SVS drive plugged into/mounted on non-airgapped machine. inform Legacy (Tails/SVS)

THREAT142 · Inform: Handled by telling users how to protect themselves. · Defined in catalog.py:2442

Risk: Medium impact × Low likelihood = 4 medium
After mitigations: Medium impact × Low likelihood = 4 medium (unchanged)

A journalist accidentally plugs in the SVS drive into a non-airgapped computer. If the drive is mounted on a compromized computer, SVS private key may be exposed.

Threat actors: Journalist error

Mitigations

No mitigations in place.

Possible further mitigations

Journalist guide should explain airgap and describe how the drive should never be plugged into online workstation MITIG181 Legacy (Tails/SVS) proposed
Provide stickers / color coding to help journalists enforce airgap MITIG180 Legacy (Tails/SVS) proposed

Residual risk

Candidate for further mitigation efforts.

Where it applies

Applies to 1 component in 2 scenarios.

Secure Viewing Station Legacy (Tails/SVS) Airgapped Viewing Area

Transfer & decrypt Legacy (Tails/SVS) · Secure Viewing Station

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Airgapped_Viewing_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Airgapped Viewing Area</i>>;
        ]

        component_Secure_Viewing_Station_Airgapped_Viewing_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Secure Viewing\nStation";
            URL = "component_Secure_Viewing_Station.html";
            tooltip = "Secure Viewing Station (Legacy (Tails/SVS))";
            margin = 0.02;

            style = "filled,dashed";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "tagged highlighted";
        ]

    }

    actor_Journalist_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Journalist";
        URL = "component_Journalist.html";
        tooltip = "Journalist";
        margin = 0.02;
    ]

    component_Transfer_Device_ [
        shape = circle;
        color = black;
        fontcolor = black;
        label = "Transfer Device";
        URL = "component_Transfer_Device.html";
        tooltip = "Transfer Device (Legacy (Tails/SVS))";
        margin = 0.02;
        style = "dashed";
        class = "tagged";
    ]

    actor_Journalist_ -> component_Transfer_Device_ [        color = black;        fontcolor = black;        dir = forward;        label = "1. Copy to transfer\ndevice";    ]
    component_Transfer_Device_ -> component_Secure_Viewing_Station_Airgapped_Viewing_Area [        color = black;        fontcolor = black;        dir = forward;        label = "2. Carry to air-gap";    ]
    component_Secure_Viewing_Station_Airgapped_Viewing_Area -> component_Secure_Viewing_Station_Airgapped_Viewing_Area [        color = black;        fontcolor = black;        dir = forward;        label = "3. Decrypt offline";    ]
    component_Secure_Viewing_Station_Airgapped_Viewing_Area -> component_Secure_Viewing_Station_Airgapped_Viewing_Area [        color = black;        fontcolor = black;        dir = forward;        label = "4. Sanitize";    ]
}

Publish & export Legacy (Tails/SVS) · Secure Viewing Station

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Airgapped_Viewing_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Airgapped Viewing Area</i>>;
        ]

        component_Offline_Printer_Airgapped_Viewing_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Offline Printer";
            URL = "component_Offline_Printer.html";
            tooltip = "Offline Printer (Legacy (Tails/SVS))";
            margin = 0.02;
            style = "dashed";
            class = "tagged";
        ]

        component_Secure_Viewing_Station_Airgapped_Viewing_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Secure Viewing\nStation";
            URL = "component_Secure_Viewing_Station.html";
            tooltip = "Secure Viewing Station (Legacy (Tails/SVS))";
            margin = 0.02;

            style = "filled,dashed";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "tagged highlighted";
        ]

    }

    subgraph cluster_boundary_Publishing_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Publishing Area</i>>;
        ]

        component_Sanitized_submission_Publishing_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Sanitized\nsubmission";
            URL = "component_Sanitized_submission.html";
            tooltip = "Sanitized submission";
            margin = 0.02;
        ]

    }

    component_Export_Device_ [
        shape = circle;
        color = black;
        fontcolor = black;
        label = "Export Device";
        URL = "component_Export_Device.html";
        tooltip = "Export Device";
        margin = 0.02;
    ]

    component_Secure_Viewing_Station_Airgapped_Viewing_Area -> component_Export_Device_ [        color = black;        fontcolor = black;        dir = forward;        label = "1. Export sanitized";    ]
    component_Export_Device_ -> component_Sanitized_submission_Publishing_Area [        color = black;        fontcolor = black;        dir = forward;        label = "2. To publishing\narea";    ]
    component_Secure_Viewing_Station_Airgapped_Viewing_Area -> component_Offline_Printer_Airgapped_Viewing_Area [        color = black;        fontcolor = black;        dir = forward;        label = "3. Print";    ]
}

Notes

Further mitigations: Journalists should be instructed to never plug the Tails SVS drive on any SVS-dedicated and airgapped machine (MITIG181). Provide stickers/color coding scheme (MITIG180). Automated test for mitigation: No.

How this threat is matched

Listed for these components. A boundary covers every component inside it.