0

If you were in a Five Eyes country and you wanted to contact someone else anonymously, without this person or the government finding out who you are or your location, how would you do it?

The person you are contacting does not know you and you have never spoken before. The only initial contact information you have is an email address, and you wish to send a message, and potentially later some files, in an on-going conversation over several weeks or even months.

Assume neither the content of the message or the files can be connected to you. There is however a possibility that either the government is monitoring this person, or that they are actually working together or have taken over their communication. And finally, if caught you face a good few years in prison for passing on the information.

I am aware that a government adversary of this calibre is extremely difficult to evade if they really want to get you. Would it be enough to:

  • Use some form of more secure operating system (Whonix, Qubes, Tails) on a laptop bought in cash, which has never connected to the internet from an IP linked to you.
  • Contact the person using an email like ProtonMail over Tor (uses Javascript?)
  • Use a different location each time you connect to the internet, e.g. public wifi, or a data SIM and dongle (bought with cash and discarded after each use), and avoiding CCTV.

I assume the first message sent in the above way would be relatively untraceable, but after that?

Or is there a better way? Am I completely off track?

1
  • 2
    "like protonmail" - please, please, never, ever, ever send anything sensitive over Protonmail. If you must use mail then PGP encrypt it yourself, do not rely on the provider to do it for you. – J is 12 years old. Feb 1 at 12:36
2

If you really have sensitive information to transmit, seems to me that learning PGP is a must-do. when Edward Snowden contacted journalists he actually had to train them to PGP in order to establish a secure channel for further correspondence.

I am talking about end to end encryption here, not relying on some third party like Protonmail to encrypt your original plain text materials.

Even if the person is not under targeted surveillance, the intelligence agencies tap into Internet traffic and sniffing keywords off plain E-mail for data mining purposes is routine for them. There is a chance that your correspondence will trigger some alarm, depending on the keywords. Anyway, E-mail is mostly in the clear unlike web traffic. In short E-mail is not a good way to send sensitive/confidential information.

It is perfectly plausible that your E-mail could be reviewed by an analyst at some 3-letter agency before the intended recipient actually reads it.

Obviously using PGP is a sign that both parties "have something to hide" or just take their privacy seriously, and that can attract further scrutiny. But with proper opsec on both ends nosy governments should not be able to figure out the contents of the mails. What you don't want is Big Brother being alerted and terminating the conversation before you've had a chance to deliver your message.

Tails should be sufficient for your purpose, using a public wifi connection, preferably in a place where there are no cameras and no footage of your presence. Note that Tails will spoof your MAC addresses, so in theory it cannot be proven that your laptop was even used on a given wifi hotspot, provided that the connection can actually traced back to the place of origin.

The critical part in this setup is that when your correspondent sends you their public PGP key, you have to trust that it is really theirs and not that of a man in the middle. But if it comes to that your correspondent is already compromised.

2
  • The critical part in this setup is that when your correspondent sends you their public PGP key .. spend a lot of time thinking about this first step, ie. how to validate the recipient's pk, as everything rests on this predicate – brynk Mar 2 at 1:18
  • How exactly is Big Brother going to be alerted and terminate the conversation before a message is even received? – Conor Mancone Mar 2 at 10:54
0

Use some form of more secure operating system (Whonix, Qubes, Tails) on a laptop bought in cash, which has never connected to the internet from an IP linked to you.

This IP will get flagged immediately. If it is your home IP expect your traffic to be watched more closely and maybe some targeted attacks. Everything catered to the security/privacy crowd gets a very close look from NSA,BND,CIA,FSB,GCHQ...

Contact the person using an email like ProtonMail over Tor (uses Javascript?)

See above. While I can't prove it (those who can please stand up ^^) I'm pretty sure that mails encrypted with PGP get a closer look (i.e. the sender end receiver)

Use a different location each time you connect to the internet, e.g. public wifi, or a data SIM and dongle (bought with cash and discarded after each use), and avoiding CCTV.

Sounds a bit better in combination with some laptop bought in cash running. If it is really the NSA or your countries equivalent looking after you and they know something is going on they could still start attacks on a bigger level (launching exploits from each wifi/mobile hotspot in town) cut the communication on the other side like blocking emails the person should receive ... You'd need to recognize when they approach you virtually or physically. This requires some deeper understanding of IT and physical security. Just installing the latest "secure" OS and using Tor won't help against such an attacker. It could make things actually worse.

Also: Welcome to the NSA,BND,CIA,FSB,GCHQ... watchlist ;)

1
  • Using privacy software doesn't automatically flag you for extra scrutiny – Conor Mancone Mar 2 at 2:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.