Hacker News new | past | comments | ask | show | jobs | submit login
How to Leak to the Press (wired.com)
236 points by phxql on June 7, 2013 | hide | past | favorite | 100 comments



Feels a bit overkill and way too identifying - security cameras + internet records + GPS locations will all help track you down, even if they are intermittent.

Buy a stack of envelopes from a supermarket. Buy a stack of stamps. Buy a USB. Acquire all with cash. Transfer all files to the USB via live CD - make sure all meta-data is stripped and files are redacted to avoid fingering you. Handle the envelopes/stamps/USB with care - gloves + hairnets + have a shower before handling (skin cells). Print the addresses (be careful here - printers sometimes put identifying marks - get the most common inkjet that doesn't use dots). Print a message and stick it in the envelope - e.g. "USB contains leaked NSA documents on massive domestic spying. Copy files to your computer then destroy and dump USB then burn the envelope to ensure your own security." Put the stamp on. Drop the letter in the mailbox - try and get a journalist's home address, they'll read it.

Repeat for multi-journalist dump.

Make sure you don't lick the stamps and drop the letters off in physically separated postboxes without security cameras.

You do not want to be in constant communication with journalists/people whilst doing any of this, because the more you talk with them, the more you leak. You want to just strip all identifying data, dump your leak, and run. This tactic has been used for ages to transfer sensitive data, most notably by kidnappers (ransom notes), spies (easy data transfer), whistle blowers (documents) and serial killers (think Ted Kaczynski).


>Print the addresses (be careful here - printers sometimes put identifying marks - get the most common one)

Printer steganography is usually limited to color laser printers and high-end inkjets. Buying a common one unfortunately won't help you. Included in the codes that have been cracked is the serial number of the printer as well as a date and time stamp of the printout.

Source: http://en.wikipedia.org/wiki/Printer_steganography


Couldn't you just buy a cheap printer with cash, use it, and then dump it as well, perhaps leave it in a charity bin somewhere.

Printers are pretty cheap these days, and it seems that in order for any of the markings to be useful they would have to find the printer in question in your possession/prove it was your printer.


The more purchases they can tie to the event, the more information they have and the more chances to track you down. You can slip up at any point- for example, say you buy the printer at Best Buy, and they figure out based on the S/N which Best Buy and what day the sale was made. You can't turn off security cameras in Best Buy.

The fewer transactions, the better.


or buy a crappy one from goodwill or a pawn shop, pawn shop might have cameras goodwill probably not


An old dot-matrix or label / thermal receipt printer will do. Buy it at a Flea Market / yard Sale / hamfest / craigslist. Make sure you get a ribbon with it ;)


they will catch you trying to get a dot-matrix printer working


Why not just use Kinko's?


Cut the letters out of a common magazine or newspaper then.


Just write with a thick generic pen using your non-dominant hand.


Use a letter stencil? One of those plastic stencils.


That should do it too, you can even make it yourself with a piece of cardboard and a sharp knife.


Probably take fingerprints of someone on the envelope too? Randomize it and complicate it so much that the idea of finding you dies the most desperate death.

Ha ha, the situation feels 'arrived' at fictional level already!


Cut the common letters out of a newspaper or magazine.


Or typewriter.


Being completely anonymous with no method for followup questions makes it difficult for the journalist to publish your leak. I suggest you be very patient if you go this route as any reputable journalist will have to independently find another source or verify the documents.


A multi-journalist dump + impressive documents + ambitious journalists + at their home addresses = highly likely publication without getting you sent to Gitmo. Make sure journalists are already on side with you though - aka people that have already argued against whatever cause you wish to damage.

However, if the documents are uniquely identifying and of incredible importance then you will want to go public, and you will want to go loud; have your face plastered everywhere, documents in every conceivable location, send them to thousands of journalists via email, scream your identity to the roof tops, don't go to ground, go to press conferences, and leave the country if at all possible before you do go loud.


Too much work. Watch homeland and drink amazing wine on your 100K+ salary. Tearfully wish the country wasn't descending into the cauldron ...


I think that's both unfair and inaccurate. You don't want someone to publish a story based a single anonymous source and unverified documents. That's how bogus stories about Benghazi emails or George W Bush's military record get made.


I am positive that you have the facts about George W. Bush's military record wrong.

The real story there is that all of the pertinent facts, with evidence, appeared in the BBC. Greg Palast was responsible for a lot of it. When CBS wanted to report on the story, they were given all of that, then went and did their own digging.

In the process of digging they were given a perfect memo that they ran with without authenticating properly. The memo turned out to be too good to be true, and was a forgery. The result is that everyone was left believing that the whole thing was based on a forgery.

But it wasn't. All of the key facts were uncovered earlier by the BBC and the planted forgery was merely a clever way to discredit the story. After Dan Rather painfully took a public fall over it, the issue became radioactive for all US media organizations.

See http://www.gregpalast.com/dan-crashes-bush-flies-high/ for Greg Palast's view on what happened to Dan Rather.


I don't care about George W Bush's military record and I don't think it changes my point.


I do not disagree with your point, but your example undermined it. It is therefore an example that you should avoid in the future.

When I find out that I've had the facts on an important issue wrong, my response is to say, "Thank you," because I learned something.

shrug


You can provide avenues for followups without compromising anonymity. This is one of the things dead drops are for.


This advice is dangerous, because the author fails to mention other precautions the user can and should take, such as:

* Use a Linux live CD on the "burner laptop" -- don't trust the preinstalled OS

* Change the MAC address of the Wifi used to connect at the internet cafe

* Use Tor, most easily via the Vidalia browser bundle

The author also does not mention that leaking documents can expose the whistleblower via watermarking and user information embedded in the file (most infamously in MS Word documents with versioning).

Edit: update formatting


> Use a Linux live CD on the "burner laptop" -- don't trust the preinstalled OS

Tails is a Linux distribution aimed at privacy and anonymity.

(https://tails.boum.org/)


I know I'm being paranoid, but I feel uneasy using a privacy-aimed distribution for privacy. The whole obvious target thing.


This is where the 'many eyes' things comes into play; if the whole distro is OSS, then you can be pretty sure that it's good.


Most people never review source code, and they certainly don't disassemble and review all the binaries. 'Many eyes' is a security fallacy in cases like this.


Tails is ridiculously well known; if something was bad in it, it would be big news.


If it was found. Which is the point.

Debian, which is much better known and in much wider circulation than Tails generated weak SSH keys for two years. Yes, it was indeed very big news. When it was found. After two years.

Oh, and tin-foil-hat on: Do we know (actually know-know, not just assume, think, trust) that the weakness wasn't planted there?


TAILS is actually now done by the Tor Project, so I think they have a vested interest in vetting it before it is released.

https://www.torproject.org/projects/projects/


And Debian doesn't have a vested interest in making sure a central security component isn't weakened?

Also, how do you know that Tor and Tails aren't infiltrated by the enemy (for any value of "enemy")?


Buy a long-range WiFi antenna and connect from a distant location instead of going to an Internet cafe where you can be recorded by a lot of cameras in the way.


This! Who cares if the laptop is a "burner" if you were caught on Starbucks cameras opening a laptop minutes before the communication was sent, in a place you'd never normally go?

Or parking up and walking past the bank next to the coffeeshop a few more minutes before entering the coffeeshop?

You have to be even more paranoid if you are on a short list of people with access to the information - they will pull up all of your movements, possibly check traffic cameras for your care movements, etc.

Long range Wi Fi just makes so much more sense.


Fears of watermarking is probably why the leaked documents are what they are. A court order and a training slide deck are the kind of thing that people are authorized to distribute internally.


Which is why you need a co-leaker. Dangerous yes, but you can at least compare documents between each other. Extract the text, strip the UTF down to ascii and fix the whitespace...

Hell, even have it transcribed by a typist. Full air-gap. This whole leaking business needs to be turned into an SEO optimized translated wiki page.


Agreed. The author obviously knows little about opsec.


you can get distros for the raspberry pi that hack wifi networks these days.


...feeding the information to the phone company which retains this information for weeks, months, even years. Just a warrant-step away.

The warrant comment suddenly sounds old-fashioned.


FTA: "There’s another option I didn’t originally mention here — leaking over mail. Investigative journalist Julia Angwin of the Wall Street Journal points out that physical mail, dropped in a random post-box with a bogus return address, is perhaps the best way for anonymous one-way communication."

DO NOT DO THIS! Every printer leaves a microscopic fingerprint on every printout. The printouts can be traced back to your printer. If it's an office printer, that still narrows it down considerably.

Even electronic documents can have watermarks, etc. For photographs, there's the EXIF information, for instance. If you want to share a photo, pipe it through "djpeg | pnmscale 0.99 | cjpeg -quality 90" first. It will get rid of EXIF, and also re-compress the image, changing its signature.


Interesting, I didn't know about printer fingerprints.

But I think there are still ways to workaround this. You could print the doc in an internet cafe, or buy a cheap printer and then destroy it, or print it and then take a low quality photocopy. You could even write it by hand or on a typewriter.


A photocopier is a (scanner+printer), so the problem remains.

Your best bet is large flea markets, where you can buy stuff like WiFi dongles, etc. with cash. Then wait a while before you use them.

I can't believe I'm having to write this, either. This is like giving instructions to a Soviet activist in the Cold War days, but ironically it is in my own country. How did we fall so far?


> How did we fall so far?

Fall? You'd have to give the same instructions to a Soviet activist in the Cold War days here.


"buy a cheap printer and then destroy it"

Have somebody else buy it with cash only. Surveillance cameras catching you with a printer and then not able to explain where it went will not go well.

I can't believe I actually am saying this. I truly can't believe that we are all having these kinds of conversations about something that should be as trivial as telling the truth. This is the kind of stuff I imagine the Russian mob would do, not employees of the US government who have a conscious. It is truly despicable and makes me a bit nauseated. The worse part is there doesn't seem like a fix and there doesn't seem like there is anywhere else to go to avoid this.


I should mention that actual watermarks in digital media (images, audio, video, etc.) will not be removed by recompressing the media. These watermarks are specifically designed to remain readable through compression and simple transformations. This technology is widely available commercially, so presumably the government has even more robust versions.



You would still want to use a tablet/laptop as they described to connect to TOR and DeadDrop.


It seems to be often said that on the order of 1/3 of the Tor Exit/Entry nodes are run by the NSA.


Interesting, do you have a source for this?


In Russia you have to provide passport in order to buy a sim card.


That may be the law but in places like Russia you can also just hand them 20 USD to look the other way.


I'm not sure why you were downvoted; this is true in many places in the world.


Question about cash: do banks keep track of the bills that are dispensed through ATMs? If so, it's probably safer to break your bills first.

Also, be aware of cameras near the internet cafes or places you intend to use the burner phone.


Love the quote "Even the head of the CIA can’t email his mistress without being identified by the FBI." :-)


The leaking via gmail has an issue:

In many cases when creating a new gmail account, you have to provide a phone number for an automatic text verification code.


yeah, I was going to say this as well. sometimes they ask for a phone number, and sometimes they don't.

I wonder what triggers it, maybe if a lot of different Google Accounts log in from that single IP, it assumes it's some open coffeeshop wifi or similar?


True. The article has so many mistakes in it, it's almost as if it's written by the government !! We need a new article.


Pull the sim card, and smash THAT with a hammer. Don't just smash the whole phone - you're unlikely to destroy the sim card, which is the most incriminating part of your phone.


Or toss the whole thing in a fire.


Or use a website that has an Anonymous Drop Box. Wikileaks did have one, but its no longer operational. I think a few mainstream media organisations copied the idea and claimed to have anonymous drop boxes?

e.g New Yorker has one, called Strongbox - http://www.newyorker.com/online/blogs/closeread/2013/05/intr... - powered by Tor, designed by Aaron Swartz and others, and open-sourced as DeadDrop http://deaddrop.github.io/


Although, first comment on the new yorker post is a good explanation of why StrongBox might not be enough http://fyre.it/i3tCXN.4


It sounds like we need to provide time delay for file transfer as a Tor hidden service.


Clicking on the comments link does not reveal any comments. I'm getting a "Subscribe now to get more of The New Yorker's signature mix of politics, culture, and the arts. "


I get the same. Might be related to the fact that I use Ghostery to block absolutely everything. I was starting to feel too paranoid about that, but now I think it's totally justified.


Oh, correct! Must be Ghostry as I use it as well.


It is Ghostery. Pause it and the comments will appear.



Out of curiosity, why not just send a letter in the post?

Pretty hard to trace an anonymous letter.

EDIT: Just spotted the update. Question answered.


Take in account they'll look at fingerprints, sweat, DNA, type of paper, ink and type of printer used. Spelling errors, how you wrote something, etc can also be used to identify you. (Every printer leaves it's own watermark). Perhaps best to print and use a old 2nd hand xerox machine to copy everything or fax it from a public faxservice.


Write in foreign language you do not master well. All your errors are then "childish" and untraceable.


Or run it through Google translate (or equivilent) a few times and manually correct any critical words in the end result.


Hopefully it doesn't log the messages... or does it?


There are plenty of old typewriters lying around. Although you would still have to take precautions like getting rid of it afterwards and make sure it does not make use of polymer tape ribbons (in which case you would have to destroy and discard that as well).



Sure, but the government wouldn't have a database of those anywhere and getting rid of a typewriter isn't likely to get anybody noticed (I cleaned up in the attick the other day, can you believe what I found?).


Good link, thanks.


Even better, receipt / thermal printers. No ribbon and pretty much untraceable. Lots of them lying around second hand in flea markets and yard sales.


Or maybe not that hard.

"Feds: Postal Service photographs every piece of mail it processes"

http://www.thesmokinggun.com/documents/woman-arrested-for-ob...


The bigger point is that journalists usually need to go back and forth with you.


Here is a good guide from Cryptome http://cryptome.org/cryptome-anon.htm


Tell the reporter to mail you at Mailinator or Lockbin.com and retrieve their messages by connecting with TOR.


Or tell the reporter to take out a classified ad in a free, public paper distributed in the nearest large metropolitan area.

The communications from the reporter don't need to be private or targeted. Everyone will know he's involved when he publishes, and he can reasonably encode questions by referring to the documents already sent. "MR X, CAN YOU PROVIDE FURTHER INFORMATION ON THE EVENTS DISCUSSED ON PAGE 13."


The communications from the journalist certainly do need to be private. Advertising that you are working on a story that will reveal big government secrets is a good way to be put under surveillance to find out who is doing the leaking to you. The journalist would not want to announce to the world that the process of receiving classified information is ongoing.


The ad can be written so as to look innocuous to anyone other than the journalist and the leaker, if those two can agree on a format for doing so.


The Boston bombing also shows that you should cloak your identity physically. Hat and sunglasses at least. The one who didn't hide his identity is the one who was easily identified.


Hat and sun glasses?

No, get a burka (the muslim body clothing that hides the entire body) -- not only will people want to avoid you, but they wouldn't even be able to write in the description what sex you are (and with a little bonus they might assume it is not a disquise in which case they are truly looking in the wrong direction).


Probably one of the easiest ways to stand out in a typical US crowd. More noticable than hat and sunglasses. If the purpose it to make video surveillance not as notable but also not attract attention than a large hat and sunglasses in hot weather or a scarf and hat in cold weather (even better) will do the trick. Also, modifying hair color and facial hair features is a good trick.


You may stand out, but that isn't necessarily bad, so long as what they remember about you isn't enought to identify you and might even misdirect them into thinking muslim terrorist.


This discussion revolves a lot around printer watermarking documents. It seems that it mostly concern color printers. Here is an advisory by the EFF which tested quite a few of them https://www.eff.org/pages/list-printers-which-do-or-do-not-d...


Honest question: what prevents someone from feeding misinformation to the press if all IDE tidying info is stripped away? If the journalist has no way to contact you, why should they trust your leak? Could the FBI or NSA send out bogus leaks and the go after journalists that publish the fake info for revealing what they believed to be confidential information?


"I don't need to be fast. I just need to be faster than you!"

Your trail-covering only needs to be better than the investigation capability of those who are investigating your leak.


Last time I purchased a prepaid cell phone, I had to show government photo ID. The RadioShack clerk entered my license number in a database.

So the burner phone may not be the best route.


This is why you go to a package store, or some other non-tech establishment. Probably in a shadier part of town.


Try your weed dealer next time.


A test would at least increase my confidence. I guess step 1 is to find something worth reporting, and the article pretty well demonstrates how hard that is.


"When you are done you must [...] turn off the Wi-Fi before turning off the computer and removing the battery. The dedicated computer should never be used on the network except when..."

This is silly on a "behind 7 proxies" level. Just go the library. If you're worried that investigators are going to swoop down CSI style to track you down because of your important secrets, maybe you should speak to a psychiatrist.


The article basically for people who want to leak classified documents or state secrets. Whistleblowers are currently the target of witchhunts so I'm not sure what makes you feel think they should seek the help of a psychiatrist.


Security cameras are quite often placed at the entrance/exit. Having your device connect and making a DHCP request as you walk in seems like a legitimate concern.


Yeah, I get it. I just don't feel this level of caution is productive. If you aren't being currently tracked, then your concern is about whether someone can backtrack forensically and find you. I think a simple trip to a public computer at a library, particularly at a busy time, affords as much pragmatic anonymity as jumping through all the hoops described in the article.

On the flip side, if you are already are under suspicion, then all your efforts to anonymize a leak are in vain. You'll be the first person interrogated after a leak, and if your beliefs about the Orwellian nature of the government are true, the $10 hammer to the kneecaps (thanks XKCD) will undo any clever hiding you did.

I just don't think it makes much sense to go to these lengths. It's already understood that governments are corrupt. Are the specifics of what secrets you want to publicize worth the personal risk? If no, then you're playing spy, which is fine. If yes, then they'll probably find you if they really put their heart into it.


Connect from the parking lot.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: