In early 2015, an anonymous source contacted Bastian Obermayer, a reporter at Germany's Süddeutsche Zeitung. The source offered internal data from Mossack Fonseca, a Panamanian law firm that created offshore companies for clients around the world. The leak eventually grew to 11.5 million documents. No single newsroom could report it alone, and no single country's laws could govern it.

The paper brought the files to the International Consortium of Investigative Journalists, which coordinated hundreds of reporters across roughly eighty countries. Each partner faced different defamation standards, different surveillance risks, and different consequences for publishing. A story that was legal to print in Munich could invite prosecution elsewhere. A source who was safe in one country could be exposed in another.

When the Panama Papers were published in April 2016, the coordinated release looked effortless. It was not. Behind it sat months of legal analysis, security planning, and careful negotiation over timing. Cross-border investigations succeed or fail on this hidden architecture. Understanding it shows how modern accountability journalism actually works.

The first question in any cross-border investigation sounds simple: whose laws apply? The answer is rarely one country. Reporters must consider where the journalist lives, where the newsroom is incorporated, where the subjects reside, where the documents were obtained, and where readers will encounter the story. Each location can create legal exposure, and each has its own rules about what counts as fair, true, or lawful reporting.

Defamation law shows the problem clearly. In the United States, public figures must prove actual malice, a high bar that protects aggressive reporting. England and Wales historically put more of the burden on publishers, which made London a favored venue for wealthy claimants. Critics called the practice libel tourism. Online publication complicates things further. In Dow Jones v Gutnick, Australia's High Court held that material is published where it is downloaded, not only where it is uploaded.

Defamation is only one layer. Data protection rules such as Europe's GDPR govern how personal information is handled. Official secrets laws may make it a crime to possess certain documents. Some countries treat publishing leaked financial data as a banking-secrecy offense. Legal teams therefore build what amounts to a jurisdiction map. It lists every country with a plausible claim over the story, the specific legal risks in each, and how likely subjects are to sue or prosecute there.

That map shapes reporting decisions long before publication. It determines which claims need extra documentation and which subjects receive detailed right-of-reply letters. It also identifies which partner is best positioned to carry the most sensitive findings. The goal is not to avoid every risk. It is to understand the risks precisely enough to report the truth without handing powerful subjects an easy legal weapon.

Takeaway

A story doesn't exist in one legal system. It exists in every place it can be read, and rigorous reporters plan for all of those places before they write a word.

Source protection rests on a principle that crosses every border: people who reveal wrongdoing should not be punished for trusting a journalist. In practice, though, what that principle means changes dramatically from country to country. In Europe, the European Court of Human Rights recognized in Goodwin v United Kingdom that protecting sources is a basic condition of press freedom. Elsewhere, journalists can be forced to testify, and sources can face prison or worse.

Investigative teams respond with threat modeling. This is a structured assessment of who might try to identify a source, what capabilities they have, and what exposure would cost the source. A whistleblower at a European company faces different adversaries than a government insider in a country where intelligence services monitor phone networks. The tools often overlap: encrypted messaging, secure submission systems, and computers kept permanently offline. How strictly reporters use those tools depends on the threat.

The 2021 Pegasus Project sharpened this lesson. Coordinated by Forbidden Stories with technical support from Amnesty International's Security Lab, the investigation examined spyware that could compromise a phone without its owner clicking anything. The implication for reporters in high-surveillance environments was stark. A compromised phone could betray a source no matter how carefully the messages were encrypted. In many newsrooms, the response is a return to older methods: devices left behind, meetings in person, and notes on paper.

Collaboration adds its own complications, because every partner who handles the material becomes a potential point of exposure. Mature consortiums therefore compartmentalize. They share documents widely but restrict knowledge of the source's identity to a very small circle. They also recognize an uncomfortable imbalance: local journalists often carry far greater personal risk than foreign colleagues reporting the same story. Security plans must be built around the most vulnerable person involved.

Takeaway

Operational security is only as strong as its weakest participant, so serious collaborations design their protection around the person with the most to lose.

Once the reporting is complete, international collaborations face a strategic question: how should the findings reach the world? The answer is almost never a single story from a single outlet. Instead, consortiums typically agree on a coordinated embargo, a fixed moment when every partner publishes at the same time. This prevents subjects from using early publication in one country to seek court orders or destroy evidence in another.

Simultaneous release also spreads the legal risk. Each partner publishes under its own editorial control, with its own lawyers reviewing the work under domestic law. A newspaper in a country with strong press protections may publish the most aggressive findings. A partner in a more restrictive environment may frame the same material differently or focus on details it can verify locally. The investigation is shared, but each outlet carries legal responsibility only for its own version.

Localization serves audiences as much as lawyers. The Panama Papers became hundreds of stories rather than one, because partners pursued the angles that mattered to their own readers: a national politician in one country, a local business network in another. In Iceland, the revelations helped force the prime minister's resignation within days. A global finding becomes accountability only when it reaches the people positioned to demand answers.

Consortiums also plan for the worst. Forbidden Stories exists partly to ensure that if a journalist is threatened, jailed, or killed, colleagues abroad can finish and publish the work. After the 2017 murder of Maltese journalist Daphne Caruana Galizia, reporters from multiple outlets continued her investigations through the Daphne Project. The strategy sends a deliberate message: silencing one reporter will not silence the story.

Takeaway

Distributed publication turns a single point of failure into a network, making it far harder for any one government, court, or threat to stop the truth from getting out.

Cross-border investigations reveal something that is usually invisible in finished journalism: the scaffolding of legal analysis, security planning, and coordination that makes publication possible. The headline is the last step, not the first.

This scaffolding matters because power increasingly operates internationally. Money moves through offshore structures, surveillance technology is sold across borders, and people with resources can choose the courts most favorable to them. Journalism that stays within national lines will miss much of what matters.

Jurisdiction mapping, adaptive source protection, and distributed publication are how reporters meet that challenge. These methods allow journalists working under very different laws to act as one. When they succeed, accountability no longer depends on where a story happens to be told.