# CONFIDENTIAL NEWS TIPS

Bloomberg Industry Group accepts confidential news tips that may lead to stories in the areas we cover, including government, regulatory, legal and business news. If you have information you wish to share with our reporters, here are several methods for doing so with as much anonymity as possible. Please note that routine press releases or requests for coverage should not be sent to these contacts.

# Postal Mail

The easiest way to do so is by postal mail. For additional anonymity you may wish to omit your return address and use a public mailbox. You can mail letters and documents to us at:

# Signal

You may also contact us using the Signal app available for Apple iOS and Android devices. This app allows encrypted communications for documents, text and voice. Instructions for downloading and using the app can be found at https://whispersystems.org/. BBNA’s contact number is 571-329-4495.

# Secure Drop

# What is SecureDrop?

SecureDrop is a secure communication platform designed to protect anonymity. As a possible source of news and information, you can use our SecureDrop installation to submit documents and materials to our organization. We control the SecureDrop server, which stores in an encrypted format, the information and materials that you send to us.

# What should I know before submitting material through SecureDrop?

To protect your anonymity when using SecureDrop, it is essential that you do not use a network or device that can easily be traced back to your real identity, such as a home or office wifi network. Instead, use public wifi networks as well as devices that you control.

Do NOT access SecureDrop on your employer’s network.

Do NOT access SecureDrop using your employer’s hardware.

Do NOT access SecureDrop on your home network.

Do access SecureDrop on a network not associated with you, like the wifi at a library or cafe.

# Got it. How can I submit files and messages through SecureDrop?

Once you are connected to a public network at a cafe or library, download and install the Tor Browser bundle at https://www.torproject.org/projects/torbrowser.

Launch the Tor Browser. Visit our organization’s unique SecureDrop URL at 7mtafjzwv5ups4w3.onion. Follow the instructions you find on our source page to send us materials and messages.

When you make your first submission, you will receive a unique codename. Memorize it. If you write it down, be sure to destroy the copy as soon as you’ve committed it to memory. Use your codename to sign back in to our source page, check for responses from our journalists, and upload additional materials.

# As a source, what else should I know?

No tool can absolutely guarantee your security or anonymity. There are some best practices, however, that are intended to protect your privacy and anonymity as a source:

• You can use a separate computer you've designated specifically to handle the submission process. Or, for additional security, you can use an alternate operating system like Tails, which boots from a USB stick and erases your activity at the end of every session.
• A file contains valuable metadata about its source — when it was created and downloaded, what machine was involved, the machine’s owner, etc. You can scrub metadata from some files prior to submission using the Metadata Anonymization Toolkit featured in Tails.
• We do not ask or require you to provide any personally identifying information when you submit documents and materials through SecureDrop. However, please be mindful of the fact that the actual messages you send and receive through SecureDrop may include personally identifying information included by you or our organization. We will decrypt and read each message offline. We also will delete your messages and materials sent through SecureDrop from our server on a regular basis (the date and time of any message will be securely deleted from the server as well when the message is deleted). Once you read any responding message for us, we recommend that you delete it, at it will then be securely deleted from the file system.
• Your online behavior can be extremely revealing. Regularly monitoring our publication’s social media or website can potentially flag you as a source. Take great care to think about what your online behavior might reveal, and consider using Tor Browser for such monitoring.
• Our organization retains strict control over our SecureDrop project. A select few journalists within our organization will have access to SecureDrop submissions. We control the servers that store your submissions, so no third party has direct access to the metadata or content of what you send us.
• Do not discuss leaking or whistleblowing, even with trusted contacts.

Ultimately, however, you access and use SecureDrop at your own risk.