"Source Safety Guide" design

[ninavizz]

Problem

• The Source UI's footer has yet to be updated from when SD was a hacker project
• For security reasons, we cannot provide links from the footer. Users who want to learn more about SecureDrop or about risks when whistleblowing yet who have not taken the time to read through the wealth of information today's source journey expects they will, need a resource.

Design + User Goals

• Offer credibility to users where they have been trained to expect it
• Provide resource(s) users expect to see in a footer, that both meet our high security needs while also educating whistleblowers about concepts they need to understand to excise agency in their own risk management.

Solution

• DONE: Footer completed/deployed in 1.0.0
• New page w/in SD webapp for the footer to link-out to, with educational content on it. In ~500 words or less and within a highly consumable format (layout) this page needs to cover the most urgent things Sources will want to know and we believe they need to learn.
  • This is a TL;DR resource
  • Hovercards will enable nesting of richer information via progressive disclosure to help keep within the 500 character-count w/o compromising learning.

Working materials

• Sweet GDoc Erik started to iterate on TL;DR and footer text
• Quick wire Nina created of the above, edited somewhat and presented in a page w/ possible illustrations
  • See hovercard interaction from unsafe network link
  • See footer design on same wire

[ninavizz]

Good feedback from a friend w/ journalism expertise; captured below in my own notes from a verbal conversation

---

• Metadata from documents is unlikely to be associated with the source themself, unless it's images they shot on their own device or a file they created on their personal machine

• Detection of "document tracking" in printed documents may not be likely by the journalists themselves? It is still not known to many, exactly how printer dots are detected.

• If a source is one of a small group of individuals that have access to privileged information, that is more likely to be used against them in future legal action—not metadata.

• What stands-out as a larger priority is the source establishing a social contract with journalists wrt exactly how much of the information they've shared will get published. Will an org publish the full document, will they remove metadata and/or redact it before publishing, will they not publish the document and just quote from it, or will they just describe the revelations from it without even mentioning that a document exists?

Reference websites:

• http://seeingyellow.com/
• (curiously more current than EFF!) https://www.snopes.com/fact-check/household-printers-tracking-code/

[ninavizz]

11 July UX Meeting Notes

• Social contract with the news organization
  • Important to flag to users the necessity to create a clear understanding with the news organization about what is published
• Metadata Discussion
  • EXIF & .doc metadata far more common/likely to be issues
  • Printer dots blub shouldn't be outright removed, but emphasis on that one thing shd be de-emphasized
  • Action item: let's re-jigger "Example" sentence to speak more to metadata first, printer dots, second; and "What you can do" in parallel.
    • More important to do hovercard on EXIF and document-license owner metadata, than printer dots
    • "Documents and photos could contain hidden information that reveal your information"
    • Don't limit mention of printer dots to just yellow, though they may be safe to restrict to color laser printers (albeit not known entirely)?
• Erik
  • Pushing new footer w/ TL;DR page for 1.0 release feels like a high priority... let's jam on this to see if we can get it in?

@olivemartini @huertanix @eloquence @kushaldas @harlo @redshiftzero ^^ Eyes/Thoughts on the above? I've created a Figma file for this, so that folks can edit directly in the wireframe. If you'd like to do that, please ping Nina for a Figma invite. :)

[ninavizz]

Footer prioritized for rev2 for @eloquence's 1.0 UI updates!

Summary in 01 Aug UX meeting; TL;DR page sought for +1.0 release.

[ninavizz]

• Footer DONE for 1.0.0
• TL;DR page w/ inclusion of link in footer, to do in a forthcoming release

[ninavizz]

Content for this in-progress, with Content for Source Safety Guide being tracked in the main SD repo.