Question:

How can I securely and anonymously report unethical practices in my company?

I am a whistleblower who wants to expose some serious misconduct by my division manager to the senior management of my company. I have collected some evidence in the form of files that I want to send via email to the personal accounts of the compliance officer and other executives. However, I am afraid of being traced, identified, and retaliated against by my manager, who has a lot of resources and influence. My location could also reveal my identity, as our team is small and based in a specific city.

What are the best steps to take to protect my anonymity and safety while sending the email? What tools or services should I use to hide my IP address, encrypt my email, and avoid any logs or traces? How can I ensure that the recipients will trust and act on my email?

Please note that this is a hypothetical scenario and I am not actually in this situation.

Thank you for your advice.

Answer:

Whistleblowing is a courageous and noble act that can expose corruption, fraud, abuse, or other illegal or unethical activities in an organization. However, whistleblowers often face serious risks of retaliation, harassment, discrimination, or even physical harm from the perpetrators or their allies. Therefore, it is crucial for whistleblowers to protect their identity and safety while reporting their concerns to the appropriate authorities.

In this article, we will discuss some of the best practices and tools for whistleblowers who want to send an email with evidence to the senior management of their company, without being traced or identified by their division manager or anyone else. We will assume that the whistleblower has already obtained the personal email addresses of the compliance officer and other executives, and that they have some files that contain the proof of the misconduct. We will also assume that this is a hypothetical scenario and not a real situation.

Step 1: Use a secure and anonymous email service

The first step is to choose a reliable and trustworthy email service that offers strong encryption, privacy, and anonymity features. Some of the popular options are:

–

ProtonMail: ProtonMail is a Swiss-based email service that uses end-to-end encryption, meaning that only the sender and the recipient can read the email content and attachments. ProtonMail does not log any user data or metadata, and does not require any personal information to create an account. ProtonMail also has a feature called self-destructing emails

, which allows the sender to set a timer for the email to be automatically deleted after a certain period of time. ProtonMail is free for basic users, and has paid plans for more features and storage.

–

Tutanota: Tutanota is a German-based email service that also uses end-to-end encryption, and does not store any user data or metadata. Tutanota also does not require any personal information to create an account, and has a feature called confidential mode

, which allows the sender to set a password for the email that the recipient has to enter to access it. Tutanota is free for basic users, and has paid plans for more features and storage.

–

Mailfence: Mailfence is a Belgian-based email service that also uses end-to-end encryption, and does not store any user data or metadata. Mailfence also does not require any personal information to create an account, and has a feature called digital signatures

, which allows the sender to verify their identity and the integrity of the email using a cryptographic key. Mailfence is free for basic users, and has paid plans for more features and storage.

These are just some of the examples of secure and anonymous email services that whistleblowers can use. There are many other alternatives available, but the whistleblower should do their own research and comparison before choosing one. The whistleblower should also create a new and unique email address that does not reveal any personal information, such as their name, location, or company.

Step 2: Use a VPN or Tor to hide your IP address

The second step is to use a VPN (Virtual Private Network) or Tor (The Onion Router) to hide your IP address, which is a unique identifier that can reveal your location and internet service provider. A VPN or Tor can mask your IP address by routing your internet traffic through a series of encrypted servers in different locations, making it harder for anyone to trace or monitor your online activity.

A VPN or Tor can also help you bypass any firewalls, censorship, or surveillance that your company or government may have in place. However, not all VPNs or Tor nodes are equally secure or trustworthy, so the whistleblower should do their own research and comparison before choosing one. The whistleblower should also avoid using any public or shared Wi-Fi networks, as they may be compromised or monitored by hackers or authorities.

Step 3: Encrypt your email and attachments

The third step is to encrypt your email and attachments, which means converting them into a code that only the intended recipient can decipher. Encryption can prevent anyone from intercepting, reading, or modifying your email and attachments, even if they manage to access them.

There are different methods and tools for encrypting your email and attachments, depending on the email service you use and the level of security you need. Some of the common options are:

–

PGP (Pretty Good Privacy)

: PGP is a widely used encryption standard that uses a pair of keys, one public and one private, to encrypt and decrypt messages and files. The sender and the recipient have to exchange their public keys, which are used to encrypt and verify the messages and files. The sender and the recipient also have to keep their private keys, which are used to decrypt and sign the messages and files. PGP can be used with any email service, but it requires some technical knowledge and software installation to set up and use.

–

S/MIME (Secure/Multipurpose Internet Mail Extensions)

: S/MIME is another encryption standard that uses a pair of keys, one public and one private, to encrypt and decrypt messages and files. The sender and the recipient have to obtain and exchange their digital certificates, which contain their public keys and some personal information, from a trusted authority. The sender and the recipient also have to keep their private keys, which are used to decrypt and sign the messages and files. S/MIME can be used with some email services, such as Outlook, Gmail, or Apple Mail, but it also requires some technical knowledge and software installation to set up and use.

–

Built-in encryption

: Some email services, such as ProtonMail, Tutanota, or Mailfence, have built-in encryption features that automatically encrypt and decrypt the messages and files between the users of the same service. The sender and the recipient do not have to exchange any keys or certificates, as the email service handles the encryption and decryption process. However, this option only works if both the sender and the recipient use the same email service, and it may not be compatible with other encryption methods or tools.

These are just some of the examples of encryption methods and tools that whistleblowers can use. There are many other alternatives available, but the whistleblower should do their own research and comparison before choosing one. The whistleblower should also use strong and unique passwords or passphrases for their encryption keys or certificates, and store them in a secure and offline location.

Step 4: Avoid any logs or traces

The fourth step is to avoid any logs or traces that could link the whistleblower to the email or the evidence. Logs or traces are records of the online activity or communication that could reveal the identity, location, or behavior of the whistleblower. Some of the common sources of logs or traces are:

–

Browser history and cookies

: Browser history and cookies are files that store the information about the websites that the whistleblower visits and the actions that they take on them. Browser history and cookies can reveal the email service that the whistleblower uses, the time and date of the email, and the content of the email and attachments. The whistleblower should clear their browser history and cookies after sending the email, or use a private or incognito mode that does not store them.

–

Email headers and metadata

: Email headers and metadata are information that are attached to the email and the files that contain the details about the sender, the recipient, the subject, the date, the size, and the format of the email and the files. Email headers and metadata can reveal the email address, the IP address, the encryption method, and the file name of the whistleblower. The whistleblower should use an email service that does not store or transmit any email headers or metadata, or use a tool that can remove or modify them.

–

File properties and metadata

: File properties and metadata are information that are embedded in the files that contain the details about the author, the creation date, the modification date, the file name, and the file format of the files. File properties and metadata can reveal the name, the location, the device, and the software of the whistleblower. The whistleblower should use a tool that can remove or modify the file properties and metadata, or use a file format that does not support them, such as PDF or JPG.

These are just some of the examples of logs or traces that whistleblowers should avoid. There are many other sources of logs or traces that could expose the whistleblower, such as email drafts, deleted files, cloud storage, or social media. The whistleblower should be careful and vigilant about their online activity and communication, and use a tool that can erase or overwrite any logs or traces, such as BleachBit or CCleaner.

Step 5: Ensure the trust and action of the recipients

The fifth and final step is to ensure that the recipients of the email will trust and act on the email and the evidence. The recipients may be skeptical or cautious about the email and the evidence, as they may not know the identity or the credibility of the whistleblower, or they may fear the consequences of opening or acting on the email and the evidence. Therefore, the whistleblower should take some measures to persuade and motivate the recipients to trust and act on the email and the evidence. Some of the possible measures are:

–

Use a convincing subject line

: The subject line is the first thing that the recipients will see when they receive the email, and it can influence their decision to open or ignore the email. The subject line should be clear, concise, and catchy, and it should convey the urgency and importance of the email and the evidence. For example, the subject line could be: “URGENT: Evidence of serious misconduct by division manager – please read and act”.

–

Use a professional and polite tone

: The tone of the email is the way that the