Over the past month, we’ve seen significant interest in newsrooms setting up SecureDrop. Our open source whistleblower submission system is already used around the globe by large media organizations, small nonprofit newsrooms, and everything in between. We’re excited to see more adoption of SecureDrop. Here are five things you should know before getting started:
SecureDrop protects sources and journalists
SecureDrop aims to protect both the person providing the information and the reporter receiving it. Sources connect solely using the encrypted Tor network; there’s no app or special software to install that could leave a trace when they leak. All communications are encrypted on the server, with as minimal metadata retained as possible.
Normally it’s dangerous to open arbitrary documents sent by strangers, but SecureDrop uses an air-gapped system for reviewing submissions to protect journalists from any potential malware.
While we believe SecureDrop is best-in-class software, with defense-in-depth features and regular security audits, keep in mind that no software is perfect and entirely bug-free.
Free software, but it requires an investment to set up
The SecureDrop software is open source, so anyone can use it free of charge and you don’t need our permission or participation. The installation process is fully documented, with step-by-step instructions available online. (We can help with this; see below.)
However, SecureDrop is not free to run. First off, you’ll need two dedicated servers, a firewall, and a laptop. We suggest budgeting for a likely minimum hardware budget of $2,500; our hardware guide has details on all the required components.
On top of that, you’ll need an IT professional with basic Linux skills to perform the initial setup and any required maintenance (a few hours per month).
Finally, you’ll need a place to host the servers with a reliable internet connection and physical security. Keeping SecureDrop in a journalist's home comes with additional risks and is not something we generally recommend unless necessary.
Advertising attracts whistleblowers
A secure tipline is only useful if potential sources know about it.
Newsrooms will also need to set up a tips page on their website to direct sources to their SecureDrop and any other potential secure contact methods. It’s important that this tips page doesn’t have any tracking or analytics, to prevent sources from being outed before they even reach SecureDrops. Some examples: The Guardian, The New York Times, and Greekleaks.
Experience has shown that newsrooms that invest in advertising their SecureDrop will have a far better outcome in terms of useful submissions versus those that don’t. Promote your tips page wherever possible: via social media, in the footer of investigative pieces, or even in print editions.
We’re here to help
Freedom of the Press Foundation (FPF), which develops SecureDrop, offers on-site install assistance, training for journalists, and more. FPF also provides priority support contracts, and we do have some limited capacity for pro bono support for independent and nonprofit newsrooms.
And even if you don’t need help, please still reach out if you’re setting up a SecureDrop! We will add you to our internal Support Portal to receive security bulletins and other news about SecureDrop.
Part of an ecosystem
SecureDrop is one part of an ecosystem of communications tools that facilitate whistleblowing; each tool has its own pros and cons. By prioritizing source and journalist safety to significant lengths, SecureDrop comes with a higher setup cost and in some cases, a more difficult user experience.
SecureDrop may not be the best fit for your newsroom, and we understand that. FPF has published a comparison of other secure tipline options that you may find useful.