How to share stories with Stuff Circuit securely, confidentially and anonymously

We have established a secure system to help whistleblowers or people with important information, video, photographs, documents or tips to communicate confidentially and anonymously with the Stuff Circuit investigative team.

This method - SecureDrop - is used internationally by media outlets including The New York Times, The Guardian, Vice, and Fairfax Media (owners of Stuff Limited).

If used as directed below in the ‘HOW TO USE SECUREDROP’ section, the SecureDrop service is a way in which you can share files with us and remain confident of complete anonymity. Even we won’t know who you are unless you choose to tell us.

While SecureDrop uses Tor hidden services to support anonymity, we would advise you to take precautions and think very carefully about where you access it from. You should avoid using SecureDrop on networks where Tor usage may be monitored or restricted, or where CCTV cameras may be able to capture the activity on your screen.

How to use SecureDrop:

We recommend that you undertake these steps using a public wifi connection in a cafe or public library, rather than on your work or home network. If there is a risk someone could investigate your computer for evidence you have visited SecureDrop, consider downloading and installing Tails OS onto a USB stick and use that to submit your documents.

Stuff Circuit journalists will check for submissions to SecureDrop. If we want to contact you about information you have submitted, we will leave a message for you in SecureDrop.

If you want to remain anonymous you should not supply any personally identifying information in your exchanges with us.

If you want to communicate with a specific journalist outside of the Stuff Circuit team please indicate this in your submission.

How is my privacy protected?

The SecureDrop platform has the following characteristics, which reduce the chance that your identity will be linked to the documents you upload:

PGP Keys

If you prefer to use an alternative, or Tor is blocked, you can also contact our journalists using a PGP email plugin or client (with a dummy email account, if you prefer - we recommend Protonmail.com). Please note that unlike SecureDrop, PGP only encrypts the message you are trying to send. It does not offer to anonymise the sender’s email address or IP address, and does not hide other fields such as what the email subject is.

The list of PGP Public keys for Stuff Circuit and other Stuff journalists who use PGP are here as are their keybase.io profiles, which show cryptographic proof that the owners work for Stuff.

Toby Longbottom
Email
PGP (Keybase)
94B4 E565 4000 BCA0 D1FF 2C3A F5A9 707E 9E47 AA19 CopyCOPIED
Eugene Bingham
Email
PGP (Keybase)
A96F A2F6 07E3 3A69 8813 AE6D 07A2 97A4 BE8C 87F2 CopyCOPIED
Paula Penfold
Email
PGP (Keybase)
ED15 68CA 7F5E 9406 D2A7 74A9 22CD D3F8 F318 5297 CopyCOPIED
Terms and conditions
  1. By using the SecureDrop platform, you agree to these conditions of use.
  2. Use of the SecureDrop platform is at the user's own risk. As no software is 100% bug-free, we cannot guarantee security.
  3. We recommend you take the security steps outline above to protect your confidentiality. However, you understand and acknowledge that confidentiality cannot be guaranteed by this alone, and technology may facilitate new means of establishing identity regardless of any protections taken.
  4. Unless you choose to waive anonymity, we will treat any content uploaded via SecureDrop carefully to preserve confidentiality to the greatest possible extent.
  5. You acknowledge that we may be required by law to disclose information stored in the SecureDrop platform to law enforcement agencies or other third parties in any jurisdiction.
  6. Uploading of content to the platform is no guarantee that an article or other item will be published referencing that data.
  7. You must not abuse the platform by uploading any pornographic, obscene or illegal content.
  8. Journalists decrypt and read each message on a machine that is never connected to the internet or a network, and will delete messages from the SecureDrop server on a regular basis.
  9. The system does not record your IP address, information about your browser, computer, or operating system. Furthermore, the SecureDrop pages do not embed third-party content or deliver persistent cookies to your browser.
  10. We don't ask or require you to provide any personally identifying information when you submit documents through SecureDrop.