6

I'm a faculty member at a university and I want to leak to students an email sent between the administration and faculty members concerning ethical transgressions against the student body as a whole.

I don't want to reveal my identity in the process because it puts my job in danger. One the one hand, I have a list of student emails and a vague idea that I can use some sort of mail service to copy-paste the email contents to all of them. On the other hand, I'm worried that if I set up an easy to use and anonymous email account, through protonmail lets say, and copy-paste the email contents it will be flagged as spam.

What's the most practical way for me to "forward" this email to all of the students, without revealing my identity or having the email flagged as spam?

  • 4
    If it's that serious, it might be newsworthy. Did you consider talking to a local journalist (or even someone at the student paper, though students are probably less likely to be able to maintain your anonymity)? – drewbenn Oct 5 '18 at 16:05
  • Luke Senior's question looking for ways to be anonymous and you're considering him to contact a journalist? This paradox blown my mind. – slayer Oct 5 '18 at 16:56
  • 2
    @slayerowner en.wikipedia.org/wiki/Protection_of_sources I guess it does depend on OP's country. And it's important to stress to the journalist you want to remain anonymous. – drewbenn Oct 5 '18 at 17:38
  • 3
    Is forwarding an email the best way to go? Why not just head down to your local copy shop and copy a printed version a bunch and post them around campus? Send it to the school paper to publish. Write a letter to a journalist of a local paper. – Daisetsu Oct 6 '18 at 7:26
  • For what it's worth, it is a Mexican institution and journalism here is better than most of Latin America but still suspect. The school paper might be an interesting way to go, since the administration might even try to censor it. – Luke Senior Oct 7 '18 at 2:12
5

Do:

  • Use a private computer

  • Use a VPN (Tor if you prefer.)

  • Create a new yahoo account (using the VPN)

  • Copy and past the body of the email

  • Send

  • Close the yahoo account.

Do NOT:

  • Use the university's internet

  • Use a university computer

  • Forward the email.

  • I repeat. Do NOT "forward" the email.

The final do not is most important. The email sent to you has a header. The header contains to: and from: information plus a few other things it sounds like you don't want to reveal. Once you have sent the email, never login to that account again, it's best if the account is closed.

5

Aside from the security measures mentioned in other posts:

Make sure that you search the original e-mail for hidden content, such as zero length whitespace or other invisible characters. Maybe use a regex to check the entire mail for compliance. Replace line endings with a (small) random number of newlines (\n). Make sure you get rid of HTML if possible.

If you have to obfuscate the content, because someone paranoid might try to spear fish you/the mule; use a translator and translate the text back and forth. Do NOT add commas that went missing during the translation (and don't fix other issues that (you feel that) are wrong). Only fix the content if the meaning of the original message went missing. Try to convince the translator tool to use the correct term, instead of fixing it yourself.

  • Remove useless content, such as: exact dates+times, special greeting terms, loose words without context.

  • Avoid slang words or anything that is related to you or your background or environment.

  • Do not try add extra mistakes. Don't try to convince the audience that a special group was responsible for the mail.

That's not fair and you usually are not as good as the other party in their way of writing things. And if you are as good as them (in making mistakes), then there is too much that points back to you.


  • Don't send pictures/scans or binary data or anything that is easy to fingerprint.

  • Do not send the mail with your favorite mail tool, use the browser gui. (Most GUIs use an identifyable newline policy)
  • Wow thank you, I really hadn't thought of the possibility that the email might contain such whitespace/invisible characters, but it seems like an obvious risk now that you bring it up. – Luke Senior Oct 7 '18 at 2:11
4
  • private computer: Meaning that you use the computer only to do this job and never come back to him again.

    • You can:
      1. Buy an refurbished laptop. Update the firmware just for guarantee the integrity data, remove the hard disk storage.
      2. I wouldn't do that, but it also an option: Use your own laptop.
  • private environment: Make a Bootable Linux from a USB Stick. I recommend Tails OS1.

  • private internet: Do not use any free proxy or VPN. If you want a good proxy advice, use Private Internet Access (PIA)2.

    • One more note: Do not use your ISPN. Looking for another network point––i.e., bakery or whatever establishment that probably has not follows any security guidance.
  • anonymity mailing: After building your environment described above, create a free mail account (i.e., Mail.Ru3 or anyone else) using Belgium proxy to bypass phone number requirement.

    • ProtonMail is not spotted as spam unless the e-mail has been set up for it. If you're also concerned about Mail.Ru, you can use Yahoo! as well.
    • Remember to not link any pseudonyms to you:
      1. Username: The best username is those that are generated randomly like as a password. You can try Asian/Arabic keyboard characters.
      2. Password: Of course, you need to include special characters, numbers, uppercase letters, lowercase letters––being a long length password. Maybe a password generator could help you4.
      3. Writing: This is a utmost importance! Pay attention how you are writing because this can denounce you through an calligraphy's investigation. So, try to use synonyms and maintain a well different writing technique from normal.
  • ending job: Getting rid of all equipment used.

    • computer: I mean, you can sell the laptop if you bought it to accomplish such a task. Find a way to do this offline without any sort of online ad.
      1. Since you didn't use the laptop's hard drive––even to save any data such as Tails OS image and among others things––,you don't have to do anything with it.
    • Make a zero-fill on every storage that you used to, even on USB flash drive.
  • PIA is actually a pretty crappy service. If you're going to the length of using a burner system, using PIA undoes a lot of that. The ISP it uses does record IP address and timings. – forest Oct 6 '18 at 3:44
1

Use an anonymous remailer with Tor.

Some of the existing answers are far too complex and contain a number of unnecessary steps. Assuming the incriminating email was not sent specifically to you with slight modifications to test your loyalty, you can use an anonymous remailer to send the email without an account and even with a spoofed source address. You can additionally do this while using Tor to ensure even better anonymity. This has the additional benefit of not saving browsing history, which could be incriminating.

Anonymous remailers do not include the sender's IP address in its headers, so there is no need to worry about using Tor on the university's network. If the sender's IP address was included, then the use of Tor on the university's network could be a problem, as a Harvard student found out.

  • Hello, I like the anonymous remailer link, thank you! Can I batch it or should I try to thin my email list? – Luke Senior Oct 7 '18 at 2:10
  • @LukeSenior That depends on what you want to accomplish. If you just want to whistleblow, you really don't need to send the mail to everyone, just enough people to get it out in the open. Thinning the email list would also reduce the chance of getting caught in a spam filter. – forest Oct 8 '18 at 3:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.