Consider this scenario:
Alice is a typical corporate shark. She wants to get ahead in her organisation. Alice has a sensitive information security scenario, she needs expert consultation but she doesn't know any experts. Due to whatever she's consulting on, she needs to be completely untraceable. Same goes for the consultant too. She doesn't care where the consultant is from, Romania or wherever, just that he is capable, and as far removed from her as possible so as to avoid any compromising situations. She also doesn't care about the consultant, only that there is a complete separation between the consultant and her. His methods also do not concern her in any way.
Bob, her bestie, a little tech minded but not much, advices her to:
- Set up Tor
- With Tor, Register for a completely secure email account outside of the US.
- With Tor, create accounts on security forums (with the email) and post job requests.
- Conduct discussions+ by connecting to the email account [via TOR].
- She might obtain attachments that she might have to transfer to her computer [via TOR]
- For payments, use a crypto currency++.
I'm wondering how can one or all of 3 hostile entities - Her organisation, Her country security apparatus, and the security consultant - establish a link between her and anything related to the scenario. Worst case scenario is that the consultant is sloppy and makes a big mess and gets himself traced, in the early stages, during or later (an year later maybe).
What are the problems with the above approach, in regards to stealth, deniability, being compromised etc?
Update: Also, she & her computer, are the central nodes that know the whole picture. I'm thinking, cash only 2nd hand laptop, wipe it, use from crowded wifi hotspots. Keep moving. Once achieved overall aim, wipe & reinstall (change the network card too?) & sell away.
+ Please ignore the specific contents of Alice's emails. As @Schroeder said in comments below, it's probably too much for this question. I'll open a separate question on crafting/sending/receiving/handling data through properly established secure channels. Also please advise me regarding deeper technical aspects that I should open separate questions for. Thanks.
++ I'll open a separate question on obfuscating/removing digital currency trails. (thanks @Philipp)
Disclaimer: Purely theoretical question. However I'm keen on learning more on the subject. Yes I'm a responsible adult and I know all the legal stuff, so please don't lecture me on ethics.