The Guardian’s new whistleblower tool buries leaks to journalists within its own readers’ everyday traffic

If you download the new mobile apps The Guardian released today, in a small way, you’ll be helping protect whistleblowers around the world.

Okay — so it’s a very small way. But because of an ingenious new leaking-to-journalists protocol — created in concert with Cambridge computer scientists — regular app users are actually running interference for those who need to reach reporters securely and safely. If smoking out a whistleblower is like finding a needle in a haystack, Guardian readers are now a giant pile of extra hay.

The feature, called Secure Messaging, is based on a tool called CoverDrop, first proposed in 2022. Its source code is available on GitHub — letting other publishers use it in their apps and giving security researchers the ability to poke around for holes.

Secure Messaging does two especially smart things. First, it uses the newspaper’s own mobile apps as the vehicle through which a whistleblower’s communication happens. No need to push people to a separate app, explain what a Tor browser is, or get tech mortals to understand PGP. Someone looking to leak to The Guardian probably already reads The Guardian — and having a news app on your phone likely won’t spark an employer’s suspicion in the same way that Signal might. And, most importantly, a news organization has control over its app’s underlying code base in a way it can’t with a third-party option.

The second smart thing is using the app’s own data flows to make leaks indistinguishable from regular traffic — cutting off one of the easiest ways for a repressive government or corporate boss to identify a leaker.

Here’s how it works. The Guardian’s mobile apps communicate regularly with the paper’s servers. (How else is it going to hear about new stories?) With this new version, anyone using the app will regularly send small packets of information, called CoverDrop messages, up to Guardian servers. For you and me, those packets will contain nonsense — a dummy message. But if a Secure Messaging user reaches out to Guardian journalists, that nonsense will be replaced with an encrypted form of whatever text they’ve chosen to send — in a way that looks identical to its decoys to anyone sniffing packets. “Consequently a network observer cannot determine whether any communication is taking place and CoverDrop therefore provides the potential source with plausible deniability,” researchers say in their accompanying white paper:

Our central insight towards a practical solution is that news organizations already run a widely-available platform from which they can offer a secure, usable method of initial contact: the news app on a smartphone. The confidentiality and integrity of message content can be assured through widely-available cryptography on these platforms; journalists can be authenticated directly by the news organization; traffic analysis by a network operator or state actor can be thwarted by requiring all the installations of the news app to produce cover traffic, thus hiding whether any given user is in contact with a journalist or not; the system does not require users to install specialist software or tools; and the news app can provide a usable interface which is similar in style and operation to a typical messaging app.

In other words, both a user’s Guardian app and the web traffic originating from it should look indistinguishable whether or not she is actively dishing secrets to reporters — thus giving leakers “plausible deniability.”

“That’s important in a world of pervasive surveillance where it has become increasingly hazardous to be a whistleblower,” said Cambridge postdoc Daniel Hugenroth, who led CoverDrop’s development along with professor Alastair Beresford.

That process makes the communication slower than your favorite chat app. “Secure Messaging is not by any means an instant messenger,” Luke Hoyland, The Guardian’s product manager for investigations and reporting, told me. Making delivery anything close to realtime would require every Guardian app to be sending CoverDrop messages around the clock — which is neither practical nor particularly nice to regular users. (I sent Hoyland a test message this morning, and its sending was listed as “pending” for quite some time afterward — though it did eventually go through.)

Work on this tool dates back to 2019, when a group of Cambridge researchers held workshops with a number of British journalists to discuss their digital security needs. Hoyland and other Guardian colleagues were among the attendees, and when they saw the researchers describe CoverDrop in 2022, they got in touch. Beresford and Hugenroth have been working with the paper on the integration ever since — Beresford as a consultant and Hugenroth as a contractor.

He said that Secure Messaging isn’t meant to replace other whistleblowing tools like SecureDrop: “We are enthusiastic supporters of SecureDrop and we think the tools complement each other.” Secure Messaging is optimized for a particular moment in the leaker-leakee relationship: first contact. Both sides are feeling each other out; trust is being built. And once that relationship is established — and large document caches need to be exchanged, say — it can move to SecureDrop, Signal, or whatever other method makes sense.

“Signal is a particularly good example for many scenarios,” Hoyland said. “It’s easy to ‘downgrade’ from a position of strong security, but it’s difficult to remove digital footprints once they are out there.” (CoverDrop underwent a third-party security audit earlier this year.)

Right now, Secure Messaging isn’t hard to find in the app — hint: hamburger menu — but it also isn’t something someone is likely to stumble upon by accident. This is a frequent tension in leaking protocols; making them prominent to every user may generate more valuable leaks — but it will also generate more useless ones. (Any journalist with an email address can tell you from experience that most unsolicited tips fall well short of Pulitzer-worthy.)

“It’s a difficult balance to strike: We wanted the tool to be easy enough for non-technical users, but also to include sufficient friction to discourage misuse,” Hoyland told me. There are plans in place to deal with potential spam and abuse, and developers are thinking about how (and how much) to promote the tool.

I asked Hoyland how many tips had come in via Secure Messaging in its first few hours. It turns out the feature was actually turned on for a subset of Guardian users a week ago, and since then the paper has received “a steady stream of tips.” He declined to give a specific number (“since doing so would undermine our security model”), but was able to give me this scoop: “more than dozens and fewer than gazillions.”