[00:04.480 --> 00:05.440]  Thanks, guys.
[00:06.220 --> 00:07.960]  Awesome to see so many people here.
[00:08.540 --> 00:11.880]  So, yeah, this is SecureDrop, a WikiLeaks in every newsroom.
[00:12.500 --> 00:16.280]  My name is Garrett, and I'm a security and privacy engineer at Mozilla.
[00:16.660 --> 00:19.180]  And I also work on SecureDrop.
[00:20.880 --> 00:22.820]  This is Bill.
[00:23.360 --> 00:25.000]  Hi there, I'm Bill Budington.
[00:25.280 --> 00:28.020]  I work as a developer at the Electronic Pantera Foundation.
[00:28.340 --> 00:30.620]  We also have our fingerprints up here.
[00:30.620 --> 00:35.560]  Hi, I'm Yan, and I work as a technologist at the Electronic Frontier Foundation.
[00:35.940 --> 00:37.220]  So, we all have day jobs.
[00:37.380 --> 00:40.720]  We work on SecureDrop for Freedom of the Press as well.
[00:41.560 --> 00:46.540]  And quickly, Freedom of the Press Foundation is a nonprofit that was founded in December 2012.
[00:46.980 --> 00:50.780]  It was originally created as a fancy way to launder money for WikiLeaks.
[00:50.980 --> 00:53.460]  But since then, it's kind of expanded its scope.
[00:54.880 --> 01:01.260]  So, now we fund and support a lot of really cool projects, focusing mostly on public interest journalism.
[01:01.880 --> 01:08.620]  And we have a really cool board that has some awesome people like Glenn Greenwald, Laura Poitras, John Cusack, who's a huge supporter of Press Freedom.
[01:08.780 --> 01:09.020]  Awesome.
[01:09.620 --> 01:12.540]  And Ellsberg and Snowden, who you'll be hearing from after our talk.
[01:13.780 --> 01:14.260]  Woo!
[01:15.000 --> 01:16.060]  So, yeah.
[01:16.200 --> 01:18.980]  We continue to process payments for WikiLeaks.
[01:19.040 --> 01:25.140]  If you want to donate to them and don't like how it's being blocked off, you can go to our website and donate to support them.
[01:25.620 --> 01:29.340]  We also do fundraisers, crowdfunding campaigns for encryption tools.
[01:29.920 --> 01:34.880]  We crowdfunded transcripts for Chelsea Manning's trial, which would not have been made public otherwise.
[01:36.000 --> 01:36.780]  Thank you.
[01:41.470 --> 01:42.070]  Thanks.
[01:43.330 --> 01:54.750]  And we also operate and maintain SecureDrop, which is a whistleblowing system that any news organization can install and use to receive anonymous tips and communicate with sources safely.
[01:55.930 --> 01:58.070]  And with that, I'll turn it over to Bill.
[02:03.150 --> 02:05.110]  So, the question is, why SecureDrop?
[02:06.190 --> 02:07.550]  Anyone recognize his face?
[02:08.710 --> 02:09.750]  A few of you, right?
[02:10.670 --> 02:13.970]  Yeah, he's been wondering the crowd, and he gave a talk yesterday.
[02:14.210 --> 02:15.090]  And this is Thomas Drake.
[02:15.810 --> 02:19.830]  He leaked information about fraud and abuse at the NSA, part of the Trailblazer program, in 2005.
[02:20.790 --> 02:24.450]  He was indicted under the Espionage Act, under Obama.
[02:25.870 --> 02:32.390]  This is kind of unusual, because the Espionage Act is a federal law that was, you know, enacted in 1917.
[02:32.890 --> 02:35.850]  It was meant to criminalize spies and not journalists.
[02:36.570 --> 02:46.490]  And Thomas Drake was exposing corruption, you know, and he went through every conceivable channel to expose corruption internally before going out to the public.
[02:48.170 --> 02:52.410]  It's also unusual, given that this is the most transparent administration in history.
[02:53.630 --> 02:54.550]  Believe it!
[02:56.590 --> 02:58.010]  But put that aside for a moment.
[02:58.690 --> 03:02.950]  The Espionage Act has been used for decades to criminalize those leaking documents.
[03:03.070 --> 03:13.290]  Daniel Ellsberg, also probably in the crowd, has been indicted, was indicted in 1971 for releasing the Pentagon Papers.
[03:13.950 --> 03:16.830]  In 1985, Samuel Morrison, under Reagan.
[03:17.130 --> 03:19.690]  In 2006, Lawrence Franklin, under Bush.
[03:20.530 --> 03:25.570]  So you can see this history of the executive branch criminalizing leaks under the Espionage Act.
[03:26.830 --> 03:32.370]  The only thing is, this is an unusual move for a president voted in on the premise of change.
[03:34.030 --> 03:42.990]  But one crackdown on leaks, however totally illegitimate, shouldn't besmirch an entire administration's history and legacy, right?
[03:43.370 --> 03:43.970]  Wrong.
[03:44.210 --> 03:44.590]  Right?
[03:44.890 --> 03:45.270]  Wrong.
[03:46.250 --> 03:46.910]  Right?
[03:46.910 --> 03:47.810]  And then this happened.
[03:48.070 --> 03:53.650]  Shamai Leibovitz, convicted for leaking FBI wiretaps in May 2010.
[03:54.030 --> 03:55.210]  And then this happened.
[03:55.450 --> 04:02.270]  Steven Kim, indicted in August 2010 for giving classified information to Fox News about North Korea.
[04:03.430 --> 04:05.070]  That's kind of not cool, guys.
[04:05.430 --> 04:06.330]  Maybe you should tone it down.
[04:06.470 --> 04:07.190]  And this happened.
[04:09.150 --> 04:13.230]  Chelsea Manning, convicted of 35 years in military prison.
[04:13.230 --> 04:17.910]  So, of course, we have a few more names to add to the list.
[04:18.130 --> 04:21.350]  Jeffrey Sterling, John Kiriakou, and Edward Snowden.
[04:23.550 --> 04:29.230]  All indicted, some charged with Espionage Act under Obama.
[04:30.410 --> 04:37.850]  So we have this kind of paradigm that in the 20th century, a journalist could protect their sources just by refusing to disclose them.
[04:38.390 --> 04:41.530]  In the 21st century, the journalists are out of the loop completely.
[04:41.530 --> 04:42.850]  They're taken out of the equation.
[04:43.170 --> 04:46.050]  And the government can discover sources on their own.
[04:47.130 --> 04:49.210]  So let's go over a bit of threat modeling.
[04:50.510 --> 04:55.630]  These mass surveillance programs can even compromise a source before they get to the point of submission.
[04:56.450 --> 05:01.490]  They might not even be able to submit documents to the press in the first place before they're caught.
[05:02.730 --> 05:17.010]  And if and when they do actually get there, we've learned through a Google study in March 2014 that 21 out of 25 media organizations across the world have been the target of a state-sponsored hacker attack.
[05:17.690 --> 05:18.950]  So that's kind of frightening.
[05:19.990 --> 05:22.230]  Two days ago, Edward Snowden has this quote.
[05:22.830 --> 05:37.170]  Journalists have to be particularly conscious about any sort of network signaling, any sort of connection, any sort of license plate reading device that they pass on their way to a meeting point, any place they use their credit card, any place they take their phone,
[05:37.530 --> 05:46.530]  any email contact they have with their source, because that very first contact before encrypted communications are established is enough to give it all away.
[05:48.470 --> 05:51.990]  This has been called a high-tech war on leaks by the New York Times.
[05:52.910 --> 05:59.210]  You know, as I said, in total, eight leakers have been charged under the Espionage Act under Obama alone.
[05:59.750 --> 06:05.790]  And for simply collaborating with a source, James Rosen had his phone calls and emails to have without his knowledge.
[06:07.530 --> 06:09.890]  So what options do leakers have?
[06:10.130 --> 06:11.530]  You have a trove of documents.
[06:11.530 --> 06:12.830]  You want to get them out to the public.
[06:13.530 --> 06:14.670]  It's of vital importance.
[06:15.550 --> 06:16.450]  How do you do it?
[06:16.610 --> 06:23.070]  If you don't have the technical skills to actually do what Edward Snowden was able to do.
[06:23.490 --> 06:31.450]  You can try to email a reporter, but, you know, half the time they have a stat page and they don't actually publish any GPG keys.
[06:31.710 --> 06:32.850]  How do you do that?
[06:32.950 --> 06:34.130]  How do you send them files securely?
[06:36.030 --> 06:43.210]  Even if you do have the skills to send them files securely, they might not have a GPG key for you to do so.
[06:43.970 --> 06:46.270]  Even if they do, how do you protect your own anonymity?
[06:46.830 --> 06:48.710]  Do you create an anonymous email address?
[06:48.850 --> 06:50.250]  How and with what service?
[06:51.150 --> 06:56.690]  If you were a whistleblower today, would you send a snail mail to open up communication?
[06:57.190 --> 07:00.130]  I mean, that doesn't leave a digital trace, but it leaves a bio trace.
[07:00.270 --> 07:01.110]  It leaves bio data.
[07:01.690 --> 07:04.810]  And as they say, mo snail mail, mo problems.
[07:05.810 --> 07:09.230]  I don't know if they actually say that, but it leaves traces.
[07:10.710 --> 07:13.450]  So there are a lot of unanswered questions for a potential leaker.
[07:14.050 --> 07:15.490]  So you're kind of left with this situation.
[07:21.130 --> 07:22.770]  So with that, I'll turn it over to Yan.
[07:26.300 --> 07:27.060]  Thank you, Bill.
[07:27.240 --> 07:27.720]  That was great.
[07:29.060 --> 07:34.540]  So, yeah, so we were in this situation a few months ago and we thought, well, what?
[07:34.540 --> 07:38.240]  Well, not that we were leakers, but we saw that other people were in this situation.
[07:38.400 --> 07:40.100]  And we thought, well, how do we fix it?
[07:41.020 --> 07:42.800]  And our solution was SecureDrop.
[07:43.300 --> 07:51.780]  So SecureDrop has a server in each newsroom, like physically located in each newsroom, where the sources can send documents.
[07:52.000 --> 07:54.040]  And the server runs a Tor hidden service.
[07:54.240 --> 07:56.840]  Y'all know about Tor hidden services, sort of.
[07:56.960 --> 07:57.120]  Okay.
[07:57.520 --> 08:04.020]  So Tor hidden services can only be accessed via Tor, and that provides some guarantee of anonymity for the source.
[08:05.520 --> 08:10.040]  There's a web front end on the Tor hidden service to upload documents using the Tor browser bundle.
[08:10.620 --> 08:15.040]  And the nice thing about the Tor browser bundle is that not only whistleblowers have it.
[08:15.140 --> 08:19.520]  It's not a specialized piece of software, so that's some plausible deniability for the source.
[08:19.940 --> 08:23.760]  And each document gets PGP encrypted to the journalist for a confidentiality.
[08:24.260 --> 08:30.620]  Garrett will talk more about how and where that encryption happens, because I'm sure a lot of you are wondering whether it happens on the client side or the server side.
[08:31.000 --> 08:32.000]  We'll get to that later.
[08:32.000 --> 08:37.740]  So SecureDrop is essentially a Dropbox hosted directly in the newsroom.
[08:37.940 --> 08:39.600]  And why would we do that?
[08:39.840 --> 08:46.300]  Well, so Congress in 1980 established the Privacy Protection Act to protect newsrooms from arbitrary seizures.
[08:46.840 --> 08:55.680]  In addition, because there's no third party involved in this source-to-journalist-to-source communication, that's some extra legal protection.
[08:56.000 --> 09:01.340]  So there's no third party email service like Lavabit to subpoena in this case.
[09:01.580 --> 09:02.500]  So great!
[09:02.840 --> 09:04.540]  We're doing awesome, right?
[09:04.600 --> 09:05.180]  SecureDrop.
[09:05.320 --> 09:06.100]  We're happy.
[09:07.480 --> 09:10.380]  So here's a quick history of how this came to be.
[09:10.860 --> 09:16.620]  So it was originally created as DeadDrop by Aaron Schwartz and Kevin Poulsen in 2012.
[09:16.620 --> 09:19.640]  And the New Yorker deployed it in May 2013.
[09:20.040 --> 09:21.600]  Their instance is still running.
[09:22.480 --> 09:26.820]  Freedom of the Press Foundation took over in October of last year and we renamed it to SecureDrop.
[09:27.420 --> 09:30.720]  Here's a lovely picture of Aaron and Kevin working on SecureDrop.
[09:31.500 --> 09:33.160]  And so far, here are the numbers.
[09:33.340 --> 09:34.900]  We've had three security audits.
[09:34.900 --> 09:39.040]  We have around 50 contributors, so it's a very active open-source project.
[09:39.560 --> 09:43.200]  Two major releases so far, and 0.3 is coming out very shortly.
[09:44.160 --> 09:50.140]  Twelve running instances that we know of, including Forbes, Guardian, Washington Post, and ProPublica.
[09:51.000 --> 09:56.980]  And only one leak accidentally submitted to our GitHub page as an issue, as a GitHub issue.
[09:57.200 --> 10:02.800]  And after that, I put up a big warning that said do not submit leaks to our GitHub repository.
[10:02.800 --> 10:07.440]  It's not a SecureDrop instance, even though it has the logo on the front page.
[10:07.840 --> 10:09.620]  So quickly, how does SecureDrop work?
[10:10.220 --> 10:10.580]  Great.
[10:10.840 --> 10:13.720]  So as we said, we have a... sorry, this text is kind of small.
[10:13.860 --> 10:17.800]  But we have a TorHiddenService, which provides source anonymity.
[10:18.380 --> 10:26.680]  So we have a public... so TorHiddenServices are .onion addresses, and the TorBrowserBundle can route .onion addresses to the correct TorHiddenService.
[10:26.680 --> 10:38.340]  So the public.onion is published on the new source's website and in many public places, and on our SecureDrop directory, PGP signed.
[10:38.800 --> 10:41.600]  And this is where the source goes to submit documents.
[10:41.740 --> 10:54.900]  So they open up TorRowserBundle, they go to some base64 string .onion, and they see this, submit documents for the first time, or check for responses to things that you've already submitted.
[10:54.900 --> 11:01.820]  And if you submit documents for the first time, we generate a long, random authorization code name for you.
[11:02.420 --> 11:09.400]  We can talk about that more later, but we have a really cool authorization system that makes things both memorable and pretty secure.
[11:10.260 --> 11:15.540]  And the same server running this public.onion also runs a secret.onion TorHiddenService.
[11:16.040 --> 11:22.280]  And this is what's called a stealth-authenticated TorHiddenService, which means you don't know about it unless you have the secret token.
[11:22.280 --> 11:24.800]  And so this is only accessed by the journalists.
[11:25.020 --> 11:30.640]  So they log in to the secret.onion, and they can retrieve source documents and write replies to the sources.
[11:31.580 --> 11:32.900]  This is what it looks like for them.
[11:33.040 --> 11:34.320]  We're doing some UI work right now.
[11:34.540 --> 11:35.780]  You can see there's messages.
[11:36.040 --> 11:37.520]  You can mark them, read them.
[11:39.480 --> 11:42.420]  But by the time they get to this point, they're GPG-encrypted.
[11:42.420 --> 11:50.100]  So the journalist has to take them off that on a USB stick and move them to an AirGap machine.
[11:50.460 --> 11:54.380]  So only the AirGap machine has the secret key to decrypt these documents.
[11:56.040 --> 11:57.300]  Quickly go over this.
[11:58.920 --> 11:59.480]  Great.
[11:59.760 --> 12:05.080]  And so the point of having the AirGap machine is so that we don't have to take the secret key off an AirGap ever.
[12:05.420 --> 12:09.120]  And once they get to the AirGap machine, they can decrypt documents.
[12:09.120 --> 12:10.560]  They can scrub metadata.
[12:10.820 --> 12:19.260]  They can decide what they want to publish and move just the parts that they want to publish to a different USB stick and take it off and move it to their personal computer and start publishing.
[12:19.640 --> 12:29.600]  And the additional server is a monitoring server which has this OSEC alert system to see if the app server hosting these .onion things are still active.
[12:29.740 --> 12:32.240]  And if not, if they send out these SMTP alerts.
[12:33.740 --> 12:34.640]  Here's a diagram.
[12:35.440 --> 12:41.460]  We can talk more about it if you have questions, but Garrett's going to talk about some of our future plans for SecureDrop now.
[12:50.680 --> 12:51.180]  Hey, guys.
[12:51.300 --> 12:53.560]  So that was a whirlwind tour of the SecureDrop architecture.
[12:54.560 --> 12:56.120]  Show of hands if you understood it.
[12:57.120 --> 12:57.820]  Oh, wow.
[12:58.000 --> 12:58.560]  Wow, thank you.
[12:58.560 --> 12:59.460]  You are all lying.
[13:00.060 --> 13:00.520]  Four minutes.
[13:01.040 --> 13:02.220]  Thanks for being so nice.
[13:02.380 --> 13:02.920]  That was great.
[13:03.060 --> 13:03.760]  I'm really glad.
[13:03.960 --> 13:11.500]  So if you did understand the architecture or at least you have some sense of the parts of it, you might be thinking, oh, wait.
[13:11.640 --> 13:12.340]  I got ahead of myself.
[13:12.340 --> 13:17.540]  Quickly, SecureDrop 0.3, that's the new release that we're releasing in about two weeks.
[13:17.800 --> 13:22.240]  We have a few more final issues to fix up, but here's a sneak peek of what to expect.
[13:23.460 --> 13:26.140]  This is what the source UI looks like in the current version.
[13:26.740 --> 13:29.040]  If you were polite, you might say it's a little homely.
[13:30.000 --> 13:38.960]  And we're upgrading that so it looks kind of like sexy and fresh in the new version, and hopefully it's also more friendly and easier to use and understand.
[13:39.980 --> 13:42.000]  We also did the same thing with the journalist interface.
[13:42.260 --> 13:49.340]  And not only does it look nicer, but we also incorporated a lot of usability improvements that were specifically requested by our deployment partners.
[13:49.580 --> 13:53.780]  So I get a lot of emails that are journalists saying like, hey, man, this is really annoying.
[13:53.900 --> 13:55.540]  This is happening or this is hard to use.
[13:55.680 --> 13:59.440]  And so we took all those filed issues on GitHub and then resolved them one by one.
[13:59.600 --> 14:06.960]  So this is an incremental improvement that has a lot of requested features and should make it easier for journalists to kind of develop a workflow around SecureDrop.
[14:08.640 --> 14:11.580]  In version 0.2, installation is somewhat complicated.
[14:11.780 --> 14:13.260]  As you can see, there are multiple components.
[14:13.620 --> 14:19.580]  There's a lot of security hardening, which takes a pretty experienced sys-admin to set up properly.
[14:19.780 --> 14:22.900]  We actually have such an awesome person on our team.
[14:23.420 --> 14:34.300]  So in version 0.2, we have a full-time employee who travels around to every news organization, sets up SecureDrop, trains their employees and helps them with updates and any problems they might have.
[14:34.780 --> 14:38.380]  In 0.3, we replace him with an apps get.
[14:42.520 --> 14:42.920]  Thanks.
[14:44.920 --> 14:50.560]  So he'll still be around helping us out, but we don't need to waste his time on doing the same job every time, which is going to be awesome.
[14:51.660 --> 14:52.360]  So, yeah.
[14:52.520 --> 14:55.220]  We also got an audit done, this time by iSecPartners.
[14:55.320 --> 14:59.060]  They did a really great audit of our code, found some issues, nothing too major.
[14:59.060 --> 15:05.560]  So we're going to release the full audit report along with the code in about two weeks once we have everything, all the issues from the audit fixed up.
[15:05.980 --> 15:13.860]  This is part of our commitment to audit every single release that we put out because we recognize that people use this for high security situations.
[15:14.000 --> 15:15.800]  We want to make sure that the software is as safe as possible.
[15:15.980 --> 15:19.600]  So we'll have every release from now on audited by independent third parties.
[15:19.600 --> 15:21.360]  And we got iSec to do this one.
[15:21.460 --> 15:22.040]  They did a great job.
[15:22.320 --> 15:23.200]  So, rock and roll.
[15:26.160 --> 15:26.540]  Thanks.
[15:28.540 --> 15:36.640]  So, back when I was saying if you understood the architecture, you might have had, if you're familiar with security engineering at all, a few thoughts like this.
[15:37.960 --> 15:39.520]  It's not a perfect architecture.
[15:39.700 --> 15:41.700]  There are a lot of trade-offs for usability.
[15:42.020 --> 15:43.880]  And I want to talk a little bit about what those look like.
[15:44.940 --> 15:49.060]  So, one thing that you can say about SecureDrop is that it's a web application.
[15:50.280 --> 15:52.180]  That's good because it makes it easy to use.
[15:52.300 --> 15:58.860]  The process is pretty much install the Tor Browser bundle, visit a .onion address for that new organization, and then click a bunch of buttons.
[15:59.220 --> 16:02.300]  It's way easier to set up than GPG or OTR.
[16:03.320 --> 16:07.100]  And it also has, as Jan mentioned before, a nice property of plausible deniability.
[16:07.300 --> 16:25.500]  Since the Tor Browser does a lot of work to try and erase any traces of sessions that you do in the Tor Browser, by simply not storing any persistent state in the application, it's pretty easy to have a strong assurance about the application not leaving traces on a source's machine.
[16:25.720 --> 16:33.260]  So, if a source is being investigated, they might have the Tor Browser bundle, but they don't have, like, a SecureDrop native client, which would look a little bit more awkward.
[16:34.320 --> 16:36.240]  And so, we think that's a pretty cool property.
[16:37.900 --> 16:40.360]  Unfortunately, SecureDrop is also a web application.
[16:41.100 --> 16:45.300]  And that means that there is the huge attack surface of the browser to contend with.
[16:45.720 --> 16:58.840]  We do encourage sources to disable JavaScript, and that's specifically with the Tor Freedom Hosting attacks in mind of last August, where the FBI used targeted malware based on a JavaScript exploit to own a bunch of Tor users and de-anonymize them.
[16:59.460 --> 17:05.800]  So, that is kind of a cool mitigation, but we have no idea if people actually follow our instructions.
[17:06.340 --> 17:09.340]  And it also really limits what we can do with the application.
[17:09.340 --> 17:13.500]  If you're a web developer, try writing a thing without JavaScript these days.
[17:13.700 --> 17:14.480]  It's pretty hard to do.
[17:15.640 --> 17:17.380]  So, it also limits use cases.
[17:17.540 --> 17:29.040]  You know, if you're a source who doesn't feel comfortable using a browser for whatever reason, we simply have a really difficult time supporting your threat model and your use case, because everything is so constrained to this one stack.
[17:30.480 --> 17:33.900]  Another design choice, which is kind of questionable, is that we do server-side encryption.
[17:34.280 --> 17:44.600]  So, plain text is sent from a source to the server over the Tor hidden service protocol, which is encrypted end-to-end, and then it's encrypted on behalf of the source on the server.
[17:45.020 --> 17:46.120]  This is great for usability.
[17:46.320 --> 17:47.380]  There are no keys to manage.
[17:47.740 --> 17:49.040]  It also helps maintain deniability.
[17:49.240 --> 17:53.400]  Imagine if you're an engineer for a second, trying to do end-to-end encryption without storing any state.
[17:53.840 --> 17:54.480]  It's tricky.
[17:54.760 --> 17:56.280]  Not impossible, but tricky.
[17:57.460 --> 17:59.960]  It also lets us use established tools like GPG.
[18:00.460 --> 18:11.360]  So, instead of rolling around crypto, we can simply use established, audited, highly considered tools that already exist, and that makes auditing and reasoning about the security of the system a lot easier.
[18:13.240 --> 18:16.700]  But it makes the server a huge, huge target.
[18:17.940 --> 18:23.660]  And this is some of the things that an attacker can do if they have an active, ongoing attack on a secure drop server right now.
[18:23.900 --> 18:27.940]  They can get the plain text of all submissions submitted past the point of compromise.
[18:28.560 --> 18:36.080]  Plain text of submissions reveals what's being submitted, and it might reveal who is submitting it, depending on the metadata that could be stored in that file.
[18:36.480 --> 18:42.060]  We treat that as being almost as severe as a Tor compromise, AKA a full de-anonymization.
[18:43.460 --> 18:45.080]  So, it's a really, really severe attack.
[18:45.500 --> 18:49.060]  They can also get the source's passphrase when it's been sent to the server.
[18:49.580 --> 18:53.300]  They can pull it in as it's being fed to the server over the Tor hidden service protocol.
[18:53.540 --> 18:57.520]  And then they can use that to decrypt replies that are sent from the journalist to the source.
[18:57.700 --> 19:02.680]  As you might imagine, those could contain all kinds of correlating data that would help you identify a source.
[19:03.320 --> 19:06.560]  Of course, they can get all of the stored, encrypted submissions and replies.
[19:06.760 --> 19:13.520]  They are encrypted, and the keys are kept offline in cold storage as on Yantet before, but they still can't access that, and maybe then get those keys.
[19:14.240 --> 19:18.800]  And they can also get the metadata about the size and timing of communication, which could also be useful for an investigation.
[19:19.440 --> 19:20.800]  So, this is pretty bad.
[19:20.940 --> 19:33.880]  It means we have to be really, really careful about the server and make sure that it's not being compromised, which is why, as Yant said before, we have an OS sec-based monitoring server and all these hardening steps built into the server to try and mitigate this risk,
[19:34.000 --> 19:34.900]  but it's still a huge risk.
[19:36.600 --> 19:48.320]  Also, if you're a network attacker and you can do an active man in the middle of, say, the Tor hidden service protocol, then you can read plain text submissions and replies, depending on your perspective and what traffic you can eavesdrop on.
[19:48.860 --> 19:58.840]  So, the Tor hidden service protocol is, as far as we know, secure, and it is end-to-end, but we'd like to have more defense in depth and not rely on that protocol alone to be secure.
[19:59.100 --> 20:02.900]  And, of course, you can DOS things, but anyone, that's not... people can always do that.
[20:03.840 --> 20:04.280]  Yeah.
[20:04.540 --> 20:12.300]  So, these are the solutions we're considering for a kind of a big overhaul and a re-architecture of SecureDrop, tentatively called the 1.0 release.
[20:12.520 --> 20:17.480]  So, we'll have a generic API that allows us to make implementation agnostic clients.
[20:17.660 --> 20:29.360]  So, it could be a web app, and we can maintain the experience that we have now, or it could be a native application, and we can use that platform to develop a much more hardened application with better security assurances, etc.
[20:29.620 --> 20:31.240]  The possibilities become limitless.
[20:31.760 --> 20:38.480]  And then, through that, we can hopefully support more use cases and threat models, and support a wider array of sources.
[20:38.920 --> 20:43.300]  You know, like if you're a local whistleblower, maybe you don't have the same adversary as Edward Snowden does.
[20:43.500 --> 20:48.880]  We'd like to kind of support a wide range with appropriate tools for everybody in between.
[20:49.920 --> 20:56.520]  And we also want to encrypt end-to-end, and that will, of course, minimize the damage from the server compromise I was just talking about.
[20:56.780 --> 21:01.700]  So, from this list, if we have end-to-end encryption, my animation is gone.
[21:02.200 --> 21:04.840]  But the first two things are no longer a problem.
[21:05.680 --> 21:10.920]  And the fourth thing is still a problem, but we can obfuscate and normalize, which we already do some of today.
[21:11.360 --> 21:13.540]  We can try and make that less of a problem than it is.
[21:14.720 --> 21:22.560]  And then, on this slide, the first point about reading plaintext submissions and replies is no longer a problem if the communication is end-to-end encrypted.
[21:24.420 --> 21:25.180]  So, yeah.
[21:25.320 --> 21:30.280]  Some of the challenges we're facing are trying to maintain plausible deniability as we move to an end-to-end system.
[21:30.280 --> 21:31.880]  As I said before, that's a challenge.
[21:32.020 --> 21:33.920]  It's very difficult to do, but not impossible.
[21:34.540 --> 21:40.020]  And more generally, as you want to create more full-featured applications, storing state is very useful.
[21:40.380 --> 21:43.940]  And we want to trade off the deniability with the functionality of the application.
[21:44.200 --> 21:45.160]  So that's pretty tricky.
[21:45.620 --> 21:48.020]  And usability is a challenge, especially for journalists.
[21:48.220 --> 21:58.680]  You know, we have an air gap that we currently enforce every installation to transfer submissions to an air gap to work with them, which is really nice from a security point of view, but it's also a huge pain in the ass.
[22:00.160 --> 22:02.720]  So it's not clear if that's always the best thing to do.
[22:02.880 --> 22:08.320]  We'd like to support, again, a wider variety of use cases to make this a useful tool for journalists and for sources.
[22:09.340 --> 22:13.340]  That's kind of just a subset of what we're working on, but I wanted to kind of whet your appetite.
[22:13.880 --> 22:16.920]  If you guys have any questions, check out our Twitter account.
[22:17.060 --> 22:18.320]  We have a mailing list for developers.
[22:18.920 --> 22:20.260]  Our GitHub is very active.
[22:20.820 --> 22:25.140]  And, of course, SecureDrop and everything that the Fibular Press Foundation does is supported by donations.
[22:25.440 --> 22:27.220]  So please consider donating.
[22:27.540 --> 22:32.560]  And I went through that really fast because we have to end really early, but I think we still have 15 minutes for questions.
[22:32.840 --> 22:35.160]  So if you have any questions, please come to the mic.
[22:36.460 --> 22:37.880]  Uh, yeah.
[22:38.120 --> 22:39.000]  Can you go to the mic, please?
[22:39.460 --> 22:40.340]  So people can hear it?
[22:40.960 --> 22:41.740]  Oh, no.
[22:41.900 --> 22:42.300]  Go for it.
[22:42.380 --> 22:42.600]  What's up?
[22:49.140 --> 22:55.840]  So the question was, what, if any, protection do we have against screen scrapers on whistleblower computers?
[22:56.500 --> 22:57.000]  Uh, none.
[22:57.560 --> 22:59.160]  No protection against that.
[22:59.460 --> 23:07.520]  We, uh, part of our threat model is that we assume the source machine has not been compromised by malware, and that would fall under the category of malware currently.
[23:09.560 --> 23:25.120]  So it seems to me that one of the possible weak points here is getting, um, the leaker to actually download the Tor Browser Bundle, particularly in light of some of the revelations that anyone who downloads Tor is, could be, uh, target of surveillance.
[23:25.780 --> 23:35.220]  So it seems like, um, you know, if Alice works for the CIA and wants to leak documents, as soon as she does a Google search for Tor Browser Bundle, that could be a weak point in the communication.
[23:37.580 --> 23:47.180]  So, it definitely, uh, raises some flags, I think, in the XKEYSCORE programs that we've seen if you're downloading Tor Browser Bundle.
[23:47.440 --> 23:55.940]  Uh, and that's a real issue, but I think that, um, when you're downloading Tor Browser Bundle, there's, uh, an array of use cases for it, and it's not just whistleblowers.
[23:55.940 --> 23:57.060]  It's all sorts of people.
[23:57.780 --> 24:13.300]  Um, they, you know, even the national security industry uses, uh, Tor to, uh, protect their own bodies, uh, when they're working in countries, uh, that are outside the U.S.
[24:13.540 --> 24:23.400]  So, it doesn't automatically open you up for, uh, a full-scale investigation, I would say, but it certainly would raise some flags.
[24:23.740 --> 24:33.660]  Uh, and we've been thinking about the process of traffic analysis in Tor, and how to mitigate, um, the ways by which a source could be compromised that way.
[24:33.980 --> 24:38.160]  Everyone here should download the Tor Browser Bundle right now, and Google it.
[24:38.300 --> 24:38.460]  Yeah.
[24:38.540 --> 24:41.500]  So, let's give people some more plausible deniability, right?
[24:42.160 --> 24:46.600]  If you guys could, like, repeatedly download it, uh, randomly, every day, that'd be really great.
[24:46.620 --> 24:49.220]  Yeah, write a con job to download it every five minutes.
[24:49.720 --> 24:49.800]  Yeah.
[24:49.800 --> 24:50.560]  And that's a real thing, though.
[24:50.640 --> 25:01.920]  It makes the haystack bigger, and it makes it so that you can't pinpoint, uh, whistleblowers and leakers when, uh, when they're doing that extensive traffic analysis that we know they do.
[25:03.360 --> 25:11.740]  Yeah, and we also want to do a lot of work, uh, to try and combat traffic analysis, but that's a really difficult field full of open problems, also very interesting problems.
[25:13.380 --> 25:24.180]  So, if you're a, uh, potential source or leaker, uh, maybe somebody with fewer technical skills, how do they find, uh, this, and how do they figure out how to set it up if they don't have strong technical skills?
[25:25.120 --> 25:26.860]  Uh, right.
[25:27.280 --> 25:37.280]  So, if you're a source and you want to use SecureDrop, um, we've been publicizing it pretty well on Twitter, and we've done, like, lots of media interviews and press requests.
[25:37.840 --> 25:44.400]  Uh, it does, uh, so you can find a directory of all the instances on Freedom of Press Foundation's website.
[25:44.920 --> 25:57.240]  Um, and if you're a journalist and you want to set it up, uh, we, uh, we have seen people try to do this themselves, but they usually have questions, and they post them on, as, like, GitHub issues, and we help them out.
[25:57.520 --> 26:03.280]  But if you're a well-funded journalist organization, we can usually just help, help you set it up directly.
[26:03.600 --> 26:10.800]  I mean, like, if you're just, like, random government employee, you don't use Twitter, and you're like, I want to call my local paper.
[26:10.980 --> 26:11.620]  It's the Republican.
[26:12.300 --> 26:15.260]  Like, how do they discover how to do this?
[26:15.440 --> 26:15.680]  Right.
[26:15.920 --> 26:22.720]  So, every news organization has what we call a landing page, and that describes how to, how to use SecureDrop.
[26:22.920 --> 26:25.180]  So, basically, get Tor Browser Bundle, go to this Onion.
[26:25.500 --> 26:29.340]  Um, and also has some basic OPSEC guidelines, like, don't do this on your corporate network.
[26:29.520 --> 26:31.500]  Go to a coffee shop, et cetera, and so forth.
[26:31.960 --> 26:35.700]  Um, I mean, those are things that sources need to consider, um, in this case.
[26:36.000 --> 26:49.160]  Um, so, it's really up to the news organization where they put that and how they, um, make that known to sources, and it's, like, up to them if they want to get more information from people by making that more accessible.
[26:49.480 --> 26:58.660]  Um, but I do know and can say that one of our partners, I think next week, will be starting to put the text of their landing page on every page of their site.
[26:58.880 --> 27:03.120]  Um, which hopefully will help with traffic analysis, and also make it more accessible.
[27:03.400 --> 27:04.380]  So, stay tuned for that.
[27:05.480 --> 27:08.340]  Uh, I think there's also a billboard in Washington, D.C.
[27:08.340 --> 27:11.040]  with a secure drop URL on it.
[27:11.220 --> 27:11.860]  Is that right?
[27:12.300 --> 27:12.680]  Or am I?
[27:12.920 --> 27:15.160]  I think there might be a billboard as well.
[27:15.280 --> 27:16.100]  Yeah, I think there's a billboard somewhere.
[27:16.360 --> 27:17.440]  We should get a picture of that.
[27:19.260 --> 27:19.700]  Yeah.
[27:20.280 --> 27:22.200]  Yes, I'm an alternative journalist.
[27:22.400 --> 27:23.380]  Thank you for doing this.
[27:23.480 --> 27:26.060]  This is really remarkable and a great public service.
[27:26.280 --> 27:30.320]  You said what I was going to suggest, which is everybody should have Tor.
[27:30.820 --> 27:36.560]  I used Tor when it was first developed, and then fast forward to now, it was horrible at the start.
[27:36.760 --> 27:38.460]  And I think it was a DOD project too.
[27:38.840 --> 27:39.920]  Now it's pretty terrific.
[27:40.080 --> 27:46.960]  What about a viral campaign, a coordinated campaign, for all those people out there who want to help press freedom, download Tor?
[27:47.100 --> 27:48.320]  Because you could get several million.
[27:49.240 --> 27:57.940]  I mean, I think that one of the limits of using Tor is that it's slow, and then some people are like, well, you know, it's slow, I don't want to use it.
[27:57.940 --> 28:00.860]  It's, you know, unviable for my everyday web browsing habits.
[28:01.580 --> 28:10.920]  And one of the things that, not to plug EFF too much, but we're doing an EFF project on getting more Tor nodes out there.
[28:11.020 --> 28:17.180]  And the more Tor nodes there are, especially Tor exit nodes, the better the network becomes.
[28:17.240 --> 28:27.460]  And the paths that are created when you boot up your Tor browser bundle, there's, it becomes, it makes the network overall much faster.
[28:28.140 --> 28:29.780]  So I think that's one of the...
[28:29.780 --> 28:29.940]  Yeah.
[28:30.080 --> 28:32.940]  But I think a lot of people would download it who might use it once.
[28:33.220 --> 28:34.000]  I mean, would that help?
[28:35.020 --> 28:39.460]  If they knew that was a contribution to freedom of the press and...
[28:39.460 --> 28:40.760]  Yeah, solidarity.
[28:41.220 --> 28:41.500]  Yeah.
[28:41.700 --> 28:41.900]  Okay.
[28:41.900 --> 28:41.940]  Great.
[28:42.100 --> 28:59.980]  And also on pressfreedomfoundation.org, we have a donation page that gives to the lead project as well as the Tor browser bundle and a bunch of other projects and SecureDrop that you can kind of, as a sliding scale, you know, donate to whoever you want to.
[29:00.340 --> 29:00.980]  Thank you again.
[29:01.340 --> 29:01.540]  Yeah.
[29:01.540 --> 29:01.660]  Thanks.
[29:01.860 --> 29:02.000]  Thank you.
[29:05.480 --> 29:07.960]  I'd like to first re-emphasize the point you just said.
[29:08.050 --> 29:10.500]  Please run a Tor exit node.
[29:10.540 --> 29:11.760]  It's really cheap.
[29:11.780 --> 29:12.660]  You can do it on Amazon.
[29:13.320 --> 29:14.380]  It's pretty trivial.
[29:15.600 --> 29:20.790]  With regards to the first couple comments about, hey, you know, what if the source is already owned?
[29:20.790 --> 29:30.000]  I mean, you can't enforce that someone run a Tails live CD, but I think you should highly, highly, highly encourage it.
[29:30.090 --> 29:31.780]  Assume that the source is compromised.
[29:32.040 --> 29:32.480]  Definitely.
[29:32.480 --> 29:34.810]  Assume that they're already owned.
[29:35.550 --> 29:35.590]  Definitely.
[29:35.590 --> 29:42.810]  You can't, you know, a hundred percent say, yes, this person is running from a live CD, but I think you should really, really, really emphasize that.
[29:42.980 --> 29:43.700]  Thanks for showing that.
[29:43.860 --> 29:44.860]  We totally agree.
[29:45.810 --> 29:58.590]  In our mind, for the 1.0, the big major next release, the two main clients will be some kind of a browser thing to maintain the current experience, but probably an add-on so we can maybe do crypto more safely.
[29:58.960 --> 30:00.160]  Question mark, question mark, question mark.
[30:00.240 --> 30:00.880]  Please don't kill me.
[30:01.440 --> 30:06.480]  And the other idea is a native client that we want to try and get included in Tails by default.
[30:06.680 --> 30:07.440]  So it's just with Tails.
[30:07.830 --> 30:08.180]  Thank you.
[30:08.330 --> 30:08.680]  Yeah.
[30:08.810 --> 30:09.220]  Thank you.
[30:09.570 --> 30:10.020]  Thanks.
[30:14.750 --> 30:18.890]  Yeah, I guess that was kind of what I was going to start talking about.
[30:19.850 --> 30:25.370]  Because, yeah, as you said that you would recommend that users disabled JavaScript on the client end.
[30:25.770 --> 30:31.590]  But I was, yeah, wondering about the possibility of JavaScript-based cryptography.
[30:31.690 --> 30:33.170]  Just in general, I guess.
[30:33.730 --> 30:35.590]  But maybe you already answered that question.
[30:35.590 --> 30:54.290]  So my second question would be, then, that I guess the allure of it for journalists, or for, not journalists, but organizations of the press specifically, is because they can hold on to those documents in-house because of, you know, this Congressional Act that you mentioned beforehand.
[30:54.290 --> 31:06.710]  However, do you ever see that, I mean, citizen journalists themselves, you know, as they grow a number, especially across the world, start to take on a lot of these responsibilities, but yet they do not have these protections.
[31:07.410 --> 31:18.410]  Would you still suggest, or, you know, experimenting with SecureDrop if you're with a smaller organization, perhaps an unofficial organization?
[31:18.590 --> 31:26.270]  So I would say that there's this project being developed by one of our lead developers called OnionShare.
[31:26.750 --> 31:35.250]  And I think that that might be something to look into if you don't have the ability to set up SecureDrop instances.
[31:36.390 --> 31:46.450]  But generally, I think that, you know, we try and focus on things that we can reason about in a lot of ways, but there's no reason for a citizen journalist not to use SecureDrop.
[31:46.550 --> 31:49.570]  They should definitely explore it, and if it's a useful tool, check it out.
[31:49.770 --> 31:54.670]  We also have some projects, some deployments of SecureDrop that are kind of being set up now.
[31:54.970 --> 32:05.110]  And they're with lawyers and also some members of Congress who are fed up with not being able to get access to documents through their conventional channels, and so they want people to leak to them.
[32:06.350 --> 32:06.770]  Seriously.
[32:07.850 --> 32:12.550]  So it's not just for journalist organizations or big ones, but that is what we started focusing on.
[32:12.610 --> 32:13.610]  We understand that the best.
[32:14.150 --> 32:21.510]  As we grow, we want to support more and more cases, citizen journalists, watchdog groups, NGOs, lawyers, et cetera, and so forth.
[32:21.510 --> 32:24.310]  But we want to consider that carefully as we go.
[32:28.470 --> 32:36.630]  Onion Share is another cool anonymous file sharing project that you guys should take a look at if you're interested.
[32:37.650 --> 32:38.130]  Yes.
[32:38.370 --> 32:47.210]  One technology that Aaron Schwartz was also working on was Tor2Web, which was a kind of a web proxy for accessing Tor hidden services in the darknet.
[32:47.770 --> 32:52.890]  But when I look at your architecture, then I think there was nothing about Tor2Web.
[32:53.010 --> 32:56.870]  So why did you drop Tor2Web from your architecture, or did you?
[32:57.390 --> 32:57.870]  Sure.
[32:58.810 --> 33:02.330]  Currently, if you use Tor2Web to access a SecureDrop instance, it gives you a warning.
[33:02.330 --> 33:10.450]  And it says, you are highly advised not to submit any documents over Tor2Web to our portal because it doesn't protect your anonymity.
[33:11.550 --> 33:15.590]  Tor2Web has great uses, but SecureDrop is not one of them.
[33:16.530 --> 33:17.050]  Yeah.
[33:17.250 --> 33:19.890]  So the source isn't being protected when they use Tor2Web.
[33:19.970 --> 33:25.670]  It's really great for anonymous publishing, but for anonymous submission, the source isn't being anonymized at all.
[33:25.710 --> 33:29.670]  So it's not a good idea to use SecureDrop over Tor2Web.
[33:29.670 --> 33:33.130]  And we do display a banner warning if they try to do that.
[33:33.310 --> 33:34.030]  We detect Tor2Web.
[33:34.630 --> 33:38.670]  Other platforms like GlobalLeaks encourage the user Tor2Web, but we feel like that is risky.
[33:40.910 --> 33:41.350]  Okay.
[33:41.690 --> 33:42.190]  Thank you.
[33:44.430 --> 33:54.410]  Can you talk about some of the vulnerabilities for the air gap machines in the newsroom, and what you've done to make sure somebody doesn't accidentally plug that machine in, for instance, because newsrooms can be hectic places?
[33:55.550 --> 33:56.150]  Yeah.
[33:56.470 --> 34:00.210]  So the air gap machine is, first of all, it's physically air gap.
[34:00.450 --> 34:03.970]  So do you want to take out the wireless card?
[34:04.550 --> 34:05.170]  So, yeah.
[34:06.310 --> 34:11.010]  To prepare the air gap workstation, we disable the wireless card.
[34:11.010 --> 34:16.270]  We also have the metadata analysis tool?
[34:16.670 --> 34:17.430]  Anonymization tool.
[34:17.430 --> 34:18.270]  Anonymization tool.
[34:18.890 --> 34:31.890]  Built in so that all the metadata will hopefully essentially be scrubbed, and then documents can be prepared on the air gap itself.
[34:32.210 --> 34:32.350]  Right.
[34:32.450 --> 34:39.850]  And the air gap machine is also running Tails as an operating system, which is like a fresh instance of Tails every time you reboot it.
[34:40.270 --> 34:43.230]  So if we get malware, it's likely not going to be persistent.
[34:44.570 --> 34:59.110]  And additionally, so some of the more paranoid installations, instead of using a USB stick, which can be compromised via its firmware, will use CDRs to transfer files to the air gap, which is a huge pain, but it's really secure.
[34:59.490 --> 35:04.690]  The malware can't exfiltrate data back onto the CDR to go back to a machine like a can with a USB stick.
[35:05.150 --> 35:09.190]  We've also debated write-only USB sticks, which don't work 100%.
[35:09.190 --> 35:10.890]  They're not totally a good guarantee.
[35:11.490 --> 35:18.470]  And having a big bucket of USB sticks that you just throw away each time, which is horribly for the environment, you know.
[35:18.570 --> 35:20.230]  But anyway, we've been considering it a whole lot.
[35:20.310 --> 35:21.090]  It's a really interesting problem.
[35:21.950 --> 35:22.790]  Thank you.
[35:26.270 --> 35:26.690]  Hi.
[35:27.130 --> 35:32.870]  I wanted to know how do you guys compare or cooperate with other projects like Global Leaks or maybe others you're not aware of?
[35:33.390 --> 35:33.810]  Sure.
[35:33.810 --> 35:40.910]  So we actually were in Berlin, all three of us and some others, with Global Leaks this week, Sunday through Thursday.
[35:41.510 --> 35:45.730]  We are both interested in trying to get something into the Tor browser bundle by default.
[35:45.990 --> 35:48.070]  Again, so we can preserve this deniability property.
[35:48.690 --> 35:51.710]  And they're interested, but they have a lot of concerns and a lot of requirements.
[35:51.990 --> 35:58.590]  And so we thought, well, we could maybe work together on something that would help both platforms be more secure for its users.
[35:58.590 --> 36:03.630]  We have some really cool ideas that we're going to be publishing this upcoming week.
[36:04.150 --> 36:04.930]  So stay tuned.
[36:05.050 --> 36:05.390]  Check it out.
[36:05.530 --> 36:06.430]  Hopefully it'll be really cool.
[36:07.050 --> 36:07.150]  Yeah.
[36:07.330 --> 36:07.750]  Thank you.
[36:09.230 --> 36:11.490]  I think we have time for about one more question.
[36:11.710 --> 36:11.850]  Yeah.
[36:12.490 --> 36:12.890]  Yeah.
[36:13.050 --> 36:16.150]  We're actually just the opening band for Ellsberg and Snowden.
[36:16.630 --> 36:19.110]  So lots more cooler stuff ahead.
[36:19.250 --> 36:20.670]  Everybody say Snowden.
[36:20.670 --> 36:22.210]  I already asked a question.
[36:22.230 --> 36:25.330]  So if somebody else wants to jump in, they can totally have it.
[36:25.350 --> 36:26.230]  It's very generous of you.
[36:26.990 --> 36:27.850]  But go ahead.
[36:28.530 --> 36:29.590]  Just another question.
[36:29.710 --> 36:31.210]  At what point do you scrub the metadata?
[36:31.830 --> 36:34.870]  And are you talking about scrubbing the metadata of documents that people submit?
[36:35.130 --> 36:35.370]  Yeah.
[36:35.610 --> 36:36.510]  Why do you do that?
[36:36.730 --> 36:46.470]  I mean, only because, I mean, some journalists now, some data journalists, and increasingly the journalists of the future are making use of that data.
[36:47.210 --> 36:47.650]  Right.
[36:47.650 --> 36:49.770]  So at the point of submission, it's an option.
[36:49.790 --> 36:53.750]  So we give sources the ability to scrub metadata.
[36:54.990 --> 36:57.030]  But it's an imperfect process.
[36:57.550 --> 37:03.730]  And often, as you said, journalists like to use that information to provide additional details in their stories.
[37:04.170 --> 37:15.950]  In the future, I think we're going to be moving more towards a model of being able on the air gap machine to choose which metadata is to be preserved or to be redacted.
[37:20.330 --> 37:20.610]  Cool.
[37:20.830 --> 37:21.210]  All right, guys.
[37:21.390 --> 37:22.070]  That's it for us.
[37:22.210 --> 37:22.790]  We're the opening band.
[37:22.910 --> 37:23.290]  Thank you.
[37:24.330 --> 37:24.750]  Thank you.
[37:24.750 --> 37:24.830]  Thank you.