If you think clicking the Google Chrome Incognito window is blanketing you in an impenetrable layer of privacy, you’re in for a rude awakening. Many Internet users assume that the measures they take to conceal their identities online – using proxies, never revealing personal information on forums – is enough to keep your real self a secret. But it’s far more difficult to truly preserve your anonymity on the Internet – targeted ads can follow you from device to device, Google Glass could allow near-constant collection of data, and the data brokerage industry proves that keeping tabs on you is a profitable, booming business. And that’s just corporations trying to peer into your soul through your computer. If someone like, say, the Department of Justice wants your information, you better believe that Incognito window isn’t worth the price of an outdated floppy disk with Oregon Trail 2 on it.
Here’s where Strongbox comes in
In this climate, the debut of Strongbox is something to celebrate. So what is it? It’s the New Yorker’s new digital drop-off for tips and documents that senders want to deliver anonymously. Considering the recent news that the Justice Department secretly seized phone records from the Associated Press, protecting the privacy of sources is harder for journalists than ever before. And ensuring that online communication remains protected is especially difficult, since hackers from fringe groups and governments alike grow increasingly skilled at circumventing digital roadblocks.
Strongbox was coded by the late Aaron Swartz after New Yorker writer Kevin Poulsen approached him with the project. Swartz said he’d create a secure, anonymous dropbox for the magazine, but only if it was open code, so that anyone could use it. Swartz had the code stable by December 2012, but the New Yorker delayed the project after Swartz committed suicide in early 2013.
It works like this: If you want to submit something to the New Yorker but you really, really don’t want to get traced, you log onto the Tor network. Tor stands for “the onion router” and it gives you more security than a normal proxy, because it encrypts and re-encrypts your data multiple times and uses many randomized relays to make it very difficult to trace your digital path. Then you go to Strongbox and submit whatever you wanted to submit. You’re given a randomly generated code name – and since Swartz had a sense of humor, the code names are super New Yorker-y SAT vocab combos. Then the files are encrypted and sent to a special network separate from the rest of Conde Nast. The New Yorker editors will look at the material from a secure laptop with a VPN. Then they download the files using a thumb drive, transfer them to a second computer, then put them on another thumb drive, and then finally open and un-encrypt the files on a laptop that’s not connected to the Internet. The process has many, many steps to ensure that tracing is as difficult as possible.
New Yorker editor Nick Thompson and James Dolan, who worked on security architecture and documentation, answered questions about Strongbox during a Reddit aMa last week. I took the opportunity to ask if journalists could reach out to a source to verify information sent with Strongbox. Thompson answered first: “There’s no direct way to reach someone. But when somebody submits a document they are given a secret username. We can then post an encrypted message back that only somebody with that username can read. It’s kind of like we can post a message on a bulletin board, and the original source can choose whether or not to look at the bulletin board.” And Dolan agreed, noting “the system assigns a persistent anonymous ID so editors can theoretically communicate with sources, assuming the sources are willing to participate.”
The importance of anonymity
Now, Strongbox is not a perfect system. Though it is potentially the most advanced media drop box right now, the New Yorker describes it as having a “reasonable amount of anonymity” – in other words, somebody with extremely advanced hacking skills could hypothetically figure out a way to trace the sources.
When two people are talking together without any wiretaps, completely alone, they are able to tell each other things in confidence. This is how sources like Deep Throat conferred confidential information to Woodward and Bernstein. When communication is oral and not recorded it’s truly temporary, traceless. But secret face-to-face meetups are hard to come by, especially with global stories, when sources and journalists don’t live in the same place. The Internet is an astounding connection tool but the fact that our online journeys leave digital footprints makes it difficult to hide confidential conversations, especially if you’re hiding them from governments and highly organized groups that have the IT manpower to root out what they want to know.
Anonymous sources are crucial to many investigative journalism projects, and without the opportunity to give information without tying yourself to a controversy, many people with information that deserves to be made public will not reach out. This means the success of Strongbox and systems like it is imperative for the health of the press. An excerpt from a 1995 Supreme Court ruling in McIntyre v. Ohio Election Commission on the EFF’s website characterizes this well:
“Protections for anonymous speech are vital to democratic discourse. Allowing dissenters to shield their identities frees them to express critical minority views … Anonymity is a shield from the tyranny of the majority … It thus exemplifies the purpose behind the Bill of Rights and of the First Amendment in particular: to protect unpopular individuals from retaliation … at the hand of an intolerant society.”
If you want to remain anonymous while you’re doing research but you don’t have anything to give to Strongbox yet, there are certain ways you can boost your security online, as Digital Trends previously outlined in a guide to staying anonymous. Of course, nothing is 100 percent secure, but taking steps like using Tor and disposable e-mail accounts can help you.
Efforts like Strongbox are compensating for a demonstrated lack of respect for the First Amendment on the part of government organizations – and the New Yorker isn’t the only media company pursuing better systems for their sources. Wired published an op-ed outlining ways people can provide information to a variety of outlets. Their advice involves paying cash for a throwaway laptop. So even though there are ways to make it harder to out you as a source, none of them are free (or particularly cheap). What’s great about Strongbox is that it provides many steps to secure information after its sent, so sources don’t necessarily need to do things like buy a whole separate computer (though I suppose you can never be too careful.)
Efforts like Strongbox may end up looking rudimentary a few decades from now, as technology continues to evolve and people figure out security loopholes, but for now, it’s a testament to the continued value of anonymous sources for journalism.
