What to Check Before Using SecureDrop
Before using SecureDrop, check the official destination, files, content, access environment, post-submission behavior, alternatives, and source protection risks.
SecureDrop is a system used by whistleblowers and sources to send materials more safely to news organizations and similar recipients.
However, using SecureDrop does not automatically make things safe. The submitted content, file metadata, access time, internal organization logs, real-world behavior, and the trustworthiness of the destination all matter.
For high-risk submissions, preparation before using the tool is important.
This article organizes what to check before using SecureDrop. For an actual submission, always check the official guidance from the destination.
What Is SecureDrop?
SecureDrop is an open-source whistleblowing platform that news organizations and similar organizations use to receive materials more safely from sources.
The official SecureDrop site provides information about the system, participating organizations, and documentation.
URL : https://securedrop.org/
| Element | Meaning | Caution |
|---|---|---|
| Destination | News organization or organization | Check whether it is truly the official channel |
| Tor use | Design that protects the communication path | Do not misuse Tor |
| Material submission | Sends files | Check metadata and content |
| Reply checking | Communicates with the destination | Checking times and content can become clues |
| Legal risk | Related to the submitted content | Consult a specialist if needed |
SecureDrop becomes meaningful only when there is a trustworthy destination and correct operation.
Check the Destination
Before using SecureDrop, check whether the destination is genuine.
Do not simply trust links found in search results or on social media. Go from the official site of the news organization or organization to its guidance.
| What to check | Reason |
|---|---|
| Whether you reached it from the official site | Avoid fake links |
| Who operates the destination | See whether the other party is trustworthy |
| What it accepts | Avoid inappropriate submissions |
| How replies work | Understand the later checking procedure |
| Whether risk explanations are provided | See whether submitter risk is addressed |
In anonymity, the destination is also part of the trust model.
Check the other party, not only the tool.
Check the Files and Content
Before submitting, check the file metadata and content.
Office documents, PDFs, images, videos, and audio can retain the creator, company name, location information, edit history, and comments. The body content can also suggest who could access the material.
| Check item | Reason |
|---|---|
| Creator information | Personal names or organization names remain |
| Filename | Case names or department names appear |
| Edit history | People involved become visible |
| Specific information in the body | The source can be inferred backward |
| Range of people who can access it | Candidate submitters narrow |
In whistleblowing, the content itself can be the strongest clue.
Even if metadata is removed, if only a small number of people could see the material, the candidates narrow.
Prepare the Environment Before Access
The environment used for access is also important when using SecureDrop.
Accessing from a workplace or school network, issued device, or monitored device is dangerous. Internal organization logs, device management, surveillance cameras, entry and exit records, and print history may be involved.
| What to check | Reason |
|---|---|
| Whether you are using an issued device | Management logs remain |
| Whether you are using an organization network | Connection records remain |
| Whether material access history remains | Candidates narrow |
| Whether there are real-world movement records | They connect with cameras or payment records |
| Whether you decided how to check after submission | Avoid standing out by accessing repeatedly |
For high-risk situations, do not make decisions from this article alone.
If there is legal risk or physical danger, consultation with a lawyer or a trusted support organization is necessary.
Decide Post-Submission Behavior in Advance
When using SecureDrop, behavior after submission also affects anonymity.
Checking repeatedly, searching for related news at work, sounding out coworkers, or reacting from real-name social media. These behaviors can become more dangerous clues than the actions before submission.
| Post-submission behavior | Risk | Alternative |
|---|---|---|
| Check frequently | Communication-time patterns appear | Decide the checking frequency |
| Search at work | Remains in internal organization logs | Check in a safer environment |
| Talk to people involved | Source candidates increase | Limit discussion to people or organizations you need to consult |
| React on real-name social media | Correlation with the person appears | Do not react |
| Send additional materials | Metadata and content risks increase | Recheck before adding anything |
Providing information does not end at the moment it is sent.
Think of before submission, during submission, and after submission as one operation.
There Are Also Options Other Than SecureDrop
SecureDrop is not the only way to provide information.
Depending on the news organization, Signal, postal mail, dedicated forms, in-person consultation, or another anonymous submission system may be available. Which method is better depends on the nature of the material, the risk, the destination, and the legal situation.
| Method | Caution |
|---|---|
| SecureDrop | Confirm the official channel, use Tor, and check materials |
| Signal | Look at how phone numbers and contacts are handled |
| Headers and sender information remain | |
| Postal mail | Consider surveillance cameras, postmarks, fingerprints, and purchase records |
| In-person consultation | Consider movement records and accompanying people |
For high-risk submissions, choose not simply a method that can send the information, but a method that can handle it safely.
Read the destination's official guidance, and if unsure, consult a trusted specialist or support organization.
Protect Not Only Yourself but Also Sources
When using SecureDrop, you need to protect not only yourself, but also people connected to the materials.
The content of the materials can reveal who could access them, who attended a meeting, who created them, or who was in a position to send them.
| Information to look at | Risk |
|---|---|
| Material viewing permissions | Candidate submitters narrow |
| Creator name | People involved are directly visible |
| Edit history | Who was involved becomes known |
| Timeline | Compared against access logs |
| Rarity of the content | People who know it are limited |
When providing sensitive information, inference from the content is extremely important, not only the communication path.
Before submission, organize how many people could see the material, when the material was touched, and where it could have been saved.
That organization itself becomes confidential information, so be careful not to save it in a real-name cloud account or on a workplace device.
SecureDrop helps with the submission route, but the safety of the submitted content must be checked separately.
Summary
SecureDrop is an important system for connecting sources with news organizations and similar recipients more safely.
However, using SecureDrop does not automatically make things safe.
The trustworthiness of the destination, file metadata, inference from content, access environment, internal organization logs, and real-world records all matter.
Before using it, check the official guidance, check the materials, and organize which behaviors could lead to identifying you or people involved.
For high-risk submissions, it is important not to judge too much alone.
Related tools
Tor Project
An external resource related to this article. Open it only when it fits your situation and threat model.
Why it is listed: It can help with the article topic, but it is outside Anonymity Sense and should be checked before use.
ExifTool
An external resource related to this article. Open it only when it fits your situation and threat model.
Why it is listed: It can help with the article topic, but it is outside Anonymity Sense and should be checked before use.
URL : https://exiftool.org/
SecureDrop
An external resource related to this article. Open it only when it fits your situation and threat model.
Why it is listed: It can help with the article topic, but it is outside Anonymity Sense and should be checked before use.
URL : https://securedrop.org/
GlobaLeaks
An external resource related to this article. Open it only when it fits your situation and threat model.
Why it is listed: It can help with the article topic, but it is outside Anonymity Sense and should be checked before use.
URL : https://globaleaks.org/