10.25.15

How to Securely Provide Techrights With Information, Documents

Posted in Site News at 6:35 am by Dr. Roy Schestowitz

The key is anonymity

A lock

Summary: Advice for potential whistleblowers, or sources with evidence of abuse that they wish to anonymously share with the world (via Techrights)

OVER the years Techrights has received critical information from dozens of sources, all of which remained safe (unexposed). But this does not mean that all of them did this safely. This article provides advice for those who wish to pass to us information in the safest of ways, without having to do a lot of complicated things.

Why Not Off-the-shelf, Self-contained Secure Software?

Over the past 6 months or so we have looked into various bits of Free/libre software, e.g. Briefkasten (no longer actively maintained, as of 2013) and SecureDrop, which is too big a project (massive also in the source code sense compared to Briefkasten, not to mention difficult to set up). After much effort we decided to settle for something which is simpler to use and is much faster to use. To facilitate leaking of sensitive documents (e.g. evidence of misconduct) we mostly require anonymity, as the content of the material does not — in its own right — do much (if anything) to expose the source.

Typically, whole frameworks are built for distributed and de-centralised leaking. This requires quite a bit of hardware, which in turn needs to be set up and properly configured. It’s complicated for both sides (source and receiver) and it’s usually developed for large teams of journalists, for constant interaction with sources, or a regular flow of material. We do not require something this advanced. In practice, a one-time document drop is usually enough.

Our Proposed Solution

We have decided that the following method would be good enough given the nature of leaks we normally receive. They are typically about technology, rather than some military or surveillance apparatus such as the CIA’s assassination (by drones) programme or the NSA’s mass surveillance programme.

For extra security, we kindly ask people to ensure anonymity/privacy tools are used, notably Tor. Without it, privacy/anonymity cannot be assured to a high degree. It’s possible, but it would not be unbreakable (meaning too great an effort and a challenge for spies to take on).

Establishing a Secure (Anonymous) Session

Follow the following steps, with (1) for extra assurance of anonymity.

  1. Install Tails or prepare a Tails device (e.g. Live CD) to boot on a laptop, in order to simplify session creation with Tor (for those who insist on using Windows we have this guide [PDF]).
  2. Irrespective of (1), seek public wireless/wired access in something like a mall (preferably not a sit-down like a coffee shop, where cameras are operated and situated in a way that makes it easy to track individuals by faces, payment with debit/credit cards and so on). The idea is to seek a place — any place — where it is hard to know the identity of the connected party, even by association (e.g. friend or family). Do not use a portable telephone (these are notoriously not secure and regularly broadcast location).
  3. Refrain from doing any browsing that can help identify patterns or affiliations of the user (e.g. session cookies). In fact, unless Tails is used, it might be worth installing a new browser (Opera for instance) and doing nothing on it prior to the sending of material. This reduces the cookie trail/footprint.

Send the material

Once logged in anonymously, anonymously (do not log in) submit text through Pastebin and take the resultant URL for later pasting. Do not pass PDFs for non-textual material. Instead take shots of them, to reduce/eliminate metadata which is often being passed along with them. Then submit to Anonmgur and make a note of the resultant URL for later pasting.

This is typically a one-way communication channel, so add any context which is necessary, then link to the above material as follows:

  • Log in to the #techrights IRC Channel via the Web browser.
  • Choose a pseudonym and sooner or later we will get around to seeing the new arrival and checking what there is to be said (there are dozens of us there).
  • Drop the link/s in the channel. If someone is on the keyboard at the time, there might even be time for interaction. Do not say anything that can help reveal identity (sometimes the language itself is revealing).

Caveats

While not impenetrable, it would take an enormous amount of effort (and connections in several high places) to unmask a source who follows the steps above. Unless it’s a high-profile political leak, such an unmasking effort would be well beyond what’s worth pursuing (expensive and complicated). MAC address-level spying often assumes access to very high places (and deep into back rooms), so therein lies no significant danger, especially when the best anonymity tools are properly used and the incentive to unmask isn’t great enough at high places (usually the political or military establishments).

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

What Else is New


  1. Internal Error: Unified Patent Court and Unitary Patent Incompatible With the Constitution and Basic Laws

    The FFII has issued a statement for Members of the Bundestag, Members of the European Parliament, Members of the Council, German Presidency of the EU, Chancellor Merkel, Commissioner Von Der Leyen, Commissioner Reynders, and Battistelli's buddy Breton



  2. The EPO is Using Hype Wave and Buzzword to Promote Illegal Software Patents in a So-Called “Digital Conference”

    The "HEY HI" or "AI" hype is misused by the Office; not just in person but also in webstreams, which basically serve as a vehicle for illegal agenda



  3. Dutch Delegation and German Delegation at the Administrative Council of the EPO Upset at the Office for Secrecy, Working Behind the Scenes to Crush Productive Staff

    Less than halfway through his term at the Office, Battistelli's buddy already faces growing criticism and, according to the Central Staff Committee, he "was emotionally affected by the intervention such that he was not able to effectively reply to the questions of the delegates."



  4. Links 23/11/2020: GNU Guix 1.2.0, Evaluating Precursor’s Hardware Security, Kdenlive 20.08.3, Kodi 19.x Beta, Vulkan 1.2.162

    Links for the day



  5. Links 23/11/2020: Linux 5.10-rc5, GIMP Turns 25, 4MLinux 34.2, Escuelas Linux 6.11, MPV Player 0.33

    Links for the day



  6. How to Put on Airs of Professionalism Like a Boss

    "Boardroom suits are not meant to be flashy, but to conform. Simple lines and smart ties -- the opposite of what Richard Stallman would wear, show that you are either a well-machined cog or a serious adversary."



  7. IRC Proceedings: Sunday, November 22, 2020

    IRC logs for Sunday, November 22, 2020



  8. Legal Action at the European Patent Office (EPO) Leveraged Against Management... for Robbing EPO Staff and Robbing Europe, by Extension

    The EPO is being looted for its value; the staff is rightly concerned and there’s legal action on the way, filed reluctantly as there’s clearly no other option (a last resort/necessary recourse)



  9. Cory Doctorow at Privacy Week 2020 on DRM, Freedom/Software Freedom, Regulation, Etc.

    “We Used To Have Cake, Now We’ve Barely Got Icing” by Cory Doctorow.



  10. Links 22/11/2020: KaOS 2020.11, Calindori 1.3, KStars 3.5.0

    Links for the day



  11. New Position Paper on the Unified Patent Court (UPC) Says It's “Not the Best Solution for Europe” -- Clearly an Understatement

    UPC proponents (profiteers) aren't enjoying support anymore; not only has progress stalled (come to a complete stop) but the whole debate about the UPC (or anything conceptually like it) turned toxic and negative because facts come out, overriding lobbyists of litigation giants



  12. Mortality Rates Increase at the EPO and Christmases (or Holidays) During Corona Mean Fewer Days Off

    There's still no sign (other than hand-waving and empty gestures/smiles) that the EPO's management wishes to right the wrongs and undo the damage done over the past decade or so; in some ways, today's management is worse than ever before (grossly incompetent and eager to break the law at every turn)



  13. Newly Abnormal: A Crackdown on EPO Staff and Labour Rights in 'Survey' Clothing (Willis Towers Watson)

    In a very characteristic fashion, with zero consultation/input from staff (or staff representatives/union leaders) EPO President António Campinos proceeds to implementing illegal ‘reforms’, assuring any remaining non-sceptics that he’s just another Benoît Battistelli



  14. IRC Proceedings: Saturday, November 21, 2020

    IRC logs for Saturday, November 21, 2020



  15. [Meme] Good Advice From the FSF, So It's Time to #DeleteGitHub

    A good gift for the FSF would be git; not GitHub, but git



  16. Go Distributed, Go Encrypted, Go Secure, Transparency Still Possible

    Earlier today we enhanced access to our (sometimes anonymised) IRC logs by issuing text (ASCII) versions, which will from now onwards be a nightly/daily occurrence; we're also making everything we publish accessible from a large number of IPFS nodes (akin to P2P)



  17. IAM Celebrating and Glorifying Illegal Patents With Fake 'Awards' and Bogus 'Endorsements'

    IAM's fake 'awards' are nothing more than business and agenda-steering lies; it's time to call out again the real corruption that's driving IAM (which is itself supporting and advocating corruption)



  18. Been There, Done That: Team UPC's 'October' Becomes 'Early November' and Now Late November

    The self-serving litigation fanatics who mislead their customers are still at it; Bristows says that UPC has no issues other than “delay”



  19. The Only Real Dialogue the 'European' Patent Office is Having... is With Litigation Parasites, Even Foreign Ones

    The EPO's mask falls off again, revealing a ruthless herd immunity-like mentality that welcomes patent trolls, threatens/condemns actual scientists, harms Europe and basically does a disservice to everybody



  20. Inside the EPO During Corona: SUEPO (EPO Staff Union) and the Central Staff Committee Blast the Office for Illegal Practices and Threaten Legal Action

    The Staff Union of the European Patent Office (SUEPO) and the Central Staff Committee (CSC) are escalating their tone; the management of the Office and the Organisation is running out of time as staff loses its patience and its tolerance for the repeated abuses by the administration



  21. IRC Proceedings: Friday, November 20, 2020

    IRC logs for Friday, November 20, 2020



  22. Links 21/11/2020: Coreboot 4.13, EasyOS 2.5, Wine 5.22, Gmusicbrowser 1.1.16

    Links for the day



  23. Links 20/11/2020: Xfce 4.16pre2 and Qt Releases

    Links for the day



  24. Open Letter to Mogzagain (No Worries)

    figosdev responds to a concerned reader of Techrights, who wants Free software to succeed



  25. Better Privacy Than Pretty Good Privacy

    We're getting into distributed-as-in-decentralised and encryption-enabled page distribution; we're also likely to be adopting Sequoia-PGP over time



  26. Inside the EPO During Corona: The EPO is Violating Workers'/Stakeholders' Privacy and Breaking Data Protection Law (Again)

    There's no respect for the law or for the dignity/privacy of EPO staff; whenever the subject is being brought up there's nothing but stonewalling and the Data Protection Officer is a friend of the offender, who would be reluctant to oversee anything



  27. Conduct of EPO Management Lacks “Basis in Legality” According to EPO Staff Representatives

    The ongoing assault on staff of the EPO isn't going unnoticed and for the impression of consent (acceptance of this assault) a survey is being imposed on workers (with pressure put by line managers to participate); Europe as a whole is under assault from the EPO, whose decision-making groups are entirely infiltrated by special interests (to give an impression of professional consultation)



  28. Inside the EPO During Corona: Managers Don't Think of the Children, Cut Their Budget for First Time in Half a Century

    The systematic attack on staff's rights and welfare shows no signs of stopping; the so-called 'president', who isn't even showing up for meetings with staff, has turned Europe's second-largest institution from cash cow into a cash laundering apparatus that eats its own workers



  29. IRC Proceedings: Thursday, November 19, 2020

    IRC logs for Thursday, November 19, 2020



  30. Links 20/11/2020: Mir 2.2, Istio Releases, Linux 5.9.9

    Links for the day


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts