- \n
- A criminal offence, for example someone is defrauding your organization. The organization is the victim<\/em>.<\/li>\n
- An organization is breaking the law. The organization is the wrongdoer<\/em>.<\/li>\n
- Something that jeopardizes the health or safety of a person.<\/li>\n
- Something that either puts the environment at risk or actually damages it.<\/li>\n
- A miscarriage of justice.<\/li>\n
- Someone is covering up a wrongdoing.<\/li>\n
- Violations of human rights.<\/li>\n<\/ul>\n
However, anything to do with bullying, harassment, or discrimination at work is not considered<\/em>\u00a0whistleblowing in most jurisdictions. The difference is important.<\/p>\n
Whistleblowers are protected by law in many countries. In the U.S. the\u00a0Whistleblower Protection Act of 1989<\/a> protects federal whistleblowers. In the United Kingdom, the\u00a0Public Interest Disclosure Act 1998<\/a> provides similar protection and the \u201cright not to suffer detriment\u201d for whistleblowing. In Europe, the\u00a0EU Whistleblower Directive<\/a>\u00a0protects people who report breaches of\u00a0European Union\u00a0law.<\/p>\n
There are many other pieces of legislation and statutes that uphold the rights and protection of whistleblowers. The U.S. Department of Labor\u2019s\u00a0Occupational Safety and Health Administration<\/a>\u00a0has a\u00a0Whistleblower Protection Program<\/a>. It protects workers from detriment should they report a breach in any of\u00a0more than 20 federal laws.<\/p>\n
Who Do You Disclose to?<\/h2>\n
What you\u2019re disclosing will usually dictate who you disclose it to. If it is something about a colleague you\u2019ll probably be reporting it to a member of the management team of your organization. Many organizations have a whistleblowing process. This should outline the steps they have in place to safeguard your anonymity.<\/p>\n
If you\u2019re unhappy about revealing your identity because of fear of reprisals, you can report the wrongdoing anonymously. There can be an awkward balance at play here. Your organization may or may not be able to proceed with the complaint if you withhold your name, but providing your name gives rise to a risk of exposure. If you\u2019re whistleblowing on your manager it would create an untenable situation if they later discovered who the whistleblower was.<\/p>\n
There might be a\u00a0prescribed person or body<\/a>\u00a0that you can disclose to anonymously. If you\u2019re reporting an organization and not an individual, it will usually be to a prescribed body, professional body, or a trade association.<\/p>\n
If you’re wanting to draw world attention to a breach of human rights you’ll need to approach an organization like the United Nations<\/a>.<\/p>\n
You can also whistleblow to the media to bring wrongdoings to the attention of the public and the relevant authorities. Most\u00a0major media organizations have guidelines regarding anonymous sources. Online resources like WikiLeaks<\/a>\u00a0are also popular with whistleblowers.<\/p>\n
![\"WikiLeaks](\"https:\/\/itenterpriser.com\/wp-content\/uploads\/2021\/03\/5-1.png\")
WikiLeaks upload portal<\/figcaption><\/figure>\n The media organization will probably require your name in order to pursue the story, but you\u2019ll be protected as an\u00a0anonymous source. This is a right accorded to journalists by law in many countries and under international law. It prohibits attempts to compel them to reveal their anonymous source. This is doubly important because whistleblowing to the media waives your rights in law to protection as a whistleblower.\u00a0Without anonymity\u2014or if your anonymity is broken\u2014you will face the possibility of reprisals.<\/p>\n
- \n
- You might get demoted, repositioned, transferred, or lose your job altogether if you are still working at the organization in question when your identity is revealed.<\/li>\n
- You might be seen as untrustworthy and a traitor. You might become the victim of workplace bullying.<\/li>\n
- Other businesses in the same industry could add you to a blacklist, making future employment difficult if you choose to leave your current organization.<\/li>\n
- You might face legal action if you break any laws to gather evidence to justify or support your whistleblowing claims. Even with the legal protection for whistleblowers, there is no protection for breaking the law.<\/li>\n
- If you’re whistleblowing on an oppressive regime your life may be at risk.<\/li>\n<\/ul>\n
Preserving Your Anonymity<\/h2>\n
Communicating and delivering documents anonymously isn\u2019t as easy as you might think. Almost everything we do to communicate or transmit data leaves a trail of breadcrumbs that can lead right back to you or has a log that records what you did and when. It isn\u2019t easy to act anonymously, but it isn\u2019t impossible either. Knowing what type of tracking and logging exists allows you to avoid many common mistakes.<\/p>\n
Email<\/h3>\n
The run-of-the-mill email account isn\u2019t anonymous. It is tied to your identity so that you can receive your email. And you have to provide information about yourself\u2014and verify it\u2014before you can set up most email accounts. And anyone who can access the email system logs\u2014either through administrative capabilities or via a subpoena\u2014can see who you have been communicating with.<\/p>\n
However, there are free, secure, privacy-focused, and anonymous email services that you can use. ProtonMail<\/a> is one of the better known. Your email is encrypted. Even ProtonMail cannot access your emails. It\u2019s a web-based service so you don\u2019t need to have an application installed anywhere to send or read your email.<\/p>\n
Crucially, you can sign up for the ProtonMail service without providing any information about yourself. They do ask for some means to contact you in case you lock yourself out of your account and they need to verify it is you before they restore access to you. However, that is optional. If you don\u2019t want to, you don\u2019t need to provide any information about yourself at all. Just make sure you don\u2019t forget your password.<\/p>\n
You’ve now got an email address that is secure, encrypted, and not linked to your identity in any way. But now you have to be able to use it so that your online activity doesn\u2019t point back to you.<\/p>\n
Exfiltrating Data: Gathering the Evidence<\/h3>\n
There\u2019s a great saying \u201ccomputers serve their owners, not their users\u201d and it\u2019s good to keep that in mind. If you\u2019re using someone else\u2019s computer you don\u2019t know what is being logged. It could be anything from the usual internet browser activity and system logs to a full corporate employee monitoring system. These systems can:<\/p>\n
- \n
- Capture keystrokes.<\/li>\n
- Detect file copy actions.<\/li>\n
- Detect document creation, edits, and deletions.<\/li>\n
- Detect and log, or prevent, the use of a USB memory drive.<\/li>\n
- Take a screenshot every few seconds.<\/li>\n<\/ul>\n
But even in the absence of employee monitoring software, you can\u2019t trust a corporate computer, an internet cafe computer, or the computers in your library. You can\u2019t purge and clean them to remove all traces of your activity. Router and firewall logs also track what you do. And you might well be on CCTV too.<\/p>\n
Obviously, don\u2019t use your work computer for whistleblowing activities, and don\u2019t check your ProtonMail from your work desk. But the problem is, if you need to exfiltrate files that contain evidence of the wrongdoing how can you achieve that?<\/p>\n
If you have a hard copy of the files and it is feasible, you can photocopy them. If that\u2019s out of the question\u2014some corporate photocopiers require an ID to identify the employee before they can be used\u2014covertly remove the hard copies that you have. You can then scan them or photograph them at home and return the originals when you\u2019ve finished. Don\u2019t take them to a photocopy shop.<\/p>\n
Trying to covertly print at work is dangerous. Large corporate printers log who has printed what and when. Some of them even keep copies of the documents that pass through them. And printing at home isn\u2019t anonymous either if you have a color laser printer.<\/p>\n
Many domestic color printers\u00a0fingerprint pages with tiny yellow on white dots<\/a>\u00a0that identify the time, date, and serial number of the printer the printouts came from. If you\u2019re considering sending a letter or a covering note with the exfiltrated documents, don\u2019t use a color printer.<\/p>\n
If hard copies are not a possibility and you have to gather electronic documents, you have some options. The hard part is knowing which of the possible actions is going to be detected and reported as a suspicious activity\u2014if any. Some organizations are lax when it comes to data protection automation.<\/p>\n
You may be able to upload files to private cloud storage such as\u00a0OneDrive,\u00a0Google Drive,\u00a0DropBox\u00a0Evernote, or an anonymous, free, file-sharing site like\u00a0GoFile<\/a>.<\/p>\n
If you have administrative access to a private website you can try using a File Transfer Protocol (FTP) browser plug-in and FTP the files to the storage in the website.<\/p>\n
Plugging a smartphone into a computer’s USB port to charge it is common practice. But smartphones can also store files, allowing data to be copied to them as though they were a USB memory drive. If USB drive access hasn\u2019t been turned off, this might be less eye-catching than using a regular USB drive.<\/p>\n
Emailing files is too traceable to be anything other than a dire, last-ditch option.<\/p>\n
If you\u2019re not going to be caught on CCTV camera, taking photographs of your screen or of the hardcopy documents is a long-winded possibility.<\/p>\n
Dealing With Metadata<\/h3>\n
Electronic documents, especially those created with office productivity suites such as\u00a0Microsoft Office\u00a0contain metadata<\/em>. Metadata is data that describes the document itself. It is automatically created by software applications. Metadata holds information such as:<\/p>\n
- \n
- The name and version of the package that created the document.<\/li>\n
- The name (or network ID) of the original author.<\/li>\n
- The date and time when the document was created.<\/li>\n
- The name (or network ID) of the person who last edited the documents.<\/li>\n
- The date and time when it was last edited.<\/li>\n<\/ul>\n
Some of that data could incriminate you.<\/p>\n
Photographs taken with a digital camera or a smartphone contain a wealth of information about the image including when it was taken, the details of the device used to take the photograph, and the GPS coordinates of where the image was taken. If you\u2019ve taken hardcopy documents home and photographed them the GPS location of your home is likely to encoded within the images. That will directly implicate you as the whistleblower.<\/p>\n
Here are the number of pieces of data found in a few sample files from one of my computers. Your documents may contain even more metadata than these, depending on your device and software settings.<\/p>\n
- \n
- 45 Metadata Fields<\/strong>:\u00a0Microsft Word\u00a0\u201c.docx\u201d word processing file.<\/li>\n
- 34 Metadata Fields<\/strong>:\u00a0Microsft Excel\u00a0\u201c.xlsx\u201d spreadsheet file.<\/li>\n
- 102 Metadata Fields<\/strong>:\u00a0JPG image\u00a0taken on a smartphone.<\/li>\n<\/ul>\n
![\"Using](\"https:\/\/itenterpriser.com\/wp-content\/uploads\/2021\/03\/2-1.png\")
Using ExifTool to see the GPS data in a JPG image<\/figcaption><\/figure>\n Clearly, if you are going to deliver electronic documents and images to your contact and you wish to remain anonymous you need to erase or edit the metadata. Free tools exist for this and are available for all common computing platforms. ExifTool is one of the most capable<\/a>. It is free, cross-platform, and capable of working with the metadata of over 190 different file types.<\/p>\n
![\"The](\"https:\/\/itenterpriser.com\/wp-content\/uploads\/2021\/03\/3-1.png\")
The author’s name clearly displayed in the metadata of an Excel spreadsheet<\/figcaption><\/figure>\n ExifTool is a command-line tool, but if you\u2019re not comfortable with the command line you can download jExifToolGUI, which is a free, cross-platform GUI<\/a>\u00a0for ExifTool that works on Windows, Mac, and Linux.<\/p>\n
![\"jExifToolGUI](\"https:\/\/itenterpriser.com\/wp-content\/uploads\/2021\/03\/1-1.png\")
jExifToolGUI displaying image metadata<\/figcaption><\/figure>\n jExifToolGUI makes it easy to delete metadata fields that contain information that could be a clue to your identity.<\/p>\n
Making the Disclosure<\/h2>\n
Assuming you have gathered the evidence, you need to make the disclosure. That means making contact with the party you are disclosing to. Most major newspapers and many other organizations have a means of obtaining anonymous news stories and tip-offs, using SecureDrop\u00a0to provide a portal for file transfer. Because SecureDrop portals are hosted on the\u00a0Dark Web<\/a>\u00a0you\u2019ll need to use a\u00a0Tor-enabled browser\u00a0such as the\u00a0Tor browser\u00a0to access them.<\/p>\n
![\"The](\"https:\/\/itenterpriser.com\/wp-content\/uploads\/2021\/03\/6-1.png\")
The Tor browser<\/figcaption><\/figure>\n For example, the\u00a0New York Times SecureDrop<\/a>\u00a0portal is located at:\u00a0https:\/\/nytimes.securedrop.tor.onion<\/a>, and can only be accessed using a Tor-enabled browser.<\/p>\n
![\"New](\"https:\/\/itenterpriser.com\/wp-content\/uploads\/2021\/03\/7-1.png\")
New York Times upload portal<\/figcaption><\/figure>\n The Tor anonymous network makes it\u00a0virtually<\/em> impossible to backtrack and find out your IP address, so you cannot be identified. If you need to communicate with an organization that doesn’t use SecureDrop you should check their website for details of how to contact them for confidential matters.\u00a0Use a\u00a0Virtual Private Network<\/a>\u00a0at the least, and a Tor-enabled browser by preference, when contacting any site for any aspect of your whistleblowing. That includes the relatively benign act of finding out what the address of their SecureDrop portal is, or looking up other contact details.<\/p>\n
Once you\u2019ve made contact, leave your ProtonMail or other secure email address so that they can get back to you. Once you\u2019ve communicated back and forth for a period of time and you\u2019re comfortable with your contact, you may choose to connect with them using\u00a0Signal Messenger, a secure, private messaging service<\/a>.<\/p>\n
Signal is\u00a0private<\/em>, but it isn\u2019t\u00a0anonymous<\/em>. If the authorities want to, they can subpoena Open Whisper Systems\u2014the creators of Signal\u2014and find out whether you use the service, when you joined, and when you last used it. But that\u2019s\u00a0all they can discover because that\u2019s all that the Signal services stores about you. No one can determine with whom you have communicated, or about what. If you want to have voice calls with your contact do it from your home, and use Signal\u2019s voice call capability.<\/p>\n
If you want to have the strongest possible protection for your online anonymity, use Tails. Tails is an operating system that sits on a USB memory stick or CD. You boot your computer using the image on the memory stick or CD, and it runs a privacy-focused minimalist Linux based on Debian<\/a>. It already has the Tor browser installed for you.<\/p>\n
- 34 Metadata Fields<\/strong>:\u00a0Microsft Excel\u00a0\u201c.xlsx\u201d spreadsheet file.<\/li>\n
- 45 Metadata Fields<\/strong>:\u00a0Microsft Word\u00a0\u201c.docx\u201d word processing file.<\/li>\n
- An organization is breaking the law. The organization is the wrongdoer<\/em>.<\/li>\n