You have data you would like to share with us?

How to reach the Süddeutsche Zeitung investigative team

You're interested in sending us confidential information, perhaps even anonymously? Protecting our sources is our highest priority. To that end, we would like to remind you that communication by telephone and email is probably not secure enough, particularly if you would like to send us sensitive information like internal documents, database excerpts or contracts.

Before establishing contact with us, please read the following tips regarding the pros and cons of various communication tools and methods.

Broadly speaking, you should never write emails from your office or using your company email address. Nor should you send other forms of electronic communication from devices to which others have access, such as those belonging to your employer. In particularly sensitive cases, you should also avoid using your telephone, whether mobile or landline, or your private email address. Since 2017, buyers of prepaid SIM cards have been required to present their IDs, which means that even calls made from prepaid mobile phones can possibly be traced.

SecureDrop

If you would like to share documents or information with us, you can use our SecureDrop system, which is based on software from the Freedom of Press Foundation that enables encrypted communication with journalists.

  1. Download and install the TOR-Browser from the website www.torproject.org. This browser obscures your IP address when you navigate to the Süddeutsche Zeitung's SecureDrop site.
  2. Launch the TOR browser and copy the following URL directly into the navigation bar: http://rx4g2bilxipcryde.onion
    This URL can only be opened via the TOR browser and should not be opened in a different browser, because it will leave traces there.
  3. You are now on the Süddeutsche's SecureDrop page and can follow the additional steps outlined there to send us messages or documents. You will be asked to memorize an alias so that you can log in to SecureDrop on future visits and read messages posted there by the Süddeutsche Zeitung.

To ensure secure communication, it is best to access SecureDrop from a public Wi-Fi connection. Ideally, find a busy café where you've never been before, making sure that your screen is not being filmed by a security camera. If you want to send us sensitive information, you shouldn't connect to SecureDrop from your home or place of work. Further security can be provided by using the operating system Tails. For additional information, visit the website https://securedrop.org.

The SecureDrop servers are in the possession of the Süddeutsche Zeitung and any information you send to us is stored on our servers in encrypted form. Before we can read your messages and information, it is decrypted on a computer that is not connected to the internet. It no longer contains metadata of any kind that might make it possible to identify the source of the material. The Süddeutsche Zeitung likewise has no knowledge of the source of the information, unless the information transferred provides clues about the source.

Using your alias, you can log in to SecureDrop at any time to read messages from the Süddeutsche Zeitung. To ensure the utmost security, it is recommended that you delete the messages as soon as you have read them. Once you do so, the messages are also erased completely from our servers.

The SecureDrop software is regularly checked by independent security experts. Just like every software program, however, SecureDrop, too, can exhibit security loopholes. Use of SecureDrop comes at your own risk.

E-Mail

As was made clear by Edward Snowden's revelations, if not before, it is relatively easy to spy on normal emails. Encrypted emails provide much better protection and the Süddeutsche Zeitung uses PGP. To learn more about how PGP works, we recommend the German-language tutorial from our colleagues at netzpolitik.org or the English-language explanation from the Electronic Frontier Foundation. The so-called public keys belonging to Süddeutsche Zeitung journalists can be found lower down on this page.

The Swiss email service ProtonMail offers encryption for emails sent from a ProtonMail account to a ProtonMail account, similar to the service offered by Tutanota. Several Süddeutsche journalists, including many in the investigative section, can also be reached via ProtonMail or Tutanota. But even encrypted emails are no guarantee for absolute security. Even if the content is encrypted, the email's path through the internet can be logged and that metadata can be used to lead back to the sender. The above-mentioned anonymization network Anonymisierungsnetzwerk TOR can help, since it obscures the identity of users.

Anonymous email accounts, such as those offered by Hushmail, ProtonMail and others, give you the possibility of using an email account without having to divulge your name. Still, you should assume that your computer's IP address and additional information that could help identify you will be logged and could be passed on to security officials if requested.

Encrypted Messenger Services

Messenger services work similarly to text messaging, but each piece of communication is encrypted. WhatsApp is likely the best known and most widely used messaging app, but it belongs to Facebook, which has repeatedly been criticized for its handling of data. As such, the more trustworthy option is Signal, a service recommended by cryptologists like Bruce Schneider and the NSA whistleblower Edward Snowden. Whereas accounts with Signal and WhatsApp are linked to your mobile phone number and can thus be linked to you, the messenger services Threema and Peerio offer encrypted communication without requiring you to reveal your mobile phone number.

You can find contact information for Süddeutsche Zeitung journalists lower down on the page.

Mail

Traditional mail is a relatively secure method, provided you don't include your real name on the letter or package, and you send it from a post office that isn't in your immediate vicinity. You should assume that any address information provided will be recorded.

Our mailing address is:
Süddeutsche Zeitung
Hultschiner Str. 8
81677 München
Germany

Personal Delivery

You may at any time drop by the reception desk at the Süddeutsche Zeitung building located at Hultschiner Str. 8, 81677 München to submit material. Please address the material to the section called Investigative Recherche (Investigative Reporting). The Süddeutsche high-rise is located near the public transit stop Berg am Laim, which is accessible by bus, tram and commuter train (S-Bahn).

The Süddeutsche Zeitung Investigative Team

You may also contact a member of Süddeutsche's investigative team directly.

Sincerely,
Your Süddeutsche Zeitung investigative team