What is SecureDrop?
SecureDrop is an open-source whistleblower submission system that media organizations can install to accept documents from anonymous sources. It was originally coded by the late Aaron Swartz, with assistance from Wired editor Kevin Poulsen and James Dolan. The project was previously called DeadDrop. Freedom of the Press Foundation took over management of the project in October 2013.
How can media organizations install SecureDrop?
Any organization can install SecureDrop for free and also make modifications because the project is open-source. We have written detailed installation instructions, which can be read here. Because the installation and operation are still complex, Freedom of the Press Foundation will also help organizations install SecureDrop and train journalists in security best practices to ensure the most protection for sources. Please go here to apply for assistance and set up an appointment. We do ask for-profit news organizations to pay for installation support and maintenance so we can continue funding the project.
How does SecureDrop work?
SecureDrop is designed to use two physical servers: a public-facing server that stores messages and documents, and a second that performs security monitoring of the first. The code on the public-facing server is a Python web application that accepts messages and documents from the web and GPG-encrypts them for secure storage. This site is only made available as a Tor Hidden Service, which requires sources to use Tor, thus hiding their identity from both the SecureDrop server and many types of network attackers. Essentially, it’s a more secure alternative to the “contact us” form found on a typical news site. Every source who visits the site is given a unique “codename.” The codename lets the source establish a relationship with the news organization without revealing his/her real identity or resorting to e-mail. They can enter the code name on a future visit to read any messages sent back from the journalist, or submit additional documents and messages under the same persistent, but pseudonymous, identifier. The source is known by a different and unrelated code name on the journalist’s side. All of the source’s submissions, and replies to the source from journalists, are grouped together into a collection. Every time there’s a new submission by a source, their collection is bumped to the top of the submission queue.
What technologies does SecureDrop use?
SecureDrop does not seek to re-invent the wheel. Instead it combines several well-respected tools into an application that is easier to use for sources and forces security best practices on journalists. Among the tools used in and around the SecureDrop application are: Tor, GnuPG encryption, Apache, OSSEC, grsecurity, Ubuntu, the Tails operating system, and an air-gap.
What type of hardware is needed to run SecureDrop and how much does it cost?
SecureDrop is a free and open source application that costs nothing to install. However, the application does require hardware that news organizations must purchase, including two servers, several USB sticks, an air-gapped computer, and a firewall. We have created a recommended hardware guide, however, news organizations can also choose their own hardware. It is critical, however, that the hardware is owned by the media organization and stored on its property in a secure space. The total cost of the hardware we recommend is $2,200 to $2,400, though it can be done for less if you are willing to sacrifice size and speed on the servers or are able to use recycled machines sourced from within your organization. Freedom of the Press Foundation will also physically come to your office to help set up SecureDrop and train journalists to use it if our travel costs are covered. Larger news organizations are also strongly encouraged to make a donation to the SecureDrop project for further development and tech support.
–
Source of this article: https://securedrop.org