Ubuntu 20.04 (Focal) has reached end of life. Any SecureDrops still using Ubuntu Focal after May 30, 2025, will stop receiving security updates to operating system packages, the kernel, and SecureDrop itself.
To ensure the safety of both journalists and sources, SecureDrops still running Ubuntu Focal will automatically disable their Source Interfaces. Existing source submissions will not be affected and will still be available to journalists, but no new submissions will be accepted.
Over the past month, all SecureDrop servers should have received an update triggering the automated upgrade to Ubuntu 24.04 (Noble). If your SecureDrop Application and Monitor servers have not been upgraded — either automatically or via a semiautomated upgrade — your SecureDrop is likely to go offline starting on May 31. If you’re unsure about the status of your instance, you can follow our documentation to verify your SecureDrop’s OS version.
What to do if your SecureDrop has not upgraded
SecureDrop will support upgrading directly to Ubuntu Noble until June 30, 2025. After this cutoff date, you will need to perform a fresh SecureDrop install of the latest version and restore from a backup.
If you find that your SecureDrop is presently stuck on Ubuntu Focal, you will need to troubleshoot why it has not already succeeded in performing the automated upgrade to Noble — this could be due to hardware or connectivity issues. For support in this troubleshooting process, please don’t hesitate to reach out:
- via our Support Portal, if you are a member (membership is approved on a case-by-case basis)
- via securedrop@freedom.press (PGP encrypted) for sensitive security issues (please use judiciously)
What this means for sources
If you were in contact with an organization via SecureDrop, and you find it disabled before you have established another communications channel to use, we recommend that you wait until their new instance is set up and advertised via their landing page or the SecureDrop directory before resuming contact.
We recommend against communicating with an organization by other means if you have previously exclusively used SecureDrop. Given that your code name serves as a secret passphrase and is invisible to journalists, you should never provide it to anyone who asks.