SecureDrop is an open source whistleblower platform designed to securely accept documents from and communicate with anonymous sources. It was initially written (mainly in Python) by the late Aaron Swartz with assistance from Kevin Poulsen and security expert James Dolan. Originally the project was named DeadDrop. In October 2013 the Freedom of the Press Foundation started to manage this project and renamed it to SecureDrop.
SecureDrop is a free whistleblower submission system that media organizations can use for secure communication, e.g. between journalists and their sources that wish to stay anonymous. For this purpose it uses the anonymity network, Tor. SecureDrop sites are only accessible as hidden services in the Tor network. When users visit a SecureDrop website, they are given a randomly generated code name. Then this code name can be used for a contact via SecureDrop messaging or to send information to a particular author or editor via uploading. The most important thing is that the news organization involved does not record any data about the uploader i.e. IP address, or information about the physical computer used. Moreover, the browser does not enable cookies or allow third party embedding.
The code behind SecureDrop is a Python application that accepts messages and documents from the web and GPG-encrypts them for secure storage. In some ways SecureDrop can be explained as a more secure version of the “contact us” form on usual news websites. Although anonymity is not guaranteed and there are always risks, the creators claim that the system is much safer than simple e-mail. In fact, since security is the main goal, SecureDrop attempts to create as secure environment as possible for sources to exchange information.
Target users of the SecureDrop project are news organizations and journalists that need to anonymously and securely accept documents and tips from sources. Two main problems in such interactions are: the third party and the metadata. First of all, it is easy for authorities to acquire information from email or phone providers without involving the news organization itself. Secondly, there is a digital trail - the metadata that can provide details of every contact between source and journalist.
SecureDrop tries to eliminate these issues by excluding the third party - the server that both source and journalist connect to is the news organization's property, so that risk of exposure is smaller. Encryption protects the data in transport and at rest. Also SecureDrop uses Tor hidden services to warrant that metadata is not saved at all or is deleted before publication and to make sure that a digital trail doesn’t exist.
Several large and influential organizations already operate their own instances of SecureDrop: The New Yorker, ProPublica, Forbes, The Intercept, BalkanLeaks, and the San Francisco Bay Guardian. As an anonymous electronic communication tool SecureDrop uses some of the most reliable security measures (GPG encryption, the Tor network, the Tails operating system, etc.) and integrates them in the user-friendly software. Visit securedrop page to get more information on the subject.