[SolemnGolem]

From my own time in journalism, a lot of the material in GURPS Social Engineering would be spot-on. Also the recent Keeping In Contact supplement would be helpful.

Most journalism (as of early 00s) was still being done by phone, with a bit by email (social media not really existing back then, though NYT journalist Jennifer 8. Lee was briefly notable for posting requests on message boards essentially asking for tips, leads, etc. in an early form of crowdsourcing).

For stories with some degree of actual legal liability, we had to rely heavily on contacts and trust built over years. You'd try to attack a certain question from multiple angles - "who would know anything at all about this topic and what relationship do we have with them going back when?" - and like as not your first two or three calls would whiff (the nice ones would tell you they can't help you at all, others just wouldn't call you back).

Protecting your sources was important too, and not just in the Watergate Deep Throat sense, but also in the sense of maintaining plausible deniability about who they were and what they knew. Say one source gave you an exact dollar amount, but this information could potentially be used to reveal who the source was. You'd try to get a second source, perhaps blur the actual dollar amount somewhat so it could have come from a variety of places. (A similar wartime practice was used by the US intel codebreakers to mislead Japanese counterintel about their leaked sources for Admiral Yamamoto's assassination). Less dramatically, a source could be fired or potentially cut out of future information leaks if they became implicated in media reporting.

I never did any "cloak and dagger" style reporting - the most sensitive source I ever had was a North Korean defector, but he was safely in the USA by the time I spoke with him, and he was very happy to have his photo and name publicly associated with his family's story. But hopefully these could give some idea of the trade.