Transfer device seized/stolen/lost inform Legacy (Tails/SVS)

THREAT81 · Inform: Handled by telling users how to protect themselves. · Defined in catalog.py:1428

Risk: Medium impact × Low likelihood = 4 medium
After mitigations: Medium impact × Low likelihood = 4 medium (unchanged)

An adversary or law enforcement gains possession of the transfer device

Threat actors: Any

Mitigations

Mitigation	Status
Persistent FDE Storage of Transfer Device MITIG57 Legacy (Tails/SVS)	implemented

Possible further mitigations

Transfer devices should be regularly sanitized - e.g. after each use. MITIG154 Legacy (Tails/SVS) proposed

Residual risk

Administrator or journalist error (e.g. weak passphrase, no encryption), admin/journalist keeps passphrase on physical documents

Where it applies

Applies to 1 component in 1 scenario.

Transfer Device Legacy (Tails/SVS)

Transfer & decrypt Legacy (Tails/SVS) · Transfer Device

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Airgapped_Viewing_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Airgapped Viewing Area</i>>;
        ]

        component_Secure_Viewing_Station_Airgapped_Viewing_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Secure Viewing\nStation";
            URL = "component_Secure_Viewing_Station.html";
            tooltip = "Secure Viewing Station (Legacy (Tails/SVS))";
            margin = 0.02;
            style = "dashed";
            class = "tagged";
        ]

    }

    actor_Journalist_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Journalist";
        URL = "component_Journalist.html";
        tooltip = "Journalist";
        margin = 0.02;
    ]

    component_Transfer_Device_ [
        shape = circle;
        color = black;
        fontcolor = black;
        label = "Transfer Device";
        URL = "component_Transfer_Device.html";
        tooltip = "Transfer Device (Legacy (Tails/SVS))";
        margin = 0.02;

        style = "filled,dashed";

        fillcolor = "#c0392b";

        fontcolor = "white";

        class = "tagged highlighted";
    ]

    actor_Journalist_ -> component_Transfer_Device_ [        color = black;        fontcolor = black;        dir = forward;        label = "1. Copy to transfer\ndevice";    ]
    component_Transfer_Device_ -> component_Secure_Viewing_Station_Airgapped_Viewing_Area [        color = black;        fontcolor = black;        dir = forward;        label = "2. Carry to air-gap";    ]
    component_Secure_Viewing_Station_Airgapped_Viewing_Area -> component_Secure_Viewing_Station_Airgapped_Viewing_Area [        color = black;        fontcolor = black;        dir = forward;        label = "3. Decrypt offline";    ]
    component_Secure_Viewing_Station_Airgapped_Viewing_Area -> component_Secure_Viewing_Station_Airgapped_Viewing_Area [        color = black;        fontcolor = black;        dir = forward;        label = "4. Sanitize";    ]
}

Notes

Existing mitigations: Admin guide states that device be encrypted using LUKS (MITIG57). Further mitigations: Provide further documentation to Journalists/admins to wipe/destroy transfer devices after each use (MITIG154). Automated test for mitigation: No.

How this threat is matched

Listed for these components. A boundary covers every component inside it.