EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

10.25.15

How to Securely Provide Techrights With Information, Documents

Posted in Site News at 6:35 am by Dr. Roy Schestowitz

The key is anonymity

A lock

Summary: Advice for potential whistleblowers, or sources with evidence of abuse that they wish to anonymously share with the world (via Techrights)

OVER the years Techrights has received critical information from dozens of sources, all of which remained safe (unexposed). But this does not mean that all of them did this safely. This article provides advice for those who wish to pass to us information in the safest of ways, without having to do a lot of complicated things.

Why Not Off-the-shelf, Self-contained Secure Software?

Over the past 6 months or so we have looked into various bits of Free/libre software, e.g. Briefkasten (no longer actively maintained, as of 2013) and SecureDrop, which is too big a project (massive also in the source code sense compared to Briefkasten, not to mention difficult to set up). After much effort we decided to settle for something which is simpler to use and is much faster to use. To facilitate leaking of sensitive documents (e.g. evidence of misconduct) we mostly require anonymity, as the content of the material does not — in its own right — do much (if anything) to expose the source.

Typically, whole frameworks are built for distributed and de-centralised leaking. This requires quite a bit of hardware, which in turn needs to be set up and properly configured. It’s complicated for both sides (source and receiver) and it’s usually developed for large teams of journalists, for constant interaction with sources, or a regular flow of material. We do not require something this advanced. In practice, a one-time document drop is usually enough.

Our Proposed Solution

We have decided that the following method would be good enough given the nature of leaks we normally receive. They are typically about technology, rather than some military or surveillance apparatus such as the CIA’s assassination (by drones) programme or the NSA’s mass surveillance programme.

For extra security, we kindly ask people to ensure anonymity/privacy tools are used, notably Tor. Without it, privacy/anonymity cannot be assured to a high degree. It’s possible, but it would not be unbreakable (meaning too great an effort and a challenge for spies to take on).

Establishing a Secure (Anonymous) Session

Follow the following steps, with (1) for extra assurance of anonymity.

  1. Install Tails or prepare a Tails device (e.g. Live CD) to boot on a laptop, in order to simplify session creation with Tor (for those who insist on using Windows we have this guide [PDF]).
  2. Irrespective of (1), seek public wireless/wired access in something like a mall (preferably not a sit-down like a coffee shop, where cameras are operated and situated in a way that makes it easy to track individuals by faces, payment with debit/credit cards and so on). The idea is to seek a place — any place — where it is hard to know the identity of the connected party, even by association (e.g. friend or family). Do not use a portable telephone (these are notoriously not secure and regularly broadcast location).
  3. Refrain from doing any browsing that can help identify patterns or affiliations of the user (e.g. session cookies). In fact, unless Tails is used, it might be worth installing a new browser (Opera for instance) and doing nothing on it prior to the sending of material. This reduces the cookie trail/footprint.

Send the material

Once logged in anonymously, anonymously (do not log in) submit text through Pastebin and take the resultant URL for later pasting. Do not pass PDFs for non-textual material. Instead take shots of them, to reduce/eliminate metadata which is often being passed along with them. Then submit to Anonmgur and make a note of the resultant URL for later pasting.

This is typically a one-way communication channel, so add any context which is necessary, then link to the above material as follows:

  • Log in to the #techrights IRC Channel via the Web browser.
  • Choose a pseudonym and sooner or later we will get around to seeing the new arrival and checking what there is to be said (there are dozens of us there).
  • Drop the link/s in the channel. If someone is on the keyboard at the time, there might even be time for interaction. Do not say anything that can help reveal identity (sometimes the language itself is revealing).

Caveats

While not impenetrable, it would take an enormous amount of effort (and connections in several high places) to unmask a source who follows the steps above. Unless it’s a high-profile political leak, such an unmasking effort would be well beyond what’s worth pursuing (expensive and complicated). MAC address-level spying often assumes access to very high places (and deep into back rooms), so therein lies no significant danger, especially when the best anonymity tools are properly used and the incentive to unmask isn’t great enough at high places (usually the political or military establishments).

Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • del.icio.us
  • Reddit
  • co.mments
  • DZone
  • email
  • Google Bookmarks
  • LinkedIn
  • NewsVine
  • Print
  • Technorati
  • TwitThis
  • Facebook

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

What Else is New


  1. Another Misleading Article Regarding Patents From Rana Foroohar at the Financial Times

    In an effort to promote the agenda of patent maximalists, many of whom are connected to the Financial Times, another deceiving report comes out



  2. Monika Ermert's Reports About the Crisis at the EPO and IP Kat's Uncharacteristically Shallow Coverage

    News from inside the Council shows conflict regarding the quality of European Patents (granted by the EPO under pressure from top-level management)



  3. Patent Troll VirnetX a Reminder to Apple That Software Patents Are a Threat to Apple Too

    VirnetX, a notorious patent troll, is poised to receive a huge sum of money from Apple and Qualcomm is trying to ban Apple products, serving to remind Apple of the detrimental impact of patents on Apple itself



  4. Links 16/10/2017: Linux 4.14 RC5, Debian 9.2.1, End of LibreOffice Conference 2017

    Links for the day



  5. The Systematic Erosion of Workers' Rights and Holidays at the EPO Goes Years Back

    The legitimacy of the staff's concerns at the EPO, having seen basic labour safeguards being shredded to pieces by Battistelli for a number of years (predating even the escalation of the conflict)



  6. Articles in English and German Speak About the Decline in Quality of European Patents (Granted by the EPO)

    Heise and The Register, two sites that have closely watched EPO affairs for a number of years, speak about the real problem which is declining patent quality (or rushed examination) -- a recipe for frivolous litigation in Europe



  7. Software Patents and Patent Trolls Not a Solved Issue, But the US is Getting There

    A media survey regarding software patents, which are being rejected in the US in spite of all the spin from law firms and bullies such as IBM



  8. US Patent Trolls Are Leaving and the Eastern District of Texas Sees Patent Cases Falling by More Than Half

    The decline of patent aggression in the US and the patent microcosm's response to Justices, having ruled in TC Heartland, curtailing patent trolls



  9. Qualcomm's Nightmares Are Getting Worse as Antitrust Questions Are Raised and Assessed

    Qualcomm is getting itself deeper in trouble as fines pile up and its multi-billion dollar dispute with Apple isn't getting it anywhere



  10. Forget About Apple; Two of the Leading Phone Makers (Samsung and Huawei) Are Bickering Over Patents

    Massive Android OEMs, Huawei and Samsung, are in a big patent dispute and this time, for a change, China is a legal battleground



  11. Tim Heberden From the Glasshouse Advisory is Throwing Stones in a Glasshouse to Create Patent Litigation

    IAM's latest lobbying, aided by the patent microcosm, for a climate of feuds and disputes (to line the pockets of the litigation 'industry')



  12. Access to Medicine is More Important Than Patents

    Some of the latest news about patents that impede/deny access to crucial medication; strategic litigation from the generics sector, seeking to invalidate patents and then offer low-cost alternatives



  13. Links 14/10/2017: Windows Breaks Dutch Law, Wine 2.19 Released

    Links for the day



  14. The Patent Trial and Appeal Board (PTAB) Supported by Congress, a Federal Judge, Soon to be Supported by the Supreme Court Too?

    The Patent Trial and Appeal Board is still widely defended, except by the patent microcosm which likes (and profits from) patent trolls and litigation Armageddon



  15. Patents Are Turning BlackBerry and Nokia, Which Used Android, Into Anti-Android Fronts That Tax Android OEMs

    The Canadian BlackBerry has sued BLU in the US only to compel it to pay 'protection' money; Nokia's patents are being scattered to trolls, which are doing something similar (without risking litigation themselves)



  16. The Unified Patent Court (UPC) is Rotting Like the European Patent Office

    The Unitary Patent litigation pipe dreams (or prosecution/trolling fast lane), which Battistelli's EPO long relied on, turn out to be the road to nowhere



  17. Lying and Faking Now a Standard Procedure at the European Patent Office

    The European Patent Organisation (EPO) under the leadership (or chairmanship) of Christoph Ernst continues to relay lies from Battistelli's Office, SUEPO rejects these, the Office lies about SMEs, prioritises Microsoft (again), and probably buys fake Twitter "followers"



  18. Links 13/10/2017: X.Org Server 1.19.5, pfSense 2.4, Final Stages of Ubuntu 17.10

    Links for the day



  19. Truly Terrible 'Journalism' About António Campinos Boils Down to Lobbying and Agenda-Pushing

    The expectedly shallow coverage of the appointment (succession) of Battistelli's French pick, which will likely change nothing of significance at the European Patent Office (EPO)



  20. Under Christoph Ernst, the Council is Just a Megaphone of Battistelli's EPO, Including on Patent Quality

    The Administrative Council of the EPO does not appear to be interested in a serious, adult, scientific debate about the quality of European Patents (EPs) and is instead relaying lies from Benoît Battistelli



  21. Links 12/10/2017: Cutelyst 1.9.0, Qt Creator 4.5 Beta

    Links for the day



  22. The Hogwash Begins: Patent Microcosm's Media Pretends Campinos is Anything But Battistelli's French Succession Plan

    A survey of media coverage regarding António Campinos, the French person whom Benoît Battistelli selected as his successor at the EPO



  23. Patent Quality at the EPO (European Patents) is Slipping While Battistelli's Office Boasts “Expansion of Early Certainty” (Even Worse)

    The EPO is staring down the abyss as high-level EPO management, quite frankly as usual, looks for new ways to further exacerbate patent quality (for superficial gains in the number of granted patents) rather than improve it



  24. Former Microsoft Employee Explains Why Microsoft 'Embrace' of GNU/Linux and Free/Libre Open Source Software is Like W3C Entryism

    Microsoft's latest moves are "EEE" that "concern" him, according to this new video



  25. Links 11/10/2017: Krita 3.3.1, KDE Plasma 5.12 Plans

    Links for the day



  26. China is Getting Full of -- and Fed Up With -- Patent Trolls

    In China too, as expected, local companies are becoming rather disgusted by a wave of patent trolls, enabled by misguided officials and bad advice from the likes of IAM (which sets up events in China at the behest of the patent microcosm)



  27. The FRAND Lobby is Trying to Sneak Software Patents Into Countries That Banned Them

    The patent lobby is attempting to find new ways to impose patents on software (with euphemisms like "reasonable", "non-discriminatory" or "fair"), even in places that explicitly disallow these



  28. Musical Chairs as Battistelli's 'Chinchilla' García-Escudero Márquez Could Reportedly Take António Campinos' Place

    A culture of nepotism continues to thrive at the EPO, with García-Escudero Márquez rumoured to be after Campinos' position now that he's taking Battistelli's position; García-Escudero Márquez is also Battistelli's 'chinchilla' at the appeal boards, obliterating any illusion of independence



  29. With Surveillance Recruits at the EPO, Are (or Were) DNA Tests Ever on the Agenda?

    Since a lot of what's happening at WIPO has also happened at the EPO, and overlap between the two is growing, we recall tactics which are illegal but are miraculously protected by the veil of immunity



  30. Links 10/10/2017: Plasma 5.11, GCC 5.5 Released

    Links for the day


CoPilotCo

RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

CoPilotCo

Recent Posts