Usually you would only communicate through secure drop. Looks like the Washington post uses it: https://www.washingtonpost.com/securedrop/