Privacy Tools Guide

A corporate whistleblower faces a unique security challenge: preserving evidence of wrongdoing while maintaining anonymity against sophisticated adversaries. This threat model approach provides a structured framework for protecting both your evidence and your identity throughout the disclosure process.

Understanding the Threat Landscape

Corporate whistleblowers typically face three distinct threat categories. Legal threats involve NDA violations, defamation claims, or criminal allegations. Technical threats include device compromise, communication interception, and digital forensics. Social threats encompass reputation damage, professional retaliation, and physical surveillance.

Your threat model must address all three categories simultaneously. A weakness in any single area can compromise your entire operation.

Evidence Integrity: Cryptographic Verification

The foundation of evidence protection is cryptographic hashing. Before making any copies of documents, emails, or recordings, generate SHA-256 hashes to prove the evidence hasn’t been tampered with.

# Generate SHA-256 hash for a document
sha256sum document.pdf > document.pdf.sha256

# Verify integrity later
sha256sum -c document.pdf.sha256

For sensitive documents, use GPG signing to add authentication:

# Create a detached GPG signature
gpg --armor --detach-sign document.pdf

# Verify the signature
gpg --verify document.pdf.asc document.pdf

Store these hashes and signatures on separate, air-gapped media. An USB drive kept in a secure location provides the simplest approach. For higher security requirements, write hashes on paper using archival-quality ink.

Secure Evidence Storage

Never store evidence on employer-provided devices or cloud services tied to your corporate account. Create a separate, encrypted storage system using LUKS on Linux or FileVault on macOS:

# Create encrypted container on Linux
dd if=/dev/urandom of=evidence.img bs=1M count=1024
cryptsetup luksFormat evidence.img
cryptsetup open evidence.img evidence
mkfs.ext4 /dev/mapper/evidence

For cross-platform portability, VeraCrypt provides compatible encrypted containers that work across operating systems. Use long passphrases of 25+ characters combining random words.

Identity Protection Architecture

Protecting your identity requires separating your whistleblower activities from your normal digital presence. This involves creating isolated environments using virtualization or dedicated hardware.

Qubes OS provides the strongest integration by default, compartmentalizing different activities into isolated VMs. For simpler implementations, use VirtualBox with snapshots:

# Create isolated VM for whistleblower activities
VBoxManage createvm --name "whistleblower" --ostype "Debian_64" --register
VBoxManage storagectl "whistleblower" --name "SATA" --add sata
VBoxManage createhd --filename "whistleblower.vdi" --size 50000 --format VDI

Always use the Tor Browser for all whistleblower-related activities. Configure it for maximum security by setting security.slider to “Safest” and disabling JavaScript for non-essential sites.

Secure Communication Channels

Establish communication channels before you need them. Signal provides end-to-end encryption for messaging and calls, but requires a phone number linked to your identity. Consider using Signal with a burner phone purchased with cash.

For anonymous tip submission, SecureDrop provides industry-standard infrastructure. Many news organizations host SecureDrop instances that accept submissions through Tor:

# Access New York Times SecureDrop via Tor
tor-browser https://nytimesj7fbm3w4m.onion/

Create encrypted email correspondence using GPG with fresh keypairs generated in your isolated environment. Never link these keys to your identity:

# Generate anonymous GPG key
gpg --full-generate-key
# Select RSA 4096, no expiry, enter anonymous identity
# Store private key only on air-gapped media

Metadata Stripping

Documents contain identifying metadata that can compromise your anonymity. Images may contain GPS coordinates, camera serial numbers, and timestamps. PDFs embed author information and creation software details.

Use exiftool to strip image metadata:

# Remove all metadata from images
exiftool -all= image.jpg
exiftool -all= -overwrite_original *.jpg

For PDF sanitization, use exiftool or specialized tools:

# Remove PDF metadata
exiftool -all= document.pdf
pdftk document.pdf dump_data output metadata.txt
# Edit metadata.txt to remove identifying info
pdftk document.pdf update_info metadata.txt output clean_document.pdf

Operational Security Patterns

Minimize your attack surface by following these operational rules. First, never access whistleblower resources from your home network or workplace. Public WiFi at cafes provides geographic anonymity but introduces other risks. Use a VPN service paid with cash or cryptocurrency, connected through Tor.

Second, compartmentalize your activities. Use separate browsers, separate email accounts, and separate hardware for different aspects of your disclosure. The less these compartments know about each other, the less can be compromised.

Third, practice deniable communication. When discussing sensitive matters, establish coded language that could have innocent interpretations. This provides legal plausible deniability if your communications are intercepted.

Emergency Protocols

Prepare for compromise scenarios. Establish a dead man’s switch using a trusted contact who receives encrypted instructions if you become unavailable. The Edward Snowden-style protocol involves scheduled check-ins; if you miss them, your contact initiates disclosure of your evidence.

Keep printed copies of critical evidence hashes and contact information in a secure physical location. Digital-only storage creates a single point of failure.

# Create encrypted emergency instructions
echo "If you read this, contact: journalist@protonmail.com" | gpg -ear recipient@email.com -o emergency.gpg

Store the decryption key separately from the encrypted instructions using a safe deposit box or trusted attorney’s office.

Verification and Testing

Before relying on your system, test it exhaustively. Verify that Tor is actually routing traffic through exit nodes by checking your IP address at check.torproject.org. Confirm GPG signatures on communications you send and receive.

Practice your operational security procedures until they become muscle memory. The stress of an actual whistleblower situation will degrade your judgment; automated habits provide protection when cognitive load is highest.

Building a threat model requires ongoing attention as both adversaries and tools evolve. Regular security audits of your practices help identify weaknesses before they become critical vulnerabilities.

Tools and Pricing for Whistleblower Operations

Tails Operating System ($0, free download): Live OS based on Linux that routes all traffic through Tor and leaves no persistent storage. Ideal for whistleblower activities on untrusted hardware. Requires USB drive or DVD.

Whonix ($0, free): Virtual machine that forces all traffic through Tor. Can be installed inside VirtualBox. Provides strong isolation from host system compromise. Requires 2GB RAM minimum.

SecureDrop ($0, free open-source): Turnkey secure submission system for journalists. 100+ news organizations host SecureDrop instances. Available via .onion address for Tor access. Supports file uploads and anonymous source management.

KeePass ($0, free, open-source): Offline password manager for managing credentials securely. Stores encrypted database locally. No syncing means zero cloud exposure. Suitable for storing recovery codes and contact info.

Signal ($0, free): End-to-end encrypted messaging. Requires phone number verification (use burner phone). No servers can read messages due to Signal Protocol. Desktop and mobile versions available.

VeraCrypt ($0, free, open-source): Creates encrypted containers for sensitive evidence. AES-256 encryption. Works across Windows, macOS, Linux. Hidden volume feature allows plausible deniability.

gpg (GNU Privacy Guard, $0, free, open-source): Command-line encryption tool for encrypting sensitive files and communications. Generates RSA-4096 keys for file signing. Industry standard for secure communications.

ProtonMail ($119.88/year, or free plan with limitations): Encrypted email for external communications. Swiss-based with strong privacy protections. Integrates with Signal for additional encryption.

Total baseline cost: $0 (all open-source tools) or $120/year (add ProtonMail for convenience).

Threat Model Analysis Template

Structure your threat assessment systematically:

THREAT ASSESSMENT: Corporate Whistleblower

1. ADVERSARY CAPABILITIES
   - Technical: Employer has IT department, network monitoring
   - Legal: Can conduct discovery, subpoenas
   - Physical: Access to workplace, parking lot
   - Social: Can interview employees, gain context

2. ATTACK VECTORS
   - Compromise your work computer
   - Monitor network traffic (packet capture)
   - Recover deleted files from hard drive
   - Intercept communications (phone, email)
   - Physical surveillance of home
   - Social engineering of contacts
   - Recovery of USB drives left in vehicles/offices

3. EVIDENCE PRESERVATION STRATEGY
   - Evidence location: USB drive in safe deposit box
   - Encryption: AES-256 with VeraCrypt
   - Redundancy: 3 copies in different locations
   - Verification: SHA-256 hashes on paper
   - Chain of custody: Signed evidence logs

4. OPERATIONAL SECURITY
   - Evidence collection location: Car during lunch breaks
   - Transfer method: Encrypted USB, not company network
   - Storage: Air-gapped device never connected to network
   - Timeline: Document dates/times for all evidence

5. COMMUNICATION SECURITY
   - Primary channel: Signal with burner phone
   - Secondary channel: ProtonMail for longer documents
   - Emergency contact: Journalist at news org with SecureDrop
   - Testing: Verify all channels work before deployment

Evidence Types and Handling

Different evidence types require different preservation approaches:

Digital Documents (emails, spreadsheets, code):

Screen Recordings (demonstrating UI evidence of wrongdoing):

# Use ffmpeg to record screen without audio (smaller files)
ffmpeg -f x11grab -i :0 -vf "fps=10" -q:v 5 -pix_fmt yuv420p output.mp4
# Result: Low-quality video that's hard to prove tampered with

Audio Recordings (meetings, conversations):

# Check local recording laws before capturing
# Some jurisdictions require consent from all parties
# One-party consent states: Record with only your own knowledge

# Recording quality sufficient for evidence:
# - 16-bit, 48kHz minimum for court acceptance
# - Clear audio without background noise
ffmpeg -f dshow -i "microphone" -acodec pcm_s16le -ar 48000 audio.wav

Physical Evidence (documents, printed emails):

Jurisdiction-Specific Protections

Different countries offer varying legal protections for whistleblowers:

United States:

European Union:

United Kingdom:

Australia:

Cold Start Testing

Before executing your plan, test every component without burning your cover:

#!/bin/bash
# Dry-run test of whistleblower infrastructure

set -e

# 1. Test Tor connectivity
echo "Testing Tor..."
curl -s https://check.torproject.org/ | grep -q "Congratulations" && \
  echo "✓ Tor working" || echo "✗ Tor failed"

# 2. Test Signal
echo "Testing Signal..."
signal-cli receive 2>&1 | head -1 | grep -q "error" && \
  echo "✗ Signal setup needed" || echo "✓ Signal ready"

# 3. Test encryption
echo "Testing encryption..."
echo "test" | gpg -ear your-key-id > test.gpg 2>/dev/null && \
  echo "✓ Encryption working" || echo "✗ GPG failed"

# 4. Test evidence storage
echo "Testing evidence storage..."
mkdir -p /tmp/test-evidence
dd if=/dev/urandom of=/tmp/test-evidence/1gb.img bs=1M count=1024
sha256sum /tmp/test-evidence/1gb.img > /tmp/test-evidence/checksums.txt
echo "✓ Storage device working, capacity sufficient"

# 5. Test recovery workflow
echo "Testing recovery..."
cat > RECOVERY_PLAN.txt <<'EOF'
1. Access safe deposit box with key #XXX
2. Retrieve encrypted USB drive
3. Boot from Tails OS
4. Mount VeraCrypt container with passphrase
5. Verify SHA-256 hashes
6. Contact journalist via SecureDrop
7. Provide evidence in encrypted format
EOF

echo "✓ Recovery plan documented"
echo ""
echo "All systems functional. Ready for deployment."

Built by theluckystrike — More at zovo.one

Explore Our Developer Guides

© 2026 theluckystrike Developer Guides