Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Leak to the Press

wired.com

Post reply on HN
Print view View original

51–60 of 104 posts

Re: How to Leak to the Press

#51

Post by skinnynerd »

digitalengineer wrote: post #5
Peroni wrote: post #2

Out of curiosity, why not just send a letter in the post? Pretty hard to trace an anonymous letter. EDIT: Just spotted the update. Question answered.

Take in account they'll look at fingerprints, sweat, DNA, type of paper, ink and type of printer used. Spelling errors, how you wrote something, etc can also be used to identify you. (Every printer leaves it's own watermark). Perhaps best to print and use a old 2nd hand xerox machine to copy everything or fax it from a public faxservice.

There are plenty of old typewriters lying around. Although you would still have to take precautions like getting rid of it afterwards and make sure it does not make use of polymer tape ribbons (in which case you would have to destroy and discard that as well).

Re: How to Leak to the Press

#52

Post by ceautery »

jimworm wrote: post #32
ceautery wrote: post #22

"When you are done you must [...] turn off the Wi-Fi before turning off the computer and removing the battery. The dedicated computer should never be used on the network except when..." This is silly on a "behind 7 proxies" level. Just go the library. If you're worried that investigators are going to swoop down CSI style to track you down because of your important secrets, maybe you should speak to a psychiatrist.

Security cameras are quite often placed at the entrance/exit. Having your device connect and making a DHCP request as you walk in seems like a legitimate concern.

Yeah, I get it. I just don't feel this level of caution is productive. If you aren't being currently tracked, then your concern is about whether someone can backtrack forensically and find you. I think a simple trip to a public computer at a library, particularly at a busy time, affords as much pragmatic anonymity as jumping through all the hoops described in the article.

On the flip side, if you are already are under suspicion, then all your efforts to anonymize a leak are in vain. You'll be the first person interrogated after a leak, and if your beliefs about the Orwellian nature of the government are true, the $10 hammer to the kneecaps (thanks XKCD) will undo any clever hiding you did.

I just don't think it makes much sense to go to these lengths. It's already understood that governments are corrupt. Are the specifics of what secrets you want to publicize worth the personal risk? If no, then you're playing spy, which is fine. If yes, then they'll probably find you if they really put their heart into it.

Re: How to Leak to the Press

#53

Post by skinnynerd »

jusben1369 wrote: post #16
Peroni wrote: post #2

Out of curiosity, why not just send a letter in the post? Pretty hard to trace an anonymous letter. EDIT: Just spotted the update. Question answered.

The bigger point is that journalists usually need to go back and forth with you.

Here is a good guide from Cryptome http://cryptome.org/cryptome-anon.htm

Re: How to Leak to the Press

#54

Post by smacktoward »

skinnynerd wrote: post #51
digitalengineer wrote: post #5

Earlier quoted context omitted.

Take in account they'll look at fingerprints, sweat, DNA, type of paper, ink and type of printer used. Spelling errors, how you wrote something, etc can also be used to identify you. (Every printer leaves it's own watermark). Perhaps best to print and use a old 2nd hand xerox machine to copy everything or fax it from a public faxservice.

There are plenty of old typewriters lying around. Although you would still have to take precautions like getting rid of it afterwards and make sure it does not make use of polymer tape ribbons (in which case you would have to destroy and discard that as well).

Typewriters have signatures too: http://en.wikipedia.org/wiki/Typewriter#Forensic_examination

Re: How to Leak to the Press

#55

Post by ajays »

FTA: "There’s another option I didn’t originally mention here — leaking over mail. Investigative journalist Julia Angwin of the Wall Street Journal points out that physical mail, dropped in a random post-box with a bogus return address, is perhaps the best way for anonymous one-way communication."

DO NOT DO THIS! Every printer leaves a microscopic fingerprint on every printout. The printouts can be traced back to your printer. If it's an office printer, that still narrows it down considerably.

Even electronic documents can have watermarks, etc. For photographs, there's the EXIF information, for instance. If you want to share a photo, pipe it through "djpeg | pnmscale 0.99 | cjpeg -quality 90" first. It will get rid of EXIF, and also re-compress the image, changing its signature.

Re: How to Leak to the Press

#56

Post by skinnynerd »

smacktoward wrote: post #54
skinnynerd wrote: post #51

Earlier quoted context omitted.

There are plenty of old typewriters lying around. Although you would still have to take precautions like getting rid of it afterwards and make sure it does not make use of polymer tape ribbons (in which case you would have to destroy and discard that as well).

Typewriters have signatures too: http://en.wikipedia.org/wiki/Typewriter#Forensic_examination

Good link, thanks.

Re: How to Leak to the Press

#57

Post by smacktoward »

brown9-2 wrote: post #46
saalweachter wrote: post #41

Earlier quoted context omitted.

Or tell the reporter to take out a classified ad in a free, public paper distributed in the nearest large metropolitan area. The communications from the reporter don't need to be private or targeted. Everyone will know he's involved when he publishes, and he can reasonably encode questions by referring to the documents already sent. "MR X, CAN YOU PROVIDE FURTHER INFORMATION ON THE EVENTS DISCUSSED ON PAGE 13."

The communications from the journalist certainly do need to be private. Advertising that you are working on a story that will reveal big government secrets is a good way to be put under surveillance to find out who is doing the leaking to you. The journalist would not want to announce to the world that the process of receiving classified information is ongoing.

The ad can be written so as to look innocuous to anyone other than the journalist and the leaker, if those two can agree on a format for doing so.

Re: How to Leak to the Press

#58

Post by mseebach »

steveklabnik wrote: post #45
anonyfuss wrote: post #40

Earlier quoted context omitted.

Most people never review source code, and they certainly don't disassemble and review all the binaries. 'Many eyes' is a security fallacy in cases like this.

Tails is ridiculously well known; if something was bad in it, it would be big news.

If it was found. Which is the point.

Debian, which is much better known and in much wider circulation than Tails generated weak SSH keys for two years. Yes, it was indeed very big news. When it was found. After two years.

Oh, and tin-foil-hat on: Do we know (actually know-know, not just assume, think, trust) that the weakness wasn't planted there?

Re: How to Leak to the Press

#59

Post by rbonvall »

ajays wrote: post #55

FTA: "There’s another option I didn’t originally mention here — leaking over mail. Investigative journalist Julia Angwin of the Wall Street Journal points out that physical mail, dropped in a random post-box with a bogus return address, is perhaps the best way for anonymous one-way communication." DO NOT DO THIS! Every printer leaves a microscopic fingerprint on every printout. The printouts can be traced back to you…

Interesting, I didn't know about printer fingerprints.

But I think there are still ways to workaround this. You could print the doc in an internet cafe, or buy a cheap printer and then destroy it, or print it and then take a low quality photocopy. You could even write it by hand or on a typewriter.

Post reply on HN