SecureDrop is an encrypted submission system used by many news organizations and NGOs around the world, including The New York Times, The Washington Post, and Bloomberg News.
Managed by TruthWave, SecureDrop utilizes the Tor network to protect your identity, location and any information you send us. You will not be asked or required to provide any identifiable information, and we do not we track or log the information surrounding your communication with TruthWave.
We strongly recommend that tips be sent using public Wi-Fi (like a coffee shop's Wi-Fi). Please ensure your computer is free of any malware — if your device is compromised, your communications with us through SecureDrop could be compromised as well. Additionally, be sure not to access SecureDrop while on your employer's hardware or on networks controlled by your employer. Finally, do not access SecureDrop on your home network.
The steps below outline how to use SecureDrop. There is also information regarding the steps TruthWave takes to protect your privacy.
Download and install the Tor browser from https://www.torproject.org. The Tor browser allows access to our SecureDrop page, which operates as a Tor “hidden service.”
Open the Tor browser and wait for the page that says a connection has been established, then copy and paste the following into the address bar:
Follow the instructions you see on the page to send us information.
When you make your first submission, you will receive a unique codename. Memorize it. If you write it down, be sure to destroy the copy as soon as you’ve committed it to memory. Use your codename to sign back in to our source page, check for responses from our investigators, and upload additional materials.
The SecureDrop servers are under the physical control of TruthWave.
The information you send us through SecureDrop is stored on our SecureDrop servers in an encrypted format. Prior to distributing your submission to investigators, we will decrypt your submission on a computer that has never been connected to the internet and we will remove any metadata associated with it. After it has been stripped of metadata, tips and any included documents will be made accessible to our investigations team.
The SecureDrop system prevents us from knowing a source's identity. However, if your name or other personally identifiable information is included in the tip itself, it's possible that it will not be redacted from the information we share with investigators. If we happen to see any information that gives away a source's identity within a submission, we will try to strip or redact it before sharing with our investigators, but we cannot guarantee this. If this is a serious concern for you, we encourage you to ensure that there is not any identifying information contained within your tip prior to submitting it to SecureDrop.
If you wish to log back in to check for responses from TruthWave, we recommend that you delete each message as soon as you have read it.
SecureDrop is regularly audited by independent security experts. Like all software, it could have security bugs that are exploitable. Ultimately, you use the service at your own risk.
To learn more about how TruthWave handles privacy, please read our privacy policy.
