If this is your first time using Schwartz Media's SecureDrop server, read this page carefully.

There are additional communication methods listed at the bottom of the page. If you are unsure how to proceed, message us using Ricochet and we will help you.

The Schwartz Media SecureDrop server can be used to send documents securely and anonymously to journalists at The Saturday Paper and The Monthly.

Precautions

Everything you do on the internet leaves a trail.

Before following these instructions and connecting to our SecureDrop, go to a public wifi network like a coffee shop or library that you do not normally frequent, or connect to a VPN. You should be careful in public places that may contain CCTV, or where people could see your screen.

Do not follow any links on this page from your home or office network.

How to contact us using SecureDrop

For maximum privacy you can connect to Tor with the Tails operating system, this is recommended if you are employed by a government or if you think someone may be monitoring you.

  1. Download the Tor Browser from: torproject.org
  2. Open your Tor Browser and type the following URL into the address bar and hit Enter/Return:
    3. od2icdth5ceo32wq.onion

    You can verify this is the correct address by checking inside a recent issue of The Saturday Paper or The Monthly.
  3. Follow the instructions on the SecureDrop page. You will be given a randomly generated and unique code name. This will allow you to login and check replies to your messages.

Privacy Information

Our SecureDrop servers are under the physical control of Schwartz Media. They are kept in a locked room, under constant video surveillance.

We do not ask or require you to provide any personally identifiable information when you use SecureDrop.

SecureDrop does not record your IP address, information about your browser, computer, or operating system.

Our SecureDrop server will only store the date and time of the newest message sent from each source. Once you send a message, the time and date of your previous message is automatically deleted.

Journalists decrypt and read each message on a computer that has never been and will never be connected to the internet. They are also encouraged to delete messages from the server on a regular basis. The date and time of any message will be securely deleted from the server when the message is deleted.

Be aware that the actual messages you send and receive through SecureDrop may include personally identifiable information. For this reason, once you read a journalist's message, we recommend you delete it. It will be securely deleted from the file system.

Metadata
When you submit certain types of files through SecureDrop you may be sending us metadata associated with that file.

For example, if you submit a photo through SecureDrop in JPEG format, the file may include information about the date, time, GPS location of where it was taken and the type of device used to take the photo.

Similarly, if you submit a Word file (.doc or .docx) through SecureDrop, it may include the identity of the document's author, the author's operating system, GPS data about the author's location, and the date and time when the document was created.

Our policy is to scrub metadata from the files we receive through SecureDrop before publication. If you do not want to send us metadata, please use the Metadata Anonymization Toolkit to scrub the file before you submit it.

Warnings
No system is 100% secure, so we cannot absolutely guarantee your security. SecureDrop is regularly audited by independent security experts, but like all software it could have security bugs that could be exploited by attackers.

If the computer you are using to submit documents is already compromised, any activities, including communication through SecureDrop, could be compromised as well.

Ultimately, you use the service at your own risk.

Resources

For more information on how SecureDrop works and how to use it, we suggest you read this detailed step-by-step guide on how to use it as a source, and a list of frequently asked questions.

Other forms of secure communication

If SecureDrop is unavailable you can also contact us anonymously by PGP for email or Ricochet for messaging.

If you do not know how to use PGP we strongly recommend you install Ricochet and contact us that way.

Ricochet

Ricochet is a text messaging app for Linux, Mac and Windows, and does not require any initial exchange of phone numbers unlike Signal.

The Saturday Paper
Andy Hazel
ricochet:fzr7v4tozp2qv2l2

Ricochet is a good choice if you have never contacted us or are unsure how to use our SecureDrop, and SecureDrop is overkill or too much work at this stage.

We still recommend you download and use Ricochet on a public wifi network, and never on your work computer.

PGP

If you know how to use PGP you can email us and encrypt your messages with the following key:

The Saturday Paper
Andy Hazel
Fingerprint: 
B284 9F06 015F 5A28 8835 DE23 4C0A 9C83 85FE 4F3A

PGP is a good choice if you know how to use it. It's easy to make a mistake if you don't know it well, in which case we would recommend using any of the other options on this page.

PGP users can verify this page with the following command. View page source for more information. This page is mirrored on both The Saturday Paper and The Monthly, and is signed by Michael Kandelaars. 

curl https://www.thesaturdaypaper.com.au/tips | gpg

curl https://www.themonthly.com.au/tips | gpg

Signing Key: 

D1AA C039 3288 6146 BB14 3E9F 890A 80A9 D59C 28C0