SecureDrop is a system used by whistleblowers and sources to send materials more safely to news organizations and similar recipients.
However, using SecureDrop does not automatically make things safe. The submitted content, file metadata, access time, internal organization logs, real-world behavior, and the trustworthiness of the destination all matter.
For high-risk submissions, preparation before using the tool is important.
This article organizes what to check before using SecureDrop. For an actual submission, always check the official guidance from the destination.
What Is SecureDrop?
SecureDrop is an open-source whistleblowing platform that news organizations and similar organizations use to receive materials more safely from sources.
The official SecureDrop site provides information about the system, participating organizations, and documentation.
SecureDrop becomes meaningful only when there is a trustworthy destination and correct operation.
Check the Destination
Before using SecureDrop, check whether the destination is genuine.
Do not simply trust links found in search results or on social media. Go from the official site of the news organization or organization to its guidance.
What to check
Reason
Whether you reached it from the official site
Avoid fake links
Who operates the destination
See whether the other party is trustworthy
What it accepts
Avoid inappropriate submissions
How replies work
Understand the later checking procedure
Whether risk explanations are provided
See whether submitter risk is addressed
In anonymity, the destination is also part of the trust model.
Check the other party, not only the tool.
Check the Files and Content
Before submitting, check the file metadata and content.
Office documents, PDFs, images, videos, and audio can retain the creator, company name, location information, edit history, and comments. The body content can also suggest who could access the material.
Check item
Reason
Creator information
Personal names or organization names remain
Filename
Case names or department names appear
Edit history
People involved become visible
Specific information in the body
The source can be inferred backward
Range of people who can access it
Candidate submitters narrow
In whistleblowing, the content itself can be the strongest clue.
Even if metadata is removed, if only a small number of people could see the material, the candidates narrow.
Prepare the Environment Before Access
The environment used for access is also important when using SecureDrop.
Accessing from a workplace or school network, issued device, or monitored device is dangerous. Internal organization logs, device management, surveillance cameras, entry and exit records, and print history may be involved.
What to check
Reason
Whether you are using an issued device
Management logs remain
Whether you are using an organization network
Connection records remain
Whether material access history remains
Candidates narrow
Whether there are real-world movement records
They connect with cameras or payment records
Whether you decided how to check after submission
Avoid standing out by accessing repeatedly
For high-risk situations, do not make decisions from this article alone.
If there is legal risk or physical danger, consultation with a lawyer or a trusted support organization is necessary.
Decide Post-Submission Behavior in Advance
When using SecureDrop, behavior after submission also affects anonymity.
Checking repeatedly, searching for related news at work, sounding out coworkers, or reacting from real-name social media. These behaviors can become more dangerous clues than the actions before submission.
Post-submission behavior
Risk
Alternative
Check frequently
Communication-time patterns appear
Decide the checking frequency
Search at work
Remains in internal organization logs
Check in a safer environment
Talk to people involved
Source candidates increase
Limit discussion to people or organizations you need to consult
React on real-name social media
Correlation with the person appears
Do not react
Send additional materials
Metadata and content risks increase
Recheck before adding anything
Providing information does not end at the moment it is sent.
Think of before submission, during submission, and after submission as one operation.
There Are Also Options Other Than SecureDrop
SecureDrop is not the only way to provide information.
Depending on the news organization, Signal, postal mail, dedicated forms, in-person consultation, or another anonymous submission system may be available. Which method is better depends on the nature of the material, the risk, the destination, and the legal situation.
Method
Caution
SecureDrop
Confirm the official channel, use Tor, and check materials
Signal
Look at how phone numbers and contacts are handled
Email
Headers and sender information remain
Postal mail
Consider surveillance cameras, postmarks, fingerprints, and purchase records
In-person consultation
Consider movement records and accompanying people
For high-risk submissions, choose not simply a method that can send the information, but a method that can handle it safely.
Read the destination's official guidance, and if unsure, consult a trusted specialist or support organization.
Protect Not Only Yourself but Also Sources
When using SecureDrop, you need to protect not only yourself, but also people connected to the materials.
The content of the materials can reveal who could access them, who attended a meeting, who created them, or who was in a position to send them.
Information to look at
Risk
Material viewing permissions
Candidate submitters narrow
Creator name
People involved are directly visible
Edit history
Who was involved becomes known
Timeline
Compared against access logs
Rarity of the content
People who know it are limited
When providing sensitive information, inference from the content is extremely important, not only the communication path.
Before submission, organize how many people could see the material, when the material was touched, and where it could have been saved.
That organization itself becomes confidential information, so be careful not to save it in a real-name cloud account or on a workplace device.
SecureDrop helps with the submission route, but the safety of the submitted content must be checked separately.
Summary
SecureDrop is an important system for connecting sources with news organizations and similar recipients more safely.
However, using SecureDrop does not automatically make things safe.
The trustworthiness of the destination, file metadata, inference from content, access environment, internal organization logs, and real-world records all matter.
Before using it, check the official guidance, check the materials, and organize which behaviors could lead to identifying you or people involved.
For high-risk submissions, it is important not to judge too much alone.
Related tools
Anonymous communication
Tor Project
An external resource related to this article. Open it only when it fits your situation and threat model.
Why it is listed: It can help with the article topic, but it is outside Anonymity Sense and should be checked before use.
Before using SecureDrop, check the official destination, files, content, access environment, post-submission behavior, alternatives, and source protection risks.