Why anonymity is not enough for sensitive use
-Let’s say Charlie is a whistleblower leaking information about widespread corruption via a popular online forum. To stay anonymous, he makes sure to connect to the site only through Tor and VPN, and uses a burner email address to sign up.
-In the foreword to his first leak, he uses one of his favorite personal phrases. To his misfortune, his real-name X account is the only one to ever publicly use that phrase before.
+Let’s say Charlie is using a popular online forum to leak information about a government agency’s unethical behavior. To stay anonymous, he makes sure to connect to the forum only through Tor & VPN, and uses a burner email address to sign up.
-The government connects the dots and uses its key disclosure legislation to issue a search warrant for the X user’s hard drives.
+This anonymity was essential, but not a complete savior. Only 10 people originally had access to the leaked information, so the government uses its key disclosure legislation to issue search warrants for all of their personal hard drives.
-Thankfully, Charlie needn’t worry: he has set up VeraCrypt’s deniable encryption to separate his personal life from his leaks. He gives the authorities the key to the main volume; they find nothing related to the leaks. The leaker’s use of that particular phrase is deemed a mere coincidence.
+Thankfully, Charlie needn’t worry: he has set up VeraCrypt’s deniable encryption to separate his personal life from his leaks. He gives the authorities the key to the main volume; they find nothing related to the leaks. The government does not know which of the 10 people was the leaker.
