Carmela Troncoso, SPRING professor © 2020 Alain Herzog
An EPFL laboratory has developed DataShare Network, a decentralized search engine paired with a secure messaging system that allows investigative journalists to exchange information securely and anonymously. An scientific article on this subject will be presented during the Usenix Security Symposium which will be held online from August 12 to 14.
The International Consortium of Investigative Journalists (ICIJ), which has over 200 members in 70 countries, has broken a number of important stories, particularly ones that expose medical fraud and tax evasion. One of its most famous investigations was the Panama Papers, a trove of millions of documents that revealed the existence of several hundred thousand shell companies whose owners included cultural figures, politicians, businesspeople and sports personalities. To complete an investigation of this size is only possible through international cooperation between journalists. When sharing such sensitive files, however, a leak can jeopardize not only the story's publication, but also the safety of the journalists and sources involved. At the ICIJ's behest, EPFL's Security and Privacy Engineering (SPRING) Lab recently developed DataShare Network, a fully anonymous, decentralized system for searching and exchanging information. A paper about it will be presented during the Usenix Security Symposium, a worldwide reference for specialists, which will be held online from 12 to 14 August.
Anonymity at every stage
Anonymity is the backbone of the system. Users can search and exchange information without revealing their identity, or the content of their queries, either to colleagues or to the ICIJ. The Consortium ensures that the system is running properly but remains unaware of any information exchange. It issues virtual secure tokens that journalists can attach to their messages and documents to prove to others that they are Consortium members. A centralized file management system would be too conspicuous a target for hackers; since the ICIJ does not have servers in various jurisdictions, documents are typically stored on its members' servers or computers. Users provide only the elements that enable others to link to their investigation.
