App server seized partially mitigated

THREAT147 · Partially mitigated: Some controls are in place, but the risk is still too high. · Defined in catalog.py:2528

Risk: Medium impact × Low likelihood = 4 medium
After mitigations: Medium impact × Low likelihood = 4 medium (unchanged)

How statuses and scores work

SecureDrop application server is seized by law enforcement or other government agency. Sensitive data may be available in-memory or on-disk.

Threat actors: Nation State / Law Enforcement

Mitigations

Mitigation	Status
Secure Temporary Wrapper to stream submissions encrypted on disk MITIG69	implemented
Use of airgapped SVS key MITIG10	implemented
Nighly reboot occurs to clear secrets stored in memory MITIG136	implemented
Swap disabled on servers MITIG52	implemented

Possible further mitigations

FDE on app/mon servers MITIG134 proposed
Support SecureDrop raid kill switch: Turn off / disable servers MITIG191 proposed

Residual risk

Other metadata stored on server (notably: last source activity timestamp, seen/unseen data, number/types of file/message/reply interactions), data about journalist user accounts. Submission key may be seized when app server is raided.

Where it applies

Applies to 1 component in 1 scenario.

Application Server (host) Application Server

Physical and host layer · Application Server (host)

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Application_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Application Server</i>>;
        ]

        component_Application_Server__host__Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Application\nServer (host)";
            URL = "component_Application_Server__host_.html";
            tooltip = "Application Server (host)";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

        component_SecureDrop_Application_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SecureDrop\nApplication";
            URL = "component_SecureDrop_Application.html";
            tooltip = "SecureDrop Application";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Monitoring_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Monitoring Server</i>>;
        ]

        component_Monitoring_Server__host__Monitoring_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Monitoring\nServer (host)";
            URL = "component_Monitoring_Server__host_.html";
            tooltip = "Monitoring Server (host)";
            margin = 0.02;
        ]

        component_OSSEC_server_Monitoring_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "OSSEC server";
            URL = "component_OSSEC_server.html";
            tooltip = "OSSEC server";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_SecureDrop_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>SecureDrop Area</i>>;
        ]

        component_SecureDrop_server_room_SecureDrop_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SecureDrop\nserver room";
            URL = "component_SecureDrop_server_room.html";
            tooltip = "SecureDrop server room";
            margin = 0.02;
        ]

    }

    component_SecureDrop_Application_Application_Server -> component_Application_Server__host__Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "1. Services on app\nhost";    ]
    component_OSSEC_server_Monitoring_Server -> component_Monitoring_Server__host__Monitoring_Server [        color = black;        fontcolor = black;        dir = forward;        label = "2. Services on mon\nhost";    ]
    component_Application_Server__host__Application_Server -> component_SecureDrop_server_room_SecureDrop_Area [        color = black;        fontcolor = black;        dir = forward;        label = "3. Hosts in server\nroom";    ]
}

Notes

Existing mitigations: All submissions are encrypted with a public key as they are received (MITIG69). Private key is stored on an airgapped device (MITIG10). Nightly reboots to ensure temporary data is wiped (MITIG136). Swap is disabled to prevent memory from being written to disk (MITIG52). Further mitigations: Enable FDE on the server (MITIG134). Support SecureDrop kill switch: for example, have both servers plugged into managed power device to turn off power to server in case of seizure. Admins use Haven or similar to monitor the servers and if adversary activity is detected, they kill the servers remotely (MITIG191). Automated test for mitigation: No.

How this threat is matched

Listed for these components. A boundary covers every component inside it.