Conclusion

I spoke to representatives of ten news organizations for this study, and nine told me that they regularly receive useful tips or publish stories based on information provided to them directly through SecureDrop. Still, one of the questions that looms over SecureDrop, much like any unfamiliar technology, is whether it is worth the trouble.

One of the ironies inherent in SecureDrop, and perhaps in any technology that facilitates anonymous leaking, is that its openness both enables the collection of incredibly valuable information that could not have been attained otherwise, and also attracts absolute garbage that most reporters go to considerable lengths to keep as far from their desks as possible. The same anonymity measures that protect vulnerable sources from danger make it practically impossible to block, filter, or otherwise discourage those with nothing valuable to share.

Nevertheless, most reporters were adamant that the trouble of installing and maintaining a SecureDrop system has been worth it, whether it is measured on journalistic value, financial return, or moral principle.

McKie of The Globe and Mail said that when the question of installing SecureDrop was first raised in the newsroom, they crunched the numbers for the equipment and installation expenses, as well as for the regular labor hours that the system would require. “We decided that it was a relatively small amount of money,” he said, “and if we got one story out of it, we would consider that a success—and anything else was gravy.”

McKie added that the first SecureDrop story arrived “pretty much immediately,” and that the system has proved consistently useful over its first year—although, like my other informants, he was not willing to disclose which stories or exactly how many The Globe and Mail has published based on material gathered through SecureDrop.

Cook of Gawker voiced a similar sentiment:

It’s a hassle, but it’s worth it, even if it’s just one story a year. And a big part of it, for me, was just messaging to our readers and our community that we take security seriously, and that we’re investing our time and resources into ensuring that for the exceedingly small fraction of our readership that actually has information to share, and the inclination to do it, that there’s a way for them to do it that safeguards their identity.

Gellman also underlined the importance of opening secure channels to provide for sources who would not contact the press otherwise. In his case, the source was Edward Snowden, who reached out to Gellman because he was one of the few reporters using PGP email at the time.

And even though Snowden’s case is pointed and quite persuasive, it is worth foregrounding other reporters’ insistence that secure communication tools like SecureDrop would be worthwhile even if it did not yield blockbuster stories. “Nobody’s expecting to get another Snowden just because we set up SecureDrop. There may never be another Snowden,” said McKie. “We always have to be aware of the fact that not every source we get through SecureDrop is going to have some massive, earth-shaking revelation, but there are definitely more Snowdens out there in the sense of people who will not get in touch with us unless we give them this option, as opposed to the other options.”

Framing SecureDrop this way highlights its need as both humble and urgent. Source protection is a basic and essentially undisputed journalistic value. But the legal and technological considerations to meet this need have become dramatically more complicated as unchecked powers of surveillance have been tacitly granted to several world powers. SecureDrop is not meant to amplify or augment the reporting capabilities of a newsroom, but rather to help ensure the conditions of source protection that are necessary for a healthy press.

“The way that I conceived it, this is not a dangle to lure people into giving you stories that you would not otherwise have gotten,” Poulsen said. “It’s a system that is set up just for you to communicate with me safely. So if people are using SecureDrop instead of sending me an email, if they’re using it instead of calling me on the phone, then SecureDrop has proven its usefulness right there. And the answer to that is yes, they are.”