For Whistleblowers

Last edited by Ian Elwood on May 15, 2008 - 1:09pm

Click here to anonymously submit a file

Employees, ex-employees, customers, and others are often privy to the most accurate and useful information about a particular corporation, yet they may be in a position that makes it difficult to contribute to a project such as Crocodyl without fear of the potential repercussions.

If you have information that you would like use to contribute to Crocodyl, but can not use your name to publish it, there are secure ways you can submit to Crocodyl anonymously. People submitting information to Crocodyl will be treated as a confidential source.

Recommendations

1. Set up an account that uses a pseudonym. Because we use a wiki format, all content is judged on its own merit. We do not filter information based on the identity of the user, so long as it adheres to our Editorial policy.

2) If you do not want to set up an account, you can send information in a PGP encrypted email to:

The public key is located here. We recommend using Thunderbird for email, installing GnuPg to handle the encryption, and the Enigmail Add-on to connect Thunderbird to the encryption software. You can find a really great explanation of email encryption and how to use Enigmail with Thunderbird on Mozdev.

How to leak documents

Firstly, install technology that will anonomize your identity so that you are fairly certain you will be safe (see below). Next, create an account on Crocodyl, and click "Create content" when you are logged in. Create a "Digital records" page and write a detailed description of the file you are submitting. Include where it was obtained from, how it was obtained, and links to evidence from credible sources that will support the veracity of the information contained in the file. Note: Make sure to upload documents and other materials through the "Digital records" submission process, as attachments to individual company profiles can be removed by other users. If you wish to upload multiple files, put them in a zip folder or upload them individually.

Below are a few technologies that you can implement that will protect your identity from Crocodyl and others.

Prerequisites

Mozilla Firefox: All good security starts with a good browser, and Mozilla Firefox is a great one. If you are using Internet Explorer there are many vulnerabilities that you are exposing yourself to, and many anonomyzing features are not available.
Mozilla Thunderbird: Similarly, if you are using another mail client, or webmail, there are some security vulnerabilities that you have probably overlooked. While email is a fairly insecure method of communication, using Thunderbird will mitigate the problem.

Encrypted web browsing

Tor (The Onion Router): Anonymized web surfing is almost impossible, and for absolute anonymity there is no perfect solution. Tor will get you most of the way however. The website has detailed instructions of how to install Tor and there is a Firefox plugin called Torbutton that will allow you to easily toggle Tor on and off.

Encrypted email

Gnu Privacy Guard, or GnuPG is an Open Source and Free Software implementation of the OpenPGP standard. What does that mean? It means that you can use GnuPG without restrictions from patents, and without having to pay for it. GnuPG allows you to send an email that is encrypted so that even if it is intercepted by what is called a "man in the middle" attack, the message will be undecipherable to the majority of people who could access it. Installation can be complicated for inexperienced users, but the time that you take to learn about security and encryption will be well worth it.

Less secure, but easier

Hushmail uses PGP to encrypt email and is accessible through a web browser.
Anonymouse will allow you to send an email anonymously through your web browser. The service is easy to use and fairly secure.
Anonymouse also offers anonymized web surfing through a proxy, and is one of many proxy servers online that encrypt your web browsing.