SecureDrop

{{Infobox software

| name = SecureDrop

| logo = SecureDrop logo.svg

| logo caption =

| logo_size = 150px

| logo_alt =

| screenshot = Screenshot from SecureDrop Source view.png

| caption = Screenshot from the SecureDrop Source interface.

| screenshot_size =

| screenshot_alt =

| collapsible =

| author = {{hlist|James Dolan|Kevin Poulsen|Aaron Swartz}}

| developer = Freedom of the Press Foundation

| released = {{Start date and age|2013|10|15|df=yes}}

| discontinued =

| latest release version = {{LSR/wikidata}}

| latest preview version =

| latest preview date =

| programming language = Python

| operating system = Linux

| platform =

| size =

| language =

| language count =

| language footnote =

| genre = Secure communication

| license = GNU Affero General Public License, version 3

| standard =

| website = {{Official URL}}

| AsOf =

}}

SecureDrop is a free software platform for secure communication between journalists and sources (whistleblowers).{{cite news|first1= James|last1=Ball|title= Guardian launches SecureDrop system for whistleblowers to share files|url=https://www.theguardian.com/technology/2014/jun/05/guardian-launches-securedrop-whistleblowers-documents|newspaper=The Guardian|date=5 Jun 2014}} It was originally designed and developed by Aaron Swartz and Kevin Poulsen under the name DeadDrop.{{cite web |url=http://www.techrepublic.com/blog/it-security/aaron-swartz-legacy-lives-on-with-new-yorkers-strongbox-how-it-works/ |title=Aaron Swartz legacy lives on with New Yorker's Strongbox: How it works |last1=Kassner |first1=Michael |date=20 May 2013 |website=TechRepublic |accessdate=20 May 2013 |archive-date=29 July 2013 |archive-url=https://web.archive.org/web/20130729032429/http://www.techrepublic.com/blog/it-security/aaron-swartz-legacy-lives-on-with-new-yorkers-strongbox-how-it-works/ |url-status=dead }}{{cite magazine|last1=Poulsen|first1=Kevin|title=Strongbox and Aaron Swartz|url=https://www.newyorker.com/news/news-desk/strongbox-and-aaron-swartz|magazine=The New Yorker|date=14 May 2013|language=en}} James Dolan also co-created the software.{{cite news|last1=Timm|first1=Trevor|title=A tribute to James Dolan, co-creator of SecureDrop, who has tragically passed away at age 36|url=https://freedom.press/news/tribute-james-dolan-co-creator-securedrop-who-has-tragically-passed-away-age-36/|work=Freedom of the Press Foundation|date=9 January 2018}}

History

After Aaron Swartz's death, the first instance of the platform was launched under the name Strongbox by staff at The New Yorker on 15 May 2013.{{cite magazine |url=http://www.newyorker.com/online/blogs/closeread/2013/05/introducing-strongbox-anonymous-document-sharing-tool.html |title=Introducing Strongbox |last1=Davidson |first1=Amy |authorlink1=Amy Davidson (author) |date=15 May 2013 |magazine=The New Yorker |accessdate=20 May 2013 }} The Freedom of the Press Foundation took over development of DeadDrop under the name SecureDrop, and has since assisted with its installation at several news organizations, including ProPublica, The Guardian, The Intercept, and The Washington Post.{{cite magazine|magazine=The New Yorker|url=https://projects.newyorker.com/strongbox/|title=Strongbox|accessdate=15 November 2013|archive-date=13 April 2017|archive-url=https://web.archive.org/web/20170413164430/https://projects.newyorker.com/strongbox/|url-status=dead}}{{cite arXiv|eprint=1308.6768|last1=Biryukov|first1=Alex|title=Content and popularity analysis of Tor hidden services|last2=Pustogarov|first2=Ivan|last3=Thill|first3=Fabrice|last4=Weinmann|first4=Ralf-Philipp|class=cs.CR|year=2013}}{{cite magazine|author=Davidson, Amy|date=15 May 2013|url=http://www.newyorker.com/online/blogs/closeread/2013/05/introducing-strongbox-anonymous-document-sharing-tool.html |title=Introducing Strongbox|magazine=The New Yorker|accessdate=26 December 2013}}

Security

SecureDrop uses the anonymity network Tor to facilitate communication between whistleblowers, journalists, and news organizations. SecureDrop sites are therefore only accessible as onion services in the Tor network. After a user visits a SecureDrop website, they are given a randomly generated code name. This code name is used to send information to a particular author or editor via uploading. Investigative journalists can contact the whistleblower via SecureDrop messaging. Therefore, the whistleblower must take note of their random code name.

The system utilizes private, segregated servers that are in the possession of the news organization. Journalists use two USB flash drives and two personal computers to access SecureDrop data. The first personal computer accesses SecureDrop via the Tor network, and the journalist uses the first flash drive to download encrypted data from the SecureDrop server. The second personal computer does not connect to the Internet, and is wiped during each reboot. The second flash drive contains a decryption code. The first and second flash drives are inserted into the second personal computer, and the material becomes available to the journalist. The personal computer is shut down after each use.

Freedom of the Press Foundation has stated it will have the SecureDrop code and security environment audited by an independent third party before every major version release and then publish the results.{{cite news|last1=Timm|first1=Trevor|title=SecureDrop Undergoes Second Security Audit|url=https://pressfreedomfoundation.org/blog/2014/01/securedrop-undergoes-second-security-audit|accessdate=13 July 2014|agency=Freedom of the Press Foundation|date=20 January 2014}} The first audit was conducted by security researchers at the University of Washington and Bruce Schneier.{{cite web|last1=Czeskis|first1=Alexei|last2=Mah|first2=David|last3=Sandoval|first3=Omar|last4=Smith|first4=Ian|last5=Koscher|first5=Karl|last6=Appelbaum|first6=Jacob|last7=Kohno|first7=Tadayoshi|last8=Schneier|first8=Bruce|title=DeadDrop/StrongBox Security Assessment|url=http://www.czeskis.com/research/pubs/UW-CSE-13-08-02.PDF|publisher=University of Washington Department of Computer Science and Engineering|accessdate=13 July 2014}} The second audit was conducted by Cure53, a German security firm.

SecureDrop suggests sources disabling JavaScript to protect anonymity.[https://docs.securedrop.org/en/stable/source.html Source Guide] SecureDrop

Prominent organizations using SecureDrop

The Freedom of the Press Foundation now maintains an official directory of SecureDrop instances. This is a partial list of instances at prominent news organizations.{{cite news|last1=ssteele|title=Tor at the Heart: SecureDrop|url=https://blog.torproject.org/tor-heart-securedrop|work=Tor Blog|date=6 December 2016|language=en}}

Name of organization	Implementation date
class="wikitable"
The New Yorker{{cite web \| url=https://securedrop.org/directory \| title=The Official SecureDrop Directory \| publisher=Freedom of the Press Foundation \| accessdate=January 29, 2017}} \| {{nowrap\|15 May 2013}}
Forbes{{cite web\|last=Kirchner\|first=Lauren\|title=When sources remain anonymous\|url=https://www.cjr.org/behind_the_news/securedrop_etc.php\|publisher=Columbia Journalism Review\|accessdate=28 January 2014}}{{cite web\|last=Timm\|first=Trevor\|title=Forbes Launches First Updated Version of SecureDrop Called SafeSource\|date=29 October 2013 \|url=https://pressfreedomfoundation.org/blog/2013/10/forbes-launches-first-updated-version-securedrop-called-safesource\|publisher=Freedom of the Press Foundation\|accessdate=28 January 2014}}{{cite web\|last=Greenberg\|first=Andy\|title=Introducing SafeSource, A New Way To Send Forbes Anonymous Tips And Documents\|url=https://www.forbes.com/sites/andygreenberg/2013/10/29/introducing-safesource-a-new-way-to-send-forbes-anonymous-tips-and-documents/\|work=Forbes\|accessdate=28 January 2014}} \| {{nowrap\|29 Oct 2013}}
Bivol{{cite web\|last=Chavkin\|first=Sasha\|title=Initiatives seek to protect anonymity of leakers\|date=21 October 2013 \|url=http://www.icij.org/blog/2013/10/initiatives-seek-protect-anonymity-leakers\|publisher=The International Consortium of Investigative Journalists\|accessdate=28 January 2014}} \| {{nowrap\|30 Oct 2013}}
ProPublica{{cite web\|last=Tigas\|first=Mike\|title=How to Send Us Files More Securely\|date=27 January 2014 \|url=https://www.propublica.org/nerds/item/how-to-send-us-files-more-securely\|publisher=ProPublica\|accessdate=28 January 2014}}{{cite web\|last=Timm\|first=Trevor\|title=ProPublica Launches New Version of SecureDrop\|date=27 January 2014 \|url=https://pressfreedomfoundation.org/blog/2014/01/propublica-launches-new-version-securedrop\|publisher=The Freedom of the Press Foundation\|accessdate=28 January 2014}} \| {{nowrap\|27 Jan 2014}}
The Intercept{{cite web\| title=How to Securely Contact The Intercept\|url=https://firstlook.org/theintercept/securedrop/\|publisher=The Intercept\|accessdate=9 February 2014}} \| {{nowrap\|10 Feb 2014}}
San Francisco Bay Guardian{{cite news\|last=Bowe\|first=Rebecca\|title=Introducing BayLeaks\|url=http://www.sfbg.com/2014/02/18/introducing-bayleaks\|accessdate=20 February 2014\|newspaper=San Francisco Bay Guardian\|date=18 February 2014}} \| {{nowrap\|18 Feb 2014}}
The Washington Post{{cite web\| title=Q&A about SecureDrop on The Washington Post\|url=https://www.washingtonpost.com/pr/wp/2014/06/05/qa-about-securedrop-on-the-washington-post/\|date=5 June 2014\|newspaper=The Washington Post}} \| {{nowrap\|5 Jun 2014}}
The Guardian \| {{nowrap\|6 Jun 2014}}
The Globe and Mail{{cite web\| title=The Globe adopts encrypted technology in effort to protect whistle-blowers\|url=https://www.theglobeandmail.com/news/investigations/the-globe-adopts-encrypted-technology-in-effort-to-protect-whistle-blowers/article23302598/\|date=4 March 2015\|newspaper=The Globe and Mail}} \| {{nowrap\|4 Mar 2015}}
Radio-Canada \| {{nowrap\|20 Jan 2016}}
Canadian Broadcasting Corporation{{cite web\| title=CBC adopts SecureDrop to allow for anonymous leaks\|url=http://www.cbc.ca/news/technology/cbc-securedrop-whistleblowers-1.3412450\|date=29 January 2016}} \| {{nowrap\|29 Jan 2016}}
Committee to Protect Journalists{{cite web\|url=https://cpj.org/2016/05/how-securedrop-helps-cpj-protect-journalists/\|title=How SecureDrop helps CPJ protect journalists\|date=12 January 2016\|work=Committee to Protect Journalists}} \| {{nowarp\|12 May 2016}}
Associated Press \| {{nowrap\|18 Oct 2016}}
The New York Times{{cite tweet \| user=trevortimm \| author=Timm, Trevor \| number=809385191374553088 \| date=15 December 2016 \| title=Nice. The @NYTimes launched @SecureDrop today, along with a really useful secure tips page }} \| {{nowrap\|15 Dec 2016}}
BuzzFeed News \| {{nowrap\|21 Dec 2016}}
USA Today{{cite web\| title=USA TODAY launches secure whistle-blower site\|website=USA Today\|url=https://www.usatoday.com/story/news/2017/02/22/usa-today-network-launches-securedrop-whistleblower-site/98068810/\|date=22 February 2017}} \| {{nowrap\|22 Feb 2017}}
Bloomberg News \|Unknown
The Wall Street Journal \|Unknown
Aftenposten \|Unknown
Australian Broadcasting Corporation{{cite news\| title=ABC launches SecureDrop for whistleblowers to securely and anonymously contact journalists\|newspaper=ABC News\|url=https://www.abc.net.au/news/2019-11-28/securedrop-installed-for-contacting-abc-journalists-anonymously/11708200\|date=28 November 2019}} \| {{nowrap\|28 Nov 2019}}

Awards

2016: Free Software Foundation, Free Software Award, Award for Projects of Social Benefit{{cite news|last1=Sullivan|first1=John|title=SecureDrop and Alexandre Oliva are 2016 Free Software Awards winners|url=https://www.fsf.org/news/securedrop-and-alexandre-oliva-are-2016-free-software-awards-winners|work=Free Software Foundation|date=25 March 2017|language=en|format=Press Release}}

References

External links

{{URL|https://securedrop.org/|SecureDrop.org}}
{{Github|freedomofpress/SecureDrop|SecureDrop}}
[https://freedom.press/organizations/securedrop/ SecureDrop] at Freedom of the Press Foundation

Category:Sources (journalism)

Category:Free content management systems

Category:Free software programmed in Python

Category:2013 software

Category:Whistleblowing

Category:Tor onion services

Category:Software using the GNU Affero General Public License

Name of organization	Implementation date
class="wikitable"
The New Yorker{{cite web \| url=https://securedrop.org/directory \| title=The Official SecureDrop Directory \| publisher=Freedom of the Press Foundation \| accessdate=January 29, 2017}} \| {{nowrap\|15 May 2013}}
Forbes{{cite web\|last=Kirchner\|first=Lauren\|title=When sources remain anonymous\|url=https://www.cjr.org/behind_the_news/securedrop_etc.php\|publisher=Columbia Journalism Review\|accessdate=28 January 2014}}{{cite web\|last=Timm\|first=Trevor\|title=Forbes Launches First Updated Version of SecureDrop Called SafeSource\|date=29 October 2013 \|url=https://pressfreedomfoundation.org/blog/2013/10/forbes-launches-first-updated-version-securedrop-called-safesource\|publisher=Freedom of the Press Foundation\|accessdate=28 January 2014}}{{cite web\|last=Greenberg\|first=Andy\|title=Introducing SafeSource, A New Way To Send Forbes Anonymous Tips And Documents\|url=https://www.forbes.com/sites/andygreenberg/2013/10/29/introducing-safesource-a-new-way-to-send-forbes-anonymous-tips-and-documents/\|work=Forbes\|accessdate=28 January 2014}} \| {{nowrap\|29 Oct 2013}}
Bivol{{cite web\|last=Chavkin\|first=Sasha\|title=Initiatives seek to protect anonymity of leakers\|date=21 October 2013 \|url=http://www.icij.org/blog/2013/10/initiatives-seek-protect-anonymity-leakers\|publisher=The International Consortium of Investigative Journalists\|accessdate=28 January 2014}} \| {{nowrap\|30 Oct 2013}}
ProPublica{{cite web\|last=Tigas\|first=Mike\|title=How to Send Us Files More Securely\|date=27 January 2014 \|url=https://www.propublica.org/nerds/item/how-to-send-us-files-more-securely\|publisher=ProPublica\|accessdate=28 January 2014}}{{cite web\|last=Timm\|first=Trevor\|title=ProPublica Launches New Version of SecureDrop\|date=27 January 2014 \|url=https://pressfreedomfoundation.org/blog/2014/01/propublica-launches-new-version-securedrop\|publisher=The Freedom of the Press Foundation\|accessdate=28 January 2014}} \| {{nowrap\|27 Jan 2014}}
The Intercept{{cite web\| title=How to Securely Contact The Intercept\|url=https://firstlook.org/theintercept/securedrop/\|publisher=The Intercept\|accessdate=9 February 2014}} \| {{nowrap\|10 Feb 2014}}
San Francisco Bay Guardian{{cite news\|last=Bowe\|first=Rebecca\|title=Introducing BayLeaks\|url=http://www.sfbg.com/2014/02/18/introducing-bayleaks\|accessdate=20 February 2014\|newspaper=San Francisco Bay Guardian\|date=18 February 2014}} \| {{nowrap\|18 Feb 2014}}
The Washington Post{{cite web\| title=Q&A about SecureDrop on The Washington Post\|url=https://www.washingtonpost.com/pr/wp/2014/06/05/qa-about-securedrop-on-the-washington-post/\|date=5 June 2014\|newspaper=The Washington Post}} \| {{nowrap\|5 Jun 2014}}
The Guardian \| {{nowrap\|6 Jun 2014}}
The Globe and Mail{{cite web\| title=The Globe adopts encrypted technology in effort to protect whistle-blowers\|url=https://www.theglobeandmail.com/news/investigations/the-globe-adopts-encrypted-technology-in-effort-to-protect-whistle-blowers/article23302598/\|date=4 March 2015\|newspaper=The Globe and Mail}} \| {{nowrap\|4 Mar 2015}}
Radio-Canada \| {{nowrap\|20 Jan 2016}}
Canadian Broadcasting Corporation{{cite web\| title=CBC adopts SecureDrop to allow for anonymous leaks\|url=http://www.cbc.ca/news/technology/cbc-securedrop-whistleblowers-1.3412450\|date=29 January 2016}} \| {{nowrap\|29 Jan 2016}}
Committee to Protect Journalists{{cite web\|url=https://cpj.org/2016/05/how-securedrop-helps-cpj-protect-journalists/\|title=How SecureDrop helps CPJ protect journalists\|date=12 January 2016\|work=Committee to Protect Journalists}} \| {{nowarp\|12 May 2016}}
Associated Press \| {{nowrap\|18 Oct 2016}}
The New York Times{{cite tweet \| user=trevortimm \| author=Timm, Trevor \| number=809385191374553088 \| date=15 December 2016 \| title=Nice. The @NYTimes launched @SecureDrop today, along with a really useful secure tips page }} \| {{nowrap\|15 Dec 2016}}
BuzzFeed News \| {{nowrap\|21 Dec 2016}}
USA Today{{cite web\| title=USA TODAY launches secure whistle-blower site\|website=USA Today\|url=https://www.usatoday.com/story/news/2017/02/22/usa-today-network-launches-securedrop-whistleblower-site/98068810/\|date=22 February 2017}} \| {{nowrap\|22 Feb 2017}}
Bloomberg News \|Unknown
The Wall Street Journal \|Unknown
Aftenposten \|Unknown
Australian Broadcasting Corporation{{cite news\| title=ABC launches SecureDrop for whistleblowers to securely and anonymously contact journalists\|newspaper=ABC News\|url=https://www.abc.net.au/news/2019-11-28/securedrop-installed-for-contacting-abc-journalists-anonymously/11708200\|date=28 November 2019}} \| {{nowrap\|28 Nov 2019}}