Third pillar · Evidentia · Corpus · WARTE
Who from inside
sees what outside
hidden remains.
Tips from inside sources are the most valuable form of disclosure — and the most dangerous for the whistleblowers. WARTE is not a portal but a protocol. It does not rely on trust in an operator, but on mathematics. Even someone who seizes the server does not learn who reported.
"If you want to stop a person from doing something they consider right, make it impossible for them to stay anonymous."
— principle of every functioning whistleblower suppression
WARTE inverts the principle. Anonymity is not a matter of trust, but cryptographically enforced. No operator instance — not even the tool itself — can establish the identity of the whistleblowers, even under duress.
01 · Threat model
Who hunts whistleblowers — and by what means?
Concrete, not abstract. In Austria and EU-wide. These are the six realistic attack scenarios — each anchored to a technical countermeasure in WARTE.
IP attribution
Employer or authority sees outbound traffic to the platform. Submission timestamp is traced back.
CountermeasureOnion service. No server ever knows an IP. Tor Browser mandatory.
Server seizure
Police or court has server hardware seized. Database is analyzed.
CountermeasureData is encrypted client-side. Server has only Shamir shares, no full text.
Style analysis
From the linguistic style of the tip, a person within the known group is inferred (forensic linguistics).
CountermeasureContent sanitizer offers rewrite recommendations. Documents are uploaded separately and never mixed with text.
Insider betrayal at the recipient
One of the intended recipients (journalist, NGO) is pressured or corrupted into revealing the identity.
CountermeasureShamir n-of-m. Three independent recipients must join together for the plaintext to become accessible.
Metadata in documents
Uploaded PDFs, Word files, photos contain author, GPS, timestamp, printer dots.
CountermeasureClient-side metadata stripper before encryption. Tracking-dots warning for scanned documents.
Correlation attack
Only 3 people in a company had access to a particular document. The mere fact of the report gives it away.
CountermeasureIngress warning when a tip points to too small a group of people. Recommendation: broader group access before submission.
02 · Security layers
Three layers that protect independently of each other.
If one layer fails, the others still protect. No single weak point may compromise the system. Defense in depth here is not best practice but a survival condition.
I
Transport anonymity
Tor hidden service · Onion v3 · no-JS fallback
The platform is exclusively reachable as a .onion address. No clearnet mirror, no HTTPS endpoints, no DNS entries. The server does not know where the visitor comes from — technically and mathematically, not by policy. This applies to the initial access, the submission, and the status retrieval. A no-JavaScript fallback version exists for users who disable scripting for security reasons.
What this means in practice: Anyone submitting reports from a company laptop must use Tor Browser. That is unusual enough that we point it out explicitly in the UI — better from a private device or a public library computer.
What this means in practice: Anyone submitting reports from a company laptop must use Tor Browser. That is unusual enough that we point it out explicitly in the UI — better from a private device or a public library computer.
II
Content encryption
age · X25519 · Shamir's Secret Sharing (3-of-5) · client-side
The content (text, documents) is encrypted before upload, with a one-time key split via Shamir secret sharing across the public keys of the intended recipients: e.g. 5 shares among 5 recipients, 3 suffice for reconstruction.
What the server sees: Ciphertext + 5 encrypted shares. Without the cooperation of at least 3 recipients, no decryption is possible — not even with the entire server database.
Recipient selection: Preconfigured (Klagsverband, VKI, ZARA, an investigative journalist, a data-protection lawyer). Whistleblowers can choose their own recipient sets if needed, as long as the 3-of-5 minimum is preserved.
What the server sees: Ciphertext + 5 encrypted shares. Without the cooperation of at least 3 recipients, no decryption is possible — not even with the entire server database.
Recipient selection: Preconfigured (Klagsverband, VKI, ZARA, an investigative journalist, a data-protection lawyer). Whistleblowers can choose their own recipient sets if needed, as long as the 3-of-5 minimum is preserved.
III
Metadata minimization
ExifTool (WASM) · PDFSani · stylometric sanitizer · delay jitter
Files: Before encryption takes effect, a metadata stripper runs client-side. EXIF from photos (position, camera, timestamp, serial), XMP from PDFs (author, edit history), Office metadata, printer tracking dots (where detectable — warning to re-scan).
Texts: An optional stylometric sanitizer warns of phrasings typical of a sector or hierarchy. It replaces nothing automatically — the recommendations are hints for self-editing.
Timing: Submissions are passed to the recipients with a random delay (0–6h), so that the time of activity on the platform cannot be correlated with a precise event at the source.
Texts: An optional stylometric sanitizer warns of phrasings typical of a sector or hierarchy. It replaces nothing automatically — the recommendations are hints for self-editing.
Timing: Submissions are passed to the recipients with a random delay (0–6h), so that the time of activity on the platform cannot be correlated with a precise event at the source.
03 · Flow
What a submission actually does.
Everything in the browser, nothing in plaintext on the server, verifiable in the open-source code.
WHISTLEBLOWER WARTE SERVER (.onion) RECIPIENTS (3-of-5)
│ │ │
│ 1. Tor Browser → http://xyz...abcd.onion │ │
│──────────────────────────────────────────►│ │
│ │ │
│ 2. Write tip (locally, in the browser) │ │
│ · Text │ │
│ · Attachments (auto metadata- │ │
│ stripped before upload) │ │
│ · Stylometric warning optionally active │
│ │ │
│ 3. Local encryption: │ │
│ K = random AES key │
│ Chiffrat = AES-GCM(Inhalt, K) │
│ Shares = Shamir(K, n=5, t=3) │
│ Shares_enc[i] = X25519(Shares[i], pubkey[i]) │
│ │ │
│ 4. Submit (ciphertext + shares_enc) │ │
│──────────────────────────────────────────►│ │
│ │ │
│ 5. Server responds with token │ │
│ Token = random, later shows status │
│◄──────────────────────────────────────────│ │
│ │ │
│ 6. Target fingerprint (hashes only!) │ │
│ sent to corpus │──► Corpus remembers: "report for institution-X"
│ │ │
│ │ 7. Shares_enc[1..5] delivered │
│ │─────────────────────────────────►│
│ │ │
│ │ │ 8. Three recipients
│ │ │ unlock cooperatively:
│ │ │ K = Shamir-Reconstruct(share1, share3, share5)
│ │ │ Klartext = AES-GCM-Decrypt(Chiffrat, K)
│ │ │
│ │ │ 9. Review, research,
│ │ │ class action, report...
│ │ │
│ 10. Later: enter token │ │
│ sees processing status │ │
│ can add more │ │
│──────────────────────────────────────────►│ │
│ │ │
│ No one knows the identity of the whistleblower.
│ Not the server either. Not Offenes Werkzeug either.
04 · Ecosystem
How WARTE interacts with Evidentia and Corpus.
The three projects complement each other but never exchange personal data. Linking happens exclusively via institutional fingerprints — the same technique as with Evidentia.
Evidentia·Affected people
from outside, documented
Individual citizens document personal legal problems. Generate fingerprints of their cases. Learn: "3 more people have reported problems with this institution."
Corpus·Public data
from above, made visible
Crawlers comb public sources (RIS, Parliament, Ediktsdatei, procurement register). Detect structural patterns — award concentrations, unanswered inquiries, suspicious rezonings.
WARTE·Inside sources
from inside, anonymous
People with insight into an organization provide concrete tips with documents — anonymously, cryptographically secured, distributed to several independent recipients.
Linking happens via fingerprint tokens, not via identities:
[EVIDENTIA] Fingerprint: {institution_hash: a3f...}
→ matching-pool.example
[WARTE] After a report: only institution_hash is exported
→ matching-pool.example
[CORPUS] Detects pattern with institution_hash = a3f...
→ linked with other cases
┌─── Corpus pattern grows stronger ───┐
│ 3 Evidentia fingerprints │
│ + 1 WARTE tip │
│ + 2 public anomalies │
└────────────────────────────────────┘
→ Klagsverband gets a signal: "Here is a pattern cluster,
the individual check is worthwhile."
→ No one learns: who the whistleblower was, who the Evidentia users are, which documents exist. Only the institution and the fact of the clustering are visible.
05 · Rules
Seven promises that stand in the code.
Not as a declaration of intent — as constraints the code cannot circumvent.
01
No operator access to plaintext
The respective instance operator runs the server but cannot read the content. The architecture makes this technically impossible — no master key, no backdoor, no "copy kept for emergencies". Even if we wanted to, we could not.
02
No IP storage, no logging
Access logs are completely disabled. The Tor hidden-service descriptor logs nothing beyond rendezvous circuits. Reverse-proxy logs are directed to /dev/null.
03
Open source + reproducible builds
AGPL-3.0. Every server version is published with a hash. Anyone can compare the running instance with the public source code. No secret patches.
04
Federatable
Anyone can run their own WARTE instance — other NGOs, other countries. The protocol specification is open, the recipient set configurable. If one instance is shut down, other instances keep working.
05
Recipient without going it alone
No single recipient can reconstruct the identity or the content alone. At least three of five must cooperate. This protects against corruption, pressure, infiltration of individual bodies.
06
No fees, no registration
No account, no verification, no contribution. The only prerequisite is a browser with Tor access. Any form of login would be an additional attack vector on anonymity.
07
Clear rejection criteria
Recipients commit not to process certain report types: private revenge campaigns without public interest, material from private communication unrelated to institutions, reports against individuals without a public role. This is a stance, not a technical filter — but it is anchored in the recipient code of ethics and a precondition for admission to the recipient set.
06 · Honest warnings
What WARTE cannot deliver.
▲ Residual risk style analysis
Even with the best metadata stripping, language, phrasing and substantive knowledge remain. Anyone naming details in a report that only three people can know is identifiable — no matter how good the technology. The stylometric sanitizer can only point this out. The person themselves must decide.
▲ Legal protection not automatic
The Whistleblower Protection Act (HSchG) applies only to certain types of reports and when the formal reporting channels were used. WARTE is not a certified internal or external reporting channel within the meaning of the law. The legal dimension must be checked in parallel — ideally with a lawyer specialized in HSchG before reporting.
▲ Tor use is conspicuous in some contexts
In restrictive work environments (authorities with monitoring, corporations with DLP systems), even the use of Tor can be logged. Recommendation: not from the work device, not from the company network, not signed in with a personal Google/Apple ID at the same time. From a private device, from a home or public Wi-Fi.
▲ No protection against everything
Anyone physically threatened needs personal protection, not a protocol. Anyone legally prosecuted needs lawyers. WARTE protects the technical anonymity of the submission. The rest is beyond our reach.
07 · Implementation
What really has to be built.
PHASE 01 · protocol specification (2 months)
· Finalize the cryptographic protocol (age + Shamir)
· Recipient key management (GPG, ceremony)
· Threat-model review with the security community (epicenter.works, noyb, Ottakring whistleblower research)
PHASE 02 · reference implementation (3 months)
· Client: React + age-js + shamir-js, as a static page for onion hosting
· Server: Go or Rust (small, auditable), SQLite for minimal state storage
· Metadata stripper suite (EXIF, PDF, DOCX, tracking dots)
· Documentation with threat scenarios and countermeasures
PHASE 03 · recipient onboarding (2 months)
· Agreements with Klagsverband, VKI, ZARA, investigative journalists, a data-protection lawyer
· GPG ceremony (public, live, so that all shares are generated trustworthily)
· Training on Shamir combination and handling of reports
PHASE 04 · soft launch (1 month)
· First .onion service live, documented operation
· Security audit by an external firm (positive results before public launch)
· Open-source release on Codeberg
PHASE 05 · public launch + federation
· Press conference jointly with recipient bodies
· Documentation for third parties who want to run their own WARTE instances
· Integration with the Evidentia corpus fingerprint pool
Now it needs
Team, budget, legal protection, recipients.
WARTE is technically specified but not yet built. This needs four developers with cryptography experience, five institutional partners as recipients, a lawyer specialized in HSchG, and about €150–200k for 8 months of development. Fundable via netidee, EU Direct Managed, US foundations (NLnet, OTF).
Contribute Concept as PDF