Unsanitized decrypted files are transfered to journalist workstation without prior sanitization partially mitigated Legacy (Tails/SVS)

THREAT138 · Partially mitigated: Some controls are in place, but the risk is still too high. · Defined in catalog.py:2377

Risk: Medium impact × High likelihood = 8 high
After mitigations: Medium impact × High likelihood = 8 high (unchanged)

How statuses and scores work

Improper sanitization prior to leaving the Airgapped workstation may result in an adversary's capability to identify the source or obtain sensitive information , should the computer be compromised or through Journalist error.

Threat actors: Journalist error

Mitigations

Mitigation	Status
Persistent FDE Storage of Transfer Device MITIG57 Legacy (Tails/SVS)	implemented
Persistent storage FDE for Journalist Workstation MITIG13	implemented

Where it applies

Applies to 1 component in 1 scenario.

Transfer Device Legacy (Tails/SVS)

Transfer & decrypt Legacy (Tails/SVS) · Transfer Device

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Airgapped_Viewing_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Airgapped Viewing Area</i>>;
        ]

        component_Secure_Viewing_Station_Airgapped_Viewing_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Secure Viewing\nStation";
            URL = "component_Secure_Viewing_Station.html";
            tooltip = "Secure Viewing Station (Legacy (Tails/SVS))";
            margin = 0.02;
            style = "dashed";
            class = "tagged";
        ]

    }

    actor_Journalist_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Journalist";
        URL = "component_Journalist.html";
        tooltip = "Journalist";
        margin = 0.02;
    ]

    component_Transfer_Device_ [
        shape = circle;
        color = black;
        fontcolor = black;
        label = "Transfer Device";
        URL = "component_Transfer_Device.html";
        tooltip = "Transfer Device (Legacy (Tails/SVS))";
        margin = 0.02;

        style = "filled,dashed";

        fillcolor = "#c0392b";

        fontcolor = "white";

        class = "tagged highlighted";
    ]

    actor_Journalist_ -> component_Transfer_Device_ [        color = black;        fontcolor = black;        dir = forward;        label = "1. Copy to transfer\ndevice";    ]
    component_Transfer_Device_ -> component_Secure_Viewing_Station_Airgapped_Viewing_Area [        color = black;        fontcolor = black;        dir = forward;        label = "2. Carry to air-gap";    ]
    component_Secure_Viewing_Station_Airgapped_Viewing_Area -> component_Secure_Viewing_Station_Airgapped_Viewing_Area [        color = black;        fontcolor = black;        dir = forward;        label = "3. Decrypt offline";    ]
    component_Secure_Viewing_Station_Airgapped_Viewing_Area -> component_Secure_Viewing_Station_Airgapped_Viewing_Area [        color = black;        fontcolor = black;        dir = forward;        label = "4. Sanitize";    ]
}

Notes

Existing mitigations: Transfer device and Tails Persistent volumes are encrypted (MITIG57, MITIG13). Automated test for mitigation: No.

How this threat is matched

Listed for these components. A boundary covers every component inside it.