15 ms·
How to leak to the press
- mdrzn 10y agoI had no idea all the major news sites had an .onion Secure Drop website. I wonder how many leaked news they receive per year.
- jeron 10y agoprobably a lot but few are headline grabbers, afaik the biggest leak of last year was the Panama Papers and the guy didn't really use these Secure Drop links because he had like several TBs of information
- CM30 10y agoThey likely receive a lot of leaked news items a year. However, the vast majority are either: 1. Completely fake, because someone on 4chan/Reddit/an internet forum/social media wanted to see how many journalists they could prank with false information. 2. Uninteresting or pointless to write about, since they don't describe newsworthy stories. So the amount of actual, legitimate leaked news stories they receive a year is likely a lot less than the amount of stories they receive through these systems in total.
- MrZongle2 10y agoI'd also offer: 3. Somewhat interesting and likely legitimate, but doesn't support any narrative the editor(s) or owner(s) wish to promote.
- euyyn 10y agoThere are media outlets all over the political space, so it's just a matter of dropping your stuff to the ones that are interested.
- bdrool 10y agoYes, but since everyone is super-polarized these days and only listens to "news" outlets pushing narratives they already agree with, that means no one hears it who needs to. It's very hard to get a story to get widespread attention.
- brotherjerky 10y ago> Leakers shouldn’t use their work computers and should use public wifi, “like a Starbucks or at a hotel or anywhere where the Internet is open for public use.” Lately there seem to be very few completely open wifi points. Most of them at least require some click through for agreeing to terms. Is there any risk involved here?
- stuckagain 10y agoAll of the ones with click thru terms of service are logging your MAC too. My personal favorite open wifi service is the one on Amtrak, and you can buy a paper ticket with cash. Pretty anonymous.
- bbrazil 10y agoAny AP knows your MAC, as that's the basis of how Ethernet works.
- pimlottc 10y agoChanging your MAC address is possible on most operating systems, if you're at that level of paranoia.
- noir_lord 10y agoIf you where leaking a document that involved the NSA/GCHQ I'm not sure it would be paranoia or that there is a sufficient level of paranoia. They aren't Godlike but I'll admit the Snowden revelations surprised me and I'd been following that stuff for years.
- Spivak 10y agoAnd there's nothing special about your MAC, changing your address is as easy as editing a single setting.
- stuckagain 10y agoYes thanks. The point is those click-thru landing pages work by temporarily whitelisting your MAC, which means they have a list of MACs somewhere. The MAC information needed by ordinary networks is ephemeral.
- stuckagain 10y agoSo much more to opsec than using tor. I hope leakers are either ready to be unmasked, or have countermeasures against things like document fingerprinting.
- deleted 10y ago[deleted]
- Bamberg 10y agoyes, the steps detailed in the post are likely not enough to evade being caught if a large intel agency is looking for a leaker. it very probably will be enough to prevent detection before the materials are published, but not necessarily afterwards when authorities start looking for a leaker.
- alva 10y agoThis piece is so incredibly irresponsible. If someone uses this to leak truly important information, they should not be surprised to quickly receive knock on the door and a dark cell. There are many people in a position to leak things who are not involved in technology and may believe these steps as adequate for their protection.
- mcherm 10y ago> This piece is so incredibly irresponsible. Perhaps. Can you write a better one?
- alva 10y agoNo I can't. But if I had wrote this piece I would slap an absolutely massive disclaimer at the top warning leakers-to-be that these steps alone are very far from properly protecting yourself.
- verytrivial 10y agoI think that is overstating it. If you compare doing this to simply emailing en clair from a personal or work computer is it significantly more secure. If the leaker is already under close physical or technical surveillance there is very little they can do about it.
- rc_bhg 10y agoDoes Fox News or CNN accept leaks? I feel like having a secure way to accept leaks is a sign of a good news org.
- komali2 10y agoFr.a business standpoint, they'd be stupid not to. A good leak could mean an exclusive.
- btilly 10y agoHow long until someone on the Trump side starts sending spam to all of these addresses? They can't block it, but good luck finding real signal in millions of requests. Or, more subtly, deliberately leaking easily discredited stuff. Once it gets published, it becomes a propaganda target. As a great example, consider how Dan Rather was taken down by https://en.wikipedia.org/wiki/Killian_documents_controversy https://en.wikipedia.org/wiki/Killian_documents_controversy. Planting a perfect smoking gun was enough to bring down Dan Rather and make the story of how Bush got his draft deferment toxic in the media. The ultimate irony there is that the story that Dan Rather reported was actually true. It had all been reported in The Guardian by Greg Palast, and Dan Rather had started with access to his research. It didn't matter, planting perfect fraudulent documents managed to discredit it.
- anc84 10y agoWhy the Trump side? Did you not notice what the Obama side did to Manning and Snowden, just to name two leakers?
- TheShadowRunner 10y agoObama (for the most part) went after National Security leakers, IIRC. Trump seems to be going after any federal agency that does not pursue goals that he wants.
- cmdrfred 10y agoTo keep this in context the "National Security leakers" leaked data about the Orwellian surveillance state he created and journalists that were murdered by US armed forces.
- btilly 10y agoActually the Orwellian surveillance state was mostly created by Bush. Obama only inherited and expanded it. (And now Trump looks like he wants to USE it...)
- 10y ago
- pweissbrod 10y agoIf youre one of the vast minority of internet users happening to be using Tor this stands out like a sore thumb from any party monitoring network activity. Not to mention many of the direct nodes are possible to be your would-be adversary. I hope users of this approach understand the risks involved. Tor seems deceivingly plug-and-play to the less technical crowd
- olivierlacan 10y agoThe very fact that an organization like the Nieman Foundation can publish something like this article without first having the good sense of enabling required TLS on their website is frighteningly careless. Anyone from governmental agencies who read this article at home or work can now fairly easily be targeted by the relevant surveillance agencies.
- exhilaration 10y agoI'm confused, what would TLS do? The surveillance agencies can log an HTTPS URL as easily as an HTTP URL, they don't need to see the contents to see that you requested it.
- hackcasual 10y agoThey can log the domain you connected to, not the URL you visited
- jvdh 10y agoAlthough with most TLS implementations they will see the size of your transfers, thus still giving away which URL you visited....
- mi100hael 10y agoIdea: HTTP server module that appends a minimal amount of hidden random garbage data (as a comment or similar) to each response so no two responses have the same fingerprint.
- moonlighter 10y agouser btown answered that elsewhere here in this thread: "https://github.com/technion/mod_randpad https://github.com/technion/mod_randpad (an Nginx module that injects padding as a comment into returned HTML documents) is likely the correct layer to add random padding; the performance hit would be negligible."
- timdorr 10y agoI'm curious: Is any effort made in SecureDrop to detect or scrub identifiable headers or metadata from files? I understand the trust issue is generally with the source, but I could see an identity being leaked via a blob of metadata with a name in it.
- relieferator 10y agoNew law - every computer / keyboard must now contain (already has??) a keylogger.
- wuschel 10y agoSource? Side comment/question: Depending on your operating system, perhaps?
- pimlottc 10y agoHow does site authentication work in Onion world? With those unrecognizable URLs, it seems like it'd be easy to set up a phishing site that leaks the whistleblower's identity.
- jvdh 10y ago.onion addresses are like a public key. The server needs to have a private key. Vanity addresses, ones that have a name at the beginning, require some processing in order to find the right public key.
- caseysoftware 10y agoEven the NYTimes has admitted the "omg gagged scientists!" line is standard operating procedure with new Administrations: > “I’ve lived through many transitions, and I don’t think this is a story,” said a senior E.P.A. career official who spoke on the condition of anonymity because he was not authorized to speak to the news media on the matter. “I don’t think it’s fair to call it a gag order. This is standard practice. And the move with regard to the grants, when a new administration comes in, you run things by them before you update the website.” https://www.nytimes.com/2017/01/25/us/politics/some-agencies-told-to-halt-communications-as-trump-administration-moves-in.html https://www.nytimes.com/2017/01/25/us/politics/some-agencies... Try to save some of your outrage for actual outrageous events.
- eplanit 10y agoThis x1000. Beware "outrage fatigue". It has only been a week and it's already exhausting.
- jjawssd 10y agoI'm surprised we haven't reached Peak Outrage yet. Lots of outrage stamina.
- ethbro 10y agoI dunno, today's BBC had 'US may drop Russian sanctions in exchange for cooperation against terrorism' front and center. Outrage exhaustion is easy to create, but it doesn't mean outrageous things aren't still outrageous.
- j2kun 10y agoI, for one, am using this as an excuse to teach everyone I can about encryption. So I'm willing to live with the faux outrage.
- caseysoftware 10y agoSo why did you wait until now?
- rwmj 10y agoIs using a PDF a good idea? I imagine that it'll contain loads of interesting metadata which might be related back to your computer at some later date.
- problems 10y agoMost formats are bad for this honestly. Most of the MS Office formats have lots of metadata. Printing them to PDFs might actually do a decent job to strip that data. You might have to make sure your PDF printer doesn't add additional metadata though. Of course, proving authenticity in such a case is a necessity too, no journalist wants to be responsible for publishing fake leaks.
- mirimir 10y agoWell, there's http://www.sno.phy.queensu.ca/~phil/exiftool http://www.sno.phy.queensu.ca/~phil/exiftool :)
- matthewhall 10y agoWho da thunk, this is blocked at my school
- brak1 10y ago>"Leakers shouldn’t use their work computers and should use public wifi, “like a Starbucks or at a hotel or anywhere where the Internet is open for public use.”" Hotels can normally link a computer on their network to a room number... Suggesting they use a hotel wifi isn't a good idea IMO (unless you are not actually a guest, and its just an open public wifi network).
- euyyn 10y agoMany hotels have open WiFi in their lobbies, for convenience.
- nthompson 10y agoThis reminds me of the Eldo Kim bomb threat: https://www.schneier.com/blog/archives/2013/12/tor_user_identi.html https://www.schneier.com/blog/archives/2013/12/tor_user_iden... I guess the guy was the only one on the network using tor, making him easy to identify. So unless tor gets a huge userbase in DC, it seems like an encrypted url would be safer. (I don't know much about tor; am I wrong?) Everyone reads WaPo; no suspicion getting on that site. But I think the main difficulty in becoming a leaker is that you have to hide your mental evolution as you decide to become a leaker. By expressing your dissatisfaction to your colleagues before you decide to leak, you make yourself a suspect post-leak. Leakers should be aware that traditional investigative mechanisms are very powerful, and even if the crypto is rock solid, it is still very likely they'll be caught. It's then a question of whether they are willing to 'take one for the team'.
- crb002 10y agoSSH tunnel to a bitcoin paid server, connect from there. That's how the tool sending me threatening pictures of my house operated. Fortunately his opsec sucked and he scoped me out on LinkedIn with an account under the same pseudonym of Mr. "Dendler". One email to LinkedIn to make a backup of his account in case a subpoena was needed and he stoped immediately. Must have connected to them with a traceable means.
- iamatworknow 10y agoThat seems pretty drastic (sending photos of your house). Mind if I ask why you were targeted? For what it's worth when I was a young jerkoff in college I was spamming on some forums and pissed off a guy who later sent me my college address. I got his IP from the forum, tracked down his ISP, and messaged them and the FBI about it along with the threatening chat logs and never heard from him again. Not that I think they took real action, but it was some script kiddie I wanted to set straight with the threat of real consequences. This was back around 2004 or 2005 when things were a bit more loose in terms of encryption and privacy online.
- strathmeyer 10y ago
- toehead2000 10y ago2001-2008: Dissent is the highest form of patriotism 2009-2016: Dissent is racist 2017- : Dissent is the highest form of patriotism
- EekSnakePond 10y agoI'll be looking forward to using these techniques in OP against a future pro-DNC government. Also, it is against HN policy to make apparent the implied political subtext of a post. Please report to the downvote chamber for punishment. EDIT: Looks like I'll be meeting you there, too.
- ncallaway 10y ago> 2009-2016: Dissent is racist Dunno what you're talking about. Plenty of people on these forums have been strongly dissenting about the Obama administrations attitude toward a free and open internet, government surveillance, and drone policy. I've never been accused of racism for dissenting against Obama or his administration.
- learc83 10y agoThe hypocrisy from the right was just a bit more blatant if I remember correctly. 2001-2008: Respect the President even if you disagree with him. 2009-2016: Obummer is a Kenyan Muslim dictator. 2017- : Respect the President even if you disagree with him.
- berry_sortoro 10y ago2009-2016: Dissent is racist. Totally agree with you on that one. The others not so much. But you already got it HN is PC, echo chamber crowd. Maybe not so much as elsewhere but in its core you will see the PC levels are pretty high here. I bet most of those were pro Killary.
- joshuaNathaniel 10y agoThis isn't an option for anyone in the IC. Glad 4chan trolls have somewhere to drop bullshit though.
- iamatworknow 10y agoThis may be a dumb question, but why not just use the post office?
- mikeyouse 10y agoThe Panama Papers were 11.5 million documents that were leaked all at once -- If a piece of paper is .1mm thick, that stack would be 1.15km tall. If a single piece of copy paper weighs 5 grams, double-sided printing 11.5 million documents would produce a stack that weighs almost 30 metric tons. Point taken though, one of the bigger stories of the campaign was the billion dollar loss that Trump claimed on his taxes in the mid-1990s. That came to WaPo and NYtimes via USPS and just landed in their mailboxes.
- iamatworknow 10y agoCouldn't one take that many documents and throw them on a flash drive (or even a hard drive if it's on the order of terabytes) and mail that? I'm certainly no security expert but wouldn't the risk in terms of using the drive/files to identify you be about the same for mailed physical media compared to it being sent electronically, but with decreased risk of interception along the way?
- dredmorbius 10y agoCDs, DVDs, BluRay, flash drives, and hard drives are all mailable. Panama Papers did in fact arrive on a HD IIRC.
- NoGravitas 10y agoOne of the things the Intercept recommends as an option is to put your documents in a plain manila envelope, with no return address, and mail it from a public mailbox (not yours, not a post office). But the weakness of this is that they have no way to get back to you.
- iamatworknow 10y agoWould they need to get back to the sender? If so, they could always go the BTK route[0] and address the sender through the paper/website/show itself. [0] The "BTK killer" asked in an anonymous letter to the police if they would be able to track him down if he sent subsequent letters on a floppy disk. The police took an ad out in the paper to tell him no, they couldn't, so he sent a disk. He wrote the letter in Microsoft Word and using metadata on the file they were able to track the killer down and arrest him.
- pornel 10y agoSites shouldn't be putting secure drops in a subdomain. DNS and TLS SNI expose domain names in plain text, so 3-letter agencies watching backbone traffic will immediately notice when "securedrop.example.com" is accessed. Vice and Intercept made a better choice using a path on a their regular domain: https://theintercept.com/securedrop/ https://theintercept.com/securedrop/ https://news.vice.com/securedrop/ https://news.vice.com/securedrop/
- garrettr_ 10y ago(SecureDrop developer here). Obviously we agree, using a SecureDrop-specific subdomain makes traffic analysis trivial. Our deployment best practices [0] warn folks not to use subdomains. Sadly, since SecureDrop is decentralized, we cannot enforce this, and some organizations apparently find it very difficult to provision a separate path ("example.com/securedrop" instead of "securedrop.example.com"). for their SecureDrop landing page. [0]: https://docs.securedrop.org/en/stable/deployment_practices.html#landing-page https://docs.securedrop.org/en/stable/deployment_practices.h...
- x1798DE 10y agoWhat about provisioning other, non-securedrop stuff on that subdomain, and not calling it "securedrop"? Seems like that's better than nothing: misc.mydomain.com/securedrop misc.mydomain.com/pacman-game misc.mydomain.com/portraits-of-frieda-kahlo Ideally you'd leave it at the top level since obviously whatever other random junk you put on the subdomain will be lower-traffic than the main domain, but at least here there's plausible deniability (I was just clicking on an easter egg that played pac-man!)
- georgefox 10y agoA few of these articles are suggesting that uploads be performed from public places (e.g., Starbucks) for the sake of anonymity/deniability. But it would seem that performing these actions in public would potentially reveal your identity, actions, and secret codename to any eyes or cameras around. As a question of general curiosity about anonymity, how does one weigh the benefits of using an open internet access point with the more literal visibility that using a public access point might entail?
- iak8god 10y agoWhen I wake my computer after a session of normal use and connect it to an open network, it immediately starts sending out messages to a bunch of different entities (google, dropbox, evernote, etc, etc) that can be rather easily traced back to that access point. IMHO this should be an even bigger concern than identifying a public wifi user through surveillance images, and it's a point that articles like this one routinely ignore, or gloss over: > "Use as much caution and good sense as you can about distancing yourself from equipment and network locations you might be connected to." Possibly an audience who has never heard of Tor before (the target for this piece) needs some more concrete advice about this than "use caution and good sense."
- georgefox 10y agoHmm, yeah. The linked video from the Globe and Mail says to avoid surfing the web during the procedure, but avoiding explicitly going to Facebook and Twitter (their examples, IIRC) won't stop all identifiable network traffic from your device. I suppose that's where the suggestion of using a boot-from-USB OS might come in.
- iak8god 10y agoI consider myself to be quite savvy and I'd have zero confidence in my ability to reliably shut down all identifiable traffic, except by setting up a tool that blocks all traffic (like Little Snitch[1]) and then making an exception for Tor traffic. And then there's the fact that most people's MAC addresses are ultimately tied to their identities in a way that a powerful actor could recover it without too much difficulty. [1] https://news.ycombinator.com/item?id=13443858 https://news.ycombinator.com/item?id=13443858
- vonnik 10y ago[Former reporter here] I have worked with confidential sources, and there are a number of things you can do, as a whistle blower, to protect yourself. Phone calls are better than files, generally speaking, and you should be calling from a burner; i.e. a pre-paid phone that is not in your name. You shouldn't even give your real name to the reporter on first contact. Reporters take notes and some of them have to share their sourcing with editors. So be really clear with them how they will treat your real identity, if you choose to share it. Face to face meetings are sometimes better than phone calls. You should assume, when you're handling highly sensitive information, that the reporter's devices may eventually be hacked, bugged or subpoena'd, so make sure that an electronic trail does not lead back to you. You should carefully choose the journalists you leak to. The best choice will have to be well sourced. That's because the information you leak to them, in most cases, will have to be confirmed. That is, they will have to call other insiders they know and ask "Is X true?" If they don't have other sources, the information you provide will probably not make it to the public. Reporters also get contacted by a lot of nut jobs, so early on, do what you must to establish credibility. Trust has to be established both ways.
- lazaroclapp 10y ago> Phone calls are better than files, generally speaking, and you should be calling from a burner; i.e. a pre-paid phone that is not in your name. Wouldn't you still be identifiable based on voice biometrics? Or by the security camera video of whichever store you buy the burner phone from? And if meeting in person, you could be trivially shadowed. It still looks to me like "Phone calls are better than files" is completely backwards. Files can be transferred over onion routing or other darknets, carry less identifiable information and can be digitally signed to establish identity as being the same source over multiple leaks.
- gricardo99 10y agoPhone calls and in-person meetings are far less likely to end up leaving behind proof (provable in court) of information you passed to someone. If you send files, you have to first create or possess the files. That can leave behind hard evidence. Evidence that you bought a burner phone or met someone isn’t quite the same as evidence that you passed specific information. And if you're under surveillance, being shadowed, then clearly you're going to have a lot of trouble using any means.
- ransom1538 10y agoThe hard part isn't anonymously leaking the information. (You could do this with a $0.15 envelope and a stamp. Just remember not to put in your address as the return address and to wear gloves). The hard part when you leak is that you are now in a set of people that knew the information. That usually boils things down to a handful or even one suspect. With US federal agents where in fact it is illegal to lie to them, they will have you in their office by lunch.
- swimfar 10y agoI assume you meant "with US federal agents". ;)
- pogo 10y agoIn this case, get a lawyer and don't answer any questions without them. Also, if you do leak a hard copy, print it at a public place and use a B&W printer. Color printers are relatively easily traced.
- tqkxzugoaupvwqr 10y agoAre those tracking dots not microscopic? I would assume printer manufacturers also put them on black-and-white prints. Even if they don’t do it now, this is only a printer driver update away.
- pogo 10y agoThey are very small, but not microscopic. They are done in yellow ink, which is why they are very hard to see. If they were printed in black ink, I think you'd be able to spot them immediately, despite their small size.
- x1798DE 10y ago> In this case, get a lawyer and don't answer any questions without them. This advice is valid whether or not you leaked anything.
- josnyder 10y agoI think it would be interesting for a member of Congress (or their staff) to operate a SecureDrop instance. Such a system might be a useful supplement to other forms of communication between federal officers and Congress (e.g. fax, interoffice, in person). Combined with 5 USC 7211, it might also have strong legal protection (IANAL).
- berry_sortoro 10y agoApart me considering Buzzfeed not a news source but a pile of disgusting clickbait shit from hell. I don't consider any one this claimed "credible" news sources I know worth of my leaks, except maybe the intercept. I don't know Pro Publica and The Globe and Mail but I would rather leak directly to wikileaks, I don't trust the MSM for good reasons, why should I let them make money and risk them spinning or not publishing my leaks? Wikileaks has a reputation none of those will ever even come close to.
- finalpatch 10y agoI know there are companies embed digital fingerprints in all assets on their intranet. Basically the web server serves files with different fingerprints for each employee. These fingerprints can survive even resizing/processing/re-encoding. Company then will be able to track down the person who leaked it by simply looking at the leaked file.