It had been evident for some time before Snowden surfaced that best practices in investigative reporting and source protection needed to change. Press image for Citizenfour.

“Citizenfour,” the new documentary about Edward Snowden, by Laura Poitras, is, among other things, a work of journalism about journalism. It opens with quotations from correspondence between Poitras and a new source who identifies himself only as Citizenfour. This source turns out to be Snowden. Soon, Poitras and Glenn Greenwald, at the time a columnist for the Guardian, travel to Hong Kong to meet Snowden in a hotel room.

They don’t know, at this point, if Snowden is who he says he is. They don’t know if his materials are authentic. Yet Poitras turns on her camera right away. Greenwald, who attended law school, questions Snowden, quite effectively. Gradually, Snowden’s significance becomes clear. The sequence is enclosing and tense and has many remarkable facets. One is that we witness a historically significant exercise in reporting and source validation as it happens. It is as if Bob Woodward had filmed his initial meeting, in a garage, with Deep Throat.

Snowden comes across in the film as shrewd, tough, and hard to read. (My colleague George Packer, in his recent Profile of Poitras, captures the film’s range brilliantly. Snowden also spoke to Jane Mayer remotely at this year’s New Yorker Festival.) Snowden has said that he had never spoken to a journalist before he contacted Poitras. “I knew nothing of the press,” he told the Guardian last summer. “I was a virgin source, basically.” This is not entirely persuasive: he may never have talked to a journalist, but he behaved with exceptional sophistication, both then and later— he is very far from the proverbial “naïve source.”

In fact, one of the least remarked upon aspects of the Snowden matter is that he has influenced journalistic practice for the better by his example as a source. Famously, when Snowden first contacted Greenwald, he insisted that the columnist communicate only through encrypted channels. Greenwald couldn’t be bothered. Only later, when Poitras told Greenwald that he should take the trouble, did Snowden take him on as an interlocutor.

It had been evident for some time before Snowden surfaced that best practices in investigative reporting and source protection needed to change—in large part, because of the migration of journalism (and so many other aspects of life) into digital channels. The third reporter Snowden supplied with National Security Agency files, Barton Gellman, of the Washington Post, was well known in his newsroom as an early adopter of encryption. But it has been a difficult evolution, for a number of reasons.

Reporters communicate copiously; encryption makes that habit more cumbersome. Most reporters don’t have the technical skills to make decisions on their own about what practices are effective and efficient. Training is improving (the Tow Center for Digital Journalism, at Columbia Journalism School, where I serve as dean, offers a useful place to start), but the same digital revolution that gave rise to surveillance and sources like Snowden also disrupted incumbent newspapers and undermined their business models. Training budgets shrank. In such an unstable economic and audience environment, source protection and the integrity of independent reporting fell on some newsrooms’ priority lists.

Snowden has now provided a highly visible example of how, in a very high-stakes situation, encryption can, at a minimum, create time and space for independent journalistic decision-making about what to publish and why. Snowden did not ask to have his identity protected for more than a few days—he seemed to think it wouldn’t work for longer than that, and he also seemed to want to reveal himself to the public. Yet the steps he took to protect his data and his communications with journalists made it possible for the Guardian and the Post to publish their initial stories and bring Snowden to global attention.

It took an inside expert with his life and liberty at stake to prove how much encryption and related security measures matter. “There was no risk of compromise,” Snowden told the Guardian, referring to how he managed his source relationship with Poitras and the others before their meeting in Hong Kong. “I could have been screwed,” but his encryption and other data-security practices insured that it “wasn’t possible at all” to intercept his transmissions to journalists “unless the journalist intentionally passed this to the government.”

In fashioning balanced practices for reporters, it is critical to ask how often and in what ways governments—ours and others—systematically target journalists’ communications in intelligence collection. For all his varied revelations about surveillance, this is an area where Snowden’s files have been less than definitive. It seems safe to assume the worst, but, as for the American government’s practices, there are large gaps in our understanding. White House executive orders, the Patriot Act, and the Foreign Intelligence Surveillance Act might all be grounds for targeting journalists for certain kinds of collection. Yet the government has never disclosed its policies, or the history of its actual practices following the September 11th attacks. (For a chilling sense of how vulnerable a journalist’s data would be if targeted by sophisticated surveillance, read “Dragnet Nation,” by Julia Angwin, an investigative reporter, formerly at the Wall Street Journal and now at ProPublica.)

In September, the Reporters Committee on Freedom of the Press and more than two dozen media organizations asked the Privacy and Civil Liberties Oversight Board, an independent federal body, to look into these questions and report their findings publicly. “National security surveillance programs must not be used to circumvent important substantive and procedural protections belonging to journalists and their source,” their letter said. “Sufficient details about these programs must be disclosed to the public so that journalists and sources are better informed about the collection and use of their communications.”

From a working journalist’s perspective, the Edward Snowdens of this world come around about as often as Halley’s Comet. It is not possible to report effectively and routinely while operating as though every communication must be segregated in a compartment within a compartment. The question of what constitutes best practices is a work in progress, as is the protection of personal privacy more broadly.