The document discusses a study of journalists' mental models of information security. It finds that journalists believe their security risk depends on how conspicuous their work is and that meeting sources in person is the best way to avoid security issues. This "security by obscurity" approach is ineffective long-term. The study suggests improving security education for journalists to give them a better understanding of digital communications and security best practices.