EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

10.25.15

How to Securely Provide Techrights With Information, Documents

Posted in Site News at 6:35 am by Dr. Roy Schestowitz

The key is anonymity

A lock

Summary: Advice for potential whistleblowers, or sources with evidence of abuse that they wish to anonymously share with the world (via Techrights)

OVER the years Techrights has received critical information from dozens of sources, all of which remained safe (unexposed). But this does not mean that all of them did this safely. This article provides advice for those who wish to pass to us information in the safest of ways, without having to do a lot of complicated things.

Why Not Off-the-shelf, Self-contained Secure Software?

Over the past 6 months or so we have looked into various bits of Free/libre software, e.g. Briefkasten (no longer actively maintained, as of 2013) and SecureDrop, which is too big a project (massive also in the source code sense compared to Briefkasten, not to mention difficult to set up). After much effort we decided to settle for something which is simpler to use and is much faster to use. To facilitate leaking of sensitive documents (e.g. evidence of misconduct) we mostly require anonymity, as the content of the material does not — in its own right — do much (if anything) to expose the source.

Typically, whole frameworks are built for distributed and de-centralised leaking. This requires quite a bit of hardware, which in turn needs to be set up and properly configured. It’s complicated for both sides (source and receiver) and it’s usually developed for large teams of journalists, for constant interaction with sources, or a regular flow of material. We do not require something this advanced. In practice, a one-time document drop is usually enough.

Our Proposed Solution

We have decided that the following method would be good enough given the nature of leaks we normally receive. They are typically about technology, rather than some military or surveillance apparatus such as the CIA’s assassination (by drones) programme or the NSA’s mass surveillance programme.

For extra security, we kindly ask people to ensure anonymity/privacy tools are used, notably Tor. Without it, privacy/anonymity cannot be assured to a high degree. It’s possible, but it would not be unbreakable (meaning too great an effort and a challenge for spies to take on).

Establishing a Secure (Anonymous) Session

Follow the following steps, with (1) for extra assurance of anonymity.

  1. Install Tails or prepare a Tails device (e.g. Live CD) to boot on a laptop, in order to simplify session creation with Tor (for those who insist on using Windows we have this guide [PDF]).
  2. Irrespective of (1), seek public wireless/wired access in something like a mall (preferably not a sit-down like a coffee shop, where cameras are operated and situated in a way that makes it easy to track individuals by faces, payment with debit/credit cards and so on). The idea is to seek a place — any place — where it is hard to know the identity of the connected party, even by association (e.g. friend or family). Do not use a portable telephone (these are notoriously not secure and regularly broadcast location).
  3. Refrain from doing any browsing that can help identify patterns or affiliations of the user (e.g. session cookies). In fact, unless Tails is used, it might be worth installing a new browser (Opera for instance) and doing nothing on it prior to the sending of material. This reduces the cookie trail/footprint.

Send the material

Once logged in anonymously, anonymously (do not log in) submit text through Pastebin and take the resultant URL for later pasting. Do not pass PDFs for non-textual material. Instead take shots of them, to reduce/eliminate metadata which is often being passed along with them. Then submit to Anonmgur and make a note of the resultant URL for later pasting.

This is typically a one-way communication channel, so add any context which is necessary, then link to the above material as follows:

  • Log in to the #techrights IRC Channel via the Web browser.
  • Choose a pseudonym and sooner or later we will get around to seeing the new arrival and checking what there is to be said (there are dozens of us there).
  • Drop the link/s in the channel. If someone is on the keyboard at the time, there might even be time for interaction. Do not say anything that can help reveal identity (sometimes the language itself is revealing).

Caveats

While not impenetrable, it would take an enormous amount of effort (and connections in several high places) to unmask a source who follows the steps above. Unless it’s a high-profile political leak, such an unmasking effort would be well beyond what’s worth pursuing (expensive and complicated). MAC address-level spying often assumes access to very high places (and deep into back rooms), so therein lies no significant danger, especially when the best anonymity tools are properly used and the incentive to unmask isn’t great enough at high places (usually the political or military establishments).

Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • del.icio.us
  • Reddit
  • co.mments
  • DZone
  • email
  • Google Bookmarks
  • LinkedIn
  • NewsVine
  • Print
  • Technorati
  • TwitThis
  • Facebook

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

What Else is New


  1. Links 19/6/2019: Linux Mint Vs Vista 10, Qt 5.13 Released

    Links for the day



  2. The Linux Foundation's Business Model

    The Linux Foundation's plan, illustrated



  3. Links 18/6/2019: i386 Abandoned by Canonical and a New osquery 'Community'

    Links for the day



  4. Indifference or Even Hostility Towards Patent Quality Results in Grave Injustice

    The patent extravaganza in Europe harms small businesses the most (they complain about it), but administrative staff at patent offices only cares about the views of prolific applicants rather than the interests of citizens in respective countries



  5. Links 18/6/2019: CentOS 8 Coming Soon, DragonFly BSD 5.6 Released

    Links for the day



  6. 'AI Taskforce' is Actually a Taskforce for Software Patents

    The mainstream media has been calling just about everything "HEY HI!" (AI), but what it typically refers to is a family of old algorithms being applied in possibly new areas; patent maximalists in eastern Asia and the West hope that this mainstream media's obsession can be leveraged to justify new kinds of patents on code



  7. Patent Maximalism is Dead in the United States

    Last-ditch efforts, or a desperate final attempt to water down 35 U.S.C. § 101, isn't succeeding; stacked panels are seen for what they really are and 35 U.S.C. § 101 isn't expected to change



  8. Links 18/6/2019: Linux 5.2 RC5 and OpenMandriva Lx 4

    Links for the day



  9. Weaponising Russophobia Against One's Critics

    Response to smears and various whispering campaigns whose sole purpose is to deplete the support base for particular causes and people; these sorts of things have gotten out of control in recent years



  10. When the EPO is Run by Politicians It's Expected to Be Aggressive and Corrupt Like Purely Political Establishments

    António 'Photo Op' Campinos will have marked his one-year anniversary in July; he has failed to demonstrate morality, respect for the law, understanding of the sciences, leadership by example and even the most basic honesty (he lies a lot)



  11. Links 16/6/2019: Tmax OS and New Features for KDE.org

    Links for the day



  12. Stuffed/Stacked Panels Sent Back Packing After One-Sided Patent Hearings That Will Convince Nobody, Just Preach to the Choir

    Almost a week ago the 'world tour' of patent lobbyists in US Senate finally ended; it was an utterly ridiculous case study in panel stacking and bribery (attempts to buy laws)



  13. 2019 H1: American Software Patents Are as Worthless as They Were Last Year and Still Susceptible to Invalidation

    With a fortnight left before the second half of the year it seems evident that software patents aren't coming back; the courts have not changed their position at all



  14. As European Patent Office Management Covers up Collapse in Patent Quality Don't Expect UPC to Ever Kick Off

    It would be madness to allow EPO-granted patents to become 'unitary' (bypassing sovereignty of nations that actually still value patent quality); it seems clear that rogue EPO management has, in effect, not only doomed UPC ambitions but also European Patents (or their perceived legitimacy, presumption of validity)



  15. António Campinos -- Unlike His Father -- Engages in Imperialism (Using Invalid Patents)

    Despite some similarities to his father (not positive similarities), António Campinos is actively engaged in imperialistic agenda that defies even European law; the EPO not only illegally grants patents but also urges other patent offices to do the same



  16. António Campinos Takes EPO Waste and Corruption to Unprecedented Levels and Scale

    The “B” word (billions) is thrown around at Europe’s second-largest institution because a mischievous former EUIPO chief (not Archambeau) is ‘partying’ with about half of the EPO’s all-time savings, which are supposed to be reserved for pensions and other vital programmes, not presidential palaces and gambling



  17. Links 15/6/2019: Astra Linux in Russia, FreeBSD 11.3 RC

    Links for the day



  18. Code of Conduct Explained: Partial Transcript - August 10th, 2018 - Episode 80, The Truth About Southeast Linuxfest

    "Ask Noah" and the debate on how a 'Code of Conduct' is forcibly imposed on events



  19. Links 14/6/2019: Xfce-Related Releases, PHP 7.4.0 Alpha

    Links for the day



  20. The EPO is a Patent Troll's Wet Dream

    The makers of software and games in Europe will have to spend a lot of money just keeping patent trolls off their backs — a fact that seems to never bother EPO management because it profits from it



  21. EPO Spreading Patent Extremists' Ideology to the Whole World, Now to South Korea

    The EPO’s footprint around the world's patent systems is an exceptionally dangerous one; The EPO amplifies the most zealous voices of the patents and litigation ‘industry’ while totally ignoring the views and interests of the European public, rendering the EPO an ‘agent of corporate occupation’



  22. Guest Post: Notes on Free Speech, and a Line in the Sand

    We received this anonymous letter and have published it as a follow-up to "Reader's Claim That Rules Similar to the Code of Conduct (CoC) Were 'Imposed' on LibrePlanet and the FSF"



  23. Links 13/6/2019: CERN Dumps Microsoft, GIMP 2.10.12 Released

    Links for the day



  24. Links 12/6/2019: Mesa 19.1.0, KDE neon 5.16, Endless OS 3.6.0 and BackBox Linux 6

    Links for the day



  25. Leaked Financial 'Study' Document Shows EPO Management and Mercer Engaging in an Elaborate “Hoax”

    How the European Patent Office (EPO) lies to its own staff to harm that staff; thankfully, the staff isn't easily fooled and this whole affair will merely obliterate any remnants of "benefit of the doubt" the President thus far enjoyed



  26. Measuring Patent Quality and Employer Quality in Europe

    Comparing the once-famous and respected EPO to today's joke of an office, which grants loads of bogus patents on just about anything including fruit and mathematics



  27. Granting More Fundamentally Wrong Patents Will Mean Reduced Certainty, Not Increased Certainty

    Law firms that are accustomed to making money from low-quality and abstract patents try to overcome barriers by bribing politicians; this will backfire because they show sheer disregard for the patent system's integrity and merely lower the legal certainty associated with granted (by greedy offices) patents



  28. Links 11/6/2019: Wine 4.10, Plasma 5.16

    Links for the day



  29. Chapter 10: Moving Forward -- Getting the Best Results From Open Source With Your Monopoly

    “the gradual shift in public consciousness from their branding towards our own, is the next best thing to owning them outright.”



  30. Chapter 9: Ownership Through Branding -- Change the Names, and Change the World

    The goal for those fighting against Open source, against the true openness (let's call it the yet unexploited opportunities) of Open source, has to be first to figuratively own the Linux brand, then literally own or destroy the brand, then to move the public awareness of the Linux brand to something like Azure, or whatever IBM is going to do with Red Hat.


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts