SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from and communicate with anonymous sources. It was originally created by the late Aaron Swartz and is currently managed by Freedom of the Press Foundation.
SecureDrop is a tool for sources to communicate securely with journalists. The SecureDrop application environment consists of three dedicated computers:
Secure Viewing Station: An airgapped laptop running the Tails operating system from a USB stick that journalists use to decrypt and view submitted documents. (If this laptop does not have a DVD drive, buy an external DVD drive you can use with it.)Application Server: Ubuntu server running two segmented Tor hidden services. The source connects to the first, public-facing Tor hidden service to send messages and documents to the journalist. The journalist connects to the second authenticated Tor hidden service to download encrypted documents and respond to sources.Monitor server: Ubuntu server that monitors theApplication Serverand sends email alerts.
In addition to these dedicated computers, the journalist will also use his or her normal workstation computer:
Journalist Workstation: The every-day laptop that the journalist uses for his or her work. The journalist will use this computer to connect to theApplication Serverto download encrypted documents that he or she will transfer to theSecure Viewing Station. TheJournalist Workstationis also used to respond to sources.
These computers should all physically be in your organization's office.
Before beginning installation, you should have two servers running Ubuntu Server 12.04.3 LTS, each with the grsec kernel patches installed. If you don't yet have those computers configured, see additional documentation for Preparing Ubuntu servers for installation.
You will need a DVD with the latest version of the Tails operating system burned to it. Go here for instructions on how to download and burn Tails to a DVD. You will only have to use this DVD once: After the first run from a Live DVD you can create a Live USB to boot from instead. If you already have a Tails Live USB, you may skip this requirement.
You will also need a total of three USB sticks:
- USB stick with Tails for the
Secure Viewing Station - USB stick for transfering files from the
Journalist Workstationto theSecure Viewing Station - USB stick for transfering files from the
Secure Viewing Stationto theJournalist Workstation
The Monitor Server also sends emails. You will need an SMTP server, such as your company's mail server.
Finally, you will also need to come up with and memorize a series of passphrases. The best way to generate secure passphrases is to follow the Diceware method. Generating secure passphrase takes time, so we recommend you generate these at the beginning of the installation process. You will need passphrases for:
Secure Viewing Station's Tails Persistent Volume that allows you to store filesSecure Viewing Station's GPG secret key
Each journalist will also need to come up with a password for login to the Application Server.
After installing and configuring Ubuntu Server on Application Server and Monitor Server, and downloading, verifying, and burning Tails to a Live DVD, follow the SecureDrop Installation Guide.
You can see live demos of the source and document interfaces at the following links. These are for testing purposes only; please don't submit any documents here!
In an actual SecureDrop setup, these websites are separate Tor hidden services running on the Application Server.
- Source Interface
- Journalist Interface (needs the ending slash to work)
SecureDrop is open source and released under the GNU General Public License v2.
The wordlist we use to generate source passphrases comes from Diceware, and is licensed under Creative Commons Attribution 3.0 Unported thanks to A G Reinhold.