Journalist user marks all submissions as seen out of scope

THREAT171 · Out of scope: Outside what this threat model covers. · Defined in catalog.py:2934

Risk: Low impact × Low likelihood = 2 low
After mitigations: Low impact × Low likelihood = 2 low (unchanged)

A malicious journalist can potentially mark all source submissions as seen, which would change the global state in every journalist's source list (JI or SecureDrop Client). There is no limit to the number of submissions a journalist can mark as seen.

Threat actors: Malicious journalist

Mitigations

No mitigations in place.

Possible further mitigations

Switch to a personal inbox model MITIG244 proposed

Where it applies

Applies to 1 component in 2 scenarios.

Journalist Interface Application Server

Journalist triage · Journalist Interface

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Application_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Application Server</i>>;
        ]

        component_Encrypted_submission_store_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Encrypted\nsubmission store";
            URL = "component_Encrypted_submission_store.html";
            tooltip = "Encrypted submission store";
            margin = 0.02;
        ]

        component_Journalist_Interface_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Journalist\nInterface";
            URL = "component_Journalist_Interface.html";
            tooltip = "Journalist Interface";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

        component_Metadata_DB_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Metadata DB";
            URL = "component_Metadata_DB.html";
            tooltip = "Metadata DB";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_SecureDrop_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>SecureDrop Area</i>>;
        ]

        component_Dedicated_Hardware_Firewall_SecureDrop_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Dedicated\nHardware\nFirewall";
            URL = "component_Dedicated_Hardware_Firewall.html";
            tooltip = "Dedicated Hardware Firewall";
            margin = 0.02;
        ]

    }

    actor_Journalist_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Journalist";
        URL = "component_Journalist.html";
        tooltip = "Journalist";
        margin = 0.02;
    ]

    actor_Journalist_ -> component_Dedicated_Hardware_Firewall_SecureDrop_Area [        color = black;        fontcolor = black;        dir = forward;        label = "1. Authenticate over\nTor";    ]
    component_Dedicated_Hardware_Firewall_SecureDrop_Area -> component_Journalist_Interface_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "2. Reach Journalist\nInterface";    ]
    component_Journalist_Interface_Application_Server -> component_Metadata_DB_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "3. List sources";    ]
    component_Encrypted_submission_store_Application_Server -> actor_Journalist_ [        color = black;        fontcolor = black;        dir = forward;        label = "4. Download\nencrypted";    ]
}

Workstation: reading submissions · Journalist Interface

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Application_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Application Server</i>>;
        ]

        component_Journalist_Interface_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Journalist\nInterface";
            URL = "component_Journalist_Interface.html";
            tooltip = "Journalist Interface";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

    }

    subgraph cluster_boundary_SecureDrop_Workstation {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>SecureDrop Workstation</i>>;
        ]

        subgraph cluster_boundary_Workstation_VMs {
            graph [
                fontsize = 10;
                fontcolor = black;
                style = dashed;
                color = firebrick2;
                label = <<i>Workstation VMs</i>>;
            ]

            component_sd_app__SecureDrop_Client__Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-app\n(SecureDrop\nClient)";
                URL = "component_sd_app__SecureDrop_Client_.html";
                tooltip = "sd-app (SecureDrop Client)";
                margin = 0.02;
            ]

            component_sd_gpg_Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-gpg";
                URL = "component_sd_gpg.html";
                tooltip = "sd-gpg";
                margin = 0.02;
            ]

            component_sd_log_Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-log";
                URL = "component_sd_log.html";
                tooltip = "sd-log";
                margin = 0.02;
            ]

            component_sd_proxy_Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-proxy";
                URL = "component_sd_proxy.html";
                tooltip = "sd-proxy";
                margin = 0.02;
            ]

            component_sd_viewer__disposable_VMs__Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-viewer\n(disposable VMs)";
                URL = "component_sd_viewer__disposable_VMs_.html";
                tooltip = "sd-viewer (disposable VMs)";
                margin = 0.02;
            ]

            component_sys_firewall_Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sys-firewall";
                URL = "component_sys_firewall.html";
                tooltip = "sys-firewall";
                margin = 0.02;
            ]

            component_sys_net_Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sys-net";
                URL = "component_sys_net.html";
                tooltip = "sys-net";
                margin = 0.02;
            ]

        }

    }

    actor_Journalist_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Journalist";
        URL = "component_Journalist.html";
        tooltip = "Journalist";
        margin = 0.02;
    ]

    actor_Journalist_ -> component_sd_app__SecureDrop_Client__Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "1. Use the client";    ]
    component_sd_app__SecureDrop_Client__Workstation_VMs -> component_sd_proxy_Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "2. Journalist API\nrequest";    ]
    component_sd_proxy_Workstation_VMs -> component_sys_firewall_Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "3. Route via\nfirewall";    ]
    component_sys_firewall_Workstation_VMs -> component_sys_net_Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "4. Route to network";    ]
    component_sys_net_Workstation_VMs -> component_Journalist_Interface_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "5. Reach the\nJournalist Interface";    ]
    component_Journalist_Interface_Application_Server -> component_sys_net_Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "6. Encrypted\nsubmissions";    ]
    component_sd_proxy_Workstation_VMs -> component_sd_app__SecureDrop_Client__Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "7. Relay to client";    ]
    component_sd_app__SecureDrop_Client__Workstation_VMs -> component_sd_gpg_Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "8. Decrypt";    ]
    component_sd_app__SecureDrop_Client__Workstation_VMs -> component_sd_viewer__disposable_VMs__Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "9. Open a file";    ]
    component_sd_app__SecureDrop_Client__Workstation_VMs -> component_sd_log_Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "10. Send logs";    ]
}

Notes

Existing mitigations: Seen data is recorded on a per-journalist basis. While it is currently aggregated into a global True/False status at the source level, in the event of a bulk operation, the previous state could be restored. Further mitigations: Switch to a personal inbox model to avoid global impact of individual journalist actions (MITIG244). Automated test for mitigation: Yes.

How this threat is matched

Listed for these components. A boundary covers every component inside it.