CPJ launches SecureDrop anonymous submission system

 JournalismPakistan.com |  Published: 13 May 2016

The Committee to Protect Journalists has introduced SecureDrop, a system that allows journalists to submit reports securely. This initiative enhances the safety of journalists facing threats.

Summary

SAN FRANCISCO -- The Committee to Protect Journalists (CPJ) launched a SecureDrop system that will allow journalists to contact the organization with reports of press freedom violations safely and anonymously. Journalists are under unprecedented threat of physical and technological harm, which are often closely linked.

Surveillance is becoming less expensive and easier to deploy, and while not every attacker possesses the capabilities of large nation states such as the U.S. or China, SecureDrop is designed with those threats in mind. SecureDrop is an open-source, encrypted submission system for news organizations that provides robust protections against network-based surveillance.

Journalists can use SecureDrop to submit messages and files to CPJ without revealing their identity, location, or the contents of their messages to potential attackers. To submit information to CPJ via SecureDrop, journalists should download the latest version of the Tor browser, then use it to visit CPJ's SecureDrop address at 2x2hb5ykeu4qlxqe.onion .

"SecureDrop gives journalists who face the greatest risks a secure, anonymous and reliable channel through which to contact CPJ," said CPJ Technology Program Coordinator Geoffrey King. "It combines a high level of security, which is inherent to the system, with an interface that is easy to use.

SecureDrop is the safest way contact CPJ." SecureDrop was created by the late activist Aaron Swartz and investigative journalist Kevin Poulsen. It is now maintained and developed by the Freedom of the Press Foundation .

The system incorporates well-established best practices in computer security that include asymmetric key encryption, the use of two-factor authentication, access over Tor, and physical air gapping of the computers CPJ uses to review submissions. In addition to protecting the contents and origin of messages from eavesdroppers, SecureDrop is designed so a submitter can remain wholly anonymous, even to CPJ.

"Journalists in distress - those who are being followed, harassed or intimidated, or those who are forced to flee or go into hiding - are most vulnerable to continued surveillance as they attempt to seek help," said CPJ Journalist Assistance Program Coordinator María Salazar-Ferro.

"Journalists' ability to securely convey information about their situation and needs in an easy manner from any place is key to CPJ being able to provide speedy support." CPJ installed, tested, and refined SecureDrop over several months in late 2015 and early 2016. CPJ staff technologist Tom Lowenthal led the technical aspects of the effort.

CPJ is a founding member of the ACOS Alliance, which stands for 'A Culture of Safety' and promotes the Freelance Journalist Safety Principles. - CPJ media release

KEY POINTS:

• SecureDrop facilitates anonymous communication for journalists reporting press violations.
• The system is equipped with strong encryption and two-factor authentication.
• Journalists can access SecureDrop via the Tor browser for enhanced privacy.
• CPJ aims to protect the identities of journalists even while offering assistance.
• SecureDrop was created by Aaron Swartz and Kevin Poulsen, and is maintained by the Freedom of the Press Foundation.