Components

The parts of the system, the ones carrying the most open risk first. Open threats are unmanaged or partially mitigated; see how to read this model.

Components

Component	In boundary	Open threats	Highest open risk	All threats
Journalist Workstation (device) Legacy (Tails/SVS) The journalist's physical Tails workstation, USB stick and 2FA token.	Journalist Workstation (Tails)	8	9 high	16
Source environment The source's device/network/behaviour before and during submission (OPSEC surface).	Source Area	5	9 high	10
Source Tor Browser Tor Browser / Tor client the source uses to reach the onion service.	Source Area	3	9 high	9
Workstation hardware The laptop running Qubes OS, including its CPU and peripherals.	SecureDrop Workstation	2	9 high	6
SecureDrop Application Encrypts each submission to the instance public key; plaintext is transient.	Application Server	2	9 high	5
SecureDrop source repository GitHub source repository for SecureDrop.	External Services	1	9 high	5
DNS resolver Clearnet DNS queried on behalf of the servers.	External Services	1	9 high	1
Transfer Device Legacy (Tails/SVS) USB media carrying encrypted submissions to the air-gap.		1	8 high	7
sd-app (SecureDrop Client) Non-networked VM that runs the SecureDrop Client and stores decrypted submissions.	Workstation VMs	13	6 medium	25
Admin Workstation (device) Legacy (Tails/SVS) The admin's physical Tails workstation, USB stick and 2FA token.	Admin Workstation (Tails)	7	6 medium	18
sd-proxy Networked VM that relays the client's Journalist API requests over Tor, using the Arti Tor client.	Workstation VMs	7	6 medium	18
sd-viewer (disposable VMs) Template for the non-networked disposable VMs that open submitted files.	Workstation VMs	7	6 medium	18
sd-gpg Non-networked VM holding the submission decryption key. Other VMs ask it to decrypt, so the key never leaves it.	Workstation VMs	6	6 medium	16
sys-net Qubes service VM holding the network hardware.	Workstation VMs	5	6 medium	15
sd-devices (export and print) Non-networked VM that exports files to USB drives and prints.	Workstation VMs	5	6 medium	14
sys-firewall Qubes service VM that filters network traffic. sd-proxy reaches the network through it.	Workstation VMs	5	6 medium	14
Monitoring Server (host) The monitoring server hardware/OS/host beneath OSSEC/Postfix.	Monitoring Server	5	6 medium	11
Application Server (host) The app server hardware/OS/host firewall beneath the SecureDrop services.	Application Server	5	6 medium	10
Secure Viewing Station Legacy (Tails/SVS) Air-gapped Tails: decrypts with the private key, then sanitizes.	Airgapped Viewing Area	4	6 medium	13
sd-log Non-networked VM that collects logs from the other SecureDrop VMs.	Workstation VMs	4	6 medium	13
sys-usb Qubes service VM holding the USB controllers.	Workstation VMs	4	6 medium	13
Journalist Interface Authenticated Flask app (client-auth onion) for triage.	Application Server	3	6 medium	14
Source Interface Public Flask app on a Tor onion; sources submit here.	Application Server	2	6 medium	19
Landing page News org's public landing page advertising the onion address.	External Services	1	6 medium	9
Qubes OS and Xen The Xen hypervisor and Qubes OS, which isolate the VMs from each other.	SecureDrop Workstation	1	6 medium	7
Tor software Tor daemon / onion-service protocol dependency (client and server side).	External Services	1	6 medium	3
Workstation bootloader Boots Qubes OS from the encrypted disk.	SecureDrop Workstation	1	6 medium	2
App Server SSH Admin SSH access over an authenticated Tor onion.	Application Server	1	6 medium	1
Encrypted submission store Submissions encrypted to the instance pubkey, at rest on disk.	Application Server	1	6 medium	1
OSSEC client Host IDS agent; ships logs to the Monitoring Server.	Application Server	1	6 medium	1
SecureDrop.org directory FPF-hosted directory mapping news orgs to SecureDrop onion addresses.	External Services	1	4 medium	1
FPF apt repository Serves FPF packages plus the mirrored Tor apt packages.	External Services	1	3 low	3
Ubuntu apt repository	External Services	1	3 low	3
Workstation provisioning code The securedrop-workstation RPM package and Salt states, which create and configure the VMs from dom0.	SecureDrop Workstation	1	3 low	3
Journalist Corporate Workstation Journalist's corporate/personal device & network — outside the SecureDrop trust zone.	News Organization	3	2 low	5
Postfix Relays GPG-encrypted OSSEC alert mail out to the SMTP relay.	Monitoring Server	2	2 low	2
SMTP relay	External Services	1	2 low	1
Dedicated Hardware Firewall Segments the SecureDrop Area from the workstations and the internet.	SecureDrop Area			5
SecureDrop release & package build Reproducible build & signing of released .deb packages.	External Services			3
Backup / recovery media Encrypted backup/admin USB media holding instance secrets.				2
News Organization / Legal Corporate network and legal exposure of the news organization.	News Organization			2
NTP server	External Services			1
SecureDrop server room Physical room hosting the app/mon servers and firewall.	SecureDrop Area			1
Workstation firmware The laptop's firmware, which starts the boot chain.	SecureDrop Workstation			1
dom0 The Qubes OS administrative VM. It runs provisioning and the updater, and applies the qrexec policy.	SecureDrop Workstation			1
App Server APT/NTP/DNS Pulls packages/time (systemd-timesyncd)/DNS via the Monitoring Server gateway.	Application Server
Export Device USB media carrying sanitized output off the air-gap.
Metadata DB SQLite metadata (sources, submission filenames, timestamps).	Application Server
Monitor Server APT/NTP/DNS Clearnet gateway for package/time (systemd-timesyncd)/DNS on behalf of both servers.	Monitoring Server
Monitor Server SSH Admin SSH access over an authenticated Tor onion.	Monitoring Server
OSSEC server Aggregates host-IDS events and raises alerts.	Monitoring Server
Offline Printer Legacy (Tails/SVS) Prints sanitized documents for physical handling.	Airgapped Viewing Area
Sanitized submission Metadata-stripped material ready to publish.	Publishing Area

Boundaries

Boundary	In boundary	Open threats	Highest open risk	All threats
Admin Workstation (Tails) Legacy (Tails/SVS)
Airgapped Viewing Area Legacy (Tails/SVS)
Application Server
External Services
Journalist Workstation (Tails) Legacy (Tails/SVS)
Monitoring Server
News Organization
Publishing Area
SecureDrop Area
SecureDrop Workstation
Source Area
Workstation VMs	SecureDrop Workstation

Which properties each component has is listed under component properties.