Data Submission

We are always open to accept data by any party. We take no measures to attempt to identify our sources, and do not discuss our source of data even between members of the collective. Where appropriate and with well clarified authorization from the source, we do provide credit for the source of the information if we can be confident this will not harm the objectives of the collective or lead to the identification of people at risk.

Do not contact us about potential or in-progress data breaches, as it puts you at risk and makes it difficult or impossible to determine any potential public interest while also legally preventing us from publishing any resulting leak.

To make contact about a submission:

Contact us anonymously using our GlobaLeaks instance at http://r4t6s3vzob6eidp7wg2c3smjitzusvdx2tsrt4sajwznch3dpcsvgtyd.onion/
Email us at [email protected] using the PGP key at the bottom of this page.

Once contact has been established, communications may be moved to another secure platform, such as Cwtch.

Submission Guidelines

Be honest with yourself and with us about your level of OPSEC - it's the best way we can help. If you don't know, ask. See Tools of the Trade below for more.
Bullshit never helps. If you can't tell the truth about something, don't say anything. Impressive stories are pointless. False trails are harder to pull off and less helpful than you'd think - not to mention easily unethical, depending on the circumstances.
It's better to be safe than clever. Cleverness is unique, like a signature. Silence is ubiquitous. Jokes and references can be as identifying as a name. Persona aliases can be as revealing as true names.
Don't talk about it, even "in private." If you do, assume that whatever you say might leak and know that it could be read in a courtroom.
Don't save logs. If you must save records for legal defense reasons, give your only copies to your lawyer for that explicit purpose. Don't destroy evidence - just don't have evidence to preserve or destroy.
Don't keep a copy of whatever you leaked, or anything else you don't need anymore. Even PGP and other encryption keys can be incriminating.
No, you almost definitely don't need to be able to prove it was you.
Be patient.
Assume your adversaries are smarter than you are.
Seriously, don't save logs.
When in doubt, talk to a lawyer.

Tools of the Trade

Tor Browser - Anonymous web browsing
OnionShare - Anonymous one-off file sharing
Cwtch - A decentralized, anonymous and encrypted chat service
Pidgin & OTR - Live IRC/XMPP chat with Off the Record encryption [EFF Guide]
Tails - An anonymous, non-persistent Operating System
Riseup - A privacy-friendly email and VPN provider
EFF Surveillance Self-Defense Guides - A fantastic collection of guides to resist surveillance

Browsers and Plug-ins

Disconnect - A plug-in to block malicious internet tracking, ads, and other web content
Privacy Badger - A browser extension that automatically learns to block invisible trackers
Tor Browser - Anonymous web browsing
uBlock Origin - A wide-spectrum content blocker with CPU and memory efficiency as a primary feature

Communication

Cwtch - A decentralized, anonymous and encrypted chat service
DKIM Verifier - A Thunderbird plug-in which verifies the DKIM Signature of emails
Pidgin & OTR - Live IRC/XMPP chat with Off the Record encryption [EFF Guide]
Riseup - A privacy-friendly email and VPN provider
Signal - A secure text messaging service, recommended for daily use
Thunderbird - An open-source email client

Encryption and Passwords

KeePass - An open-source, encrypted password manager with ports for many operating systems
OpenPGP - The most widely used email encryption standard
VeraCrypt - Free open source disk encryption software

Guides and Resources

Big Ass Data Broker Opt-Out List - A list of data brokers that may be making your home address and other personal details publicly available
Consumer Reports Security Planner - A guide to tools to improve online safety
EFF Surveillance Self-Defense Guides - A fantastic collection of guides to resist surveillance
The Intercept Surveillance Self-Defense Checklist - Steps journalists, activists, and everyone else can take to improve their security

Handling Data

7zip - A versatile tool for compressing and extracting data for Windows
Dangerzone - Convert potentially dangerous PDFs, office documents, or images to safe PDFs
ImportExportTools NG - A free Thunderbird extension for importing and exporting MBOX and EML emails
Keka - A versatile tool for compressing and extracting data for MacOS
pst-utils - Free linux tools to read and convert Microsoft Outlook PST files
Qubes OS - A reasonably secure operating system
Web Translate - A free Thunderbird extension for translating emails

Torrents

Deluge - A free, versatile, cross-platform torrent client
Seedboxes - Rentable, high-bandwidth servers for uploading and downloading files
Transmission - A free, simple and stable cross-platform torrent client

Tips

Use seedboxes as sandboxes

Seedboxes not only offer a way to more quickly and discretely download data, some also offer remote desktop access (or SSH access and the opportunity to install your own remote desktop client). This allows users to access the data directly on the seedbox, without having to open it on a local machine, both cutting down on the time required to access it, and reducing the risk.

SecureDrop

In late 2020, the Institute of Quantitative Social Science at Harvard University appointed DDoSecrets member Milo Trujillo as a graduate student affiliate. The IQSS operate the first SecureDrop at a United States academic institution. We can now recommend their secure dropbox to our sources. DDoSecrets researchers are collaborating with IQSS social scientists to create public good using available data.

Request Access

Some of our data sets must first be requested before we can provide access. To request access, email [email protected] or open a ticket and:

Explain why access to the material is needed and what you intend to do with it.
Include enough information to verify your credentials or purpose.
If you intend to reproduce any data, explain how it will be reproduced and who it will be shared with.

Our replies to Hotmail, Outlook, MSN and other Microsoft-based email addresses often bounce. Using other email services is recommended.

Your request will probably be rejected if:

You don't provide a way to verify your request or identity. Official email addresses are best.
You're just curious.
You're a hacktivist that wants to exploit the data.
You're a researcher without a clear journalist or academic project.
You offer only generic information.
You email the wrong address or multiple addresses.

Due to limited time, we are unable to respond to rejected requests.

Contact Methods

Email

Direct addresses can be found for some members on the Team page.

Instructions to request access to data can be found above.

Replies to Hotmail, Outlook, MSN and other Microsoft-based email addresses often bounce. Please don't use Hotmail or Outlook email addresses to contact us as we will not be able to respond.

For general contact and inquiries (PGP key below):

[email protected]

For press matters:

[email protected]

For sources making contact (PGP key below):

[email protected]

If you need to contact us via an alternative method, it is recommended that you use a temporary email address to get in touch with us and setup alternative channels.

PGP Keys

If you want to encrypt your communications to [email protected], you can use the following PGP key.

If you want to encrypt your communications to [email protected], you can use the following PGP key.