Slashdot Mirror

← Back to Stories (view on slashdot.org)

Swartz-Designed Whistleblower Tool "SecureDrop" Launched

Posted by samzenpus on from the protect-ya-neck dept.

An anonymous reader writes in with word of a new tool for whistleblowers: "The 'strongest-ever' whistleblowing tool for sources to speak anonymously with journalists, partly developed by the late Reddit co-founder Aaron Swartz, has been launched by the Freedom of The Press Foundation. Before his suicide in January 2013, Swartz had been working on a tool for sources to anonymously submit documents to journalists online, without using traceable email and in a way that could be easily catalogued by news organisations. Called SecureDrop, the tool can be installed on any news organisation's website as a 'Contact Us' form page. But where these pages usually require a name and email address, the encrypted SecureDrop system is completely anonymous, assigning the whistleblower two unique identifiers - one seen by the journalist, and one seen by the whistleblower. These identities stay the same, so a conversation can be had without names being shared or known."

79 comments

  1. LET THE GAMES BEGIN! by Jeremiah+Cornelius · · Score: 0, Troll

    Now, OUT the Bastards!

    --
    "Flyin' in just a sweet place,
    Never been known to fail..."
    1. Re:LET THE GAMES BEGIN! by Yomers · · Score: 1

      I can answer one of your questions - why some Russians have dash cameras on their cars.

      - Dash cam means in case of any kind of traffic accident that can lead to legal conflict you have video of accident and an ability to use it or not. If recorded evidence is not in your favour - delete it. If it shows how this cute child jumped on the road from behind the truck right in front of your car - it might help you to avoid some jailtime.
      - Set ups are not frequent any more - everybody have liability insurance so it does not make sense now, everybody is calling insurance after incidents as small as a scratch.
      - You might get lucky and record plane crash,
      http://www.youtube.com/watch?v=iHqFDsKq5DA
      or meteorite,
      http://www.youtube.com/watch?v=2FCJOuLXIz4
      or, at least, just a deadly accident.
      http://www.youtube.com/watch?v=gRWtf0000e0
      - Dash cams are cheap.
      - In Russia you do not need permit to use dash cam.
      - So why not to get dash cam?

      P.S. You say "have to have dash cameras on their cars" as if it is something bad. I disagree - youtube would be boring without Russian dash cams! And while cams are not feeding stream to central location but just record it on a flash - to be erased on a next day, if nothing of interest has happened - cams are not really a threat to privacy.

    2. Re:LET THE GAMES BEGIN! by icebike · · Score: 1

      I have to agree with your last paragraph, Russian dash cam videos are addictive. You can learn a lot about dangerous driving practices that cause accidents. Watching them makes you a more defensive driver.

      I've seen it alleged that the reason these are so popular in Russia is that the police are so easily corrupted and bribed into writing up the accident as being the fault of who ever offers the smallest bribe.

      Of course I have no way of knowing if this is true. In most places in the US and Canada, any suggestion of a bribe will get you in handcuffs. (I'm sure there are exceptions in some places in the US, but it is rare enough that the traveler never dares make such an offer.) In Mexico the cuffs appear only if your bribe offer is too small).

      So dash cams are not that necessary in the US, and most of Western Europe because most accidents will be reported fairly, and most insurance companies will conduct their own investigation for large claims.

      So "have to" as mentioned by the GP refers to protecting one's self from corrupt police.

      --
      Sig Battery depleted. Reverting to safe mode.
    3. Re:LET THE GAMES BEGIN! by cold+fjord · · Score: 1

      Russian automobile insurance companies have required dash cams.

      --
      much of left-wing thought is a kind of playing with fire by people who don't even know that fire is hot - George Orwell
    4. Re:LET THE GAMES BEGIN! by icebike · · Score: 1

      Source?

      --
      Sig Battery depleted. Reverting to safe mode.
    5. Re:LET THE GAMES BEGIN! by ArbitraryName · · Score: 1

      Maybe not de jure required, but certainly de facto .

    6. Re:LET THE GAMES BEGIN! by gl4ss · · Score: 1

      the cams _are_ the insurance for the insurance.

      they might not require them per se but they aren't paying money out without the footage.. though apparently you can get lower rates at least with it.

      source: various online publications.

      --
      world was created 5 seconds before this post as it is.
    7. Re:LET THE GAMES BEGIN! by Anonymous Coward · · Score: 0

      The press has free reign in the US. They can expose "atrocities" all day long.

      Michael Hastings, an investigative journalist who was was working on a story about the CIA director and who warned his friends and associates that he was being investigated by the FBI, was killed by a mysterious explosion.

      Freedom of the press indeed.

  2. Derp by Anonymous Coward · · Score: 0

    reddit*

  3. The NSA could trace this. by Anonymous Coward · · Score: 0

    Believe it.

    1. Re:The NSA could trace this. by Anonymous Coward · · Score: 0

      The NSA could trace this

      Trace it? They could flood it with red herrings. When enough fake leads cause editors to abandon it the NSA will send them all one last "Mission Accomplished" message.

    2. Re:The NSA could trace this. by AHuxley · · Score: 2

      Yes expect to see a lot of front organisations offering US legal and press advice.
      Security cleared, stay in the USA, talk to the press and congress will 'protect you'.
      Security cleared just means your trial will be in a closed court.
      Staying in the USA subjects you to color of law.
      The tame press will re work your interview into strange soundbites.
      Congress will 'protect you' all the way to your closed court with a short list of security cleared lawyers to select from.
      Fake leads seem harder after http://en.wikipedia.org/wiki/Yellowcake_forgery ... the press now knows to look into docs a bit more now :)
      Like East Germany the US will allow its press total freedoms but over time the press will get the http://en.wikipedia.org/wiki/2013_Department_of_Justice_investigations_of_reporters message.

      --
      Domestic spying is now "Benign Information Gathering"
  4. The problem - yellow dog journalists by Taco+Cowboy · · Score: 5, Insightful

    The problems that are plaguing our world is not only the power that be.

    The journalists are also part of the problem.

    You see, most journalists we have today do not even comprehend the ethic behind journalism.

    And worst of all, some of the journalists are willingly cooperating with the power-that-be (you can see the evidences of the so-called "news media" we have nowadays) - and I still remember a case back in the Bush (senior) days where CNN actually turned over the identity of a whistle blower to the Department of Defense.

    --
    Muchas Gracias, Señor Edward Snowden !
    1. Re:The problem - yellow dog journalists by mrmeval · · Score: 2

      Fat asses want a fat paycheck without working for it. Real investigative journalism is a passion, it is expensive and it is exhausting.

      I remember with Geraldo Rivera had a new TV show and had assembled an exceptional group of people and he did this and it was awesome. By the third episode he was a tripe spewing shill ... again.

      Slowly all that exceptional talent meandered away.

      --
      I'd go on a Vegan diet but the delivery time from Vega is too long. --brownkitty
    2. Re:The problem - yellow dog journalists by Anonymous Coward · · Score: 1

      The problems that are plaguing our world is not only the power that be.

      The journalists are also part of the problem.

      You see, most journalists we have today do not even comprehend the ethic behind journalism.

      And worst of all, some of the journalists are willingly cooperating with the power-that-be (you can see the evidences of the so-called "news media" we have nowadays) - and I still remember a case back in the Bush (senior) days where CNN actually turned over the identity of a whistle blower to the Department of Defense.

      It always been this way, the only time the media/press reports anything is after the fact people haven't bought into there government agenda, you could use several examples, the Vietnam War, the Iraq wars, the media/press peddled government propaganda in order to gain support from the general public, then people get wind of whats going on and start going against it, then the media/press reports what people already know.

    3. Re:The problem - yellow dog journalists by manu0601 · · Score: 1

      You see, most journalists we have today do not even comprehend the ethic behind journalism.

      The reason is perhaps that ethic had gone economically irrelevant in many medias. How do you want them to focus on ethic when their main motive is just to survive?

    4. Re:The problem - yellow dog journalists by schnell · · Score: 1

      Real investigative journalism is a passion, it is expensive and it is exhausting.

      100% agree. Slashdotters, please remember this the next time you complain about any news source that does original, investigative journalism wanting to - gasp - show you ads or charge you for a subscription.

      Recycling press releases can be done for free. REAL journalism takes dedication and money to pay the people who are doing the work.

      --
      "95% of all Slashdot .sig quotes are incorrect or completely fabricated." -Benjamin Franklin
    5. Re:The problem - yellow dog journalists by CarbonShell · · Score: 1

      Reminds me of a quote I read somewhere and am to lazy to source:
      "Journalists print things people do not want to have printed. Everything else is public relations."

    6. Re:The problem - yellow dog journalists by Anonymous Coward · · Score: 0

      "Journalists print things people in power do not want to have printed. Everything else is public relations."

      FYP.

  5. This is only one layer. by Forbo · · Score: 5, Insightful

    I certainly hope that the news orgs will include a warning that they should be using this only as one part of an attempt at anonymity. With the NSA's beam splitters hard at work in every major ISP backbone, it would be quite trivial for them to trace this back.

    1. Re:This is only one layer. by drinkypoo · · Score: 3, Insightful

      Why print? uSDHC cards are cheap. 16GB for ten bucks is not unusual, for sixteen bucks is easy. Printing won't save you from identifiers hidden in the documents, if that's what you're worried about.

      I imagine if I wanted anonymity I'd take a directional wifi rig into the hills and point it at town...

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    2. Re:This is only one layer. by madclicker · · Score: 1

      I would think there is a serial number embedded somewhere, that points to the pos for the unit. Then you can trace from there.

      --
      "History is the realm of the true lie." A.Szerb
    3. Re:This is only one layer. by complete+loony · · Score: 3, Informative

      Source code seems to be available online here. A quick look at the User Manual indicates that all communication is routed via tor which raises the bar for tracing connections significantly.

      --
      09F91102 no, 455FE104 nope, F190A1E8 uh-uh, 7A5F8A09 that's not it, C87294CE no. Ah! 452F6E403CDF10714E41DFAA257D313F.
    4. Re:This is only one layer. by lxs · · Score: 1

      I think you severely overestimate the logistic capabilities of electronics retailers. They don't keep track of the serial number (if it even has one) or batch number of every bargain bin item that passes through a store.

    5. Re:This is only one layer. by cbope · · Score: 1

      Maybe so, but you can bet the manufacturer keeps track of the items shipped by serial number and to whom they have been shipped.

    6. Re:This is only one layer. by lxs · · Score: 2

      The manufacturer usually is somewhere in China and they generally don't deal with individual stores. It either goes to a wholesaler or to the central warehouse of a chain of retailers. We're talking about bulk goods here, not about printers or PCs. Worst case, there is an RFID embedded in the packaging. IME (the place where I work sells SD cards amongst other stuff) 9 times out of 10 the packaging ends up in the trash before leaving the store. The card goes into the device while the customer stands at the counter. After a week nobody knows which individual card was sold to which customer.

    7. Re:This is only one layer. by Anonymous Coward · · Score: 0

      Exactly, I'm sure XKCD calculated how much bandwidth a truck filled with SD cards would create and it was some hugely large value.

      And another, directional WiFi would create a great sense of anonymity, especially if you transmit to repeaters that were in a town that actually transmitted the signal to others nearby, self-destructing, no clue where it came from.

      I'm not a spy or terrorist, honest, pls no bag me oh no not the nipple clamps p

  6. How I hope Mr. Aaron Swartz is still alive ! by Taco+Cowboy · · Score: 1

    The NSA could trace this.

    Believe it.

    It's too unfortunate that Mr. Swartz had to end his life, no thank to those who run MIT.

    If Mr. Swartz were still alive, he would have put in a lot of effort to counter many of the NSA's threats.

    --
    Muchas Gracias, Señor Edward Snowden !
    1. Re:How I hope Mr. Aaron Swartz is still alive ! by Anonymous Coward · · Score: 1

      i was sad to hear he committed suicide, nonetheless. We are none of us perfect, and it is still what we do that counts. I have a modicum of sympathy for the idea that the Govt coming down on you with a vengeance is definitely a life changing experience for anyone of us - unfortunately too much for this man.

      Let us not forget the whole point about this spat between the journalists and the govt is because in many respects they are acting exactly like a pathological bully.

      We the people...

    2. Re:How I hope Mr. Aaron Swartz is still alive ! by rmdingler · · Score: 3, Funny

      All we know for certain, is that if Mr. Schwartz was still alive, he would be clawing the hell out of his coffin lid.

      --
      Happiness in intelligent people is the rarest thing I know.

      Ernest Hemingway

    3. Re:How I hope Mr. Aaron Swartz is still alive ! by ihtoit · · Score: 1

      you might not agree with everything he says, but he has every right to say it just as you have every right to change the fucking channel.

      --
      Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
  7. Traditional Mail? by OldJuke · · Score: 1

    What about printing the documents and submitting them via traditional post? USPS, UPS, or Fedex? Honestly that seems to be the most anonymous/un-traceable way to send documents.

    1. Re:Traditional Mail? by Anonymous Coward · · Score: 2, Informative

      They can still narrow it down to the nearest post office or mailbox or courier depot where you drop off the package. Last time I talked to the courier, they are keeping records of 2 years. There is also the usual fingerprints etc they can collect from the letter assuming if they find the actual package.

    2. Re:Traditional Mail? by lxs · · Score: 1

      So you wear gloves and stick it in a letterbox far from your home. In a big city the other side of town should be far enough. Don't wear your AFDB when using public transport. It makes you look suspicious or a least memorable to potential witnesses.

    3. Re:Traditional Mail? by K.+S.+Kyosuke · · Score: 1

      Don't wear your AFDB when using public transport. It makes you look suspicious or a least memorable to potential witnesses.

      Well, I can definitely see how wearing your African Development Bank on public transport could raise some eyebrows...

      --
      Ezekiel 23:20
    4. Re:Traditional Mail? by lxs · · Score: 1

      You're not familiar with the Aluminum Foil Deflector Beanie? You have seven (7) days turn in your geek card at your nearest LUG. Delays will not be tolerated.

    5. Re:Traditional Mail? by capedgirardeau · · Score: 1

      Also do not forget that we know some color printers and copiers are encoding traceable information in the pages they print. I thought more than just color printers did that, but I can't find a reference.

      I would err on the safe side and assume the practice has expanded since first discovered.

      https://www.eff.org/issues/printers

      --
      Wax on, wax off baby!
  8. *-_-* by jmhobrien · · Score: 1

    I wonder if this is what Glen Greenwald is joining... http://news.slashdot.org/story/13/10/16/1216218/glenn-greenwald-leaves-the-guardian-to-start-his-own-site

    --
    Where is moderation: -1 False?
    1. Re:*-_-* by Anonymous Coward · · Score: 0

      The Village People?

  9. Reddit cofounder by Anonymous Coward · · Score: 0

    I wish people would stop billing him as this. It's really not true (he joined via merger 6mo after founding). The guy accomplished a lot but this wasn't one of the things.

  10. spam by Anonymous Coward · · Score: 0

    And they get filled with TB of encrypted spam and fiction. Going to be hell separating the signal from the noise.

  11. Why is his death considered a suicide? by t0qer · · Score: 1, Insightful

    There's been a lot of discussion after his death that it might have been a hit. He told close friends that he was under watch. A few days after his death, there was a video posted showing how a hacker could control a toyota prius.

    1. Re:Why is his death considered a suicide? by Anonymous Coward · · Score: 3, Informative

      I think you're thinking of Michael Hastings, not Aaron Swartz.

    2. Re:Why is his death considered a suicide? by artor3 · · Score: 0

      Good point. The NSA could have had a remote controlled Prius tie that noose around his neck!

    3. Re:Why is his death considered a suicide? by Frosty+Piss · · Score: 1

      There's been a lot of discussion after his death that it might have been a hit. He told close friends that he was under watch. A few days after his death, there was a video posted showing how a hacker could control a toyota prius

      There's little question that he was a smart guy, and that the charges against him were unjust.

      But it is talk like this that only goes to further support the information that is known about his personal mental state. This type of talk is classic paranoia, and very unlikely to be in the realm of reality.

      --
      If you want news from today, you have to come back tomorrow.
    4. Re:Why is his death considered a suicide? by Anonymous Coward · · Score: 0

      [...] A few days after his death, there was a video posted showing how a hacker could control a toyota prius.

      ...which might be interesting if his mode of death anything at all to do with a Toyota Prius rather than, you know, hanging from a noose.

      Sheesh

    5. Re:Why is his death considered a suicide? by AHuxley · · Score: 1

      Depends how you relate the issue to past people with unique information facing governments.
      Costas Tsalikidis, the Greek telco whistleblower was found hanged.
      http://en.wikipedia.org/wiki/Kostas_Tsalikidis
      http://en.wikipedia.org/wiki/Greek_telephone_tapping_case_2004-2005
      Adamo Bove head of security at Telecom Italia who exposed the CIA renditions via cell phones ‘fell’ to his death.
      http://en.wikipedia.org/wiki/SISMI-Telecom_scandal
      Deborah Jeane Palfrey, the D.C. Madam was found hanged.
      http://en.wikipedia.org/wiki/Deborah_Jeane_Palfrey

      --
      Domestic spying is now "Benign Information Gathering"
    6. Re:Why is his death considered a suicide? by Anonymous Coward · · Score: 0

      1.) His car blew up and the manufacturer stated it was extremely unlikely. 2.) Sparks were observed flying out from under his car as if he was trying to brake. 3.) I believe the incident remains under investigation by the FBI.

    7. Re:Why is his death considered a suicide? by Anubis+IV · · Score: 2

      There's been a lot of discussion after his death that it might have been a hit. He told close friends that he was under watch. A few days after his death, there was a video posted showing how a hacker could control a toyota prius.

      Not true, on all three counts. Aaron Swartz hung himself after something really bad happened to him. Perfectly reasonable, and an utter shame. It sounds like you're confusing him with Michael Hastings, the investigative journalist who died a few months later under somewhat suspicious circumstances involving an out of control Mercedes he was driving after he had told his friends that he needed to lay low while doing an investigation on the intelligence community.

    8. Re:Why is his death considered a suicide? by Anubis+IV · · Score: 3, Informative

      Aaron's car never blew up. He hung (hanged?) himself. You're likely thinking of Michael Hastings, who died recently under circumstances that are closer to what you're describing.

    9. Re:Why is his death considered a suicide? by Anonymous Coward · · Score: 0

      lol wut

    10. Re:Why is his death considered a suicide? by cold+fjord · · Score: 1

      None of those are quite so odd as that of MI6 Agent Gareth Williams.

      --
      much of left-wing thought is a kind of playing with fire by people who don't even know that fire is hot - George Orwell
    11. Re:Why is his death considered a suicide? by AHuxley · · Score: 1

      Cold he was GCHQ http://en.wikipedia.org/wiki/Death_of_Gareth_Williams press mentions he was seconded to the Secret Intelligence Service ~MI6.
      The press hinted at NSA, FBI past work too, with the GCHQ part been a bit more 'left' out of some news reports :)
      To be trusted by the US is interesting too.
      The inquest seems like that of http://en.wikipedia.org/wiki/David_Kelly_(weapons_expert)
      For all the fun of a security clearance, contractor or permeant staff I wonder how many people who rushed to join in the past 15 years really understand what they signed up for.

      --
      Domestic spying is now "Benign Information Gathering"
    12. Re:Why is his death considered a suicide? by Anonymous Coward · · Score: 0

      There is nothing reasonable about killing yourself. Being offered a plea deal of four months when you were caught red handed is not "really bad." Every day, thousands of people are facing a decade or more in federal prison. Even though those people have neither the resources for defending themselves nor the talent and connections that Swartz had for getting on with their lives after they get out, they do not despair and attempt to kill themselves.

      Swartz killed himself because he was sick and needed help.

  12. Proverbial trust me... by ElitistWhiner · · Score: 1

    Secure for the whistleblower to talk to the journo anonymously. If they drop signed chats over the proverbial wall hoping the chat finds its way to the proper recipient in the system. The system knows...hence the trust is in the system.

    Any questions how that ends?

  13. How does it work? by manu0601 · · Score: 1

    How does it works against Man in the Middle attacks? If it must be defended against NSA, then we cannot take for granted that a browser SSL connection is safe from observers.

    1. Re:How does it work? by watice · · Score: 3, Informative

      Looks like with PGP & Tor, & USB Keys. It's detailed here. https://github.com/freedomofpress/securedrop/blob/master/docs/user_manual.md

    2. Re:How does it work? by Anonymous Coward · · Score: 0

      TOR network? *FAIL* Didn't Snowden already provide whistleblower evidence the TOR network is compromised by the NSA?

    3. Re:How does it work? by PrimeNumber · · Score: 1

      Yes you are correct, which is why I am astounded people continually recommend Tor as if it is a privacy panacea.

    4. Re:How does it work? by watice · · Score: 1

      I haven't heard/read that. As I understood it, a different 3 letter govt agency (FBI was it?) was exploiting weaknesses in Firefox to track TOR users, but I don't believe the TOR network was "compromised by the NSA". I could be wrong though, I tend to not pay attention to conspiracies.

    5. Re:How does it work? by ihtoit · · Score: 1

      that's what I thought!

      Please, people, STOP recommending Tor! Here's a bit of forgotten history: Silk Road operated on the Tor network, it was TRACED then TAKEN DOWN by the Met's National Crime Agency.

      A primer on the NCA.

      Also, please bear in mind that the Tor protocol was developed by the US NAVY. If you do decide to use Tor consider it INSECURE.

      --
      Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
  14. also by Anonymous Coward · · Score: 0

    he also helped invent bitcoin

    1. Re:also by ArbitraryName · · Score: 1

      No, he didn't.

  15. Names No Problem: The Problem Is "traceroute" by Anonymous Coward · · Score: 0

    Who cares about "Names".

    The "real money" will pay $$$$ to obfuscate traceroute!

    And THE question is: How do we obfuscate ip routes in traceroute?

    Let the "Real Money" pay! :)

  16. I am not impressed by Anonymous Coward · · Score: 0

    Sorry folks - you may starting throwing stones now. But this technology doesn't impress me. Server side encryption is NOT secure and should not be used if people's safety and livelihoods are at risk. There are several examples around using client-side encryption providing true end-to-end protection.

    'nuff said-

    Michaela

  17. also co-founder of by Anonymous Coward · · Score: 0

    the TOR and Free Net projects

  18. Not quite the 99 percent solution by Anonymous Coward · · Score: 0

    Thank you for your thoughtful solution to the personal communications
    privacy problem. We regret to inform you that your plan will not work
    because:

      [*] The government and big business are against it,
              now you're fighting a two front war.
      [*] NSA is tapping into the carriers backbone networks.
      [*] If NSA is tapping, do you think the carriers aren't looking at
              their own traffic?
      [*] Your crypto is back-doored by NSA.
      [ ] It's not legal. We all know what the law says, but judges say
              what the law really means.
      [*] The Microsoft "_NSAKEY" registry key is for REAL!
      [ ] Your customers can be found "Guilty by Assosciation."
      [*] You'd be shut down in an instant if it worked.
      [*] You have no privacy. Get over it.

  19. tripcodes? by Anonymous Coward · · Score: 0

    So they 'invented' tripcodes that 2chan has HAD for years n years?!

  20. Sounds good. by PrimeNumber · · Score: 1

    ...but in reality it still sucks because the NSA will be continue to log and sniff all traffic between the host and web site.

  21. Can I pick the journalist? by Anonymous Coward · · Score: 0

    I would hope I could pick the journalist, since the vast majority seem so politically minded that they could very well aid in covering up or discrediting me to preserve their loyalty to their chosen party, whatever it may be.

    Over the years, we have expected our journalists to be less and less the unemotional, unbiased recorder of that which happens around them, and more of an emotional, combative and idealogical superhero.