Anonymized Whistleblower Communication Platform Using Tor — Complete Documentation & Simulation

Overview & System Context

Anonymized Whistleblower Communication Platform Using Tor: Comprehensive Web-Sourced Technical Investigation Exhaustive Research Dossier · Pure Web-Scraped Content: ~9501 Words · Real Software Screenshots: 3 1. Executive Overview & Technical Background Tor is a free overlay network for enabling anonymous communication. It is built on free and open-source software run by over seven thousand volunteer-operated relays worldwide, as well as by millions of users who route their internet traffic via random paths through these relays. This technique is called onion routing. Using Tor makes it more difficult to trace a user's internet activity by preventing any single point on the internet (other than the user's device) from being able to view both where traffic originated from and where it is ultimately going to at the same time. This conceals a user's location and usage from anyone performing network surveillance or traffic analysis from any such point, protecting the user's freedom and ability to communicate confidentially.

In 2004, the Naval Research Laboratory released the code for Tor under a free license, and the Electronic Frontier Foundation (EFF) began funding Dingledine and Mathewson to continue its development. In 2006, Dingledine, Mathewson, and five others founded The Tor Project, a Massachusetts-based 501(c)(3) research-education nonprofit organization responsible for maintaining Tor. The EFF acted as The Tor Project's fiscal sponsor in its early years, and early financial supporters included the U.S. Bureau of Democracy, Human Rights, and Labor and International Broadcasting Bureau, Internews, Human Rights Watch, the University of Cambridge, Google, and Netherlands-based Stichting NLnet. Over the course of its existence, various Tor vulnerabilities have been discovered and occasionally exploited. Attacks against Tor are an active area of academic research that is welcomed by The Tor Project itself.

Tor enables its users to surf the Internet, chat and send instant messages anonymously, and is used by a wide variety of people for both licit and illicit purposes. Tor has, for example, been used by criminal enterprises, hacktivism groups, and law enforcement agencies at cross purposes, sometimes simultaneously; likewise, agencies within the U.S. government variously fund Tor (the U.S. State Department, the National Science Foundation, and – through the Broadcasting Board of Governors, which itself partially funded Tor until October 2012 – Radio Free Asia) and seek to subvert it. Tor was one of a dozen circumvention tools evaluated by a Freedom House-funded report based on user experience from China in 2010, which include Ultrasurf, Hotspot Shield, and Freegate. Tor is not meant to completely solve the issue of anonymity on the web. Tor is not designed to completely erase tracking but instead to reduce the likelihood for sites to trace actions and data back to the user. Tor can also be used for illegal activities. These can include censorship circumvention, as well as distribution of child abuse content, drug sales, or malware distribution. Tor has been described by The Economist, in relation to Bitcoin and Silk Road, as being "a dark corner of the web". It has been targeted by the American National Security Agency and the British GCHQ signals intelligence agencies, albeit with marginal success, and more successfully by the British National Crime Agency in its Operation Notarise. At the same time, GCHQ has been using a tool named "Shadowcat" for "end-to-end encrypted access to VPS over SSH using the Tor network". Tor can be used for anonymous defamation, unauthorized news leaks of sensitive information, copyright infringement, distribution of illegal sexual content, selling controlled substances, weapons, and stolen credit card numbers, money laundering, bank fraud, credit card fraud, identity theft and the exchange of counterfeit currency; the black market utilizes the Tor infrastructure, at least in part, in conjunction with Bitcoin. It has also been used to brick IoT devices. In its complaint against Ross William Ulbricht of Silk Road, the US Federal Bureau of Investigation acknowledged that Tor has "known legitimate uses". According to CNET, Tor's anonymity function is "endorsed by the Electronic Frontier Foundation (EFF) and other civil liberties groups as a method for whistleblowers and human rights workers to communicate with journalists". EFF's Surveillance Self-Defense guide includes a description of where Tor fits in a larger strategy for protecting privacy and anonymity. In 2014, the EFF's Eva Galperin told Businessweek that "Tor's biggest problem is press. No one hears about that time someone wasn't stalked by their abuser. They hear how somebody got away with downloading child porn." The Tor Project states that Tor users include "normal people" who wish to keep their Internet activities private from websites and advertisers, people concerned about cyber-spying, and users who are evading censorship such as activists, journalists, and military professionals. In November 2013, Tor had about four million users. According to the Wall Street Journal, in 2012 about 14% of Tor's traffic connected from the United States, with people in "Internet-censoring countries" as its second-largest user base. Tor is increasingly used by victims of domestic violence and the social workers and agencies that assist them, even though shelter workers may or may not have had professional training on cyber-security matters. Properly deployed, however, it precludes digital stalking, which has increased due to the prevalence of digital media in contemporary online life. Along with SecureDrop, Tor is used by news organizations such as The Guardian, The New Yorker, ProPublica and The Intercept to protect the privacy of whistleblowers. In March 2015, the Parliamentary Office of Science and Technology released a briefing which stated that "There is widespread agreement that banning online anonymity systems altogether is not seen as an acceptable policy option in the U.K." and that "Even if it were, there would be technical challenges." The report further noted that Tor "plays only a minor role in the online viewing and distribution of indecent images of children" (due in part to its inherent latency); its usage by the Internet Watch Foundation, the utility of its onion services for whistleblowers, and its circumvention of the Great Firewall of China were touted. Tor's executive director, Andrew Lewman, also said in August 2014 that agents of the NSA and the GCHQ have anonymously provided Tor with bug reports. The Tor Project's FAQ offers supporting reasons for the EFF's endorsement: Criminals can already do bad things. Since they're willing to break laws, they already have lots of options available that provide better privacy than Tor provides... Tor aims to provide protection for ordinary people who want to follow the law. Only criminals have privacy right now, and we need to fix that...

Figure 1: A Full-Featured Anonymous Reporting Platform | Elker So yes, criminals could in theory use Tor, but they already have better options, and it seems unlikely that taking Tor away from the world will stop them from doing their bad things. At the same time, Tor and other privacy measures can fight identity theft, physical crimes like stalking, and so on.

Tor aims to conceal its users' identities and their online activity from surveillance and traffic analysis by separating identification and routing. It is an implementation of onion routing, which encrypts and then randomly bounces communications through a network of relays run by volunteers around the globe. These onion routers employ encryption in a multi-layered manner (hence the onion metaphor) to ensure perfect forward secrecy between relays, thereby providing users with anonymity in a network location. That anonymity extends to the hosting of censorship-resistant content by Tor's anonymous onion service feature. Furthermore, by keeping some of the entry relays (bridge relays) secret, users can evade Internet censorship that relies upon blocking public Tor relays. Because the IP address of the sender and the recipient are not both in cleartext at any hop along the way, anyone eavesdropping at any point along the communication channel cannot directly identify both ends. Furthermore, to the recipient, it appears that the last Tor node (called the exit node), rather than the sender, is the originator of the communication.

Tor can also provide anonymity to websites and other servers. Servers configured to receive inbound connections by connecting to Tor are called onion services (formerly, hidden services). Rather than revealing a server's IP address (and thus its network location), an onion service is accessed through its onion address, usually via the Tor Browser or some other software designed to use Tor. The Tor network understands these addresses by looking up their corresponding public keys and introduction points from a distributed hash table within the network. It can route data to and from onion services, even those hosted behind firewalls or network address translators (NAT), while preserving the anonymity of both parties. Tor is necessary to access these onion services. Because the connection never leaves the Tor network, and is handled by the Tor application on both ends, the connection is always end-to-end encrypted. Onion services were first specified in 2003 and have been deployed on the Tor network since 2004. They are unlisted by design, and can only be discovered on the network if the onion address is already known, though a number of sites and services do catalog publicly known onion addresses. Popular sources of .onion links include Pastebin, Twitter, Reddit, other Internet forums, and tailored search engines. While onion services are often discussed in terms of websites, they can be used for any TCP service, and are commonly used for increased security or easier routing to non-web services, such as secure shell remote login, chat services such as IRC and XMPP, or file sharing. They have also become a popular means of establishing peer-to-peer connections in messaging and file sharing applications. Web-based onion services can be accessed from a standard web browser without client-side connection to the Tor network using services like Tor2web, which remove client anonymity. In 2023, the Tor Project unveiled a new defense mechanism to safeguard onion services against denial-of-service (DoS) attacks. With the release of Tor 0.4.8, this proof-of-work (PoW) defense promises to prioritize legitimate network traffic while deterring malicious attacks.

Tor makes no attempt to conceal the IP addresses of exit relays, or hide from a destination server the fact that a user is connecting via Tor. Operators of Internet sites therefore have the ability to prevent traffic from Tor exit nodes or to offer reduced functionality for Tor users. For example, Wikipedia generally forbids all editing when using Tor or when using an IP address also used by a Tor exit node, and the BBC blocks the IP addresses of all known Tor exit nodes from its iPlayer service. Apart from intentional restrictions of Tor traffic, Tor use can trigger defense mechanisms on websites intended to block traffic from IP addresses observed to generate malicious or abnormal traffic. Because traffic from all Tor users is shared by a comparatively small number of exit relays, tools can misidentify distinct sessions as originating from the same user, and attribute the actions of a malicious user to a non-malicious user, or observe an unusually large volume of traffic for one IP address. Conversely, a site may observe a single session connecting from different exit relays, with different Internet geolocations, and assume the connection is malicious, or trigger geo-blocking. When these defense mechanisms are triggered, it can result in the site blocking access, or presenting captchas to the user.

Figure 2: Best 15+ anonymous reporting software platforms (2025) - SpeakUp In July 2014, the Tor Project issued a security advisory for a "relay early traffic confirmation" attack, disclosing the discovery of a group of relays attempting to de-anonymize onion service users and operators. A set of onion service directory nodes (i.e., the Tor relays responsible for providing information about onion services) were found to be modifying traffic of requests. The modifications made it so the requesting client's guard relay, if controlled by the same adversary as the onion service directory node, could easily confirm that the traffic was from the same request. This would allow the adversary to simultaneously know the onion service involved in the request, and the IP address of the client requesting it (where the requesting client could be a visitor or owner of the onion service). The attacking nodes joined the network on 30 January, using a Sybil attack to comprise 6.4% of guard relay capacity, and were removed on 4 July. In addition to removing the attacking relays, the Tor application was patched to prevent the specific traffic modifications that made the attack possible. In November 2014, there was speculation in the aftermath of Operation Onymous, resulting in 17 arrests internationally, that a Tor weakness had been exploited. A representative of Europol was secretive about the method used, saying: "This is something we want to keep for ourselves. The way we do this, we can't share with the whole world, because we want to do it again and again and again." A BBC source cited a "technical breakthrough" that allowed tracking physical locations of servers, and the initial number of infiltrated sites led to the exploit speculation. A Tor Project representative downplayed this possibility, suggesting that execution of more traditional police work was more likely. In November 2015, court documents suggested a connection between the attack and arrests, and raised concerns about security research ethics. The documents revealed that the FBI obtained IP addresses of onion services and their visitors from a "university-based research institute", leading to arrests.

Reporting from Motherboard found that the timing and nature of the relay early traffic confirmation attack matched the description in the court documents. Multiple experts, including a senior researcher with the ICSI of UC Berkeley, Edward Felten of Princeton University, and the Tor Project agreed that the CERT Coordination Center of Carnegie Mellon University was the institute in question. Concerns raised included the role of an academic institution in policing, sensitive research involving non-consenting users, the non-targeted nature of the attack, and the lack of disclosure about the incident.

The main implementation of Tor is written primarily in C. Starting in 2020, the Tor Project began development of a full rewrite of the C Tor codebase in Rust. The project, named Arti, was publicly announced in July 2021. Standard: All website functions supported by Tor Browser, such as JavaScript, fonts, and multimedia, are enabled. Safer: Some features known to be common attack vectors are disabled. JavaScript is disabled on all websites not secured by TLS; some fonts and mathematical symbols are disabled; videos and audio are click-to-play. Safest: Only features necessary for static websites and basic services are enabled. JavaScript is disabled globally; some fonts, icons, math symbols, and images are disabled; videos and audio are click-to-play. To allow download from places where accessing the Tor Project URL may be risky or blocked, a GitHub repository is maintained with links for releases hosted in other domains.

Tor has been praised for providing privacy and anonymity to vulnerable Internet users such as political activists fearing surveillance and arrest, ordinary web users seeking to circumvent censorship, and people who have been threatened with violence or abuse by stalkers. The U.S. National Security Agency (NSA) has called Tor "the king of high-secure, low-latency Internet anonymity", and BusinessWeek magazine has described it as "perhaps the most effective means of defeating the online surveillance efforts of intelligence agencies around the world". Other media have described Tor as "a sophisticated privacy tool", "easy to use" and "so secure that even the world's most sophisticated electronic spies haven't figured out how to crack it". Advocates for Tor say it supports freedom of expression, including in countries where the Internet is censored, by protecting the privacy and anonymity of users. The mathematical underpinnings of Tor lead it to be characterized as acting "like a piece of infrastructure, and governments naturally fall into paying for infrastructure they want to use". The project was originally developed on behalf of the U.S. intelligence community and continues to receive U.S. government funding, and has been criticized as "more resembl[ing] a spook project than a tool designed by a culture that values accountability or transparency". As of 2012, 80% of The Tor Project's $2M annual budget came from the United States government, with the U.S. State Department, the Broadcasting Board of Governors, and the National Science Foundation as major contributors, aiming "to aid democracy advocates in authoritarian states". Other public sources of funding include DARPA, the U.S. Naval Research Laboratory, and the Government of Sweden. Some have proposed that the government values Tor's commitment to free speech, and uses the darknet to gather intelligence. Tor also receives funding from NGOs including Human Rights Watch, and private sponsors including Reddit and Google. Dingledine said that the United States Department of Defense funds are more similar to a research grant than a procurement contract. Tor executive director Andrew Lewman said that even though it accepts funds from the U.S. federal government, the Tor service did not collaborate with the NSA to reveal identities of users. Critics say that Tor is not as secure as it claims, pointing to U.S. law enforcement's investigations and shutdowns of Tor-using sites such as web-hosting company Freedom Hosting and online marketplace Silk Road. In October 2013, after analyzing documents leaked by Edward Snowden, The Guardian reported that the NSA had repeatedly tried to crack Tor and had failed to break its core security, although it had had some success attacking the computers of individual Tor users. The Guardian also published a 2012 NSA classified slide deck, entitled "Tor Stinks", which said: "We will never be able to de-anonymize all Tor users all the time", but "with manual analysis we can de-anonymize a very small fraction of Tor users".

When Tor users are arrested, it is typically due to human error, not to the core technology being hacked or cracked. On 7 November 2014, for example, a joint operation by the FBI, ICE Homeland Security Investigations and European Law enforcement agencies led to 17 arrests and the seizure of 27 sites containing 400 pages. A late 2014 report by Der Spiegel using a new cache of Snowden leaks revealed, however, that as of 2012 the NSA deemed Tor on its own as a "major threat" to its mission, and when used in conjunction with other privacy tools such as OTR, Cspace, ZRTP, RedPhone, Tails, and TrueCrypt was ranked as "catastrophic," leading to a "near-total loss/lack of insight to target communications, presence..." Figure 3: Whistleblower Software Reviews 2026: Details, Pricing, & Features | G2 "No adversary is truly global, but no adversary needs to be truly global," he says. "Eavesdropping on the entire Internet is a several-billion-dollar problem. Running a few computers to eavesdrop on a lot of traffic, a selective denial of service attack to drive traffic to your computers, that's like a tens-of-thousands-of-dollars problem." At the most basic level, an attacker who runs two poisoned Tor nodes—one entry, one exit—is able to analyse traffic and thereby identify the tiny, unlucky percentage of users whose circuit happened to cross both of those nodes. In 2016 the Tor network offers a total of around 7,000 relays, around 2,000 guard (entry) nodes and around 1,000 exit nodes. So the odds of such an event happening are one in two million (1⁄2000 × 1⁄1000), give or take." Tor does not provide protection against end-to-end timing attacks: if an attacker can watch the traffic coming out of the target computer, and also the traffic arriving at the target's chosen destination (e.g. a server hosting a .onion site), that attacker can use statistical analysis to discover that they are part of the same circuit. A similar attack has been used by German authorities to track down users related to Boystown.

Anonymity describes situations in which the acting person's identity is unknown. Anonymity may be created unintentionally through the loss of identifying information due to the passage of time or a destructive event, or intentionally if a person chooses to withhold their identity. There are various situations in which a person might choose to remain anonymous. Acts of charity have been performed anonymously when benefactors do not wish to be acknowledged. A person who feels threatened might attempt to mitigate that threat through anonymity. A witness to a crime might seek to avoid retribution, for example, by anonymously calling a crime tipline. In many other situations (like conversation between strangers, or buying some product or service in a shop), anonymity is traditionally accepted as natural. Some writers have argued that the term "namelessness", though technically correct, does not capture what is more centrally at stake in contexts of anonymity. The important idea here is that a person be non-identifiable, unreachable, or untrackable. Anonymity is also seen as a way to realize certain other values, such as privacy or liberty. An important example of anonymity being not only protected, but enforced, by law is in voting in free elections. Criminals might proceed anonymously to conceal their participation in a crime. In certain situations, however, it may be illegal to remain anonymous. For example, 24 of the U.S. states have "stop and identify" statutes that require persons detained to self-identify when requested by a law enforcement officer, when the person is reasonably suspected of committing a crime. Over the past few years, anonymity tools used on the dark web by criminals and malicious users have drastically altered the ability of law enforcement to use conventional surveillance techniques. The term "anonymous message" typically refers to a message that does not reveal its sender. In many countries, anonymous letters are protected by law and must be delivered as regular letters. In mathematics, in reference to an arbitrary element (e.g., a human, an object, a computer), within a well-defined set (called the "anonymity set"), "anonymity" of that element refers to the property of that element of not being identifiable within this set. If it is not identifiable, then the element is said to be "anonymous".

With few perceived negative consequences, anonymous or semi-anonymous forums often provide a soapbox for disruptive conversational behavior. The term "troll" is sometimes used to refer to those who engage in such disruptive behavior. Relative anonymity is often enjoyed in large crowds. Different people have different psychological and philosophical reactions to this development, especially as a modern phenomenon. This anonymity is an important factor in crowd psychology, and behavior in situations such as a riot. This perceived anonymity can be compromised by technologies such as photography. Groupthink behavior and conformity are also considered to be an established effect of internet anonymity. Anonymity also permits highly trained professionals such as judges to freely express themselves regarding the strategies they employ to perform their jobs objectively.

Most commentary on the Internet is essentially done anonymously, using unidentifiable pseudonyms. However, this has been widely discredited in a study by the University of Birmingham, which found that the number of people who use the internet anonymously is statistically the same as the number of people who use the internet to interact with friends or known contacts. While these usernames can take on an identity of their own, they are sometimes separated and anonymous from the actual author. According to the University of Stockholm this is creating more freedom of expression, and less accountability.

Wikipedia is collaboratively written mostly by authors using either unidentifiable pseudonyms or temporary account identifiers, although many Wikipedia editors use their real names instead of pseudonyms. However, the Internet was not designed for anonymity: IP addresses serve as virtual mailing addresses, which means that any time any resource on the Internet is accessed, it is accessed from a particular IP address, and the data traffic patterns to and from IP addresses can be intercepted, monitored, and analysed, even if the content of that traffic is encrypted. This address can be mapped to a particular Internet service provider (ISP), and this ISP can then provide information about what customer that IP address was leased to. This does not necessarily implicate a specific individual (because other people could be using that customer's connection, especially if the customer is a public resource, such as a library), but it provides regional information and serves as powerful circumstantial evidence. Anonymizing services such as I2P and Tor address the issue of IP tracking. In short, they work by encrypting packets within multiple layers of encryption. The packet follows a predetermined route through the anonymizing network. Each router sees the immediate previous router as the origin and the immediate next router as the destination. Thus, no router ever knows both the true origin and destination of the packet. This makes these services more secure than centralized anonymizing services (where a central point of knowledge exists). Sites such as Chatroulette, Omegle, and Tinder (which pair up random users for a conversation) capitalized on a fascination with anonymity. Apps like Yik Yak, Secret and Whisper let people share things anonymously or quasi-anonymously whereas Random let the user to explore the web anonymously. Some email providers, like Tuta also offer the ability to create anonymous email accounts which do not require any personal information from the account holder. Other sites, however, including Facebook and Google+, ask users to sign in with their legal names. In the case of Google+, this requirement led to a controversy known as the nymwars. The prevalence of cyberbullying is often attributed to relative Internet anonymity, due to the fact that potential offenders are able to mask their identities and prevent themselves from being caught. A principal in a high school stated that comments made on these anonymous sites are "especially vicious and hurtful since there is no way to trace their source and it can be disseminated widely. "Cyberbullying, as opposed to general bullying, is still a widely-debated area of Internet freedom in several states. Though Internet anonymity can provide a harmful environment through which people can hurt others, anonymity can allow for a much safer and relaxed internet experience. In a study conducted at Carnegie Mellon University, 15 out of 44 participants stated that they choose to be anonymous online because of a prior negative experience during which they did not maintain an anonymous presence. Such experiences include stalking, releasing private information by an opposing school political group, or tricking an individual into traveling to another country for a job that did not exist.

Participants in this study stated that they were able to avoid their previous problems by using false identification online. David Chaum is considered "the father of online anonymity". In the early 1980s, while a computer scientist at Berkeley, Chaum predicted the world in which computer networks would make mass surveillance a possibility. As Dr. Joss Wright explains: "David Chaum was very ahead of his time. He predicted in the early 1980s concerns that would arise on the internet 15 or 20 years later." However, there are some who consider anonymity on the Internet as a danger for our society as a whole. David Davenport, an assistant professor in the Computer Engineering Department of Bilkent University in Ankara, Turkey, considers that when anonymous online communication is allowed, the fabric of our society is at risk. "Accountability requires those responsible for any misconduct be identified and brought to justice. However, if people remain anonymous, by definition, they cannot be identified, making it impossible to hold them accountable." he says.

People dependent on an organization, or afraid of revenge, may divulge serious misuse, which should be revealed. Anonymous tips can be used as an information source by newspapers, as well as by police departments, soliciting tips aimed at catching criminals. Not everyone will regard such anonymous communication as good. For example, message boards established outside companies, but for employees of such companies to vent their opinions on their employer, have sometimes been used in ways that at least the companies themselves were not happy about [Abelson 2001]. Police use of anonymity is a complex issue, since the police often will want to know the identity of the tipper in order to get more information, evaluate the reliability or get the tipper as a witness. Is it ethical for police to identify the tipper if it has opened up an anonymous tipping hotline? People in a country with a repressive political regime may use anonymity (for example Internet-based anonymity servers in other countries) to avoid persecution for their political opinions. Note that even in democratic countries, some people claim, rightly or wrongly, that certain political opinions are persecuted. [Wallace 1999] gives an overview of uses of anonymity to protect political speech. Every country has a limit on which political opinions are allowed, and there are always people who want to express forbidden opinions, like racial agitation in most democratic countries. People may openly discuss personal subjects that they consider too embarrassing to share with their friends, such as sexual problems. Research shows that anonymous participants disclose significantly more information about themselves.

People might also feel more open to sharing their personal work anonymously if they feel that their friends and family would harass them or disapprove of their work. Examples of such work could include fan fiction or vocal performances. People may get more objective evaluation of their messages, by not showing their real name. People are more equal in anonymous discussions, factors like status, gender, etc., will not influence the evaluation of what they say. Pseudonymity can be used to experiment with role playing, for example a man posing as a woman in order to understand the feelings of people of different gender. Pseudonymity can be a tool for timid people to dare establish contacts which can be of value for them and others, e.g.

through contact advertisements. People can contribute to online social discussion with reduced risk of harm by online predators. Online predators include "criminals, hackers, scammers, stalkers, and malicious online vendors". People can avoid becoming famous by publishing their work anonymously. There has always, however, also been a negative side of anonymity: Anonymity can be used to protect a criminal performing many different crimes, for example slander, distribution of child pornography, illegal threats, racial agitation, fraud, intentional damage such as distribution of computer viruses, etc. The exact set of illegal acts varies from country to country, but most countries have many laws forbidding certain "informational" acts, everything from high treason to instigation of rebellion, etc., to swindling. Anonymity can be used for online payments for criminals paying others to perform illegal acts or purchases. Anonymity can be used to seek contacts for performing illegal acts, like a child groomer searching for children to abuse or a swindler searching for people to rip off. Even when the act is not illegal, anonymity can be used for offensive or disruptive communication. For example, some people use anonymity in order to say harmful things about other people, known as cyberbullying. Internet trolls use anonymity to harm discussions in online social platforms. The border between illegal and legal but offensive use is not very sharp, and varies depending on the law in each country.

The right to anonymous political campaigning was established in the U.S. Supreme Court decision in McIntyre v. Ohio Elections Commission (1995) case: "Anonymity is a shield from the tyranny of the majority...It thus exemplifies the purpose behind the Bill of Rights, and of the First Amendment in particular: to protect unpopular individuals from retaliation—and their ideas from suppression—at the hand of an intolerant society". The Supreme court explained that protecting anonymous political speech receives the highest protection however, this priority takes on new dimensions in the digital age. The right of individuals for "anonymous communication" was established by the decision in case Columbia Insurance Company v.

Seescandy.com, et al. (1999) of the United States District Court for the Northern District of California: "People are permitted to interact pseudonymously and anonymously with each other so long as those acts are not in violation of the law". The right of individuals for "anonymous reading" was established in the U.S. Supreme Court decision in United States v. Rumely (1953): "Once the government can demand of a publisher the names of the purchasers of his publications, the free press as we know it disappears. Then the spectre of a government agent will look over the shoulder of everyone who reads". The pressure on anonymous communication has grown substantially after the 2001 terrorist attack on the World Trade Center and the subsequent new political climate. Although it is still difficult to oversee their exact implications, measures such as the US Patriot Act, the European Cybercrime Convention and the European Union rules on data retention are only few of the signs that the exercise of the right to the anonymous exchange of information is under substantial pressure. An above-mentioned 1995 Supreme Court ruling in McIntyre v. Ohio Elections Commission reads: "(...) protections for anonymous speech are vital to democratic discourse. Allowing dissenters to shield their identities frees them to express critical minority views . . .

Anonymity is a shield from the tyranny of the majority. . . . It thus exemplifies the purpose behind the Bill of Rights and of the First Amendment in particular: to protect unpopular individuals from retaliation . . . at the hand of an intolerant society." However, anonymous online speech is not without limits. It is clearly demonstrated in a case from 2008, one in which the defendant stated on a law-school discussion board that two women should be raped, an anonymous poster's comments may extend beyond free speech protections. In the case, a Connecticut federal court must apply a standard to decide whether the poster's identity should be revealed. There are several tests, however, that the court could apply when considering this issue.

The history of anonymous expression in political dissent is both long and with important effect, as in the Letters of Junius or Voltaire's Candide, or scurrilous as in pasquinades. In the tradition of anonymous British political criticism, The Federalist Papers were anonymously authored by three of America's Founding Fathers. Without the public discourse on the controversial contents of the U.S. Constitution, ratification would likely have taken much longer as individuals worked through the issues. The United States Declaration of Independence, however, was not anonymous. If it had been unsigned, it might well have been less effective. John Perry Barlow, Joichi Ito, and other U.S. bloggers express a very strong support for anonymous editing as one of the basic requirements of open politics as conducted on the Internet.

List of anonymously published works List of anonymous masters Notname Data anonymization Friend-to-friend Internet privacy Online disinhibition effect On the Internet, nobody knows you're a dog Personally identifiable information Anonymity (social choice) An anonymous P2P communication system is a peer-to-peer distributed application in which the nodes, which are used to share resources, or participants are anonymous or pseudonymous. Anonymity of participants is usually achieved by special routing overlay networks that hide the physical location of each node from other participants. Interest in anonymous P2P systems has increased in recent years for many reasons, ranging from the desire to share files without revealing one's network identity and risking litigation to distrust in governments, concerns over mass surveillance and data retention, and lawsuits against bloggers.

Censorship at the local, organizational, or national level Personal privacy preferences such as preventing tracking or data mining activities The material or its distribution is considered illegal or incriminating by possible eavesdroppers Material is legal but socially deplored, embarrassing or problematic in the individual's social world Fear of retribution (against whistleblowers, unofficial leaks, and activists who do not believe in restrictions on information nor knowledge) A particularly open view on legal and illegal content is given in The Philosophy Behind Freenet. Governments are also interested in anonymous P2P technology. The United States Navy funded the original onion routing research that led to the development of the Tor network, which was later funded by the Electronic Frontier Foundation and is now developed by the non-profit organization The Tor Project, Inc.

2. System Architecture & Core Working Principles Anonymous blogging is one widespread use of anonymous networks. While anonymous blogging is possible on the non-anonymous internet to some degree too, a provider hosting the blog in question might be forced to disclose the blogger's IP address (as when Google revealed an anonymous blogger's identity). Anonymous networks provide a better degree of anonymity. Flogs (anonymous blogs) in Freenet, Syndie and other blogging tools in I2P and Osiris sps are some examples of anonymous blogging technologies. One argument for anonymous blogging is a delicate nature of work situation. Sometimes a blogger writing under their real name faces a choice between either staying silent or causing a harm to themselves, their colleagues or the company they work for. Another reason is risk of lawsuits. Some bloggers have faced multimillion-dollar lawsuits (although they were later dropped completely); anonymous blogging provides protection against such risks.

Like conventional P2P networks, anonymous P2P networks can implement either opennet or darknet (often named friend-to-friend) network type. This describes how a node on the network selects peer nodes: In opennet network, peer nodes are discovered automatically. There is no configuration required but little control available over which nodes become peers. In a darknet network, users manually establish connections with nodes run by people they know. Darknet typically needs more effort to set up but a node only has trusted nodes as peers. Some networks like Freenet support both network types simultaneously (a node can have some manually added darknet peer nodes and some automatically selected opennet peers) . In a friend-to-friend (or F2F) network, users only make direct connections with people they know. Many F2F networks support indirect anonymous or pseudonymous communication between users who do not know or trust one another. For example, a node in a friend-to-friend overlay can automatically forward a file (or a request for a file) anonymously between two "friends", without telling either of them the other's name or IP address. These "friends" can in turn forward the same file (or request) to their own "friends", and so on. Users in a friend-to-friend network cannot find out who else is participating beyond their own circle of friends, so F2F networks can grow in size without compromising their users' anonymity. Some friend-to-friend networks allow the user to control what kind of files can be exchanged with "friends" within the node, in order to stop them from exchanging files that user disapproves of. Advantages and disadvantages of opennet compared to darknet are disputed, see friend-to-friend article for summary.

Syncthing – a free, open-source peer-to-peer file synchronization application. It can sync files between devices. Data security and data safety are built into the design of the software. Resilio Sync – a proprietary alternative to Syncthing Filetopia – not anonymous but encrypted friend-to-friend. File sharing, chat, internal mail service OneSwarm – a backwards compatible BitTorrent client with privacy-preserving sharing options, aims to create a large F2F network. Retroshare – filesharing, serverless email, instant messaging, VoIP, chatrooms, and decentralized forums.

anoNet – extensible IP anonymizer with steganography support (in development) Crowds – Reiter and Rubin's system for "blending into a crowd" has a known attack P2PRIV – Peer-to-Peer diRect and anonymous dIstribution oVerlay – anonymity via virtual links parallelization – currently in development and has significant, unsolved problems in a real world environment Phantom Anonymity Protocol – a fully decentralized high-throughput anonymization network (no longer in development) Race (Resilient Anonymous Communication for Everyone) – A project by DARPA to build an anonymous, attack-resilient mobile communication system that can reside completely within a network environment, capable of avoiding large-scale compromise by preventing compromised information from being useful for identifying any of the system nodes because all such information is encrypted on the nodes at all times, even during computation; and preventing communications compromise by virtue of obfuscating communication protocols.

Invisible IRC Project – anonymous IRC, inspired by Freenet, which later became I2P (Invisible Internet Project). Mnet (formerly MojoNation) – a distributed file system Secure platforms for anonymous document submission to journalists and news organizations. SecureDrop instances, independent leak platforms, and OPSEC guidance for whistleblowers.

SecureDrop is an open-source whistleblowing platform developed by the Freedom of the Press Foundation . It allows sources to submit documents and communicate with journalists entirely through Tor hidden services , ensuring that neither the news organization's servers nor network observers can identify the source. Each news organization operates its own independent SecureDrop instance.

SecureDrop uses air-gapped servers, PGP encryption, and Tails OS to create a multi-layered security architecture. Documents are encrypted before storage, and journalists can only access submissions on dedicated, network-isolated machines. The Gray Lady operates one of the most prominent SecureDrop instances, accepting leaked documents from sources worldwide.

WaPo's SecureDrop instance is a primary channel for national security and government accountability leaks. The Guardian accepts confidential tips and documents through its SecureDrop instance, particularly for UK and European accountability stories. Nonprofit investigative journalism — one of the first outlets to adopt SecureDrop for source protection.

Founded by Glenn Greenwald, Laura Poitras, and Jeremy Scahill — known for publishing Edward Snowden's NSA documents. GlobaLeaks is an open-source, self-hosted whistleblowing framework. Unlike SecureDrop, GlobaLeaks is designed to be deployed by any organization — NGOs, government agencies, corporations — to establish their own confidential reporting channels.

A transparency collective that publishes leaked datasets in the public interest. DDoSecrets serves as a WikiLeaks successor with a stronger editorial framework, redacting personally identifying information when appropriate. Whistleblowing is protected speech in many jurisdictions. These platforms exist to protect sources who expose corruption, abuse, and threats to public safety. See our OPSEC Fundamentals for additional security guidance.

SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from and communicate with anonymous sources. In many of the recent leak prosecutions in the United States, sources have been investigated because authorities are able to retrieve both metadata and content of communications from third parties like email and phone providers in secret. SecureDrop attempts to completely eliminate third parties from the equation so that news organizations can challenge any legal orders before handing over any data.

SecureDrop also substantially limits the metadata trail that may exist from journalist-source communications in the first place. In addition, it attempts to provide a safer environment for those communications than regular corporate news networks, which may be compromised. Sources and journalists connect to SecureDrop using the Tor network (represented in the diagram above by the onion symbol). The SecureDrop software is running on premises on dedicated infrastructure (two physical servers and a firewall).

The following steps describe how a SecureDrop submission is submitted, received and reviewed: 3. Software Implementation, Frameworks & Protocols A source (bottom left in the diagram) uploads a submission to the news organization using Tor Browser . A journalist connects to SecureDrop using their Journalist Workstation (booted from a USB drive) and physically transfers files to the air-gapped Secure Viewing Station, a machine that is never connected on the Internet.

On the Secure Viewing Station , the journalist can view the document, process it (e.g., to remove metadata or potential malware), print it, or export it to a dedicated device. Check out What makes SecureDrop Unique to read more about SecureDropâIIs approach to keeping sources safe. A source submits documents and messages by using Tor Browser (or Tails) to access the Source Interface : a public onion service. Submissions are encrypted in place on the Application Server as they are uploaded.

Journalists working in the newsroom use two machines to interact with SecureDrop. First, they use a Journalist Workstation running Tails to connect to the Journalist Interface , an authenticated onion service. Journalists download GPG -encrypted submissions and copy them to a Transfer Device (a thumb drive or DVD). Those submissions are then connected to the airgapped Secure Viewing Station ( SVS ) which holds the key to decrypt them. Journalists can then use the SVS to read, print, and otherwise prepare documents for publication. Apart from those deliberately published, decrypted documents are never accessed on an Internet-connected computer.

The terms in italics are terms of art specific to SecureDrop. The Glossary provides more-precise definitions of these and other terms. SecureDrop is designed against a comprehensive Threat Model , and has a specific notion of the roles that are involved in its operation. The SecureDrop servers are managed by a systems admin; for larger newsrooms, there may be a team of systems admins.

The admin uses a dedicated Admin Workstation running Tails , connects to the Application and Monitor Servers over authenticated onion services , and manages them using Ansible . The web application, which was originally called DeadDrop, was developed by Aaron Swartz in 2012 before his tragic death. The hardening guide and security environment was architected by James Dolan . Investigative journalist Kevin Poulsen originally managed the project. The New Yorker launched the first implementation and branded their version StrongBox in May 2013.

In October 2013, Freedom of the Press Foundation took over management and development of the open source project and re-named it SecureDrop. In the projectâIIs early years at FPF, development was driven by James Dolan and Garrett Robinson . Today, SecureDrop is maintained by a small full-time development team at FPF and a growing volunteer community.

SecureDrop does not seek to re-invent the wheel. Instead it combines several well-respected tools into an application that is easier to use for sources and enforces the use of many security best practices by news organizations. Among the tools used in and around the SecureDrop application are: Tor , GnuPG encryption , Apache , OSSEC , grsecurity , Ubuntu Server , the Tails operating system , and an air-gap to minimize exfiltration risks.

While we canâIIt guarantee 100% security (no organization or product can), the goal of SecureDrop is to create a significantly more secure environment for sources to share information than exists through normal digital channels. Of course, there are always risks. That said, each release of SecureDrop with major architectural changes goes through a security audit by a reputable third party security firm.

Before major code changes are shipped, our policy is to have SecureDrop audited by a professional, third-party security firm. Five audits of SecureDrop have been completed so far: The first audit of SecureDrop, conducted in the Spring of 2013, was conducted by a group of University of Washington researchers and Bruce Schneier, and can be found here .

After significant changes to the system, the second audit of SecureDrop was conducted by Cure53 at the end of 2013 and can be read here . In the summer of 2014 iSEC Partners completed the third audit of SecureDrop. Their report can be read here and you can also read about how we resolved the issues they found .

The fourth audit was conducted in summer 2015, also by iSEC Partners, and can be found in full here . The most recent audit was independently undertaken by Leviathan Security on behalf of Sofwerx in late 2018, and can be found in full here . SecureDrop is a free and open source application that costs nothing to install. However, the application does require hardware that news organizations must purchase, including two servers, several USB sticks, an air-gapped computer, and a firewall.

We have created a recommended hardware guide; following these recommendations wherever possible will minimize incompatibility risks. We are aiming to offer a set of recommendations that work for organizations at different scales. It is critical that the hardware is owned by the media organization and stored on its premises in a secure space. The total cost of the hardware we recommend is $2,200 to $2,400, though it can be done for less if you are willing to sacrifice size and speed on the servers or are able to use recycled machines sourced from within your organization.

4. Practical Deployment, Analysis & Case Studies As part of priority support agreements and on a pro-bono basis for smaller news organizations, Freedom of the Press Foundation will visit your offices, help set up SecureDrop and train journalists to use it. (For pro-bono support, we request that our travel costs are covered.) At SecureDropâIIs heart is a pair of servers: the Application (âIIAppâII) Server , which runs the core SecureDrop software, and the Monitor (âIIMonâII) Server , which keeps track of the Application Server and sends out alerts if thereâIIs a problem. These two servers run on dedicated hardware connected to a dedicated firewall appliance. They are typically located physically inside the newsroom, and must be physically located on-site within your organizationâIIs premises.

An Ubuntu server running two segmented Tor hidden services. The source connects to the Source Interface , a public-facing Tor Onion Service, to send messages and documents to the journalist. The journalist connects to the Journalist Interface , an authenticated Tor Onion Service , to download encrypted documents and respond to sources. An Ubuntu server that monitors the Application Server with OSSEC and sends email alerts.

The SecureDrop application environment consists of at least two computers, in addition to the servers described above: A physically-secured and air-gapped laptop running the Tails operating system from a USB stick, that journalists use to decrypt and view submitted documents. In addition to the Secure Viewing Station computers, each journalist will also need a computer to connect to SecureDrop: The computer used by the journalist to connect to the Journalist Interface to download encrypted documents that they will transfer to the Secure Viewing Station . The Journalist Workstation is also used to respond to sources via the Journalist Interface .

Depending on your organizationâIIs threat model, the Journalist Workstation can either be the journalistâIIs every-day laptop or a dedicated computer. In either case, it is recommended that journalists always use the Tails operating system on their Journalist Workstation when connecting to the Journalist Interface . SecureDrop administrators will also require a computer to connect to SecureDrop and perform administrative tasks. This computer is referred to as the Admin Workstation , and must be capable of running the Tails operating system . The Admin Workstation may also be used as a Journalist Workstation if necessary.

Setting up SecureDrop is a multi-step process. Before getting started, you should make sure that youâIIre prepared to operate and maintain it. YouâIIll need a systems admin whoâIIs familiar with Linux, the GNU utilities, and the Bash shell. YouâIIll need the hardware on which SecureDrop runs âII this will normally cost $2000-$3000. The journalists in your organization will need to be trained in the operation of SecureDrop, and youâIIll need to publish and promote your new SecureDrop instance afterwards âII using your existing websites, mailing lists, and social media.

It is recommended that you have all of this planned out before you get started. If you need help, contact the Freedom of the Press Foundation who will be glad to help walk you through the process and make sure that youâIIre ready to proceed. Once you are familiar with the architecture and have all the hardware, setting up SecureDrop will take at least a dayâIIs work for your admin. We recommend that you set aside at least a week to complete and test your setup.

Once SecureDrop is installed, journalists will need to be provided with accounts, two-factor credentials, workstations, and so on âII and then trained to use these tools safely and reliably. You will probably also need to train additional backup admins so that you can be sure that your SecureDrop setup keeps running even when your main admin is on holiday. Introducing staff to SecureDrop takes half a day. Training a group to use SecureDrop proficiently takes at least a day âII and a single trainer can only work with so many people at once. You will probably need to run several training sessions to instruct an entire newsroom. Depending on staff availability, training and provisioning may take a week or more. If you have multiple offices, training will need to happen at each location. Again, the Freedom of the Press Foundation are happy to help you plan and train your team.

Once you have a SecureDrop instance and your team knows how to use it, you should test it thoroughly and then tell the world. The Freedom of the Press Foundation are happy to help you check that your SecureDrop setup is up-to-code and properly grounded. After that youâIIll want to check out the best practices for your SecureDrop Landing Page and our guide to promoting your SecureDrop instance .

While SecureDrop supports having multiple journalist accounts for the document interface, all accounts will access the same inbox. To avoid confusion, we recommend news organizations assign 1-3 journalists to regularly check SecureDrop and make sure that they all are in contact as to who is responsible for responding to each source. We are considering alternative workflows for future SecureDrop releases; please visit our development roadmap for up-to-date information.

Currently you cannot use SecureDrop with multiple organizations for security reasons. One of the benefits of SecureDrop is that it completely eliminates third parties from your communication channel. The media organization owns and operates the server that both the source and journalist connect to. Any legal request or order has to be served on the media organization operating the SecureDrop server, giving them a chance to challenge it before handing over any data. If a third party operated a SecureDrop server which multiple organizations used, a legal order could be served on the operator without the media organizations knowing.

Whistleblowing is the activity of a person, often an employee, revealing information about activity within a private or public organization that is deemed illegal, immoral, illicit, unsafe or fraudulent ( source ). The Onion Services technology is very important to ensure whistleblowers' safety, and are built in the following platforms: The GlobaLeaks software aims to adhere to industry-standard best practices, with its security being the result of applied research.

5. Performance Evaluation & Extended Technical Observations This document details every aspect implemented by the application in relation to security design. The Backend is a Python-based server that runs on a physical server and exposes a REST API . The Client is a TypeScript client-side web application that interacts with the Backend only through XHR .

Following the Zero Trust paradigm and aiming at implementing a fully auditable technology both the Backend and the Client are implemented using only open-source libraries. The application is designed to avoid logging sensitive metadata that could lead to the identification of whistleblowers. The confidentiality of authentication is protected either by Tor Onion Services v3 or TLS version 1.2+ .

By accessing the login web interface, Administrators and Recipients need to enter their respective Username and Password . If the submitted password is valid, the system grants access to the functionality available to that user. Whistleblowers access their Reports using an anonymous Receipt , which is a randomly generated 16-digit sequence created by the Backend when the Report is first submitted. This format resembles a standard phone number, making it easier for whistleblowers to conceal their receipts.

Passwords are never stored on the server either in plaintext or in form on hash; instead, the system maintains only the hash of a key derived from the user password. Passwords are hashed using Argon2 with a configuration of 16 iterations and 128MB of RAM, a per-user salt for each user and a per-system salt for whistleblowers.

The system enforces complex passwords by implementing a custom algorithm necessary to ensure reasonable entropy for each authentication secret. Strong: A strong password should include capital letters, lowercase letters, numbers, and symbols, be at least 14 characters long, and contain a variety of at least 12 different characters.

Acceptable: An acceptable password should include capital letters, lowercase letters, numbers, and symbols, be at least 12 characters long, and contain a variety of at least 10 different characters. Insecure: Passwords ranked below the strong or acceptable levels are marked as insecure and are not accepted by the system.

We encourage each end user to use KeePassXC to generate and retain strong, unique passphrases. The system implements Two-Factor Authentication (2FA) based on TOTP using the RFC 6238 algorithm and 160-bit secrets. Users can enroll in 2FA via their own preferences, and administrators can optionally enforce this requirement. The system identifies multiple failed login attempts and implements a slowdown procedure, requiring an authenticating client to wait up to 60 seconds to complete an authentication.

This feature is intended to slow down potential attacks, requiring more resources in terms of time, computation, and memory. In case of a lost password, users can request a password reset via the web login interface by clicking on a Forgot password? button present on the login page. When this button is clicked, users are invited to enter their username or email. If the provided username or email corresponds to an existing user, the system will send a reset link to the configured email.

By clicking the link received by email, the user is then invited to set a new password different from the previous one. If encryption is enabled on the system, a user clicking on the reset link must first enter their Account Recovery Key . Only after correct entry will the user be able to set a new password. Harvested Online Documentation & Reference Sources • https://en.wikipedia.org/wiki/Tor%20%28network%29 • https://en.wikipedia.org/wiki/Anonymity • https://en.wikipedia.org/wiki/Anonymous%20P2P • https://torwiki.org/services/whistleblowing/ • https://docs.securedrop.org/en/stable/what_is_securedrop.html • https://onionservices.torproject.org/apps/whistleblowing/ • https://docs.globaleaks.org/en/stable/technical/security/application-security.html