Sources
Our analysis would not be possible without cultivating first-hand on-the-ground insights from our trusted global network of subject matter experts across public and private sectors. Suffice it to say, all our engagements are conducted with independent legal review ensuring full adherence to local and international regulatory requirements and professional best practices.
If you have valuable information you wish to share with us or if you would like to make the world a safer place, please contact us.
Become a Source
If you have would like to make submit an application please follow the guide below. However, please keep in mind: no communication system, piece of software or security protocol is completely secure. While there are are a number of steps that can reduce potential risk and help protect your confidentiality and anonymity – source protection is a complex field – even well-intentioned advisors often lack the necessary expertise.
You know your situation best, so we ask that you take the appropriate steps to protect yourself.
Before moving ahead
When sharing information, please make sure that you are as specific as possible and provide clear verifiable evidence and/or documentation. We may take additional steps to review and authenticate your sample from independent sources.
Please do not send feedback, corrections, pitches or commercial offers through this channel.
Proceed with caution
Think about the sensitivity of the information you’re sharing, and who might be willing to investigate the source; what are their capabilities, resources (e.g., attention, legal, financial, or technical), and motivations to investigate.
Act accordingly.
Making contact
Postal Service
Postal submissions, in combination with some electronic techniques, provide relatively strong anonymity compared to digital communications. That said, mail risks include loss, interception, or on exceedingly rare occasions of active surveillance physical arrest and seizure. While attribution vectors exist such as financial records linking to purchase points of storage media, forensic DNA/fingerprint analysis, and manufacturing supply chain tracing — these methods are expensive and unlikely in practice. Consider whether your adversary capable of intercepting mail also has the resources for forensic analysis and sufficient motivation and opportunity to conduct such costly investigations. Review your threat model and implement appropriate handling precautions accordingly.
Filetype: Files contain embedded metadata (usernames, timestamps, GPS coordinates, unique IDs). Remove metadata before copying or burning. For Microsoft Word files you've edited, send PDFs instead to avoid name/computer identification.
Manually Encrypt Messages: (optional)
Generate PGP key-pairs offline
Practice good key management.
Consider session-specific key-pairs.
Storage: Transfer data to physical media (USB, external drive, SD card, CD, DVD). Each storage media carries it’s own security risks:
USB/hard drives: may retain metadata incl. serial numbers and device IDs or contain hidden system files
CD/DVD: often embed burner serial numbers, laser signatures, and may have batch codes
Commercial printers: Embed Machine Identification Codes (yellow tracking dots with serial, date, time)
Mailing: Consider posting away from your local post office at a location without witnesses or video monitoring. If you suspect you are under physical surveillance give the letter to a trusted friend or relative to post. Address the package to any name unlikely to attract scrutiny – you can use whatever return address you like – however, please verify that you have written the destination correctly. If your country's mail system is unreliable, consider multiple copies or using courier services (DHL, FedEx).
Processing: Upon receipt, our trusted intermediary will securely transfer the data to us and destroy the mailed package. Submissions are verified against internal criteria, then processed in isolated, sandboxed environments using strong cryptography. Metadata is removed per industry best practices, files converted to appropriate formats with standardised naming practices for storage.
If you do not already have an assigned mailbox or are contacting us for the first time, please follow the instructions below.
Email
Please note that email is not a secure medium of communication protocol is only valid for establishing initial contact and not secure document submission. Following review and authentication – we may discuss establishing appropriate channel for further communication.
Clean Device
Do not use your personal, home, or work device
Ensure the device is malware-free
For technical users, boot checksum-verified live-OS on brand-new SSD/USB
Public Network
Connect from a public network you do not regularly visit without your personal devices.
Consider varying locations over time.
Use a Trusted VPN
Use a no-logs VPN that accepts anonymous payment
Choose servers not in adversarial jurisdictions.
When possible, enable additional features such as a “kill switch” to cut internet access if VPN fails.
Use Tor Enabled Services (recommended)
Only access Tor related projects or services after VPN connection is active.
Do not mix Tor and clear-net activity on the same session or device.
Isolated Email
Use a secure temporary email with servers in a friendly jurisdiction
Please note that email is not secure medium; assume all metadata (sender/recipient, time, subject line) is exposed.
Only access via Tor and VPN (Steps 3-4)
Consider encrypting messages manually using PGP (see above)
Check the spam folder for replies.
After Contact
Do not talk about your submission to others
Stick to your normal routine and behaviour. Avoid saying anything or doing anything after submitting which might promote suspicion.
We recommend that you format and dispose of the computer hard drive and any other storage media you used. Hard drives retain data after formatting which may be visible to a digital forensics team and flash media (USB sticks, memory cards and SSD drives) retain data even after a secure erasure. If you used flash media to store sensitive data, consider physically destroying the media. (Optional).
Contact Email: ████████████ [This function has been temporarily removed. We are not accepting new submissions at this time]
Public Key:
-----BEGIN PGP PUBLIC KEY BLOCK-----
mDMEaFODCRYJKwYBBAHaRw8BAQdA2wJI5qWGv0EH4lJy/7KbTrEN7Q2siwfduq+4
aTtwr1O0H0dpZnRlZCBQYW5kYSA8MDBTMTRAcHJvdG9uLmNvbT6IcgQTFggAGgQL
CQgHAhUIAhYBAhkBBYJoU4MJAp4BApsDAAoJEDOK9F8f2oMi2M0BAPrkol/TKuuY
ae7aRP9hPPiIdqnFIMBw5NnX+wBCyn50AP9HwUfx0vB0M/ZA4tgneceou6DbDd9J
5ycXZYGXqL2KCLg4BGhTgwkSCisGAQQBl1UBBQEBB0BJsGFVordcFlo1/mLzXYLm
lBsz0NtcxEUGtwhhsS3jBgMBCAeIYQQYFggACQWCaFODCQKbDAAKCRAzivRfH9qD
IqlwAQCW4/p7we8u3zkDxktwByvwnDb1XtgHY1CtI9GPSnWJ7wD+JgxkVFfF0k+i
WHgftMFGQLIvsIYrADM0lzCxqwNuOw8=
=9+Za
-----END PGP PUBLIC KEY BLOCK----- We appreciate you taking the time to contact us and we will review messages on a regular basis, the evaluation process for each message may take some time, depending on the information provided and your security situation S14 may choose not to respond.
We look forward to hearing from you.