SecureDrop is an open source whistleblower submission system that media organizations can install to accept documents from anonymous sources. It was originally developed by the late Aaron Swartz, with assistance from Wired editor Kevin Poulsen and James Dolan. The project was previously called DeadDrop. Freedom of the Press Foundation took over management of the project in October 2013.

SecureDrop does not seek to re-invent the wheel. Instead it combines several well-respected tools into an application that is easier to use for sources and enforces the use of many security best practices by news organizations. Among the tools used in and around the SecureDrop application are: Tor, GnuPG encryption, Apache, OSSEC, grsecurity, Ubuntu Server, the Tails operating system, and an air-gap to minimize exfiltration risks.

SecureDrop is designed to use two physical servers: a public-facing server that stores messages and documents, and a second that performs security monitoring of the first. The code on the public-facing server is a Python web application that accepts messages and documents from the web and GPG-encrypts them for secure storage. This site is only made available as a Tor Hidden Service, which requires sources to use Tor, thus hiding their identity from both the SecureDrop server and many types of network attackers.

Essentially, it’s a more secure alternative to the "contact us" form found on a typical news site. Every source who visits the site is given a unique "codename." The codename lets the source establish a relationship with the news organization without revealing her or his real identity or resorting to e-mail.

They can enter the code name on a future visit to read any messages sent back from the journalist, or submit additional documents and messages under the same persistent, but pseudonymous, identifier. The source is known by a different and unrelated code name on the journalist’s side.

All of the source’s submissions, and replies to the source from journalists, are grouped together into a collection. Every time there is a new submission by a source, their collection is bumped to the top of the submission queue.

The SecureDrop application does not record your IP address, information about your browser, computer, or operating system. Furthermore, the SecureDrop pages do not embed third-party content or deliver persistent cookies to your browser. The server will only store the date and time of the newest message sent from each source. Once you send a new message, the time and date of your previous message is automatically deleted.

Journalists are also encouraged to regularly delete all information from the SecureDrop server and store anything they would like saved in offline storage to minimize risk. More detailed information can be found in our sample privacy policy, which we encourage news organizations using SecureDrop to adopt from when creating their own. Make sure to also follow our best practices for creating the SecureDrop landing page so that it logs as little information as possible as well.

In many of the recent leak prosecutions in the United States, sources have been investigated because authorities are able to retrieve both metadata and content of communications from third parties like email and phone providers in secret. SecureDrop attempts to completely eliminate third parties from the equation so that news organizations can challenge any legal orders before handing over any data.

SecureDrop also substantially limits the metadata trail that may exist from journalist-source communications in the first place. In addition, it attempts to provide a safer environment for those communications than regular corporate news networks, which may be compromised.

Before major code changes are shipped, our policy is to have SecureDrop audited by a professional, third-party security firm. Five audits of SecureDrop have been completed so far:

• The first audit of SecureDrop, conducted in the Spring of 2013, was conducted by a group of University of Washington researchers and Bruce Schneier and can be found here.
• After significant changes to the system, the second audit of SecureDrop was conducted by Cure53 at the end of 2013 and can be read here.
• In the summer of 2014 iSEC Partners completed the third audit of SecureDrop. Their report can be read here and you can also read about how we resolved the issues they found.
• The fourth audit was conducted in summer 2015, also by iSEC Partners, and can be found in full here.
• The most recent audit was independently undertaken by Leviathan Security on behalf of Sofwerx in late 2018, and can be found in full here.

In addition to these audits, we also have a bug bounty program hosted by Bugcrowd.

SecureDrop is not just a web application but a whole environment with processes to cover the full lifecycle of its use. The Freedom of the Press Foundtion provides an audited, segmented environment not reliant on corporate services for administration or management. This breaks the kill chain of an attacker trying to pivot from a compromised corporate network to the SecureDrop environment.

Each device in the SecureDrop environment is deployed to provide least access and to enforce security best practices. A monitoring and alerting solution is also deployed so the administrator will be aware of the health of the environment.

Since nothing can ever be considered fully secure, especially networked computers, even with all of the other hardening provided, the secret key needed to decrypt submissions only exists on an airgapped computer. This process of putting the encrypted submissions on a transfer device and physically walking them ("sneakernet") to the airgapped Secure Viewing Station helps protect the private key from most types of attacks.

No, and any organization or product that promises 100% security is not telling the truth. The goal of SecureDrop is to create a significantly more secure environment for sources to share information than exists through normal digital channels, but there are always risks. That said, each release of SecureDrop with major architectural changes goes through a security audit by a reputable third party security firm.

The web application, which was originally called DeadDrop, was developed by Aaron Swartz in 2012 before his tragic death. The hardening guide and security environment was architected by James Dolan. Investigative journalist Kevin Poulsen originally managed the project. The New Yorker launched the first implementation and branded their version StrongBox in May 2013.

In October 2013, Freedom of the Press Foundation took over management and development of the open source project and re-named it SecureDrop. In the project's early years at FPF, development was driven by James Dolan and Garrett Robinson. Today, SecureDrop is maintained by a small full-time development team at FPF and a growing volunteer community. FPF's development efforts are led by Kevin O'Gorman (for the server) and Allie Crevier (for the Workstation).

There are many ways you can contribute to SecureDrop:

• You can make a donation to help us pay for development, upkeep and support. This also enables us to work with news organizations to help them install and use SecureDrop.
• You can contribute to the development of SecureDrop by visiting our GitHub page. If you just want to dive in and start coding, make sure you read the Developer Guide first, then check out our Issues page for something to work on.
  
• If you want to get involved in internationalization or UX work, or you have other questions or comments, you can join the SecureDrop community forums, or talk to us in real-time in our Gitter channel.