By industry · Journalists and newsrooms

OBSCURA for journalists and newsrooms

A source is more often given away by the file than by the story: the coordinates in a photograph, the corner of a screenshot, the dots a printer added, the voice on a recording. These tools find and remove those things on the reporter’s own machine, so the material is never handed to another service to be cleaned.

The applications for an investigation

The single tools further down each do one job on one file. These four are applications, for the material a story is built from over weeks. Each is paid for, on its own or with the rest of Pro, and each keeps its work in the browser on the reporter’s own computer.

OBSCURA Case

For a trove: a mailbox as Outlook PST, MBOX or EML files, or a folder of documents, loaded on the laptop, deduplicated, threaded and searched with Boolean and proximity terms, and coded as you read. Scans are read by OCR on the machine. A people map shows who wrote to whom from the email headers, and a chronology is suggested from when messages were sent and the dates written in the documents, each event pinned to the document it rests on.

It does not say whether a document is genuine. Its hashes show that the set has not changed since it was loaded, not where it came from, and the people map knows who an email was addressed to, not who read it.

OBSCURA Sound

For an interview: cut on the laptop the recording is on, with noise reduction from a profile of the room’s own noise, a high-pass for hum, and loudness measured to EBU R128 and set for broadcast or a podcast. Markers set while you listen become chapters, with a list of their times for the notes.

It edits audio; it does not disguise a voice. For that, read what VOICEGUARD and HUSH can and cannot do.

OBSCURA PDF Studio

A scanned document made searchable in any of nineteen languages, a leaked draft compared word by word with the published version, and names, numbers or your own list of words taken out of the file, not covered, before an image of a page is published.

Removing the text does not remove what the layout, the typeface or a printer’s dots say about where a page came from. Publish a transcription where you can.

OBSCURA Keep

The reporter’s own logins and two-step codes, and the papers that would hurt if a laptop were lost, encrypted with Argon2id and AES-256-GCM, unlocked by a passphrase that nobody, OBSCURA included, can reset, and synced, if at all, only through a folder of your own.

Keep cannot protect a device that is already compromised: malware or a watched screen sees what you see once it is unlocked.

Where a file gives a source away

Names in capitals are single tools: free to open and to check a file with, and Pro to save the result. A name marked Pro is a service inside the Sovereign Suite, which is Pro as a whole.

Photographs that say where and when

A phone writes the GPS position, the time and often the camera’s serial number into every photograph. What is in the frame can identify a place or a person as surely.

EXIF: shows the location, camera and time a photograph carries, before anything else is done to it
CLOAK: strips the GPS, serial number and timestamps, and blacks out anything in the frame
VEIL: pixelates faces, plates and screens at full resolution; automatic face detection loads a model the first time it is used
AVSCRUB: shows and removes the metadata in a video or audio file
RECAST: blacks out a face, a screen or a plate in a video, for the whole clip or part of it

Read first: what the location in a photo gives away.

Screenshots that show more than the message

The thing someone meant to share is rarely the problem. The notification, the profile corner and the other tabs are.

SCREENSHIELD: black boxes painted into the pixels and a new PNG exported, with nothing underneath; it explains why pixelating text is not a redaction
SCREENS: turns a stack of chat screenshots into a numbered transcript, each one kept as an exhibit

Read first: what a screenshot gives away.

A recording that identifies the speaker

A voice is recognisable, and so are the words in it. Each tool here says plainly where it stops working.

VOICEGUARD: shifts the pitch to disguise a voice from a listener who does not know it; a shift is one number and can be reversed
HUSH: bleeps, silences or garbles the spans you mark, such as a name or an address
SCRIBE: transcribes a recording on the device, so a quote can run as text; the speech model downloads once, then works offline
SPLICE: looks for cuts and joins in a recording you were sent

Read first: making a voice unrecognisable.

Printed pages and leaked text

Colour laser printers mark every page with a pattern of yellow dots, and a text can carry invisible characters that identify which copy it is.

DOTS: finds, reads and removes the tracking dots in a 600 dpi colour scan; the paper original still carries them
UNSEEN: shows zero-width characters and look-alike letters in a text, and reads anything written in them
LANTERN: finds text hidden in a PDF or Word file: white type, one-point type, lines off the page
TELLS: the writing habits that can match a text to its author, and flattens the mechanical ones

Read first: printer tracking dots and whether writing style can identify you.

A file you were sent and have not opened

An attachment from someone new may be what it says, or may be written to run something, or to report that it was opened.

Check a file before opening itPro: its real type, anything in it that runs, and secrets it leaks, without opening it
X-RAY: who wrote a document, what was deleted from it, and whether it contacts a server when opened
DISARM: rewrites an Office file or a PDF without its macros, scripts, remote references and embedded files
MAILBOX: takes a saved email apart: the delivery path, the real sending domain, where the links go
TAMPER: the standard checks for an edited photograph, which give places to look and never a verdict

Getting material to an editor or a lawyer

Cleaned material still has to travel, and so does the proof of what it was when it arrived.

Send a file securelyPro: files sealed into one page that opens with a passphrase sent another way, or encrypted to a public key
CAPSULE: the encrypted, self-opening HTML file behind it
KEYRING: age key pairs, and files encrypted to one or more public keys
ARCHIVE: freezes a saved web page into one file that cannot change, with a SHA-256 and a capture record
PROOF: records the SHA-256 of a set of files, to show later that nothing changed

Why it matters that the file stays on the machine

A file uploaded to a service so it can be cleaned exists, for a while, on that service’s disk: under its retention policy, visible to its staff and its logs, and subject to legal process wherever it is held. That copy is exactly the one a reporter was trying not to make.

The protection a journalist has against being made to give up a source mostly belongs to the journalist. A copy held by a cloud service can be sought from the service instead, sometimes without the reporter being told, and the service’s answer is governed by its terms and its jurisdiction, not by the newsroom’s judgement.

Here the file is read from the disk and worked on in the tab’s memory, and nothing is uploaded; the same is true of a trove loaded into Case. We never receive the material, so there is no copy of it with us to be requested, breached or handed over. You can confirm it in the browser’s network tab while a tool runs.

One thing does reach a server, and it matters to this readership: Cloudflare Web Analytics is on for this site and records that a page was viewed. It reports the page, not the file. Which tool page a reporter opened is itself information, and the page for teams says so too.

None of this protects a source on its own. The device, the accounts on it and the route the story took all matter as much as the file. The threat model says what each technique protects against and what it does not.

A worked example: material from a source

A source sends a scan of a printed memo, two photographs and a voice note. On the reporter’s laptop:

Before anything is opened, each attachment goes through Check a file before opening it: the real type, nothing that runs.
CLOAK shows that the photographs carry GPS coordinates and the phone’s model. Both are stripped, and VEIL covers a face reflected in a window.
DOTS finds a yellow dot pattern on the scan of the memo. The copy the desk works from has it removed, and the story does not publish an image of the page, because the paper itself still carries the dots.
SCRIBE transcribes the voice note on the laptop, and the quote runs as text. The audio is not aired: VOICEGUARD would only disguise it from a listener who is not looking.
The cleaned set goes to the paper’s lawyer through Send a file securely, with the passphrase read out over the phone.

What it costs a newsroom

Every tool above is free to open and to check a file with, so a reporter can see what a photograph or a document is carrying before anyone pays. Saving the cleaned copy is Pro.

Free, for everyone: The Workspace: Docs, Sheets, Slides, Notes, Calendar, Tasks, Contacts, Plan, Drive and the PDF editor, at work as well as at home. And every single tool on this page, to open a file and see what it finds, with no account.
One application, for one person: US$4 a month or US$35 a year, with 7 days free: Case, Sound, PDF Studio or Keep on its own, whichever the desk works in.
Pro, for one person: US$9 a month or US$79 a year, with 7 days free. Every application, and saving the result in every tool outside the Workspace.
More than one person: For now each person needs a plan of their own: a key is for one person, on every browser they use. Plans for a team or a business are not offered at the moment. A newsroom that already has one keeps it, and whoever holds its key goes on adding people and taking them off at /seats.
Not included: No admin console, single sign-on, audit log or shared team storage: each person’s work stays on their own machine. The page for teams lists the rest, with the answers a security reviewer will ask for.

Checkout is Stripe’s: the card is asked for at the start and not charged until the seven days are over, and if you cancel before then nothing is paid.

See the plans, 7 days free Try CLOAK free Ask a question

Questions

Can a pitch-shifted voice be turned back?

Yes. A pitch shift is one number, and anybody who suspects one can shift it back by the same interval. VOICEGUARD is a disguise from a listener who does not know the voice, not anonymity from somebody looking for it. Running a quote as text is the stronger choice.

Does removing the tracking dots from a scan protect the source?

It cleans that copy of the scan and nothing else. The paper original still carries the dots, and so does any other scan of it. DOTS says the same on its own page.

Is this protection against a state-level adversary?

No. It removes what a file carries and keeps the work off other people’s servers. It does nothing about a compromised device, an account that is watched, or a route that is. The threat model is the honest account of where each technique stops.

Does anything leave the laptop?

No file does. The pages themselves come from obscuraos.com, a few heavier tools fetch a library or a model from the same address the first time, and Cloudflare Web Analytics records page views. None of those carries the material.

Can it be used in the field with no signal?

Yes, once the pages have been opened. Installing it keeps a copy on the device. SCRIBE and VEIL need their model downloaded once while there is a connection.

Guides for this work

Questions this work runs into, each answered in full and ending at the tool that does the job.

How to tell if a photo has been edited: Everybody says check whether Software says Photoshop, which is the weakest signal in the file.
Why a cropped photo still shows what you cropped out: A JPEG carries a second, complete picture inside its EXIF block, written when the shutter fired.
How to work out the time of day from a shadow in a photo: The ratio of a shadow to its object gives the sun's height and its direction gives the bearing, and both are computable for any place and date.
Was this audio recording edited?: Four traces a cut leaves behind and how to measure them without uploading the file, and why a lossy re-encode destroys all four, so finding nothing proves nothing.
Does your printer hide tracking dots on every page?: Most colour laser printers and copiers put pale yellow dots on every page that name the machine and the date.
Blur faces and plates out of a photo: Why pixelation beats a blur, what else in the frame identifies people, and what the saved copy still carries.

The same tools, for other work

This page describes what the tools do and where they stop. It is not security advice for a particular source or story.