Why anonymity is not enough for sensitive use
-Let’s say Charlie is running a popular online platform with total free speech. To avoid being held liable for the content published on it, he makes sure to always be anonymous and private by using only open-source software and connecting to the site only through Tor and VPN.
-One day Charlie posts a link to a scientific paper from his anonymous “Founder” account on the platform. His followers see an uncanny similarity in the language used by the paper’s authors with the founder’s anonymous account. The government uses its key disclosure legislation to issue search warrants for the authors’ hard drives.
+Let’s say Charlie is a whistleblower leaking information about widespread corruption via a popular online forum. To stay anonymous, he makes sure to connect to the site only through Tor and VPN, and uses a burner email address to sign up.
+In the foreword to his first leak, he uses one of his favorite personal phrases. To his misfortune, his real-name X account is the only one to ever publicly use that phrase before.
+
+The government connects the dots and uses its key disclosure legislation to issue a search warrant for the X user’s hard drives.
+
+Thankfully, Charlie needn’t worry: he has set up VeraCrypt’s deniable encryption to separate his personal life from his leaks. He gives the authorities the key to the main volume; they find nothing related to the leaks. The leaker’s use of that particular phrase is deemed a mere coincidence.
-Thankfully, Charlie needn’t worry: he has set up VeraCrypt’s deniable encryption to divide his personal and scientific life from the website he’s running. He gives the authorities the key to the main volume; there are no further questions.