
How to Leak to the Press - phxql
http://www.wired.com/opinion/2013/05/listen-up-future-deep-throats-this-is-how-to-leak-to-the-press-today/
======
confluence
Feels a bit overkill and way too identifying - security cameras + internet
records + GPS locations will all help track you down, even if they are
intermittent.

Buy a stack of envelopes from a supermarket. Buy a stack of stamps. Buy a USB.
Acquire all with cash. Transfer all files to the USB via live CD - make sure
all meta-data is stripped and files are redacted to avoid fingering you.
Handle the envelopes/stamps/USB with care - gloves + hairnets + have a shower
before handling (skin cells). Print the addresses (be careful here - printers
sometimes put identifying marks - get the most common inkjet that doesn't use
dots). Print a message and stick it in the envelope - e.g. "USB contains
leaked NSA documents on massive domestic spying. Copy files to your computer
then destroy and dump USB then burn the envelope to ensure your own security."
Put the stamp on. Drop the letter in the mailbox - try and get a journalist's
home address, they'll read it.

Repeat for multi-journalist dump.

Make sure you don't lick the stamps and drop the letters off in physically
separated postboxes without security cameras.

You _do not_ want to be in constant communication with journalists/people
whilst doing any of this, because the more you talk with them, the more you
leak. You want to just strip all identifying data, dump your leak, and run.
This tactic has been used for ages to transfer sensitive data, most notably by
kidnappers (ransom notes), spies (easy data transfer), whistle blowers
(documents) and serial killers (think Ted Kaczynski).

~~~
300bps
>Print the addresses (be careful here - printers sometimes put identifying
marks - get the most common one)

Printer steganography is usually limited to color laser printers and high-end
inkjets. Buying a common one unfortunately won't help you. Included in the
codes that have been cracked is the serial number of the printer as well as a
date and time stamp of the printout.

Source:
[http://en.wikipedia.org/wiki/Printer_steganography](http://en.wikipedia.org/wiki/Printer_steganography)

~~~
confluence
Cut the letters out of a common magazine or newspaper then.

~~~
adlpz
Just write with a thick generic pen using your non-dominant hand.

~~~
jabbernotty
Use a letter stencil? One of those plastic stencils.

~~~
adlpz
That should do it too, you can even make it yourself with a piece of cardboard
and a sharp knife.

~~~
monsterix
Probably take fingerprints of someone on the envelope too? Randomize it and
complicate it so much that the idea of finding you dies the most desperate
death.

Ha ha, the situation feels 'arrived' at fictional level already!

------
irrationalidiom
This advice is dangerous, because the author fails to mention other
precautions the user can and should take, such as:

* Use a Linux live CD on the "burner laptop" \-- don't trust the preinstalled OS

* Change the MAC address of the Wifi used to connect at the internet cafe

* Use Tor, most easily via the Vidalia browser bundle

The author also does not mention that leaking documents can expose the
whistleblower via watermarking and user information embedded in the file (most
infamously in MS Word documents with versioning).

Edit: update formatting

~~~
DanBC
> Use a Linux live CD on the "burner laptop" \-- don't trust the preinstalled
> OS

Tails is a Linux distribution aimed at privacy and anonymity.

([https://tails.boum.org/](https://tails.boum.org/))

~~~
adlpz
I know I'm being paranoid, but I feel uneasy using a privacy-aimed
distribution for privacy. The whole obvious target thing.

~~~
steveklabnik
This is where the 'many eyes' things comes into play; if the whole distro is
OSS, then you can be pretty sure that it's good.

~~~
anonyfuss
Most people never review source code, and they certainly don't disassemble and
review all the binaries. 'Many eyes' is a security fallacy in cases like this.

~~~
steveklabnik
Tails is ridiculously well known; if something was bad in it, it would be big
news.

~~~
mseebach
If it was found. Which is the point.

Debian, which is much better known and in much wider circulation than Tails
generated weak SSH keys for _two years_. Yes, it was indeed _very big news_.
When it was found. After _two years_.

Oh, and tin-foil-hat on: Do we _know_ (actually know-know, not just assume,
think, trust) that the weakness wasn't planted there?

~~~
EvilLook
TAILS is actually now done by the Tor Project, so I think they have a vested
interest in vetting it before it is released.

[https://www.torproject.org/projects/projects&#x2F](https://www.torproject.org/projects/projects&#x2F);

~~~
mseebach
And Debian doesn't have a vested interest in making sure a central security
component isn't weakened?

Also, how do you know that Tor and Tails aren't infiltrated by the enemy (for
any value of "enemy")?

------
lemming
_...feeding the information to the phone company which retains this
information for weeks, months, even years. Just a warrant-step away._

The warrant comment suddenly sounds old-fashioned.

------
ajays
FTA: "There’s another option I didn’t originally mention here — leaking over
mail. Investigative journalist Julia Angwin of the Wall Street Journal points
out that physical mail, dropped in a random post-box with a bogus return
address, is perhaps the best way for anonymous one-way communication."

DO NOT DO THIS! Every printer leaves a microscopic fingerprint on every
printout. The printouts can be traced back to your printer. If it's an office
printer, that still narrows it down considerably.

Even electronic documents can have watermarks, etc. For photographs, there's
the EXIF information, for instance. If you want to share a photo, pipe it
through "djpeg | pnmscale 0.99 | cjpeg -quality 90" first. It will get rid of
EXIF, and also re-compress the image, changing its signature.

~~~
rbonvall
Interesting, I didn't know about printer fingerprints.

But I think there are still ways to workaround this. You could print the doc
in an internet cafe, or buy a cheap printer and then destroy it, or print it
and then take a low quality photocopy. You could even write it by hand or on a
typewriter.

~~~
ajays
A photocopier is a (scanner+printer), so the problem remains.

Your best bet is large flea markets, where you can buy stuff like WiFi
dongles, etc. with cash. Then wait a while before you use them.

I can't believe I'm having to write this, either. This is like giving
instructions to a Soviet activist in the Cold War days, but ironically it is
in my own country. How did we fall so far?

~~~
saraid216
> How did we fall so far?

Fall? You'd have to give the same instructions to a Soviet activist in the
Cold War days _here_.

------
mtgx
What about "simply" using DeadDrop?

[http://deaddrop.github.io](http://deaddrop.github.io)

[http://www.newyorker.com/online/blogs/closeread/2013/05/intr...](http://www.newyorker.com/online/blogs/closeread/2013/05/introducing-
strongbox-anonymous-document-sharing-tool.html)

Or Retroshare:

[http://retroshare.sourceforge.net](http://retroshare.sourceforge.net)

[https://retroshareteam.wordpress.com/2012/12/28/cryptography...](https://retroshareteam.wordpress.com/2012/12/28/cryptography-
and-security-in-retroshare)

[https://retroshareteam.wordpress.com/2013/01/06/privacy-
on-t...](https://retroshareteam.wordpress.com/2013/01/06/privacy-on-the-
retroshare-network)

~~~
kansface
It seems to be often said that on the order of 1/3 of the Tor Exit/Entry nodes
are run by the NSA.

~~~
socillion
Interesting, do you have a source for this?

------
perlpimp
In Russia you have to provide passport in order to buy a sim card.

~~~
tomjen3
That may be the law but in places like Russia you can also just hand them 20
USD to look the other way.

------
mirkules
Question about cash: do banks keep track of the bills that are dispensed
through ATMs? If so, it's probably safer to break your bills first.

Also, be aware of cameras near the internet cafes or places you intend to use
the burner phone.

------
tonyplee
Love the quote "Even the head of the CIA can’t email his mistress without
being identified by the FBI." :-)

------
sahirh
The leaking via gmail has an issue:

In many cases when creating a new gmail account, you have to provide a phone
number for an automatic text verification code.

~~~
_k
True. The article has so many mistakes in it, it's almost as if it's written
by the government !! We need a new article.

------
VikingCoder
Pull the sim card, and smash THAT with a hammer. Don't just smash the whole
phone - you're unlikely to destroy the sim card, which is the most
incriminating part of your phone.

~~~
mischanix
Or toss the whole thing in a fire.

------
codeulike
Or use a website that has an Anonymous Drop Box. Wikileaks did have one, but
its no longer operational. I think a few mainstream media organisations copied
the idea and claimed to have anonymous drop boxes?

e.g New Yorker has one, called Strongbox -
[http://www.newyorker.com/online/blogs/closeread/2013/05/intr...](http://www.newyorker.com/online/blogs/closeread/2013/05/introducing-
strongbox-anonymous-document-sharing-tool.html) \- powered by Tor, designed by
Aaron Swartz and others, and open-sourced as DeadDrop
[http://deaddrop.github.io&#x2F](http://deaddrop.github.io&#x2F);

~~~
codeulike
Although, first comment on the new yorker post is a good explanation of why
StrongBox might not be enough
[http://fyre.it/i3tCXN.4](http://fyre.it/i3tCXN.4)

~~~
digitalengineer
Clicking on the comments link does not reveal any comments. I'm getting a
"Subscribe now to get more of The New Yorker's signature mix of politics,
culture, and the arts. "

~~~
carlob
I get the same. Might be related to the fact that I use Ghostery to block
absolutely everything. I was starting to feel too paranoid about that, but now
I think it's totally justified.

~~~
digitalengineer
Oh, correct! Must be Ghostry as I use it as well.

~~~
jlogsdon
It is Ghostery. Pause it and the comments will appear.

------
Peroni
Out of curiosity, why not just send a letter in the post?

Pretty hard to trace an anonymous letter.

EDIT: Just spotted the update. Question answered.

~~~
digitalengineer
Take in account they'll look at fingerprints, sweat, DNA, type of paper, ink
and type of printer used. Spelling errors, how you wrote something, etc can
also be used to identify you. (Every printer leaves it's own watermark).
Perhaps best to print and use a old 2nd hand xerox machine to copy everything
or fax it from a public faxservice.

~~~
skinnynerd
There are plenty of old typewriters lying around. Although you would still
have to take precautions like getting rid of it afterwards and make sure it
does not make use of polymer tape ribbons (in which case you would have to
destroy and discard that as well).

~~~
smacktoward
Typewriters have signatures too:
[http://en.wikipedia.org/wiki/Typewriter#Forensic_examination](http://en.wikipedia.org/wiki/Typewriter#Forensic_examination)

~~~
tomjen3
Sure, but the government wouldn't have a database of those anywhere and
getting rid of a typewriter isn't likely to get anybody noticed (I cleaned up
in the attick the other day, can you believe what I found?).

------
smackfu
The Boston bombing also shows that you should cloak your identity physically.
Hat and sunglasses at least. The one who didn't hide his identity is the one
who was easily identified.

~~~
tomjen3
Hat and sun glasses?

No, get a burka (the muslim body clothing that hides the entire body) -- not
only will people want to avoid you, but they wouldn't even be able to write in
the description what sex you are (and with a little bonus they might assume it
is not a disquise in which case they are truly looking in the wrong
direction).

~~~
rexreed
Probably one of the easiest ways to stand out in a typical US crowd. More
noticable than hat and sunglasses. If the purpose it to make video
surveillance not as notable but also not attract attention than a large hat
and sunglasses in hot weather or a scarf and hat in cold weather (even better)
will do the trick. Also, modifying hair color and facial hair features is a
good trick.

~~~
tomjen3
You may stand out, but that isn't necessarily bad, so long as what they
remember about you isn't enought to identify you and might even misdirect them
into thinking muslim terrorist.

------
Zarathust
This discussion revolves a lot around printer watermarking documents. It seems
that it mostly concern color printers. Here is an advisory by the EFF which
tested quite a few of them [https://www.eff.org/pages/list-printers-which-do-
or-do-not-d...](https://www.eff.org/pages/list-printers-which-do-or-do-not-
display-tracking-dots)

------
IgorPartola
Honest question: what prevents someone from feeding misinformation to the
press if all IDE tidying info is stripped away? If the journalist has no way
to contact you, why should they trust your leak? Could the FBI or NSA send out
bogus leaks and the go after journalists that publish the fake info for
revealing what they believed to be confidential information?

------
beat
"I don't need to be fast. I just need to be faster than you!"

Your trail-covering only needs to be better than the investigation capability
of those who are investigating your leak.

------
superuser2
Last time I purchased a prepaid cell phone, I had to show government photo ID.
The RadioShack clerk entered my license number in a database.

So the burner phone may not be the best route.

~~~
jlogsdon
This is why you go to a package store, or some other non-tech establishment.
Probably in a shadier part of town.

------
0xdeadbeefbabe
A test would at least increase my confidence. I guess step 1 is to find
something worth reporting, and the article pretty well demonstrates how hard
that is.

------
ceautery
"When you are done you must [...] turn off the Wi-Fi before turning off the
computer and removing the battery. The dedicated computer should never be used
on the network except when..."

This is silly on a "behind 7 proxies" level. Just go the library. If you're
worried that investigators are going to swoop down CSI style to track you down
because of your important secrets, maybe you should speak to a psychiatrist.

~~~
jimworm
Security cameras are quite often placed at the entrance/exit. Having your
device connect and making a DHCP request as you walk in seems like a
legitimate concern.

~~~
ceautery
Yeah, I get it. I just don't feel this level of caution is productive. If you
aren't being currently tracked, then your concern is about whether someone can
backtrack forensically and find you. I think a simple trip to a public
computer at a library, particularly at a busy time, affords as much pragmatic
anonymity as jumping through all the hoops described in the article.

On the flip side, if you are already are under suspicion, then all your
efforts to anonymize a leak are in vain. You'll be the first person
interrogated after a leak, and if your beliefs about the Orwellian nature of
the government are true, the $10 hammer to the kneecaps (thanks XKCD) will
undo any clever hiding you did.

I just don't think it makes much sense to go to these lengths. It's already
understood that governments are corrupt. Are the specifics of what secrets you
want to publicize worth the personal risk? If no, then you're playing spy,
which is fine. If yes, then they'll probably find you if they really put their
heart into it.

