Protecting your sources is one of the most important issues in journalism. If you want somebody to tell you something, you have to make sure that he or she will not get into serious trouble because of it. The free encryption programme "Pretty Good Privacy" (PGP) and anonymous remailers help you to ensure this.

Pretty Good Privacy

What a lot of people don't realize, is that email can be intercepted and read by others very easily. Under certain circumstances this might not even be illegal. Companies, for example, have in most countries the right to read their employees' email. Not good for your source, if he wants to mail you some information about that company. With the help of PGP and remailers, you can make email and files illegible (and to a certain degree untraceable) to anyone except for the designated receiver.

The following is an extract from the Users Guide to PGP for Personal Privacy Version 5.5; Chapter 8: Security Features and Vulnerabilities.. This document is available from the International PGP Home Page.

top

Encryption basics

First, some elementary terminology. Suppose you want to send a message to a colleague, whom we'll call Alice, and you don't want anyone but Alice to be able to read it. You can encrypt, or encipher, the message, which means scrambling it up in a hopelessly complicated way, rendering it unreadable to anyone except you and Alice. You supply a cryptographic key to encrypt the message, and Alice must use the same key to decipher or decrypt it. At least that's how it works in conventional "secret key" encryption. A single key is used for both encryption and decryption. This means that this key must be initially transmitted via secure channels so that both parties can know it before encrypted messages are sent over insecure channels. This may be inconvenient. If you have a secure channel for exchanging keys, then why do you need cryptography in the first place?

How public key cryptography works

In public key cryptography, everyone has two related complementary keys, a public key and a private key. Each key unlocks the code that the other key makes. Knowing the public key does not help you deduce the corresponding private key. The public key can be published and widely disseminated across a communications network. This protocol provides privacy without the need for the same kind of secure channels that conventional secret key encryption requires. Anyone can use a recipient's public key to encrypt a message to that person, and that recipient uses her own corresponding private key to decrypt that message. No one but the recipient can decrypt it, because no one else has access to that private key. Not even the person who encrypted the message with the recipient's public key can decrypt it.

Sounds complicated? Well, it really isn't. Installing PGP under Mac OS or Windows 95 is extremely easy and doesn't take more than five minutes. It is somewhat more complicated to install it under Windows 3.x, though. Once you have installed it, encrypting and decrypting becomes a matter of two or three extra mouseclicks. Download the programme, read the documentation and try it.

Other useful features of PGP are that it can delete files for good (so that no one can recover them) and even encrypt files on your harddisk.

top

Anonymous Remailers

However, there is one problem that PGP doesn't solve. Because even if someone else can't read the message, they can still see who sent it and to whom it was sent. Sometimes you might not want this. There is a way around this problem - if you use "Anonymous Remailers". These institutions take your messages and re-send them to wherever you want, without revealing your name. Together with the use of PGP, these are the best ways to protect your source. An excellent guide about how to use Remailers and PGP to that purpose was written by Seattle Webworks. We suggest that you read their article PGP & Remailers Made Simple if you want to know more about the subject. Even though the guide was written for Windows-users, we believe that it can be of use to Mac-users as well. Alternatively, you might want to take a look at the Web interface for remailing which Anonymizer.com offers.

up to the top