SecureDrop
SecureDrop is an open-source platform that lets whistleblowers communicate confidentially with news organizations. It uses onion services, separated workflows, and hardened systems. Security comes from technology and careful editorial process together. Users should only use the address officially published by the newsroom in question.
SecureDrop is not an app from a store. It is a whistleblower platform run by a newsroom. Use only the .onion address on that newsroom’s official website.
The problem SecureDrop solves
A tip to a newsroom normally leaves traces in many places: the mail provider, the employer, connection logs. Even encrypted messages reveal who spoke to whom and when — and that is often enough to identify a source. SecureDrop therefore does not start with the content, but with the metadata: communication runs exclusively over an Onion Service v3; an account with personal details is never created.
How the workflow is designed
Whistleblowers receive a randomly generated identifier on first contact, which they can later use to retrieve follow-up questions. Submitted documents are stored encrypted and opened by the newsroom on a dedicated, air-gapped machine. This separation is not decoration: it prevents a crafted document from opening outbound connections or compromising the newsroom network.
Technology is only half the job
A SecureDrop instance protects only as far as the newsroom follows the associated procedures, and only as far as the source observes OPSEC when connecting — for example by not using a work device or the corporate network. The origin of the address also matters: only the .onion address published on the official website of the newsroom in question is valid.
Category: Journalism