Blowing the Whistle

Encrypted communication is within reach of anyone with a little patience thanks to a range of free programs created during the last few years. News organizations use systems such as SecureDrop (detailed below). Individual journalists — myself included — use encrypted text applications and PGP encryption for emails. Here you'll find some resources to help you get started, as well as links to pages that news outlets have created to help you to send them information securely and anonymously. None are perfect, so take the time to make sure you understand the potential consequences before you do anything.

In a free society, each of us is, to a degree, a referee. If you see something foul and think someone needs to blow the whistle, you might be the only one who can.


 

TOR

Start here. Tor is a web browser that protects your privacy by routing your internet connection through nodes around the world, making it extraordinarily difficult for others to identify you. Head to a place with public wifi — libraries, fast food restaurants and coffee shops are good bets — and download the Tor browser to your private computer.

 

Tails

If you want an additional level of security, download Tails. Tails is an operating system that runs off of a flash drive, DVD or SD card, bypassing the operating system installed on a computer's hard drive. Plug in the medium, start the computer, and, with a little help from you, Tails will elbow in during the boot process and take over. It routes internet traffic through Tor, and comes with basic office applications including word processing and spreadsheet programs, and an email client. When you shut down, it erases traces of itself from the host computer.

 

PGP keys

Picture one of those blue U.S. Postal Service mailboxes. Anyone can put a letter in, but to get it out, you have to have the right key. That's kind of how PGP, or Pretty Good Privacy, works. The person you want to send information to has something called a public key (here's mine) that anyone can copy. Some email clients (more on that below) allow you to use that key to encrypt your message before you send it. The encrypted message will look like gibberish. Even you won't be able to read it, just like the letter you dropped into that mailbox. Only someone with the right private key will be able to decrypt it.

 
thunderbird-256.e5af8f2b33f3.png

Encrypted email

The email client in Tails has a sibling called Thunderbird built for more traditional operating systems. Other clients allow PGP-encrypted email, but Thunderbird — developed by Mozilla — is one easy way to get started.

 

Mailvelope

Do you access your email through a web browser rather than a standalone email program? Mailvelope offers add-ons for Mozilla Firefox and Google Chrome that allow you to send and receive email using PGP encryption.

 

Signal

This free smartphone application by Open Whisper Systems offers end-to-end encryption for text messages (meaning the messages aren't decrypted on any servers between you and the person you're texting), as well as private calling. They've built versions of the app for Apple and Android phones.

I use it. My number is 412.303.5101.

 

Securedrop

In their own words, "SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from and communicate with anonymous sources. It was originally created by the late Aaron Swartz and is currently managed by Freedom of the Press Foundation." Head over to the site and you'll find instructions and a list of media organizations that use it.


LNP Always Lancaster - FullColor.jpg

LNP

I work for The Caucus, a team of investigative reporters covering Pennsylvania's state government. Our publisher, LNP Media Group Inc., uses SecureDrop and PGP-encrypted email.

 
 

Buzzfeed

Along with instructions for using Signal, SecureDrop, email and snail mail to contact them, BuzzFeed's tips page offers a clear-eyed look at the risks of leaking information and the obligation of its journalists to protect their sources.

 
fallback-logo.png
 

The Guardian

The Guardian has created a slick interactive tool that walks potential sources through the various encryption options and helps them determine the best way to get information into the hands of its journalists.

 

The Intercept

In addition to detailed instructions for whistleblowers, The Intercept offers some sound advice for people considering leaking sensitive information to journalists. Scroll to the bottom of their page to read it.

 
 

the new york times

They're set up to take anonymous tips through email, snail mail, Signal, WhatsApp and SecureDrop, and they have a handy list of instructions for how to use each.

 
 

The New Yorker

Before it became SecureDrop, the anonymous document-transfer system was known as Strongbox. The New Yorker was its first home, and the magazine continues to rely on it.

 

ProPublica

A nonprofit dedicated to investigative journalism, ProPublica offers a comprehensive summary of methods of secure communication and ways to use them to get information directly to individual reporters.

 
 

The Washington Post

Like The Times, The Washington Post has set up a number of avenues for people to get anonymous tips and documents to its reporters.


A note

This is, of course, not a comprehensive list. If you think an encryption tool, news organization or journalist should be added to this list, please let me know. Scroll down for my contact information.