Journalist workstation Tails Key seized partially mitigated Legacy (Tails/SVS)

THREAT151 · Partially mitigated: Some controls are in place, but the risk is still too high. · Defined in catalog.py:2597

Risk: Medium impact × Low likelihood = 4 medium
After mitigations: Medium impact × Low likelihood = 4 medium (unchanged)

How statuses and scores work

An adversary seizes the Journalist's Tails USB stick

Threat actors: Nation State / Law Enforcement

Mitigations

Mitigation	Status
Persistent storage FDE for Journalist Workstation MITIG13	implemented

Possible further mitigations

Admin guide explains incident response when passphrase to online journalist workstation is compromised MITIG147 Legacy (Tails/SVS) proposed

Residual risk

Candidate for further mitigation efforts.

Where it applies

Applies to 1 component in 1 scenario.

Journalist Workstation (device) Legacy (Tails/SVS) Journalist Workstation (Tails)

Workstation lifecycle and backups Legacy (Tails/SVS) · Journalist Workstation (device)

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Admin_Workstation__Tails_ {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Admin Workstation (Tails)</i>>;
        ]

        component_Admin_Workstation__device__Admin_Workstation__Tails_ [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Admin\nWorkstation\n(device)";
            URL = "component_Admin_Workstation__device_.html";
            tooltip = "Admin Workstation (device) (Legacy (Tails/SVS))";
            margin = 0.02;
            style = "dashed";
            class = "tagged";
        ]

    }

    subgraph cluster_boundary_Journalist_Workstation__Tails_ {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Journalist Workstation (Tails)</i>>;
        ]

        component_Journalist_Workstation__device__Journalist_Workstation__Tails_ [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Journalist\nWorkstation\n(device)";
            URL = "component_Journalist_Workstation__device_.html";
            tooltip = "Journalist Workstation (device) (Legacy (Tails/SVS))";
            margin = 0.02;

            style = "filled,dashed";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "tagged highlighted";
        ]

    }

    actor_Administrator_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Administrator";
        URL = "component_Administrator.html";
        tooltip = "Administrator";
        margin = 0.02;
    ]

    component_Backup___recovery_media_ [
        shape = circle;
        color = black;
        fontcolor = black;
        label = "Backup /\nrecovery media";
        URL = "component_Backup___recovery_media.html";
        tooltip = "Backup / recovery media";
        margin = 0.02;
    ]

    actor_Journalist_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Journalist";
        URL = "component_Journalist.html";
        tooltip = "Journalist";
        margin = 0.02;
    ]

    actor_Administrator_ -> component_Admin_Workstation__device__Admin_Workstation__Tails_ [        color = black;        fontcolor = black;        dir = forward;        label = "1. Admin operates\nworkstation";    ]
    actor_Journalist_ -> component_Journalist_Workstation__device__Journalist_Workstation__Tails_ [        color = black;        fontcolor = black;        dir = forward;        label = "2. Journalist\noperates workstation";    ]
    component_Admin_Workstation__device__Admin_Workstation__Tails_ -> component_Backup___recovery_media_ [        color = black;        fontcolor = black;        dir = forward;        label = "3. Back up secrets";    ]
}

Notes

Existing mitigations: Full disk encryption of persistence volume (MITIG13). Further mitigations: Inform users to immediately change Journalist credentials should there be any doubt that the Journalist persistent volume was lost or seized (MITIG147). Automated test for mitigation: No.

How this threat is matched

Listed for these components. A boundary covers every component inside it.