AUDIE CORNISH, HOST:
The New York Times has moved all of its reporters onto corporate Gmail accounts. Unlike the free Gmail used by millions of people, corporate Gmail accounts cost money and have greater privacy protections. But that protection is not complete. The move could leave Times reporters in a difficult legal situation if they are the subject of a government investigation. NPR's Steve Henn reports.
STEVE HENN, BYLINE: In the digital world, almost everything you do to communicate leaves a trace. Emails are stored on servers often after they're deleted. Phone calls create logs detailing which numbers connected, when and for how long. Your mobile phone can create a record of where you are. So if you're a journalist trying to protect a confidential source, this is a very difficult world to work in.
JULIA ANGWIN: I have been running around in my newsroom screaming about this for years.
HENN: Julia Angwin is a reporter at The Wall Street Journal who covers computer security and privacy.
ANGWIN: There's so much evidence now that journalists are being targeted, that our communications are vulnerable, and mostly that our sources are being put in jail.
HENN: She says one of the reasons so many journalists have been unable to protect their sources is that records about who they're talking to are collected by third parties. So last year, when the Justice Department was investigating the leak about a foiled terrorism plot in Yemen, it didn't subpoena reporters at The Associated Press. Instead, it went to Verizon and asked for records of calls going into and out of AP bureaus. Prosecutors go after journalists' private email accounts. And often, investigative requests to companies like Google and Verizon come with gag orders.
JENNIFER VALENTINO-DEVRIES: I find that all of this, including the AP revelations, contributed to a sense of nervousness, I guess, among sources.
HENN: Jennifer Valentino-DeVries is also with The Wall Street Journal.
VALENTINO-DEVRIES: Even people who are not discussing particularly sensitive information with me will comment about the possibility of my emails and phone calls being tapped, and I think that's been disconcerting.
HENN: It's in this context that The New York Times decided to outsource its email to Google. Before the switch, Times' emails were stored on servers it owned. Now, those messages are in Google's digital filing cabinet.
ANGWIN: I worry a lot about the outsourcing of email at a news organization.
HENN: Julia Angwin.
ANGWIN: We only have two layers of protection, right? One is technological, and one is legal. So certainly, our lawyers at our news organization are going to fight to protect our emails, but if they don't fully control them technically, they can't mount a very good argument. If Gmail is handling our emails, then we have to rely on them to mount our legal arguments, and that's not a situation that news organizations have been in in the past.
HENN: The Times isn't the only media organization to outsource its email. And in a statement, it said it had discussed the legal issues involved here in detail. The company said it's confident its deal with Google, combined with precautions its journalists are now taking, has actually enhanced the protection of sensitive information. Right now, the Times believes hackers are actually a bigger security threat than government investigations or gag orders. Fred Cate is the director for applied cyber security research at Indiana University. He says a large email service provider like Google may very well have better security. Still, Cate says when it comes to mounting a legal defense against a leak investigation, the Times is making itself vulnerable.
FRED CATE: There will be a gap. I mean, there's no question that there's going to be a gap because previously you would have had to serve that piece of paper on The New York Times.
HENN: And now, an investigator will serve Google. And if the request comes with a gag order, the Times might never know. Steve Henn, NPR News, Silicon Valley.