| SecureDrop | |
|---|---|
 | |
 Screenshot from the SecureDrop Source interface. | |
| Original authors | |
| Developer | Freedom of the Press Foundation |
| Initial release | 15 October 2013; 12 years ago (2013-10-15) |
| Stable release | |
| Written in | Python |
| Operating system | Linux |
| Type | Secure communication |
| License | GNU Affero General Public License, version 3 |
| Website |
|
| Repository | |
SecureDrop is afree software platform forsecure communication betweenjournalists andsources (whistleblowers).[2] It was originally designed and developed byAaron Swartz andKevin Poulsen under the nameDeadDrop.[3][4]James Dolan also co-created the software.[5]
After Aaron Swartz's death, the first instance of the platform was launched under the nameStrongbox by staff atThe New Yorker on 15 May 2013.[6] TheFreedom of the Press Foundation took over development of DeadDrop under the nameSecureDrop, and has since assisted with its installation at several news organizations, includingProPublica,The Guardian,The Intercept, andThe Washington Post.[7][8][9]
SecureDrop uses the anonymity networkTor to facilitate communication betweenwhistleblowers, journalists, and news organizations. SecureDrop sites are therefore only accessible asonion services in the Tor network. After a user visits a SecureDrop website, they are given a randomly generated code name.[6] This code name is used to send information to a particular author or editor via uploading.Investigative journalists can contact the whistleblower via SecureDrop messaging. Therefore, the whistleblower must take note of their random code name.[3]
The system utilizes private, segregatedservers that are in the possession of the news organization. Journalists use twoUSB flash drives and two personal computers to access SecureDrop data.[3][6] The first personal computer accesses SecureDrop via the Tor network, and the journalist uses the first flash drive to downloadencrypted data from the SecureDrop server. The second personal computer does not connect to the Internet, and is wiped during each reboot.[3][6] The second flash drive contains adecryption code. The first and second flash drives are inserted into the second personal computer, and the material becomes available to the journalist. The personal computer is shut down after each use.[3]
Freedom of the Press Foundation has stated it will have the SecureDrop code and security environment audited by an independent third party before every major version release and then publish the results.[10] The first audit was conducted by security researchers at theUniversity of Washington andBruce Schneier.[11] The second audit was conducted byCure53, a German security firm.[10]
SecureDrop suggests sources disablingJavaScript to protect anonymity.[12]
The Freedom of the Press Foundation now maintains an official directory of SecureDrop instances. This is a partial list of instances at prominent news organizations.[13]
| Name of organization | Implementation date |
|---|---|
| The New Yorker[14][3] | 15 May 2013 |
| Forbes[14][15][16][17] | 29 Oct 2013 |
| Bivol[14][18] | 30 Oct 2013 |
| ProPublica[14][19][20] | 27 Jan 2014 |
| The Intercept[14][21] | 10 Feb 2014 |
| San Francisco Bay Guardian[14][22] | 18 Feb 2014 |
| The Washington Post[14][23] | 5 Jun 2014 |
| The Guardian[14][2] | 6 Jun 2014 |
| The Globe and Mail[14][24] | 4 Mar 2015 |
| Radio-Canada | 20 Jan 2016 |
| Canadian Broadcasting Corporation[14][25] | 29 Jan 2016 |
| Committee to Protect Journalists[26] | 12 May 2016 |
| Associated Press | 18 Oct 2016 |
| The New York Times[14][27] | 15 Dec 2016 |
| BuzzFeed News | 21 Dec 2016 |
| USA Today[14][28] | 22 Feb 2017 |
| Bloomberg News | Unknown |
| The Wall Street Journal | Unknown |
| Aftenposten | Unknown |
| Australian Broadcasting Corporation[29] | 28 Nov 2019 |
