How to Leak Under the Trump Administration

Whistleblowers are advised to use extreme caution when leaking information under the Trump administration, as there is a documented history of government entities attempting to track leaks through communications metadata. Phone calls and text messages are considered unsafe because government investigators have used compulsory processes to request non-content records, which include metadata detailing who communicated with journalists, even if the content is unrecorded. Similarly, email communications are vulnerable because while message bodies can be encrypted, metadata such as send/receive times and addresses are not protected by default, allowing investigators to establish links between journalists and sources.
The guidance suggests avoiding all direct communication methods when dealing with sensitive information, including social media, due to the potential for platform owners to provide user data to government entities. While end-to-end encryption exists on some platforms, metadata remains a risk regarding who is communicating. Therefore, the safest approach involves using highly secure, metadata-minimizing tools like Signal or Session. Beyond technical security measures, operational security (OPSEC) is emphasized: whistleblowers must avoid communicating while at work, refrain from using work devices for sensitive transfers, and implement physical safeguards against forensic tracing of documents, such as watermarking.

* The Institute for Public Accuracy launched ExposeFacts.org in June 2014 to encourage whistleblowers to disclose information.
* The Justice Department utilized "compulsory processes" like subpoenas and search warrants to request "non-content communications records" from phone carriers serving journalists.
* Requests sought metadata pertaining to communications, such as who sent a message or made a call and the time of communication.
* Email address details and timestamps for emails are not encrypted by default.
* Setting up separate email accounts introduces potential risks; precautions include masking identifiers in burner accounts and using VPNs or Tor.
* Social media platforms' owners have shown varying degrees of alignment with the Trump administration regarding privacy policies (e.g., Meta, Proton).
* End-to-end encryption alone does not mask metadata about who is communicating with journalists.
* Signal minimizes metadata collection compared to other platforms by limiting stored user information.
* Session focuses on minimizing metadata by avoiding centralized servers for message relay.
* Whistleblowers should avoid using work devices or personal devices for communications, and must delete all sensitive records after communication.

The narrative constructs a framework prioritizing operational security against state surveillance by framing digital communication as inherently vulnerable to metadata exposure, irrespective of content encryption. The emphasis on moving beyond standard end-to-end encryption to systems like Signal and Session highlights a systemic distrust in proprietary platform controls, suggesting that privacy is not secured by technology alone but by architectural design choice. This moves the discussion from a technical fix to an epistemological challenge: if metadata reveals intent and association regardless of content secrecy, then the mechanism of knowing *who* you are talking to becomes the primary target for adversaries.
The strongest implication is that whistleblowing safety depends not just on technological competence but on creating a physical and digital security posture where the context of access—where and when information is accessed—is intentionally decoupled from the content itself. The warning against using work or personal devices, coupled with forensic countermeasures like watermarking, suggests an understanding that the material itself carries traceable provenance, implying that the act of leaking itself is subject to retrospective scrutiny. This pattern points toward a tension between democratic ideals of free expression and the contemporary reality where systemic power structures seek to control informational flows by monitoring the infrastructure of communication.
Bridge questions: If metadata can reveal associations regardless of encryption level, what structural reforms are necessary within communication infrastructure to guarantee the separation of identity from interaction data? How can whistleblowers build sufficient trust in open-source privacy tools when those same tools face potential state scrutiny regarding their own usage logs? What are the long-term consequences for public trust if digital security is perpetually framed as a battle against external actors rather than an inherent expectation of the system itself?