What to Check Before Whistleblowing
Before whistleblowing, check purpose, materials, devices, networks, internal logs, official destinations, content clues, post-submission behavior, and consultation needs.
In whistleblowing, the time before pressing the send button matters most.
Materials, messages, screenshots, and files that have been sent once are saved by the recipient. Sending time, communication route, filenames, author information, document content, and device traces become material for narrowing the candidate pool later.
In whistleblowing, the other party may be able to see internal organizational logs, access permissions, and operation records.
For that reason, simply "not writing your name" is not enough.
This article organizes items to check before whistleblowing in the order of purpose, materials, device, destination, time, and consultation.
Organize the Purpose
First, organize why you are making the report.
Providing information to a news organization, internal reporting, consulting an administrative agency, consulting about a labor issue, and preserving evidence of harm require different appropriate recipients and procedures.
| Purpose | What to check |
|---|---|
| Providing information to a news organization | Safety of the intake point, source protection, handling of materials |
| Internal reporting | Independence of the reporting desk, logs, retaliation risk |
| Consulting an administrative or supervisory agency | Procedure, identity verification, submitted materials |
| Consulting about a labor issue | Evidentiary value, timeline, lawyer or support contact |
| Recording harm | Evidence preservation before deletion, safety measures |
If the purpose is vague, you may choose the wrong recipient.
In whistleblowing, choosing the recipient greatly affects anonymity and safety.
Check the Materials
Internal materials retain information beyond the body text.
Author, edit history, comments, distribution numbers, file paths, internal terminology, watermarks, viewing permissions, and access history. These become clues that show who had the materials or who created them.
| Check item | What to look at |
|---|---|
| Author information | Whether real names, department names, or device names remain |
| Change history | Whether editors, reviewers, or comments remain |
| Filename | Whether case names, department names, dates, or personal names appear |
| Watermarks and identifiers | Whether they indicate the distribution destination or recipient |
| Specific expressions in the body | Whether the range of people who know them is narrow |
The basic rule is not to send originals as-is.
However, if evidentiary value is important, do not alter materials carelessly. If you do not know what may be altered, consult a lawyer or the receiving news organization.
Check the Device and Network
Work devices and workplace networks are not suitable for whistleblowing.
On company PCs, work smartphones, internal Wi-Fi, company VPNs, work email, and managed cloud systems, operation logs, communication logs, file access, printing, and download history may remain.
| What you are about to use | Risk |
|---|---|
| Company PC | File operations, browser history, and USB connections may be recorded |
| Work smartphone | Management apps and communication history may be involved |
| Internal Wi-Fi | Connection times and destinations may remain |
| Company VPN | The organization may retain the route even for external communication |
| Work email | Sending history and attachment history may be audited |
If you are thinking about anonymity, separate the device, communication route, and account.
However, in high-risk cases, the more you experiment on your own, the more traces you may create. Check the procedure of a trusted intake point first.
Assume Internal Organizational Logs
In whistleblowing, think not only about public information, but also about cross-checking against internal organizational logs.
Who opened the document, who printed it, who downloaded it, who accessed external storage. This information may not be visible to outside people, but it may be visible to organizational administrators or investigators.
| Internal organizational log | Why candidates narrow |
|---|---|
| Document access logs | Show who opened the materials |
| Print logs | The person who printed, time, and document name may remain |
| Download history | Shows when materials were taken out |
| Email search logs | May show which materials were searched for |
| Entry and exit records | Behavior times connect with sending times |
In whistleblowing, the other party does not necessarily look only at "the published materials."
Think on the assumption that the materials will be compared against records of people who touched them.
Check the Destination
In whistleblowing, it is important that the destination can receive materials safely.
Some news organizations and NGOs have dedicated intake points for anonymous information provision. SecureDrop and GlobaLeaks are mechanisms used as those kinds of intake points.
SecureDrop is an open-source system for news organizations and NGOs to receive anonymous information submissions.
URL : https://securedrop.org/
GlobaLeaks is free and open-source software for building whistleblowing platforms.
URL : https://globaleaks.org/
What matters is confirming whether it is the official intake point.
Do not simply trust links found in search results or on social media. Check the guidance from the official page of the news organization or group.
Check Whether the Content Narrows Candidates
Even if the materials are made safer, the content can still narrow the candidate pool.
If "only three people can see this material," "only people at this meeting know this," or "this department's wording remains," then removing metadata is still dangerous.
| Content clue | Risk |
|---|---|
| Meeting name and date/time | Attendees become candidates |
| Department-specific wording | Affiliation is inferred |
| Material number | Compared with distribution destinations and management history |
| Facts known only by a small group | Candidates narrow at once |
| Tone and explanation order | Position or job type appears |
If you blur the content too much, evidentiary value may decrease.
It is safer to decide what to hide and what to keep in consultation with the recipient or a specialist.
Think About Behavior After Sending
Whistleblowing does not end at the moment you send it.
Deleting related documents immediately after sending, acting unnaturally at work, talking to people around you, or hinting on social media. These behaviors also become material for correlation.
| Behavior after sending | Risk |
|---|---|
| Suddenly deleting documents | Draws attention during an investigation |
| Talking to people around you | Information routes spread |
| Hinting on social media | Anonymous posting and the person become connected |
| Checking the intake point repeatedly | Communication and behavior times increase |
| Sudden change in attitude | Suspicion arises from internal relationships |
Before sending, decide the method of contact after sending and how often to check.
Final Conditions for Stopping
If any of the following conditions apply, stop sending.
| Condition for stopping | Reason |
|---|---|
| Material metadata has not been checked | Author or distribution information may remain |
| You are using a workplace device | It may remain in organizational logs |
| You do not know whether the destination is official | There is a danger of sending to a fake intake point |
| The content narrows candidates to a small number | Identity can be inferred from the body text alone |
| Legal judgment is needed | Deciding alone can be dangerous |
Whistleblowing is high-risk.
If you are unsure, consult before sending.
Summary
Before whistleblowing, check the purpose, materials, device, communication route, destination, and posting time.
Even if you do not write your name, the candidate pool can narrow from document metadata, internal terminology, distribution scope, access logs, and sending time.
Intake points such as SecureDrop and GlobaLeaks are practical options, but tools alone are not enough for safety. Confirm the official intake point and also manage the correlation of devices, materials, and behavior.
If there is legal risk or personal danger, do not decide alone. Consult a lawyer, support group, trusted news organization, or similarly appropriate place.
Related tools
ExifTool
An external resource related to this article. Open it only when it fits your situation and threat model.
Why it is listed: It can help with the article topic, but it is outside Anonymity Sense and should be checked before use.
URL : https://exiftool.org/
MAT2
An external resource related to this article. Open it only when it fits your situation and threat model.
Why it is listed: It can help with the article topic, but it is outside Anonymity Sense and should be checked before use.
SecureDrop
An external resource related to this article. Open it only when it fits your situation and threat model.
Why it is listed: It can help with the article topic, but it is outside Anonymity Sense and should be checked before use.
URL : https://securedrop.org/
GlobaLeaks
An external resource related to this article. Open it only when it fits your situation and threat model.
Why it is listed: It can help with the article topic, but it is outside Anonymity Sense and should be checked before use.
URL : https://globaleaks.org/