VPS for Journalists: Offshore Secure Hosting

When national security letters, court orders, or physical server raids are your threat model, the location and jurisdiction of your server infrastructure is not a technical preference - it is a fundamental security decision. Servers in your country of operation are accessible to domestic authorities. Servers in Iceland are subject only to Icelandic legal process, which requires Icelandic court orders under Icelandic law. This jurisdictional difference is material. A journalist in the United States faces NSLs (National Security Letters) that compel providers to hand over data without judicial review and prohibit disclosure of the request. An Iceland-hosted server is outside NSL jurisdiction entirely. A journalist in Russia covering opposition politics cannot safely host infrastructure domestically - Iceland VPS is outside Russian law enforcement authority. Iceland has a history of protecting press freedom. The Icelandic Modern Media Initiative resulted in some of the world's strongest legal protections for journalists and sources. WikiLeaks used Icelandic infrastructure for data storage - the legal environment was chosen deliberately.

A complete journalist VPS setup covers four needs: source communication, document storage, investigation management, and publication. **Source communication**: Install Signal-protocol compatible messaging. Matrix (Synapse) homeserver allows encrypted messaging without depending on Signal's US-based servers. Sources contact you via your Matrix server address - all message content is end-to-end encrypted and stored on your Iceland server, not on Signal's US servers. **Document storage**: SecureDrop is designed for source document submission. Install on your VPS: ```bash git clone https://github.com/freedomofpress/securedrop.git cd securedrop # Follow official installation guide for Tor-only access ``` SecureDrop uses Tor for anonymous source submissions and stores documents encrypted. Your Iceland VPS runs the SecureDrop server - outside domestic legal reach. **Investigation management**: Nextcloud provides encrypted file storage, shared editing (Collabora Online), and access control. Investigation files never leave your Iceland server. Team members access via encrypted connection. **Publication**: Host your publication directly on your VPS using static site generators (Hugo, Jekyll). HTTPS via Let's Encrypt. Optional: also publish to a .onion address via Tor for readers in censored environments.

Source protection requires layered technical measures. Your Iceland VPS is one layer - the infrastructure layer. Additional layers: Tor hidden service: Publish your SecureDrop and source contact information as a .onion address. Sources connect via Tor - no IP metadata is logged on your server because Tor hides source IPs in the network routing. Anubiz Host Tor Hosting Basic plan ($25.74/mo) is designed for .onion hidden service hosting. SSL/TLS and HTTPS: All web content from your VPS must be served over HTTPS. Let's Encrypt provides free certificates. Sources connecting to your web forms have their connection encrypted in transit. Logs: Nginx and Apache log client IPs by default. Modify log configuration to not log IPs, or to hash IPs. If you do not log source IPs, you cannot be compelled to produce them. Server hardening: change SSH port, disable password auth, use key-based auth only, install fail2ban, enable UFW firewall, disable root SSH login, create a limited user for application processes.

Funding your journalistic infrastructure anonymously prevents payment trail linking you to your server. Credit card payments create a permanent record. Anubiz Host accepts Monero (XMR), Bitcoin, and USDT. For maximum anonymity: receive Monero directly from sources or exchanges, transfer to a new wallet address, pay for VPS from that wallet. The payment chain from your identity to the VPS becomes very difficult to trace. Subscription management: Anubiz Host sends renewal notices via email. Renew 5-7 days before expiration using cryptocurrency. Do not let your server expire - recovering a non-operational server from an emergency context is more disruptive than a maintained renewal schedule.