Journalist gets phished inform

THREAT56 · Inform: Handled by telling users how to protect themselves. · Defined in catalog.py:989

Risk: Medium impact × Medium likelihood = 6 medium
After mitigations: Low impact × Medium likelihood = 3 low

An adversary performs a (spear)phishing attack on a journalist to gather information about SecureDrop submissions.

Threat actors: Any

Mitigations

Mitigation	Status
Journalist guide contains some limited information about OPSEC with respect to source materials MITIG226	implemented

Possible further mitigations

Detailed OPSEC guide for journalists comms with respect to comms about source material within the news org MITIG225 proposed

Residual risk

Journalist error or omission

Where it applies

Applies to 1 component in 1 scenario.

Journalist Corporate Workstation News Organization

Corporate and legal zone · Journalist Corporate Workstation

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_External_Services {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>External Services</i>>;
        ]

        component_SMTP_relay_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SMTP relay";
            URL = "component_SMTP_relay.html";
            tooltip = "SMTP relay";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_News_Organization {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>News Organization</i>>;
        ]

        component_Journalist_Corporate_Workstation_News_Organization [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Journalist\nCorporate\nWorkstation";
            URL = "component_Journalist_Corporate_Workstation.html";
            tooltip = "Journalist Corporate Workstation";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

        component_News_Organization___Legal_News_Organization [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "News\nOrganization /\nLegal";
            URL = "component_News_Organization___Legal.html";
            tooltip = "News Organization / Legal";
            margin = 0.02;
        ]

    }

    actor_Journalist_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Journalist";
        URL = "component_Journalist.html";
        tooltip = "Journalist";
        margin = 0.02;
    ]

    actor_Journalist_ -> component_Journalist_Corporate_Workstation_News_Organization [        color = black;        fontcolor = black;        dir = forward;        label = "1. Journalist uses\ncorporate device";    ]
    component_SMTP_relay_External_Services -> component_Journalist_Corporate_Workstation_News_Organization [        color = black;        fontcolor = black;        dir = forward;        label = "2. Alerts to\ncorporate mail";    ]
    component_Journalist_Corporate_Workstation_News_Organization -> component_News_Organization___Legal_News_Organization [        color = black;        fontcolor = black;        dir = forward;        label = "3. Organizational /\nlegal exposure";    ]
}

Notes

Existing mitigations: Journalist guide contains very limited information about OPSEC considerations within the news organization: https://docs.securedrop.org/en/release-0.13.0/journalist.html#researching-submissions (MITIG226). Further mitigations: Journalists should be instructed to very stricly comparmentalize SecureDrop-related activities and to only discuss when strictly necessary over end-to-end encrypted communications (e.g. Signal with disappearing messages and validated safety numbers) (MITIG225). Automated test for mitigation: No.

How this threat is matched

Listed for these components. A boundary covers every component inside it.