”
Skip to content
Burger
Cross



Whistleblower Anonymity: A Structured Guide Based on Webinar Materials

How can whistleblower protect their anonymity?

Introduction

Anonymity is a key safeguard for a whistleblower’s safety. It protects not only against persecution but also against psychological pressure. The webinar emphasized that the goal is not to provide a “perfect formula,” but to raise the cost of exposing the whistleblower’s identity, making the identification process as difficult and expensive as possible.

It is important to understand that absolute anonymity does not exist. The whistleblower’s task is to choose a level of protection that corresponds to the resources and capabilities of the potential “adversary” (a small company, an international corporation, or government agencies).


Types of Evidence

Physical Evidence

Any actions in the physical world leave traces: surveillance cameras, witnesses, or handing a device over to another person.

  • Make sure no one is watching while you're composing or sending the message.

  • Do not share this information, even with people close to you.

  • Avoid filling out forms or writing messages as a group.

  • Do not let anyone else use your device.

  • Use independent intermediaries (such as specialized hotlines).

  • In addition, you should be mindful of your location: crowded areas provide better “camouflage” and anonymity than empty or monitored spaces. You should also be aware of video surveillance when entering the premises where the report is being made.

Technological Traces

The greatest risks lie in technology. Every communication channel has its own vulnerabilities.

Phone:

  • You can determine a location using cell towers.

  • The voice recording is used for identification purposes.

  • The subscriber's number is always transmitted.

Recommendations:

  • Use a separate device and SIM card.

  • Call from crowded places.

  • Dispose of the device after use.

  • Do not connect to corporate networks.

  • Keep the phone without the battery and insert it only when making a single call. 

  • Avoid long conversations—the shorter the message, the less likely you are to leave additional clues.

Email:

  • Vulnerability via IP address.

  • File metadata can reveal a person's identity.

  • The content of messages is stored on the servers.

Recommendations:

  • Use encrypted email (ProtonMail, Tutanota).

  • Use PGP or other encryption methods.

  • Use disposable email addresses.

  • Please access this site only via VPN or Tor.

  • Avoid set phrases and personal stylistic “traces”. Using a translator can help you change your language patterns.

  • The attached files did not contain any hidden GPS coordinates or other metadata.

Web forms and browsers:

  • Browser fingerprinting.

  • Text Entry Patterns.

  • Cookies and browsing history.

Recommendations:

  • Use browsers that minimize fingerprinting (Brave, Tor).

  • Delete cookies, cache, and browsing history.

  • Use virtual machines or Tails OS.

  • When using a browser, you should test your own digital fingerprint (using specialized services such as https://coveryourtracks.eff.org/) and make sure it is not unique. Use extensions such as NoScript, Canvas Defender, and Ghostery.

Messaging Apps:

  • The level of security varies greatly.

  • Signal and Kryptos offer a high level of anonymity.

  • Telegram is less secure due to metadata.

  • Use messaging apps that do not require a phone number or email address for registration. Choose those that automatically delete metadata.

Behavioral Cues

Even without technology, a whistleblower can be identified by their behavior.

  • Unexpected changes in habits.

  • Increased interest in a topic related to the disclosure.

  • Emotional reactions to news.

Recommendations:

  • Maintain your usual behavior.

  • Do not show excessive interest in “your” topic.

  • Control your emotions.


Sudden deviations from your established routines are particularly dangerous: for example, taking new routes, going on vacation at an “unusual” time, or suddenly using new technology. Plan your actions so that they fit naturally into your daily life.

 

Key Tools

  • VPN, Tor, DuckDuckGo as a search engine.

  • Virtual machines (VirtualBox, VMware).

  • Operating systems for anonymity (Tails, Qubes OS).

  • Encryption (VeraCrypt, AESCrypt).

  • “Disposable” devices and storage media: cheap push-button cell phones, USB flash drives designed for a single file download, and laptops with an operating system that runs solely in RAM.

 

Psychological Aspects

Anonymity isn’t just about technology.

  • A whistleblower must be prepared to stand up for their principles.

  • It’s important to realize that no technical measures are 100 percent effective.

Before making a disclosure, it’s worth “trying on” the role of an investigator: how would others go about finding you, and what clues might they use? This approach allows you to minimize risks in advance.

 

Conclusion

Protecting anonymity involves a combination of technological, behavioral, and psychological measures. A whistleblower must act cautiously and be aware of the level of risk and responsibility involved. The most effective approach is to use independent channels and third parties that operate on a “zero-knowledge” principle.

The best strategy is to combine several methods: an anonymous messaging app, VPN + Tor, disposable devices, and monitoring of behavioral patterns. This creates “multi-layered protection”, which makes it significantly more difficult to identify the whistleblower.
Categories