Failure to sanitize documents partially mitigated Legacy (Tails/SVS)
THREAT87
· Partially mitigated: Some controls are in place, but the risk is still too high.
· Defined in catalog.py:1508
- Risk
- High impact × Medium likelihood = 9 high
- After mitigations
- High impact × Medium likelihood = 9 high (unchanged)
A journalist may not suffciiently redact/sanitize a submission prior to publication, resulting in the identification of the source.
Threat actors: Journalist error
Mitigations
| Mitigation | Status |
|---|---|
| Journalist guide mentions that metadata should be removed from documents MITIG98 | implemented |
Possible further mitigations
- Journalist guide has detailed information about removing metadata and handling the malware threat MITIG88 proposed
- Improve MAT in Tails MITIG99 Legacy (Tails/SVS) proposed
Residual risk
Organizations that do not already have solid procedures in place for handling source documents may not have sufficient information to properly handle source materials. Existing tooling is generally difficult to use and has poor UX.
Where it applies
Applies to 1 component in 1 scenario.
- Journalist Workstation (device) Legacy (Tails/SVS)
Workstation lifecycle and backups Legacy (Tails/SVS) · Journalist Workstation (device)
Notes
Existing mitigations: Journalist guide instructs users to adequately sanitize submissions (MITIG98). Further mitigations: News organisations should be surveyed to produce a comprehensive document sanitization guide (MITIG88). Future Qubes workstation should contain sanitization tools. Improve the Metadata Anonymization Toolkit currently in Tails (MITIG99). Integrate other tools into Tails as needed. Automated test for mitigation: No.
How this threat is matched
Listed for these components. A boundary covers every component inside it.