EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

10.25.15

How to Securely Provide Techrights With Information, Documents

Posted in Site News at 6:35 am by Dr. Roy Schestowitz

The key is anonymity

A lock

Summary: Advice for potential whistleblowers, or sources with evidence of abuse that they wish to anonymously share with the world (via Techrights)

OVER the years Techrights has received critical information from dozens of sources, all of which remained safe (unexposed). But this does not mean that all of them did this safely. This article provides advice for those who wish to pass to us information in the safest of ways, without having to do a lot of complicated things.

Why Not Off-the-shelf, Self-contained Secure Software?

Over the past 6 months or so we have looked into various bits of Free/libre software, e.g. Briefkasten (no longer actively maintained, as of 2013) and SecureDrop, which is too big a project (massive also in the source code sense compared to Briefkasten, not to mention difficult to set up). After much effort we decided to settle for something which is simpler to use and is much faster to use. To facilitate leaking of sensitive documents (e.g. evidence of misconduct) we mostly require anonymity, as the content of the material does not — in its own right — do much (if anything) to expose the source.

Typically, whole frameworks are built for distributed and de-centralised leaking. This requires quite a bit of hardware, which in turn needs to be set up and properly configured. It’s complicated for both sides (source and receiver) and it’s usually developed for large teams of journalists, for constant interaction with sources, or a regular flow of material. We do not require something this advanced. In practice, a one-time document drop is usually enough.

Our Proposed Solution

We have decided that the following method would be good enough given the nature of leaks we normally receive. They are typically about technology, rather than some military or surveillance apparatus such as the CIA’s assassination (by drones) programme or the NSA’s mass surveillance programme.

For extra security, we kindly ask people to ensure anonymity/privacy tools are used, notably Tor. Without it, privacy/anonymity cannot be assured to a high degree. It’s possible, but it would not be unbreakable (meaning too great an effort and a challenge for spies to take on).

Establishing a Secure (Anonymous) Session

Follow the following steps, with (1) for extra assurance of anonymity.

  1. Install Tails or prepare a Tails device (e.g. Live CD) to boot on a laptop, in order to simplify session creation with Tor (for those who insist on using Windows we have this guide [PDF]).
  2. Irrespective of (1), seek public wireless/wired access in something like a mall (preferably not a sit-down like a coffee shop, where cameras are operated and situated in a way that makes it easy to track individuals by faces, payment with debit/credit cards and so on). The idea is to seek a place — any place — where it is hard to know the identity of the connected party, even by association (e.g. friend or family). Do not use a portable telephone (these are notoriously not secure and regularly broadcast location).
  3. Refrain from doing any browsing that can help identify patterns or affiliations of the user (e.g. session cookies). In fact, unless Tails is used, it might be worth installing a new browser (Opera for instance) and doing nothing on it prior to the sending of material. This reduces the cookie trail/footprint.

Send the material

Once logged in anonymously, anonymously (do not log in) submit text through Pastebin and take the resultant URL for later pasting. Do not pass PDFs for non-textual material. Instead take shots of them, to reduce/eliminate metadata which is often being passed along with them. Then submit to Anonmgur and make a note of the resultant URL for later pasting.

This is typically a one-way communication channel, so add any context which is necessary, then link to the above material as follows:

  • Log in to the #techrights IRC Channel via the Web browser.
  • Choose a pseudonym and sooner or later we will get around to seeing the new arrival and checking what there is to be said (there are dozens of us there).
  • Drop the link/s in the channel. If someone is on the keyboard at the time, there might even be time for interaction. Do not say anything that can help reveal identity (sometimes the language itself is revealing).

Caveats

While not impenetrable, it would take an enormous amount of effort (and connections in several high places) to unmask a source who follows the steps above. Unless it’s a high-profile political leak, such an unmasking effort would be well beyond what’s worth pursuing (expensive and complicated). MAC address-level spying often assumes access to very high places (and deep into back rooms), so therein lies no significant danger, especially when the best anonymity tools are properly used and the incentive to unmask isn’t great enough at high places (usually the political or military establishments).

Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • del.icio.us
  • Reddit
  • co.mments
  • DZone
  • email
  • Google Bookmarks
  • LinkedIn
  • NewsVine
  • Print
  • Technorati
  • TwitThis
  • Facebook

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

What Else is New


  1. Links 13/12/2018: IRS Migration, GNOME 3.31.3 Released

    Links for the day



  2. Patent Trial and Appeal Board (PTAB) Decisions Still Uncontroversial Unless One Asks the Patent Maximalists

    Contrary to what the Director of the U.S. Patent and Trademark Office has claimed, PTAB is liked by companies that actually create things and opposition to PTAB comes from power brokers of the Koch brothers, law firms, and trolls (including those who foolishly repeat them)



  3. Latest Talk From IBM’s Manny Schecter Shows That IBM Hasn't Changed and After the Red Hat Takeover It'll Continue to Promote Software Patents

    IBM's hardheaded attitude and patent aggression unaffected by its strategic acquisition of a company that at least claimed to oppose software patents (whilst at the same time pursuing them)



  4. The European Patent Troll Wants as Much Litigation as Possible

    Patent quality is a concept no longer recognisable at the European Patent Office; all that the management understands is speed and PACE, which it conflates with quality in order to register as much cash as possible before the whole thing comes crashing down (bubbles always implode at the end)



  5. António Campinos Turns His 'Boss' Into His Lapdog, Just Like Battistelli and Kongstad

    The European Patent Organisation expects us to believe that Josef Kratochvíl will keep the Office honest while his predecessor, the German who failed to do anything about Battistelli's abuses, becomes officially subservient to António Campinos



  6. Links 12/12/2018: Mesa 18.3.1 Released, CNCF Takes Control of etcd

    Links for the day



  7. EPO Trust, Leadership and Commitment

    "Trust, leadership and commitment" is the latest publication from EPO insiders, who in the absence of free speech and freedom of association for the union/representation are an essential spotlight on EPO abuses



  8. Links 11/12/2018: Tails 3.11, New Firefox, FreeBSD 12.0

    Links for the day



  9. Number of Filings at the Patent Trial and Appeal Board (PTAB) Highest in Almost Two Years

    Patent Trial and Appeal Board (PTAB) inter partes reviews (IPRs), which [cref 113718 typically invalidate software patents by citing 35 U.S.C. § 101], are withstanding negative rhetoric and hostility from Iancu



  10. With 'Brexit' in a Lot of Headlines Team UPC Takes the Unitary Patent Lies up a Notch

    Misinformation continues to run like water; people are expected to believe that the UPC, an inherently EU-centric construct, can magically come to fruition in the UK (or in Europe as a whole)



  11. The EPO Not Only Abandoned the EPC But Also the Biotech Directive

    Last week's decision (T1063/18, EPO Technical Board of Appeal 3.3.04) shows that there's still a long way to go before the Office and the Organisation as a whole fulfil their obligation to those who birthed the Organisation in the first placeLast week's decision (T1063/18, EPO Technical Board of Appeal 3.3.04) shows that there's still a long way to go before the Office and the Organisation as a whole fulfil their obligation to those who birthed the Organisation in the first place



  12. Patents on Abstract Things and on Life (or Patents Which Threaten Lives) Merely Threaten the Very Legitimacy of Patent Offices, Including EPO

    Patent Hubris and maximalism pose a threat or a major risk to the very system that they claim to be championing; by reducing the barrier to entry (i.e. introducing low-quality or socially detrimental patents) they merely embolden ardent critics who demand patent systems as a whole be abolished; the EPO is nowadays a leading example of it



  13. Links 10/12/2018: Linux 4.20 RC6 and Git 2.20

    Links for the day



  14. US Courts Make the United States' Patent System Sane Again

    35 U.S.C. § 101 (Section 101), the Patent Trial and Appeal Board (PTAB) and other factors are making the patent system in the US a lot more sane



  15. Today's USPTO Grants a Lot of Fake Patents, Software Patents That Courts Would Invalidate

    The 35 U.S.C. § 101 effect is very much real; patents on abstract/nonphysical ideas get invalidated en masse (in courts/PTAB) and Director Andrei Iancu refuses to pay attention as if he's above the law and court rulings don't apply to him



  16. A Month After Microsoft Claimed Patent 'Truce' Its Patent Trolls Keep Attacking Microsoft's Rivals

    Microsoft's legal department relies on its vultures (to whom it passes money and patents) to sue its rivals; but other than that, Microsoft is a wonderful company!



  17. Good News: US Supreme Court Rejects Efforts to Revisit Alice, Most Software Patents to Remain Worthless

    35 U.S.C. § 101 will likely remain in tact for a long time to come; courts have come to grips with the status quo, as even the Federal Circuit approves the large majority of invalidations by the Patent Trial and Appeal Board’s (PTAB) panels, initiated by inter partes reviews (IPRs)



  18. Florian Müller's Article About SEPs and the EPO

    Report from the court in Munich, where the EPO is based



  19. EPO Vice-President Željko Topić in New Article About Corruption in Croatia

    The Croatian newspaper 7Dnevno has an outline of what Željko Topić has done in Croatia and in the EPO in Munich; it argues that this seriously erodes Croatia's national brand/identity



  20. The Quality of European Patents Continues to Deteriorate Under António Campinos and Software Patents Are Advocated Every Day

    The EPC in the European Patent Office and 35 U.S.C. § 101 in the USPTO annul most if not all software patents; under António Campinos, however, software patents are being granted in Europe and the USPTO exploits similar tricks



  21. Team UPC is Still Spreading False Rumours in an Effort to Trick Politicians and Pressure Judges

    Abuses at the European Patent Office, political turmoil and an obvious legislative coup by a self-serving occupation that produces nothing have already doomed the Unitary Patent or Unified Patent Court (UPC); so now we deal with complete fabrications from Team UPC as they're struggling to make something out of nothing, anonymously smearing opposition to the UPC and anonymously making stuff up



  22. Patents on Life and Patents That Kill the Poor Would Only Delegitimise the European Patent Office

    After Mayo, Myriad and other SCOTUS cases (the basis of 35 U.S.C. § 101) the U.S. Patent and Trademark Office is reluctant to grant patents on life; the European Patent Office (EPO), however, goes in the opposite direction, even in defiance of the European Patent Convention



  23. EPO 'Untapped Potential'

    "Campinos is diligently looking for ways to further increase the Office’s output without increasing the number of examiners," says the EPO-FLIER team



  24. Links 9/12/2018: New Linux Stable Releases (Notably Linux 4.19.8), RC Coming, and Unifont 11.0.03

    Links for the day



  25. Links 8/12/2018: Mesa 18.3.0, Mageia 7 Beta, WordPress 5.0

    Links for the day



  26. The European Patent Organisation is Like a Private Club and Roland Grossenbacher is Back in It

    In the absence of Benoît Battistelli quality control at the EPO is still not effective; patents are being granted like the sole goal is to increase so-called 'production' (or profit), appeals are being subjected to threats from Office management, and external courts (courts that assess patents outside the jurisdiction of the Office/Organisation) are being targeted with a long-sought replacement like the Unified Patent Court, or UPC (Unitary Patent)



  27. Links 7/12/2018: GNU Guix, GuixSD 0.16.0, GCC 7.4, PHP 7.3.0 Released

    Links for the day



  28. The Federal Circuit's Decision on Ancora Technologies v HTC America is the Rare Exception, Not the Norm

    Even though the PTAB does not automatically reject every patent when 35 U.S.C. § 101 gets invoked we're supposed to think that somehow things are changing in favour of patent maximalists; but all they do is obsess over something old (as old as a month ago) and hardly controversial



  29. The European Patent Office Remains a Lawless Place Where Judges Are Afraid of the Banker in Chief

    With the former banker Campinos replacing the politician Battistelli and seeking to have far more powers it would be insane for the German Constitutional Court to ever allow anything remotely like the UPC; sites that are sponsored by Team UPC, however, try to influence outcomes, pushing patent maximalism and diminishing the role of patent judges



  30. Many of the Same People Are Still in Charge of the European Patent Office Even Though They Broke the Law

    "EPO’s art collection honoured with award," the EPO writes, choosing to distract from what actually goes on at the Office and has never been properly dealt with


CoPilotCo

RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

CoPilotCo

Recent Posts