Bonum Certa Men Certa

How to Securely Provide Techrights With Information, Documents

The key is anonymity

A lock



Summary: Advice for potential whistleblowers, or sources with evidence of abuse that they wish to anonymously share with the world (via Techrights)

OVER the years Techrights has received critical information from dozens of sources, all of which remained safe (unexposed). But this does not mean that all of them did this safely. This article provides advice for those who wish to pass to us information in the safest of ways, without having to do a lot of complicated things.



Why Not Off-the-shelf, Self-contained Secure Software?



Over the past 6 months or so we have looked into various bits of Free/libre software, e.g. Briefkasten (no longer actively maintained, as of 2013) and SecureDrop, which is too big a project (massive also in the source code sense compared to Briefkasten, not to mention difficult to set up). After much effort we decided to settle for something which is simpler to use and is much faster to use. To facilitate leaking of sensitive documents (e.g. evidence of misconduct) we mostly require anonymity, as the content of the material does not -- in its own right -- do much (if anything) to expose the source.

Typically, whole frameworks are built for distributed and de-centralised leaking. This requires quite a bit of hardware, which in turn needs to be set up and properly configured. It's complicated for both sides (source and receiver) and it's usually developed for large teams of journalists, for constant interaction with sources, or a regular flow of material. We do not require something this advanced. In practice, a one-time document drop is usually enough.

Our Proposed Solution



We have decided that the following method would be good enough given the nature of leaks we normally receive. They are typically about technology, rather than some military or surveillance apparatus such as the CIA's assassination (by drones) programme or the NSA's mass surveillance programme.

For extra security, we kindly ask people to ensure anonymity/privacy tools are used, notably Tor. Without it, privacy/anonymity cannot be assured to a high degree. It's possible, but it would not be unbreakable (meaning too great an effort and a challenge for spies to take on).

Establishing a Secure (Anonymous) Session



Follow the following steps, with (1) for extra assurance of anonymity.

  1. Install Tails or prepare a Tails device (e.g. Live CD) to boot on a laptop, in order to simplify session creation with Tor (for those who insist on using Windows we have this guide [PDF]).
  2. Irrespective of (1), seek public wireless/wired access in something like a mall (preferably not a sit-down like a coffee shop, where cameras are operated and situated in a way that makes it easy to track individuals by faces, payment with debit/credit cards and so on). The idea is to seek a place -- any place -- where it is hard to know the identity of the connected party, even by association (e.g. friend or family). Do not use a portable telephone (these are notoriously not secure and regularly broadcast location).
  3. Refrain from doing any browsing that can help identify patterns or affiliations of the user (e.g. session cookies). In fact, unless Tails is used, it might be worth installing a new browser (Opera for instance) and doing nothing on it prior to the sending of material. This reduces the cookie trail/footprint.


Send the material



Once logged in anonymously, anonymously (do not log in) submit text through Pastebin and take the resultant URL for later pasting. Do not pass PDFs for non-textual material. Instead take shots of them, to reduce/eliminate metadata which is often being passed along with them. Then submit to Anonmgur and make a note of the resultant URL for later pasting.

This is typically a one-way communication channel, so add any context which is necessary, then link to the above material as follows:



Caveats



While not impenetrable, it would take an enormous amount of effort (and connections in several high places) to unmask a source who follows the steps above. Unless it's a high-profile political leak, such an unmasking effort would be well beyond what's worth pursuing (expensive and complicated). MAC address-level spying often assumes access to very high places (and deep into back rooms), so therein lies no significant danger, especially when the best anonymity tools are properly used and the incentive to unmask isn't great enough at high places (usually the political or military establishments).

Recent Techrights' Posts

Weaponisation of For-Profit Dockets - Part I: Hiding Behind Lawyers (or Guns for Hire) After Abusing Many People and Even Strangling Women While Microsoft Paid Salaries
This whole thing is very typical of the Microsoft and Bill Gates mindset
From EPO to "MAGA Regime": A Shift Away From Reality to Fake News and False Metrics
Disbelief in itself isn't a bad thing; but the problem is that people are taught to believe rich people in suits more than they believe others
Skype is Officially Dead Today and This is Why People Should Use Free Software Instead (Goodbye, Microsoft)
It's also a good reminder of why people should move to GNU/Linux
'Simple Articles' in MyGemini Just One of Many New 'Sites' in Geminispace
Geminispace has grown fast lately; it's turning 6 next month
 
Making Site Archives More Easily Accessible (Approaching 50,000 Blog Posts)
Efforts to censor us have always backfired badly
Weaponisation of For-Profit Dockets - Part II: Hiding Behind Lawyers and Barristers Who Lack Standards so as to Engage in Classic Corporate Extortion
They're trying to scare people and they misuse their licence to operate
Links 06/05/2025: LLMs/Chatbots Attract More Scrutiny (Getting Worse Over Time), PwC Has Many Layoffs
Links for the day
Thanks for listening. How can this Morse feed be further improved?
Right now any and all feedback on the audio would be helpful
statCounter: Bing's Market Share Lower Right Now Than It Was When LLM Hype Began (With "Bing Chat")
If anybody gains at Google's expense in search, it is BRICS' alternatives such as Yandex
Gemini Links 06/05/2025: Failure and Proxmox Cluster
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Monday, May 05, 2025
IRC logs for Monday, May 05, 2025
Links 05/05/2025: TikTok Still a Romanian Woe/Foe, Signal Perils Showing
Links for the day
Gemini Links 05/05/2025: Debian and GNOME and a "Welcome to Simple Articles"
Links for the day
Links 05/05/2025: US Economy Shrinks, US Presidency Spreading Deepfakes
Links for the day
Links 05/05/2025: Breaches, Environment, and Conflicts
Links for the day
SUSE the Company Now Uses LLM Slop to 'Write' Its Blog, What Does That Tell Us About SUSE?
There are many giveaways
Richard Stallman is in Alicante Today to Give a Talk, Czech Republic in Two Days (Wednesday)
Of course he can deliver the talk in Spanish
Gemini Links 05/05/2025: XL Bullies and Luddites
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Sunday, May 04, 2025
IRC logs for Sunday, May 04, 2025
Links 04/05/2025: Science, Conflicts, and Monopolies
Links for the day
GNU/Linux Above 7% in Bulgaria, Rising Just Like in Most of Europe
Up to 7%, not counting Chromebooks
Data Shows Largest EU Economies Shifting to GNU/Linux
all-time highs
statCounter Says Only One in 6 Web-Connected Clients in Hungary Are Using Windows, iOS Almost Bigger Than Windows Now
Hungary is a cautionary tale in the world of European (or Russian) politics
Many Reports About Microsoft's Financial Report/Performance Are False, Fake News, Churnalism/Parroting, and LLM Slop (Machine-Generated Lies)
Even if you see a thousand sites saying that Microsoft is performing well ask yourself why the company is rushing to fire tens of thousands of workers and cancelling datacentres
Links 04/05/2025: FCC Turning Into MAGA’s Censoring Machine, SEC Pressured to Delist Chinese Companies
Links for the day
Gemini Links 04/05/2025: Historical Artifacts and Date Calculations in POSIX Shell
Links for the day
In the First 3 Months of 2025 GAFAM Debt Rose by More Than $14.4 Billion
That's based on their official statements
10-Step Strategy to Get BRETT WILSON LLP ("Gun for Hire"), Microsoft's Serial Strangler, and the Serial Defamer to Compensate Techrights and Tux Machines for Years of SLAPPs and Abusive Litigation
There's no room or capacity for forgiveness here; enablers and protectors of crime need to be scuttled and pay up in full
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Saturday, May 03, 2025
IRC logs for Saturday, May 03, 2025