Staying anonymous vs a Five Eyes adversary?

Question

If you were in a Five Eyes country and you wanted to contact someone else anonymously, without this person or the government finding out who you are or your location, how would you do it?

The person you are contacting does not know you and you have never spoken before. The only initial contact information you have is an email address, and you wish to send a message, and potentially later some files, in an on-going conversation over several weeks or even months.

Assume neither the content of the message or the files can be connected to you. There is however a possibility that either the government is monitoring this person, or that they are actually working together or have taken over their communication. And finally, if caught you face a good few years in prison for passing on the information.

I am aware that a government adversary of this calibre is extremely difficult to evade if they really want to get you. Would it be enough to:

• Use some form of more secure operating system (Whonix, Qubes, Tails) on a laptop bought in cash, which has never connected to the internet from an IP linked to you.
• Contact the person using an email like ProtonMail over Tor (uses Javascript?)
• Use a different location each time you connect to the internet, e.g. public wifi, or a data SIM and dongle (bought with cash and discarded after each use), and avoiding CCTV.

I assume the first message sent in the above way would be relatively untraceable, but after that?

Or is there a better way? Am I completely off track?

Answer 1

If you really have sensitive information to transmit, seems to me that learning PGP is a must-do. when Edward Snowden contacted journalists he actually had to train them to PGP in order to establish a secure channel for further correspondence.

I am talking about end to end encryption here, not relying on some third party like Protonmail to encrypt your original plain text materials.

Even if the person is not under targeted surveillance, the intelligence agencies tap into Internet traffic and sniffing keywords off plain E-mail for data mining purposes is routine for them. There is a chance that your correspondence will trigger some alarm, depending on the keywords. Anyway, E-mail is mostly in the clear unlike web traffic. In short E-mail is not a good way to send sensitive/confidential information.

It is perfectly plausible that your E-mail could be reviewed by an analyst at some 3-letter agency before the intended recipient actually reads it.

Obviously using PGP is a sign that both parties "have something to hide" or just take their privacy seriously, and that can attract further scrutiny. But with proper opsec on both ends nosy governments should not be able to figure out the contents of the mails. What you don't want is Big Brother being alerted and terminating the conversation before you've had a chance to deliver your message.

Tails should be sufficient for your purpose, using a public wifi connection, preferably in a place where there are no cameras and no footage of your presence. Note that Tails will spoof your MAC addresses, so in theory it cannot be proven that your laptop was even used on a given wifi hotspot, provided that the connection can actually traced back to the place of origin.

The critical part in this setup is that when your correspondent sends you their public PGP key, you have to trust that it is really theirs and not that of a man in the middle. But if it comes to that your correspondent is already compromised.

Answer 2

Use some form of more secure operating system (Whonix, Qubes, Tails) on a laptop bought in cash, which has never connected to the internet from an IP linked to you.

This IP will get flagged immediately. If it is your home IP expect your traffic to be watched more closely and maybe some targeted attacks. Everything catered to the security/privacy crowd gets a very close look from NSA,BND,CIA,FSB,GCHQ...

Contact the person using an email like ProtonMail over Tor (uses Javascript?)

See above. While I can't prove it (those who can please stand up ^^) I'm pretty sure that mails encrypted with PGP get a closer look (i.e. the sender end receiver)

Use a different location each time you connect to the internet, e.g. public wifi, or a data SIM and dongle (bought with cash and discarded after each use), and avoiding CCTV.

Sounds a bit better in combination with some laptop bought in cash running. If it is really the NSA or your countries equivalent looking after you and they know something is going on they could still start attacks on a bigger level (launching exploits from each wifi/mobile hotspot in town) cut the communication on the other side like blocking emails the person should receive ... You'd need to recognize when they approach you virtually or physically. This requires some deeper understanding of IT and physical security. Just installing the latest "secure" OS and using Tor won't help against such an attacker. It could make things actually worse.

Also: Welcome to the NSA,BND,CIA,FSB,GCHQ... watchlist ;)