Airgapped SVS Tails key tampered accepted Legacy (Tails/SVS)

THREAT153 · Accepted: The team has decided to live with this risk. · Defined in catalog.py:2633

Risk: Medium impact × Low likelihood = 4 medium
After mitigations: Medium impact × Low likelihood = 4 medium (unchanged)

An adversary tampers the SVS Tails USB stick and inserts malware

Threat actors: Nation State / Law Enforcement

Mitigations

Mitigation	Status
Persistent storage FDE for SVS MITIG14	implemented

Possible further mitigations

Admin guide explains incident response when submission key moved out of airgap or compromised MITIG151 Legacy (Tails/SVS) proposed
Tamper-evident stickers/bags MITIG116 Legacy (Tails/SVS) proposed
Admin guide should speak clearly to physical security considerations MITIG115 proposed

Residual risk

Candidate for further mitigation efforts. Evil maid attack still possible.

Where it applies

Applies to 1 component in 2 scenarios.

Secure Viewing Station Legacy (Tails/SVS) Airgapped Viewing Area

Transfer & decrypt Legacy (Tails/SVS) · Secure Viewing Station

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Airgapped_Viewing_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Airgapped Viewing Area</i>>;
        ]

        component_Secure_Viewing_Station_Airgapped_Viewing_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Secure Viewing\nStation";
            URL = "component_Secure_Viewing_Station.html";
            tooltip = "Secure Viewing Station (Legacy (Tails/SVS))";
            margin = 0.02;

            style = "filled,dashed";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "tagged highlighted";
        ]

    }

    actor_Journalist_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Journalist";
        URL = "component_Journalist.html";
        tooltip = "Journalist";
        margin = 0.02;
    ]

    component_Transfer_Device_ [
        shape = circle;
        color = black;
        fontcolor = black;
        label = "Transfer Device";
        URL = "component_Transfer_Device.html";
        tooltip = "Transfer Device (Legacy (Tails/SVS))";
        margin = 0.02;
        style = "dashed";
        class = "tagged";
    ]

    actor_Journalist_ -> component_Transfer_Device_ [        color = black;        fontcolor = black;        dir = forward;        label = "1. Copy to transfer\ndevice";    ]
    component_Transfer_Device_ -> component_Secure_Viewing_Station_Airgapped_Viewing_Area [        color = black;        fontcolor = black;        dir = forward;        label = "2. Carry to air-gap";    ]
    component_Secure_Viewing_Station_Airgapped_Viewing_Area -> component_Secure_Viewing_Station_Airgapped_Viewing_Area [        color = black;        fontcolor = black;        dir = forward;        label = "3. Decrypt offline";    ]
    component_Secure_Viewing_Station_Airgapped_Viewing_Area -> component_Secure_Viewing_Station_Airgapped_Viewing_Area [        color = black;        fontcolor = black;        dir = forward;        label = "4. Sanitize";    ]
}

Publish & export Legacy (Tails/SVS) · Secure Viewing Station

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Airgapped_Viewing_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Airgapped Viewing Area</i>>;
        ]

        component_Offline_Printer_Airgapped_Viewing_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Offline Printer";
            URL = "component_Offline_Printer.html";
            tooltip = "Offline Printer (Legacy (Tails/SVS))";
            margin = 0.02;
            style = "dashed";
            class = "tagged";
        ]

        component_Secure_Viewing_Station_Airgapped_Viewing_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Secure Viewing\nStation";
            URL = "component_Secure_Viewing_Station.html";
            tooltip = "Secure Viewing Station (Legacy (Tails/SVS))";
            margin = 0.02;

            style = "filled,dashed";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "tagged highlighted";
        ]

    }

    subgraph cluster_boundary_Publishing_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Publishing Area</i>>;
        ]

        component_Sanitized_submission_Publishing_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Sanitized\nsubmission";
            URL = "component_Sanitized_submission.html";
            tooltip = "Sanitized submission";
            margin = 0.02;
        ]

    }

    component_Export_Device_ [
        shape = circle;
        color = black;
        fontcolor = black;
        label = "Export Device";
        URL = "component_Export_Device.html";
        tooltip = "Export Device";
        margin = 0.02;
    ]

    component_Secure_Viewing_Station_Airgapped_Viewing_Area -> component_Export_Device_ [        color = black;        fontcolor = black;        dir = forward;        label = "1. Export sanitized";    ]
    component_Export_Device_ -> component_Sanitized_submission_Publishing_Area [        color = black;        fontcolor = black;        dir = forward;        label = "2. To publishing\narea";    ]
    component_Secure_Viewing_Station_Airgapped_Viewing_Area -> component_Offline_Printer_Airgapped_Viewing_Area [        color = black;        fontcolor = black;        dir = forward;        label = "3. Print";    ]
}

Notes

Existing mitigations: Full disk encryption of persistence volume (MITIG14). Further mitigations: Inform users to immediately discard existing key and change submission key should there be any doubt the SVS Persistent volume passphrase was lost or seized (MITIG151). Tamper-evident storage of SVS key (MITIG116, MITIG115). Automated test for mitigation: No.

How this threat is matched

Listed for these components. A boundary covers every component inside it.