Submitting documents anonymously by Atanas Chobanov
-
Upload
eurobsdcon -
Category
Technology
-
view
203 -
download
1
Transcript of Submitting documents anonymously by Atanas Chobanov
Submitting documents anonymously
Sources Protection and Anonymous Documents Submission Systems!
!Atanas Tchobanov !
bivol.bg & [email protected]
Why whistleblowing matters?
• Exposing officials misconduct;
• Bringing light to criminal behavior;
• Bringing critical information for corroborating investigative hypothesis;
• Protecting the public interest;
• Needs law & technology protection;
War on whistleblowers• Prosecution under the Espionage Act in US;
• World scale hunting (Snowden);
• Jail time sentences (Manning);
• Journalists under threat (NYTimes James Risen, The Guardian Glen Greenwald);
• Local case: the Bulgarian « Galeria » scandal.
Case study• FOIA access to a document exposing officials corruption
(« Misho The Beer » case) takes 2 years long judicial case;
• Whistleblower leaking takes 2 minutes;
Anonymous electronic submission challenges
• More dangerous then a « brown envelope »;
• Traceability resistance;
• Strong anonymity;
• Strong security;
• User friendly;
Old Systems
• cryptome.org online from 1996,
• 70000 files,
• PGP mail submissions,
• Run by John Young and Deborah Natsios;
The « Classic » System• wikileaks.org online from 2007;
• TOR submission, PGP mail submission, IRC chat, Brown envelope…;
• The TOR submission system died after the Julian Assange - Daniel Domscheit-Berg split;
• Close source, designed by a single person: The Architect;
WikiLeaks followers• AnonLeaks.eu BalkanLeaks.eu BrusselsLeaks.eu
CorporateLeaks.org CrowdLeaks.com EnviroLeaks.org FrenchLeaks.org GlobaLeaks.org GreenLeaks.com GreenLeaks.org indoleaks.org jumboleaks.org LocaLeaks.com OpenLeaks.org PirateLeaks.cz QuebecLeaks.org RuLeaks.net ThaiLeaks.info tradeleaks.com TuniLeaks.appspot.com…
• Many followers, but… No leaks;
• balkanleaks.eu, named most successful WikiLeaks follower by Assange and some media (Forbes, Arstechnica).
BalkanLeaks Success StoriesMasonic lodge in the Judicial
SystemBelene NPP
report
The « Buddha »
Files
Implementing SecureDrop• Aaron Swartz's Final Project;
• Supported by Freedom of the Press Foundation (USA);
• TOR based, PGP encryption;
• Adopted by The New Yorker, Forbes and others;
• Open source, Python;
Hardware & Software Challenges
• Affordability (two servers, a laptop, etc.) costs around $3,000;
• Needs competent IT staff;
• Needs comprehensive training for journalists (PGP skills, Local encryption/decryption);
The «AfterLeak» time• OK, we got « The MegaLeak » or the « MegaFOIA ».
Now what?
• Comprehensive indexing of millions of records: PDF, mails, etc;
• Using custom parsers and The Sphinx indexer;
• Sharing and searching the sensitive material.
The «AfterLeak» time• Case study: Searchable database of solicitation and
award notices from FBO.gov. obtained by Sunlight Foundation: https://bivol.bg/bivol_sunlight_search/
• Case study: Searchable database of leaked emails from the Bulgarian Socialist Party (BSPLeaks): https://balkanleaks.eu/bspleaks
The MIHALYA project: Javascript Based Encrypted Data Searching Tool
• Full webapp embedded in index.html;!• Local input of user and pass. They never travel through the Net unencrypted;!• No data is travelling and stored without encryption;!• Search words are encrypted and the browser tries to retrieve the corresponding
index files/localstorage;!• If index file is found, it is decrypted in RAM. Index contains only pointers to the files
with data;!• Pointers are encrypted and there is a lookup for the corresponding data files; Files
are decrypted one at a time in RAM;!• In the server version index and data are cached in localstorage in encrypted form,
which speeds up and obfuscates the way it works;!• Works with tablets, iOS, Android.!• Github: https://github.com/bivol/Mihalya
• Addressing the Single Point of Failure problem;
• Distributed storage
Prospectives
• Distributed DHT Infrastructure (Delian Delchev): https://www.balkanleaks.eu/wld/