OBSCURA for journalists and newsrooms
A source is more often given away by the file than by the story: the coordinates in a photograph, the corner of a screenshot, the dots a printer added, the voice on a recording. These tools find and remove those things on the reporter’s own machine, so the material is never handed to another service to be cleaned.
Where a file gives a source away
Names in capitals are single tools: free to open and to check a file with, and Pro to save the result. A name marked Pro is a service inside the Sovereign Suite, which is Pro as a whole.
Photographs that say where and when
A phone writes the GPS position, the time and often the camera’s serial number into every photograph. What is in the frame can identify a place or a person as surely.
- EXIF: shows the location, camera and time a photograph carries, before anything else is done to it
- CLOAK: strips the GPS, serial number and timestamps, and blacks out anything in the frame
- VEIL: pixelates faces, plates and screens at full resolution; automatic face detection loads a model the first time it is used
- AVSCRUB: shows and removes the metadata in a video or audio file
- RECAST: blacks out a face, a screen or a plate in a video, for the whole clip or part of it
Read first: what the location in a photo gives away.
Screenshots that show more than the message
The thing someone meant to share is rarely the problem. The notification, the profile corner and the other tabs are.
- SCREENSHIELD: black boxes painted into the pixels and a new PNG exported, with nothing underneath; it explains why pixelating text is not a redaction
- SCREENS: turns a stack of chat screenshots into a numbered transcript, each one kept as an exhibit
Read first: what a screenshot gives away.
A recording that identifies the speaker
A voice is recognisable, and so are the words in it. Each tool here says plainly where it stops working.
- VOICEGUARD: shifts the pitch to disguise a voice from a listener who does not know it; a shift is one number and can be reversed
- HUSH: bleeps, silences or garbles the spans you mark, such as a name or an address
- SCRIBE: transcribes a recording on the device, so a quote can run as text; the speech model downloads once, then works offline
- SPLICE: looks for cuts and joins in a recording you were sent
Read first: making a voice unrecognisable.
Printed pages and leaked text
Colour laser printers mark every page with a pattern of yellow dots, and a text can carry invisible characters that identify which copy it is.
- DOTS: finds, reads and removes the tracking dots in a 600 dpi colour scan; the paper original still carries them
- UNSEEN: shows zero-width characters and look-alike letters in a text, and reads anything written in them
- LANTERN: finds text hidden in a PDF or Word file: white type, one-point type, lines off the page
- TELLS: the writing habits that can match a text to its author, and flattens the mechanical ones
Read first: printer tracking dots and whether writing style can identify you.
A file you were sent and have not opened
An attachment from someone new may be what it says, or may be written to run something, or to report that it was opened.
- Check a file before opening itPro: its real type, anything in it that runs, and secrets it leaks, without opening it
- X-RAY: who wrote a document, what was deleted from it, and whether it contacts a server when opened
- DISARM: rewrites an Office file or a PDF without its macros, scripts, remote references and embedded files
- MAILBOX: takes a saved email apart: the delivery path, the real sending domain, where the links go
- TAMPER: the standard checks for an edited photograph, which give places to look and never a verdict
Getting material to an editor or a lawyer
Cleaned material still has to travel, and so does the proof of what it was when it arrived.
- Send a file securelyPro: files sealed into one page that opens with a passphrase sent another way, or encrypted to a public key
- CAPSULE: the encrypted, self-opening HTML file behind it
- KEYRING: age key pairs, and files encrypted to one or more public keys
- ARCHIVE: freezes a saved web page into one file that cannot change, with a SHA-256 and a capture record
- PROOF: records the SHA-256 of a set of files, to show later that nothing changed
Why it matters that the file stays on the machine
A file uploaded to a service so it can be cleaned exists, for a while, on that service’s disk: under its retention policy, visible to its staff and its logs, and subject to legal process wherever it is held. That copy is exactly the one a reporter was trying not to make.
Here the file is read from the disk and worked on in the tab’s memory, and nothing is uploaded. We never receive the material, so there is no copy of it with us to be requested, breached or handed over. You can confirm it in the browser’s network tab while a tool runs.
One thing does reach a server, and it matters to this readership: Cloudflare Web Analytics is on for this site and records that a page was viewed. It reports the page, not the file. Which tool page a reporter opened is itself information, and the page for teams says so too.
None of this protects a source on its own. The device, the accounts on it and the route the story took all matter as much as the file. The threat model says what each technique protects against and what it does not.
A worked example: material from a source
A source sends a scan of a printed memo, two photographs and a voice note. On the reporter’s laptop:
- Before anything is opened, each attachment goes through Check a file before opening it: the real type, nothing that runs.
- CLOAK shows that the photographs carry GPS coordinates and the phone’s model. Both are stripped, and VEIL covers a face reflected in a window.
- DOTS finds a yellow dot pattern on the scan of the memo. The copy the desk works from has it removed, and the story does not publish an image of the page, because the paper itself still carries the dots.
- SCRIBE transcribes the voice note on the laptop, and the quote runs as text. The audio is not aired: VOICEGUARD would only disguise it from a listener who is not looking.
- The cleaned set goes to the paper’s lawyer through Send a file securely, with the passphrase read out over the phone.
What it costs a newsroom
Every tool above is free to open and to check a file with, so a reporter can see what a photograph or a document is carrying before anyone pays. Saving the cleaned copy is Pro.
- Free, for everyone
- The Workspace: Docs, Sheets, Slides, Notes, Calendar, Tasks, Contacts, Plan, Drive and the PDF editor, at work as well as at home. And every single tool on this page, to open a file and see what it finds, with no account.
- Pro, for one person
- $15 a month or $144 a year, with 7 days free. Saving the result in every tool outside the Workspace, the whole Sovereign Suite and the Photo Editor.
- Team, up to 25 people
- $69 a month or $690 a year, with 14 days free. Everything in Pro for up to 25 people on one key for the whole team, a Stripe invoice with your organisation’s name and tax number, and email answered by a person within a working day.
- Not included
- No admin console, single sign-on, audit log or shared team storage: each person’s work stays on their own machine. The page for teams lists the rest, with the answers a security reviewer will ask for.
From five people, Team costs less than five Pro subscriptions. Checkout is Stripe’s: the card is asked for at the start and not charged until the fourteen days are over, and if you cancel before then nothing is paid.
Questions
Can a pitch-shifted voice be turned back?
Yes. A pitch shift is one number, and anybody who suspects one can shift it back by the same interval. VOICEGUARD is a disguise from a listener who does not know the voice, not anonymity from somebody looking for it. Running a quote as text is the stronger choice.
Does removing the tracking dots from a scan protect the source?
It cleans that copy of the scan and nothing else. The paper original still carries the dots, and so does any other scan of it. DOTS says the same on its own page.
Is this protection against a state-level adversary?
No. It removes what a file carries and keeps the work off other people’s servers. It does nothing about a compromised device, an account that is watched, or a route that is. The threat model is the honest account of where each technique stops.
Does anything leave the laptop?
No file does. The pages themselves come from obscuraos.com, a few heavier tools fetch a library or a model from the same address the first time, and Cloudflare Web Analytics records page views. None of those carries the material.
Can it be used in the field with no signal?
Yes, once the pages have been opened. Installing it keeps a copy on the device. SCRIBE and VEIL need their model downloaded once while there is a connection.
The same tools, for other work
This page describes what the tools do and where they stop. It is not security advice for a particular source or story.