Anonymity vs Confidentiality: a Whistleblowing Threat Model

Thu, 12 Mar 2026 00:00:00 +0000

Anonymity and confidentiality are two different security properties, and a whistleblowing platform that uses them as synonyms is selling a promise it cannot keep. Anonymity means the reporter’s identity stays unobservable to the platform, to intermediaries, and to recipients, which operationally requires a Tor onion service v3, the Tor Browser on the reporter’s side, and reporter-side discipline against forensic traces. Confidentiality means the reporter accesses the platform over a regular browser; the ISP, the employer network, or a CDN can log the connection, while the platform encrypts the content, restricts recipient access, and keeps logs honest. Both are valid, and the right default depends on context: corporate compliance programmes usually default to confidential with anonymous opt-in via Tor, whereas human-rights initiatives and investigative newsrooms default to anonymous.

Tor on Whistleblowing Software

Anonymity vs Confidentiality: a Whistleblowing Threat Model