DEPRECIATED — 2018 IFF interview script

What is this Interview Script for?

It is a 30 to 60 minutes Interview to provide you with basic understanding of what investigatives journalists do and how they related to technology when communicating with their sources. It may also be an opportunity for further dialogue with them. These can then be used to carry out further, more focused research.

The questions marked with (60) can be skipped to keep the interview shorter than 60 minutes.

Essential parts of the interview are:

• Introduction (to explain to the participant who you are, why you are talking to them)
• Get consent (to establish trust with the participant)
• About the participant (to learn about the participant, and their organisation)
• About the tools, and Usage of the tools (to learn about their uderstanding)
• Security concepts (to find what people know (e.g. if someone uses encrypted email... we cannot assume they know what a public key is, if they use protonmail for instance) and get a glimpse of their mental model people have for a given concept. It will bring us closer to the mental model of journalists with regard to security tools).
• Conclusion questions

Tools needed

• way to take notes (paper, or laptop)
• audio recorder (optional)

Interview script

Introduction

Hello there, my name is [interviewer]. I am a contributor to Securedrop. Thank you for agreeing to speak with me. I'd like to speak to you about the tools you use when you communicate with your sources.

Get consent for recording the audio of the session

I would like to ask you for your permission to record our discussion today. Recording allows me to focus my attention on you. I will use this recording to make notes of our discussion today. Once I've made the notes, I will delete the recording.

May I record our discussion?

Get consent for questions and sharing notes

You can answer my questions to the extent that you feel comfortable. You're free to choose not to answer a question, or to stop the interview at any moment. OK?

We want to keep information from interiews available for the SecureDrop UX team members. With all our interview we can remove personally identifiable information, like names, organisations, countries. We will send you the notes for review and wait for your approval to share them. It would be perfectly ok for you to decide at that time that you don't want them shared with anyone after all.

Do you have any questions before we begin?

About the participant

• Can you tell me your name, or an alias I can call you during this interview?
• Can you tell me your occupation?
  • Alternative: or what do you spend your time doing most?
• Do you work at an organisation?
  • What's it's name?
  • Alternative: what does the organisation do?
• About your work environement:
  • Are you free to choose topics to work on and work schedule?
  • What are the main criteria of topic’s choice? (60)
  • Do you think that readers’ interests are really taken into account in the topic choice?
  • Do you use google trends or other web analytic tools before starting a new topic? (60)
• Do you work with other journalists outside your organisation? (60)
• What country in the world do you work in? (60)

About your vision of today’s journalism, its role and its main challenges

• Could you define in several words what good journalism is?
• Do you think that quality journalism is impossible without investigative journalism?
• What is the main feature(s) of investigative journalism in comparison to non investigative journalism? (60)
• In the case of investigative journalism what is the "right" equilibrium between facts and opinions of different concerned parties? (60)
• An investigative journalist working on a topic, does he also provide his own personal viewpoint on this topic? (60)
• May there be any contradiction between journalistic objectivity and journalistic fairness? (60)
• When you are seeking journalistic information (whether it be for professional or personal need), do you give priority to particular media outlets or else to particular authors that you regularly follow? (60)
• What are the main threats to ethical and quality journalism today?

About your practices

• When you start working on a new topic, how do you collect information?
• How and where are you looking for the information sources? (60)

About the tools

• Can you tell me what tools you use when you communicate with your sources?
  • Further prompt if necessary: Describe what is does/what does it allow you to do?
• Where did you hear about these tools? (60)
  • Further prompt if necessary: When was that?
• Could you explain, in your own words, the following concepts. When the interviewee knows the concept, ask for a tool that implements the concept and ask them to explain how it can help protect privacy and/or security. Pick at most five concepts and stop after two concepts are cannot be explained. For those unexplained concepts, give a very short explanation of what it is:
  • Encrypted e-mail
  • An encryption key
    • A public key
    • A private key
    • A key fingerprint
  • Tor
    • Tor browser
    • A .onion URL
    • HTTPS in Tor
  • 2FA
    • TOTP and HOTP
  • Live system, tails
  • Airgap machine
  • If someone steals the disk from your computer (not the whole computer), can they read your files without your password?
  • An encrypted disk versus a locked session
  • A whistleblower communication system
  • Metadata
    • file metadata
    • mobile device metadata
    • computers metadata
    • cleaning metadata on files
  • how is a USB storage key different from an SSD or a hard drive
  • E2E
  • passphrase vs password
  • passphrase strength
  • A cryptographic signature
  • A checksum
    • Checksum collision attack
  • A threat model
    • An adversary in the context of a thread model
  • HTTP
    • HTTPS compare HTTP
    • A referer in the context of visiting a web site
    • The logs of a website
    • The logs of a service en ligne
  • Intrusion Detection System
  • GSM
  • GSM antenna
  • Security update pour un système d'exploitation
  • Device/machine compromission
  • Malware
  • Man in the middle
  • Cloud
    • Shared hosting vs dedicated hosting
    • Hosted physical machine
    • Virtual machine
    • Self-hosted
  • Backup and restore
  • Fingerprinting of a Tor Browser
    • JavaScript
    • JavaScript virtual machine
    • What happens when a web page displays an advertisement? Where does the ad comes from? How is it chosen?
  • Online service fingerprinting
  • Internet filtering
  • Internet blocking or censorship
  • What is a third party? And why it matters for security.
  • Which third party do you need to trust when using:
    • Signal?
    • Tor?
    • HTTPS?
    • Encrypted Email?
    • Facebook?
    • Twitter?
    • Mastodon?
    • OTR?
  • Safely erasing a file or a disk
  • Perfect Forward Secrecy
  • Encryption strength
  • Brute force attack
• Whether and how the use of these tools can impact the quality of journalistic information? (60)

Usage of the tools

• Tell me about how you started to use these tools. (60)
  • Further prompt if necessary: why did you start using it?
  • Who helped you get started?
• When was the last time you used them? Tell me about that time, describe what you did.
  • Further prompt if necessary: what were you trying to do? (60)
• Do you work with other journalists who use the same tools? (60)
• If you have questions about the tools, who answers them?
  • Do you help anyone with their tools?

Usability of the tools

• Imagine you have a magic wand. You can use it to change anything in one tool you use. What would that be?
  • Why do you want to change that?
• Is there anything that works well with these tools? (60)
  • Further prompt if necessary: tell me about that.

Conclusive remarks

• What is the most costly (time, money, efforts, etc) part of investigative journalism? (60)
• Which ways of funding are feasible and appropriate for investigative journalism?
• What's your opinion about the potential of crowdfunding in journalism? (60)

Finishing

Thanks very much [NAME/ALIAS] for your time and patience. As a little thank you, I'd like to give you this SecureDrop sticker.

Would it be OK if I asked you for an email address so I can contact you about SecureDrop?

If you'd like to use PGP encrypted email I will send you my PGP key.

Is there anybody you know who uses tools to communicate with their sources? Would it be OK to introduce me to them so I can talk to them about them?

Thanks again.