Categories of Submission:What Turns Up in SecureDrop?

“The ratio of wheat to chaff is unsurprising,” said Barton Gellman. His personal SecureDrop received more than five hundred messages in the twenty months between July 2014 and January 2016. Of those, he said about one hundred unique user names were registered, but these did not necessarily indicate unique visitors. Overall, Gellman said that fewer than ten percent of his SecureDrop contacts provided “useful information,” but of these only three contacts were able to provide him with “significant and journalistically valuable” information. It bears repeating that three whistleblowers in less than two years is still a considerable success rate. Nevertheless, for the sake of source protection, journalists are often not at liberty to describe the worthwhile materials they receive—whether these are troves of spreadsheets, images, PDFs, or emails they review for veracity and journalistic value.

Consequently, the journalists I interviewed were far more willing to discuss the junk they receive. The following section outlines categories of common submissions that need to be discarded in search of useful journalistic material in SecureDrop.

Security Testing

Several informants said that some of the most common messages to populate their SecureDrop inboxes arrive from white-hat hackers performing security tests on the system. Gellman said that many messages explicitly state that they are merely “checking the system setup for flaws or confirming it is online.” The SecureDrop developers do offer a “bug bounty” for those who find flaws in the system, so these messages are most likely sent in order to check for potential information leaks or openings where the system may be breached.

Malware

Despite the intense precautions of the SecureDrop developers, some submissions arrive harboring malware. Gellman noted that it is especially important for journalists to be wary of file types where malware is commonly hidden, such as PDFs and DOC files. Gellman specifically recounted catching malware in several submissions to his SecureDrop. “One upload consisted of what purported to be a long list of stolen credit card numbers, and there was malware embedded in the submission,” he wrote in an email, adding that “there have been three other confirmed deliveries of malware. Those could have posed a meaningful risk to the security of the system, but I do not (ahem) run executable files.”

Spam

As with any system where submissions are unfiltered and unmonitored, there is essentially no way to eliminate spam from SecureDrop. Cook of Gawker recalled being subjected to an especially nasty barrage of unwanted messages when his system first got off the ground. “When we launched, we were beset by trolls, so there were a lot of horrible images of dead bodies, and porn, and people uploading massive videos just to gum up the system and take up time,” he said. “The first three or four days checking it were just a nightmare.” Although these sources of noise are perhaps unavoidable, many outlets said the level of spam they receive is low and easily managed.

Tips of Limited Value

Mike Tigas said that ProPublica’s SecureDrop does not receive “spam” in the sense of “people trying to mess with them,” but that irrelevant submissions result more often from people trying to act as sources when in actuality they don’t really have anything of journalistic value to share. This seems to be due to an ordinary lack of news judgment.

McKie of The Globe and Mail shared a similar account, but also defended the value of tips that may not be offering secret or previously unknown material, because these may alert reporters to what readers consider important. “Sometimes just the fact that they sent it to us is enough to kind of twig us, journalistically, to a potential story,” he said.

Tate of The Washington Post echoed this:

Sometimes it is very confusing, because people are sending you pages from a published book. But what they’re trying to do is put context around those pages. You know, it’s not like they’re sending you a page from a book and saying that this should be a secret communication. They’re saying, “Look at this page in this book and let me explain to you what is happening here.”

Conspiracy Theories

Other failures of news judgment receive little sympathy. Many journalists are all too familiar with messages from an eager source with no credible evidence to back up their claims. SecureDrop seems to be particularly inviting for these sources. Gellman said that he has received about twenty unique communications from people offering him “elaborate and implausible theories.”

The majority of my interviewees confirmed receiving this category of submission, but Tigas of ProPublica said he encounters messages like these no more than once a month. Cook of Gawker seemed more accepting and even somewhat entertained by these characters: “SecureDrop is very wonky and labor intensive. It’s difficult and it’s a pain in the ass. By nature, it attracts people who are paranoid and distrustful. So interacting with the people who come to you through that channel, it’s always interesting.”

McKie of The Globe and Mail noted that SecureDrop may actually have a slightly higher signal-to-noise ratio than other channels the public may use to contact journalists:

We’ve had the newsroom telephone line for decades and it’s always been called the “crank line,” and there’s a reason for that. SecureDrop doesn’t change that. If anything, SecureDrop raises the barrier to entry so that people have to work a little bit harder to get in touch with us, but if you compare SecureDrop to other means, people seem to be a lot more motivated. They’re not just doing it for fun, and as a result what you get is people who believe, for whatever reason, that there’s a story in what they’ve sent you.

Hoaxes and Fakes

A separate genus of unreliable stories includes those that are deliberately false. Gellman said that he was contacted by a “sophisticated fabricator” offering forged documents using a “well-planned and well-executed fake persona,” which took Gellman some time to debunk. This underlines the importance of approaching material in SecureDrop, like anything else, with proper skepticism and subjecting it to rigorous verification. In Gellman’s case, this was time consuming, but he also said it was “a net positive for me as a learning exercise.”

Over the Transom

One of the interesting properties of SecureDrop is that it essentially offers a direct connection to an editor. Many writers covet this level of access, especially when they are accustomed to submitting their work to slush piles heaping with other literary hopefuls. At The New Yorker, for instance, editor Jeremy Keehn said that when they first launched SecureDrop, “more than half of the submissions were fiction or poetry.” None of these submissions were accepted for publication in The New Yorker, and Keehn encouraged these writers to use conventional channels in the future.