Journalist to journalist communication

[redshiftzero]

Journalist A and Journalist B are both onboarded to SecureDrop, working on source documents, and they work in different cities. If they are discussing sensitive information regarding source documents, it would be ideal if this communication were done through SecureDrop while also not being a huge burden in terms of usability. A workflow (based on #415 and #1151) here could be:

1. Journalist A is looking at documents and writes some comments for Journalist B about the documents they are working on
2. Journalist A encrypts these comments to the SVS key for Journalist B (or to the key of Journalist B)
3. Journalist A puts this encrypted message on the SecureDrop server for Journalist B to download next time she signs in
4. Journalist B downloads the message and safely decrypts on their secure journalist workstation

[psivesely]

This is a good idea, but IMO we should be moving away from PGP and to a multi-party scheme with modern features. I think a PGP and USB workflow like this will really hurt usability, and the JWs should be able to transmit data in real-time between each other through the app server.

[eloquence]

The strongest candidate for supporting journalist-to-journalist communication in the SecureDrop context is the integration of Signal in the SecureDrop Workstation:
freedomofpress/securedrop-workstation#609

Another option is to implement support for journalist-to-journalist communication in the SecureDrop Client. For medium-to-large organizations, the subset of journalists on-boarded to SecureDrop currently is, and is likely to remain, a subset of all journalists who may need to communicate about documents received via SecureDrop, so there may be limited bang for the buck in implementing journalist-to-journalist communication that's limited to other SecureDrop users. That said, such functionality is best considered in the context of the SD Client repo.

Closing this issue for now.