Airgapped SVS Tails key seized partially mitigated Legacy (Tails/SVS)

THREAT133 · Partially mitigated: Some controls are in place, but the risk is still too high. · Defined in catalog.py:2289

Risk: High impact × Low likelihood = 6 medium
After mitigations: High impact × Low likelihood = 6 medium (unchanged)

How statuses and scores work

An adversary seizes the SVS Tails USB stick

Threat actors: Nation State / Law Enforcement

Mitigations

Mitigation	Status
Persistent storage FDE for SVS MITIG14	implemented

Possible further mitigations

Admin guide explains incident response when submission key moved out of airgap or compromised MITIG151 Legacy (Tails/SVS) proposed

Where it applies

Applies to 1 component in 2 scenarios.

Secure Viewing Station Legacy (Tails/SVS) Airgapped Viewing Area

Transfer & decrypt Legacy (Tails/SVS) · Secure Viewing Station

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Airgapped_Viewing_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Airgapped Viewing Area</i>>;
        ]

        component_Secure_Viewing_Station_Airgapped_Viewing_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Secure Viewing\nStation";
            URL = "component_Secure_Viewing_Station.html";
            tooltip = "Secure Viewing Station (Legacy (Tails/SVS))";
            margin = 0.02;

            style = "filled,dashed";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "tagged highlighted";
        ]

    }

    actor_Journalist_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Journalist";
        URL = "component_Journalist.html";
        tooltip = "Journalist";
        margin = 0.02;
    ]

    component_Transfer_Device_ [
        shape = circle;
        color = black;
        fontcolor = black;
        label = "Transfer Device";
        URL = "component_Transfer_Device.html";
        tooltip = "Transfer Device (Legacy (Tails/SVS))";
        margin = 0.02;
        style = "dashed";
        class = "tagged";
    ]

    actor_Journalist_ -> component_Transfer_Device_ [        color = black;        fontcolor = black;        dir = forward;        label = "1. Copy to transfer\ndevice";    ]
    component_Transfer_Device_ -> component_Secure_Viewing_Station_Airgapped_Viewing_Area [        color = black;        fontcolor = black;        dir = forward;        label = "2. Carry to air-gap";    ]
    component_Secure_Viewing_Station_Airgapped_Viewing_Area -> component_Secure_Viewing_Station_Airgapped_Viewing_Area [        color = black;        fontcolor = black;        dir = forward;        label = "3. Decrypt offline";    ]
    component_Secure_Viewing_Station_Airgapped_Viewing_Area -> component_Secure_Viewing_Station_Airgapped_Viewing_Area [        color = black;        fontcolor = black;        dir = forward;        label = "4. Sanitize";    ]
}

Publish & export Legacy (Tails/SVS) · Secure Viewing Station

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Airgapped_Viewing_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Airgapped Viewing Area</i>>;
        ]

        component_Offline_Printer_Airgapped_Viewing_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Offline Printer";
            URL = "component_Offline_Printer.html";
            tooltip = "Offline Printer (Legacy (Tails/SVS))";
            margin = 0.02;
            style = "dashed";
            class = "tagged";
        ]

        component_Secure_Viewing_Station_Airgapped_Viewing_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Secure Viewing\nStation";
            URL = "component_Secure_Viewing_Station.html";
            tooltip = "Secure Viewing Station (Legacy (Tails/SVS))";
            margin = 0.02;

            style = "filled,dashed";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "tagged highlighted";
        ]

    }

    subgraph cluster_boundary_Publishing_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Publishing Area</i>>;
        ]

        component_Sanitized_submission_Publishing_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Sanitized\nsubmission";
            URL = "component_Sanitized_submission.html";
            tooltip = "Sanitized submission";
            margin = 0.02;
        ]

    }

    component_Export_Device_ [
        shape = circle;
        color = black;
        fontcolor = black;
        label = "Export Device";
        URL = "component_Export_Device.html";
        tooltip = "Export Device";
        margin = 0.02;
    ]

    component_Secure_Viewing_Station_Airgapped_Viewing_Area -> component_Export_Device_ [        color = black;        fontcolor = black;        dir = forward;        label = "1. Export sanitized";    ]
    component_Export_Device_ -> component_Sanitized_submission_Publishing_Area [        color = black;        fontcolor = black;        dir = forward;        label = "2. To publishing\narea";    ]
    component_Secure_Viewing_Station_Airgapped_Viewing_Area -> component_Offline_Printer_Airgapped_Viewing_Area [        color = black;        fontcolor = black;        dir = forward;        label = "3. Print";    ]
}

Notes

Existing mitigations: While off, the SVS has FDE (MITIG14). Further mitigations: Inform users to immediately change submission key should there be any doubt the SVS Persistent volume passphrase was lost or seized (MITIG151). Automated test for mitigation: No.

How this threat is matched

Listed for these components. A boundary covers every component inside it.