How to Verify Documents Received Over Tor

Receiving sensitive files through anonymous networks like Tor or SecureDrop protects whistleblowers, but it presents a unique verification challenge because the sender’s identity cannot be directly confirmed. Authenticating these leaks requires a rigorous combination of digital forensics, content analysis, cryptographic checks, and traditional investigative reporting. By following a structured verification process, journalists can ensure that the documents they receive are genuine, unaltered, and safe to report on.

1. Maintain Digital Safety and Isolation

Before inspecting the files, isolate them to prevent potential malware infections or tracking beacons that could compromise your system or reveal your identity: * Transfer the files to an air-gapped computer (a device physically disconnected from the internet and local networks). * Scan files for embedded malware, tracking pixels, or hidden macros using tools like Dangerzone or specialized sandboxes. * Convert complex files (such as .docx or .pdf) into safe, flat formats (like images or plain text) before broader analysis.

2. Perform Digital Metadata Analysis

Metadata reveals critical information about how and when a document was created: * Use command-line tools like exiftool to inspect file properties, including creation dates, modification timestamps, author usernames, printer serial numbers, and the software versions used to generate the file. * Cross-check metadata against known timelines. Anachronisms—such as software versions that did not exist on the alleged creation date—are immediate red flags. * Recognize that metadata can be deliberately spoofed, so it should be used to rule out fakes rather than serve as sole proof of authenticity.

3. Check for Cryptographic Signatures and Hashes

Digital signatures provide strong mathematical proof of authenticity: * Check if the document or email is digitally signed with an established PGP key, S/MIME certificate, or internal organization cryptographic signature. * Verify any attached checksums (SHA-256 or MD5) against known, publicly available file hashes from the originating organization. * Inspect headers in leaked email files (.eml or .msg) for valid DKIM (DomainKeys Identified Mail) signatures, which prove the email originated from the stated server and was not altered in transit.

4. Scrutinize Internal Content and Formatting

Authentic internal documents usually follow specific bureaucratic or institutional conventions: * Compare formatting, fonts, headers, footers, classified markings, and logos with confirmed authentic documents from the same organization. * Verify internal organizational details such as employee IDs, department codes, internal email routing addresses, project codenames, and office locations. * Look for anachronistic language, unusual jargon, or stylistic inconsistencies that deviate from the organization’s standard practices.

5. Corroborate Facts Through Independent Reporting

Technical analysis must be supported by classic investigative methods: * Fact-check verifiable events, dates, flight logs, weather reports, financial figures, or calendar entries mentioned within the text. * Contact independent sources within or adjacent to the organization to confirm that the described events, meetings, or decisions actually occurred. * Approach the originating organization or the individuals named in the document for comment prior to publication, presenting specific excerpts to gauge their response or confirm receipt of the original communications.