Radio Free Europe/Radio Liberty journalists are able to work online safely with the YubiKey

The risks of reporting the truth in the world s most dangerous locations

Radio Free Europe/Radio Liberty (RFE/RL) has been a trusted source for news across the globe for 75 years. Initially known for broadcasting radio behind the Iron Curtain during the Cold War, RFE/RL now covers 23 countries in 27 languages, with a mission to provide access to unbiased information wherever press freedom is under threat. RFE/RL meets audiences where they are, across web, video and radio.

This mission makes RFE/RL a target for authoritarian governments, who often seek to ban their work, while their journalists across the world face surveillance, imprisonment and a regular barrage of physical and digital threats. In Russia, RFE/RL has been classified as an undesirable organization and its journalists have been labelled as “foreign agents.”

The goal is often to intimidate and suppress free thought, according to Carter Boone, News Product Manager for Safety at RFE/RL. If journalists’ accounts are breached, the locations of their sources could also be exposed, putting them and their families at risk. RFE/RL also has a wide digital footprint across the web; if their social media accounts were to be hacked, their journalism could lose credibility.

For years, RFE/RL has dealt with constant cyber attacks, over 90% of which are phishing. “Phishing attacks are everywhere,” says Ajla Obradović, Digital Media Editor for RFE/RL’s Balkan Service. “They’re getting more and more sophisticated. Even with training, it can still be very hard to understand what’s phishing and what’s not.” Bogus push notifications are a regular occurrence. “You’re seeing the notification, the digital footprints, and it feels like someone is breaking into your personal space,” says Obradović.

Relying on the YubiKey for unparalleled protection

Defense against phishing attacks requires strong multi-factor authentication (MFA). This rules out weaker legacy methods like SMS. Even authentication apps, which offer a higher level of security, are still very vulnerable to sophisticated, modern cyber attacks. After arriving at RFE/RL, Boone advocated for the use of YubiKeys—hardware security keys offering the strongest phishing-resistance combined with a seamless user experience.

RFE/RL was able to take advantage of Yubico’s Secure It Forward program, which donates YubiKeys to non-profit organizations, human rights defenders and journalists around the world, helping those most at risk improve their security posture.

RFE/RL sees MFA as an important protection for all users, not just high-risk individuals. “Hackers and threat actors are always looking for the lowest hanging fruit,” says Boone. “Rather than going after an investigative journalist with hardened digital security practices, a hacker may look for a softer target to get access to the same system.”

“A YubiKey works across multiple accounts,” says Boone, “which is more comfortable than having multiple authentication methods scattered amongst different platforms and apps.” The same YubiKey can work both alongside a password as a strong second factor, or can replace passwords entirely. Long-term, this offers RFE/RL the possibility to achieve fully passwordless authentication by securing Single Sign-On for all applications with YubiKeys.

YubiKeys are used to secure both official RFE/RL systems and personal accounts; for journalists, personal accounts are often an important part of their work, either for communicating with sources or sharing their work with a wide audience. “Our digital security lead approached us because our YouTube and Twitter accounts were targeted heavily with phishing attacks,” says Obradović. “He told us that YubiKeys offer the maximum security level for journalists. It gives you such peace of mind, it’s incredible. If you have your YubiKeys with you, you feel very safe.”

Protecting global journalism

In addition to full-time employees at their headquarters in Prague, YubiKeys offer crucial protection to RFE/RL’s investigative journalists around the globe. “I help train smaller newsrooms that don’t have the same kind of infrastructure,” says Boone.

Secure communication is essential for journalists wherever they are. “An important part of this training is providing tools to protect against digital threats, and that relies heavily on strong multi-factor authentication. Journalists usually know MFA is important, but they are not always clear which type is best.”

For Boone, giving journalists the ability to work online safely is the best part of his job. “Yesterday, we had a journalist who received a threat from abroad, and I walked them through the process of securing all of their accounts using YubiKeys. To see they were relieved and that they were less anxious about this kind of threat was incredibly rewarding.”