4 ms·

If this is a matter of national security, realistically, you probably should not do this. If it's sensitive enough, the government(s) involved WILL expend infin

If this is a matter of national security, realistically, you probably should not do this. If it's sensitive enough, the government(s) involved WILL expend infinite resources to track you down and chase you across the world like they did with Snowden, Manning, and Assange. Don't kid yourself that using software X will make you invisible. Almost all public cybersec resources are only "good enough" against a poorly-resourced adversary, not against most state actors, and especially not against the US government and its allies. State actors have plenty of resources at their disposal for revealing your identity, ranging from the perfectly legal (wiretaps, national security letters, etc.) to the questionable (making allied intelligence agencies do their dirty work, using loopholes to do warrantless wiretapping at a mass scale, monitoring Tor exit nodes, etc.), to the outright murdery (good luck if you personally piss off the Russians or Israelis). Even if you leak it to a reputable journalistic outfit, you're betting that a reporter will value your freedom over their own. They can and have been compelled to leak their sources under enough pressure, and it takes a rare hero to stand up against that sort of governmental abuse of power. You really, really shouldn't do this if you value your safety. If you absolutely must get the information out, deliver it to some media agency anonymously, preferably without a digital record or paper trail. Or, geopolitically, you can also choose to leak to an enemy of whatever entity you're concerned about, and hope that they will protect you. (e.g. if you're leaking national security matters, go to a non-allied adversary and ask for asylum from their embassy... after making sure that country does not have extradition agreements with your own). There is no risk-free way to do this.

1024core 2y ago
> If this is a matter of national security, realistically, you probably should not do this Thank you for the concern, I understand where you're coming from; but fortunately, it's nothing that glamorous. It is about low-level corruption (think county/city level) and things like nepotism, bad contracts, wastage of resources, etc.
- dotcoma 2y ago
  Why not go see the local DA and tell them about it instead ?
pillefitz 2y ago
I might be naive, but what if you buy a burner phone/notebook on the flea market, wait a couple months, then use a public WiFi with some precautions (no cameras around, leave your phone home) to post the content? Maybe I'm severely underestimating current capabilities, but I have a hard time imagining how I could possibly be found out.
- solardev 2y ago
  As long as you don't leave any digital footprints, that might be good enough for many situations? A local politician probably doesn't have the resources to track you down from that one instance. But just some examples... - Where are you going to post something where it's both anonymous (to protect you) but also verifiable (so the person receiving it can authenticate you)? - Has, or will, that laptop ever be used for anything else? Can someone with enough power fingerprint it (MAC address, browser fingerprint, etc.) and eventually correlate it to you? - Are you sure it's not scanning for wifi while asleep to check for updates, etc., possibly leaving a log in other routers / street view cars etc. along the way? - Once the information is posted, do you need to further communicate with your audience? If so, you'll be doing so under higher risk. They'll know which IP address it came from, thereby narrowing it down to an ISP and probably a city, if not the exact library or cafe or whatever. Then that entire spot can be placed under surveillance. They can slowly try to rule out likely individuals. - If the router logged your laptop's real MAC address, they might be able to identify the vendor and the person they first sold it to, who under interrogation might reveal they sold it to a person who looked like so and so. Best case scenario maybe you buy a one time use burner laptop, hike to a different state, buy nothing along the way, connect to a public wifi there one time only, post anonymously, and then burn and bury that laptop in some forest. That'd be much harder to track down than, for example, someone who need to maintain a line of communication with a journalist over a few weeks while also trying to keep their normal life. And someone with a family is probably less likely to attempt the more extreme measures. It just depends on who you expect your adversary to be. If you're just trying to post mean things about a local politician, probably you're safe with the most basic protections. Probably you can just go to the local media and even if they reveal who you are, the impact will be limited. If it's national secrets you're revealing, well, they'll try a lot harder to track you down, both technologically and socially.

1024core 2y ago

> If this is a matter of national security, realistically, you probably should not do this Thank you for the concern, I understand where you're coming from; but fortunately, it's nothing that glamorous. It is about low-level corruption (think county/city level) and things like nepotism, bad contracts, wastage of resources, etc.

dotcoma 2y ago
Why not go see the local DA and tell them about it instead ?

pillefitz 2y ago

I might be naive, but what if you buy a burner phone/notebook on the flea market, wait a couple months, then use a public WiFi with some precautions (no cameras around, leave your phone home) to post the content? Maybe I'm severely underestimating current capabilities, but I have a hard time imagining how I could possibly be found out.

solardev 2y ago
As long as you don't leave any digital footprints, that might be good enough for many situations? A local politician probably doesn't have the resources to track you down from that one instance. But just some examples... - Where are you going to post something where it's both anonymous (to protect you) but also verifiable (so the person receiving it can authenticate you)? - Has, or will, that laptop ever be used for anything else? Can someone with enough power fingerprint it (MAC address, browser fingerprint, etc.) and eventually correlate it to you? - Are you sure it's not scanning for wifi while asleep to check for updates, etc., possibly leaving a log in other routers / street view cars etc. along the way? - Once the information is posted, do you need to further communicate with your audience? If so, you'll be doing so under higher risk. They'll know which IP address it came from, thereby narrowing it down to an ISP and probably a city, if not the exact library or cafe or whatever. Then that entire spot can be placed under surveillance. They can slowly try to rule out likely individuals. - If the router logged your laptop's real MAC address, they might be able to identify the vendor and the person they first sold it to, who under interrogation might reveal they sold it to a person who looked like so and so. Best case scenario maybe you buy a one time use burner laptop, hike to a different state, buy nothing along the way, connect to a public wifi there one time only, post anonymously, and then burn and bury that laptop in some forest. That'd be much harder to track down than, for example, someone who need to maintain a line of communication with a journalist over a few weeks while also trying to keep their normal life. And someone with a family is probably less likely to attempt the more extreme measures. It just depends on who you expect your adversary to be. If you're just trying to post mean things about a local politician, probably you're safe with the most basic protections. Probably you can just go to the local media and even if they reveal who you are, the impact will be limited. If it's national secrets you're revealing, well, they'll try a lot harder to track you down, both technologically and socially.