SecureDrop

Profile narrative

SecureDrop is an open-source whistleblower submission system designed to enable secure and anonymous document transfer from sources to journalists. It provides a web interface that sources can access via the Tor network to upload files and messages without revealing their identity. The system encrypts submissions and stores them on a server controlled by the receiving news organization, which can then decrypt and review the material using a separate, offline workstation. SecureDrop is intended for use by media outlets, non-governmental organizations, and other entities that need to protect whistleblowers while investigating sensitive information. Its deployment is typically hosted on the organization’s own infrastructure, allowing full control over security practices and data retention. The software is freely available under a permissive license, enabling any institution to install and customize it according to its operational needs. By focusing on anonymity and end-to-end encryption, SecureDrop addresses a niche market concerned with protecting confidential sources in high-risk environments.

SecureDrop distinguishes itself through its reliance on Tor hidden services, which conceal both the source’s location and the server’s IP address, reducing the risk of network‑based surveillance. The platform’s security model separates the submission interface from the decryption environment, ensuring that even if the public‑facing server is compromised, the private keys needed to read submissions remain offline. Maintenance and development of SecureDrop are overseen by the Freedom of the Press Foundation, a nonprofit that supports press freedom initiatives, while the original code was created by the late Aaron Swartz and journalist Kevin Poulsen. The project benefits from contributions by a global community of developers who audit the code for vulnerabilities and implement regular updates. In September 2019, a phishing campaign targeted the SecureDrop instance operated by The Guardian, attempting to harvest credentials from users of the whistleblowing portal; the attack was disclosed publicly and prompted the organization to reinforce user‑awareness training and monitoring. Although specific metrics such as user base size or number of participating outlets are not disclosed in the source material, the platform’s adoption is evidenced by its use among prominent international news organizations. These characteristics position SecureDrop as a specialized tool dedicated to safeguarding journalistic source protection within the broader cybersecurity landscape.

Incidents

0 incidents linked to this organisation.