility, allowing readers to evaluate a source’s expertise, authority, and potential biases. However, in the sensitive fields of corporate EdTech whistleblowing, educational surveillance resistance, cybersecurity vulnerabilities, and youth privacy litigation, vital public-interest information can frequently be obtained only if the source is granted confidentiality.

This policy establishes our rigorous protocols for granting, verifying, protecting, and maintaining confidentiality for anonymous sources, balancing the public’s right to know against our solemn obligation to protect sources—especially young people and workplace insiders—from severe retaliation.

Scope and Terminology

This policy applies to all communications between NextGen Privacy journalists and individuals seeking non-attribution. We enforce precise definitions for attribution terms:

On the Record: Information and quotes may be published directly and attributed to the source by their real name and professional title.
On Background: The verbatim information and quotes may be published, but the source is identified only by a generic, agreed-upon description (e.g., ‘a senior software engineer at an EdTech vendor’).
Deep Background: The information may be used to guide reporting and establish facts, but no direct quotes and no attribution phrase may be published.
Off the Record: The information is provided solely for the reporter’s understanding and cannot be published, quoted, or attributed in any form without subsequent explicit permission.

Decision to Grant Anonymity

Anonymity is never granted as a casual convenience, a tool for corporate public relations spin, or a routine conversational shortcut. It is an extraordinary measure permitted only when all of the following conditions are met:

The information is of vital, legitimate public importance;
The information cannot be obtained through on-the-record sources or public records;
The source faces a credible, severe threat of physical harm, job termination, expulsion from school, legal prosecution, or professional retaliation if identified;
The source’s direct access and credibility have been thoroughly verified; and
Prior written authorization has been granted by the Editor-in-Chief.

When Anonymity Is Refused

NextGen Privacy strictly refuses to grant anonymity in several circumstances: We do not grant anonymity to individuals seeking to launch personal attacks, level uncorroborated criminal allegations against third parties, or advance commercial lobbying agendas. We do not permit corporate spokespersons or vendor representatives to use background attribution to avoid public accountability for corporate actions.

Furthermore, anonymity will be denied if our editors believe the source’s claims are speculative, self-serving, or uncorroborated.

Internal Identity Verification

Under no circumstances is a source anonymous to NextGen Privacy as an institution. While the source’s identity is concealed from the public, the reporting journalist must disclose the source’s true name, institutional role, and contact details to the Editor-in-Chief and the responsible section editor.

This multi-editor verification rule ensures institutional accountability and protects against single-reporter fabrication. The editors are bound by the same absolute legal duty of confidentiality as the reporter.

Basis of Knowledge

Editors must interrogate the source’s basis of knowledge: How does the source know what they claim? Did they directly witness the event, write the code, or audit the software? Or are they recounting second-hand office gossip?

We grant anonymity only to sources with demonstrable, firsthand access to the primary facts.

Motivation and Conflicts

Journalists must thoroughly investigate the source’s underlying motivations. Is the source motivated by public-interest conscience, a workplace grievance, commercial rivalry, or school disciplinary friction? Understanding motivation helps journalists identify potential blind spots and prevents the newsroom from being weaponized in commercial feuds.

Corroboration

A claim made by an anonymous source cannot stand alone. Factual assertions provided under confidentiality must be corroborated by independent documentation—such as internal emails, technical logs, or procurement contracts—or confirmed by at least one independent, separate source with direct knowledge.

Single-source anonymous claims are prohibited in investigative reporting.

Description and Explanation to Readers

When an anonymous source is cited, our reporting must explain to readers why anonymity was granted (e.g., ‘granted anonymity because they were not authorized to speak publicly and feared professional retaliation’).

Furthermore, the source must be described with as much specificity as possible regarding their institutional proximity to the events (e.g., ‘a database administrator with direct access to student records’) without exposing identifying traits.

Source Agreements

Ground rules regarding attribution must be negotiated and agreed upon before confidential information is shared. Retrospective demands for confidentiality made after on-the-record statements have been delivered are not honored.

Once an agreement of confidentiality is formally established, NextGen Privacy treats it as a sacred, binding professional obligation.

Payment

NextGen Privacy strictly prohibits paying money, financial compensation, or commercial benefits to sources in exchange for information, documents, or interviews. Checkbook journalism corrupts the integrity of evidence and creates incentives for fabrication.

Legal and Technical Limits

We inform confidential sources that while NextGen Privacy will resist subpoenas, search warrants, and court orders to the maximum extent permitted under press freedom laws and journalistic shield statutes, absolute legal immunity cannot be guaranteed against national security interception or state surveillance.

Sources are advised on technical operational security and encouraged to use secure communication channels.

Secure Communication and Document Handling

Journalists working with confidential sources must utilize end-to-end encrypted messaging applications (such as Signal), PGP encryption, or our secure drop system. Sensitive documents must never be stored on unencrypted commercial cloud drives or public email servers.

Internal Access and Draft Hygiene

In newsroom drafts, editorial planning documents, and CMS staging systems, the real names of confidential sources are strictly omitted, replaced with standardized codenames. Access to files containing source identifying details is restricted to the essential reporting team.

Confidential Sources and Artificial Intelligence

Reporters are strictly forbidden from uploading confidential source interview transcripts, audio files, or non-public whistleblower documents to commercial generative AI platforms, online transcription services, or external cloud language models.

Processing confidential source materials through third-party AI APIs violates source confidentiality and exposes data to unauthorized third-party retention.

Source Review and Editorial Control

While reporters may read back specific quotes to an anonymous source to verify technical or factual accuracy, sources are never granted the right to review the full article draft, alter headlines, or exercise editorial control over the finished piece.

Withdrawal and Source Deception

If an anonymous source attempts to withdraw information after an article has been verified and scheduled for publication, the decision rests solely with the Editor-in-Chief. Furthermore, if an anonymous source is proven to have intentionally lied, fabricated evidence, or provided forged documents to NextGen Privacy, the agreement of confidentiality is rendered null and void, and the deception will be exposed publicly.

Complaints and Whistleblowers

For inquiries regarding source protection, or to securely contact our newsroom as a whistleblower, please utilize our dedicated channels: Whistleblower Desk: whistleblower@nextgenprivacy.org
Editor-in-Chief: contact@nextgenprivacy.org
Editorial Office: editorial@nextgenprivacy.org