Leak to Us - VSQUARE.ORG

None of the communication tools we suggest are entirely foolproof. Each has its own set of advantages and risks. If you’re unsure about the best method for getting in touch with us and/or leaking information, we recommend contacting us through the encrypted messaging app Signal, which is explained in more detail below. In this initial conversation, give a broad outline of your situation and we can provide guidance regarding the best way to move forward. If you prefer to stay anonymous, you do not need to mention your name.

SIGNAL

You can send us text messages to this mobile phone number: +48692804017, using the smartphone app called Signal, available for iOS and Android. It is very easy to use as it works like most of messaging apps, but offers better security and anonymity.

Another advantage of using Signal is that we can communicate back with you, just like we would do, using normal short text messages (SMS). You cannot attach pdf or text documents with Signal, but you can send us photos/pictures of confidential documents.

Also, if you want to send us confidential documents but are unclear how to do it, use Signal to ask us and we will text you back, providing guidance.

One thing to keep in mind is that when you contact us via Signal, we will know your phone number (just as if you would send us an ordinary SMS). We will not reveal your phone number to anybody, but if your anonymity is extremely important, please use the methods below to communicate with us instead of Signal.

BY E-MAIL

If you need maximum security and anonymity, create an anonymous email and send us encrypted emails. How to do this? There are a number of steps, outlined in detail in next sections.

When willing to get in touch with us via e-mail, just send one to vsquare@vsquare.org. We monitor this account on a regular basis and will get in touch with you if we are interested in pursuing your tip. Remember though that standard email can be traced and hacked, and it can be discoverable in lawsuits. For information about more secure email options, see “By encrypted email” below.

Another way of contacting us is via an email account registered under a fake name. Gmail, Yahoo, and Outlook are all sufficient for this purpose. If you go through this route, though, you may want to register that account on either your own personal computer (less safe), or on a terminal at a public library or Internet café (more safe). In any case, registering or even logging in to the account on your work computer or on any other network where you’re being actively monitored, means that the account could be tracked back to you.

BY PHONE

For more secure smartphone communication with us, the encrypted messaging app Signal currently is the best bet. To get in touch with us using Signal, send us a message at +48692804017.

BY POST

It’s old school, but mailing documents can be a largely undetectable way of getting information to us. The key is not putting your name or any return address on the packaging. Also, don’t put any sensitive personal information inside the packaging. In addition, don’t mail the documents from your home, work or a location near those locations. Sidewalk post boxes are preferable to post offices, which often have video cameras.

Our mailing address:

VSQUARE.ORG
ul.Narbutta 20 lok.33/34
02-541 Warsaw
Poland

To reach a specific reporter or editor, put this person’s name on the outside of the packaging.

BY ENCRYPTED E-MAIL

For more secure email, first set up a Tor browser.

You can use ProtonMail — a fully encrypted email service based in Switzerland. If you can set up a Gmail account, you can get ProtonMail working. It’s as simple as any other open mailing service. The best part is that it fully encrypts all messages going from one ProtonMail account to another automatically. ProtonMail also has a special version of its site set up to operate over Tor.

Our ProtonMail account: vsquare@protonmail.com.

You can also use PGP (Pretty Good Privacy), a method of encrypting data to protect contents from surveillance while it is being transmitted over the Internet. To do so, you’ll need to download and familiarize yourself with free software that generates a pair of PGP “keys” – one private, one public – and hooks into the email program of your choice. We recommend Mailvelope, a cross-platform browser extension that augments Gmail’s browser interface.

Here’s a video that also provides a useful tutorial.

The vsquare@vsquare.org address is configured to accept messages encrypted with PGP. The public encryption key for that email address is below and on the MIT public key server. To contact a reporter or editor directly, use the PGP keys on the individual profiles linked from our staff page.

Here’s our PGP key:

PHOTOS AND DOCUMENTS

If you want to anonymously send us photographs or documents, it’s wise to consider an additional set of precautions.

Metadata: Before sending documents, you can completely remove any identifying information from the actual electronic file. Known as metadata, this information often indicates who took or created a photo or document, the software used to create or edit it, the date and time of its creation, even GPS coordinates—any of which could be used to identify you.

QUESTIONS?

If you’re a little lost or need us to clarify anything above, you can email us at vsquare@vsquare.org.

Happy leaking.