Nieman Foundation at Harvard
The Guardian has launched a new system for anonymous sources to send confidential documents to the newspaper. SecureDrop, which uses privacy software from Tor, will let users provide The Guardian with files and avoid being tracked online.
The Guardian joins The New Yorker, ProPublica, and The Intercept in using the system as a secure method of receiving information from whistleblowers. SecureDrop was originally created by Aaron Swartz prior to his death in 2013. It’s now maintained by the Freedom of the Press Foundation.
As one of the initial news organizations to report on the leaked National Security Administration files from Edward Snowden, The Guardian hopes to find a way to let confidential information flow to the paper while protecting sources and journalists.
Because of its reporting on the NSA, The Guardian already relocated files from Snowden to the United States; the SecureDrop system is also located outside of the U.K. In 2013, the British government forced Guardian editors to physically destroy computers with documents from Snowden.Even as more newsrooms use SecureDrop as a tool for tips and leaked files, the system doesn’t promise complete security, The Guardian notes:
SecureDrop was given an extensive security audit by a team of cryptographers in July 2013, and updated in response to many of the concerns raised at the time. The system was also updated to address the widely reported Heartbleed security vulnerability.
While the system is far more secure than, for example, emailing information to a reporter, SecureDrop specifically does not promise 100% security.
“[A]ny organization or product that promises 100% security is not telling the truth,” says the Freedom of the Press Foundation website. “SecureDrop attempts to create [a] significantly more secure environment for sources to get information than exists through normal digital channels, but there are always risks.”
One comment:
Tor offers a lot of anonymity but it’s critical that you understand how Tor anonymity works. Your traffic is routed through three random hops that strip your info and the weak link in the equation has always been from the last relay to your target site. If you use https everywhere (a great extension from EFF) then you pretty much have all the anonymity you can ask for. Now for some landmines…. You need to be careful about leaving breadcrumb trails. The busting of the Silk Road founder was a failure of the human and not the technology. It’s probably best to never do any kind of authentication if you can, or use user names that are similar on Tor and non Tor networks. Also be wary of the browser bundle from Tor. This bundle is the subject of special interest by FBI and they are constantly trying to exploit whatever version of Firefox that it uses and was recently successful. If you want to get on Tor you can always do it the easy way by using a router that has Tor embedded in it. I recommend PAPARouter (http://paparouter.com) because it’s inexpensive (less than $100.00), allows you to anonymize several devices at once and best of all it has non U.S. exit nodes hard coded into it . Given all the uproar that other countries are having with U.S. spying, making your last Tor relay outside of the U.S. to your target site is great security and using https would be massive protection. TOR AND HTTPS PAGE https://www.eff.org/pages/tor-and-https FBI exploit using Firefox Bundle http://arstechnica.com/security/2013/08/attackers-wield-firefox-exploit-to-uncloak-anonymous-tor-users/
Trackbacks:
Leave a comment