Secure File Sharing for Activists: Stay Safe Online
Activists and human rights workers need secure file sharing tools. Learn encrypted transfer methods that protect against surveillance and censorship.
Activists, journalists, and human rights workers face a distinct threat model: state-level adversaries, targeted malware, network surveillance, device seizure, and social engineering against contacts. Secure file sharing for this audience requires end-to-end encryption where keys never touch any server, Tor-routed transport to defeat IP-level tracing, metadata scrubbing, plausibly deniable storage, and distributed fallbacks when primary services get blocked. Off-the-shelf tools like WeTransfer or Dropbox are inadequate here because they retain IP logs, require accounts, and respond to subpoenas in their home jurisdictions. Below is a practical threat-model-first approach.
Start With a Written Threat Model
Before picking tools, write down who you're defending against, what they want, and what they can do. A climate activist in Berlin tracking lobbying documents faces a different adversary than a Belarusian journalist leaking regime documents. The Electronic Frontier Foundation's Surveillance Self-Defense guide suggests answering five questions: what do I want to protect, from whom, how bad is it if I fail, how likely is the threat, and how much effort am I willing to spend.
A domestic activist in a democracy worries about civil discovery, corporate counter-surveillance, and doxxing. An activist under an authoritarian regime worries about signals intelligence, device confiscation, border searches, and network-level blocking of services like Signal or Tor. The tools that work for one often fail for the other.
Tor Browser Is the Baseline for Transport
For anyone under network-level surveillance, uploads should go over Tor. Tor Browser (built on Firefox ESR) routes traffic through three relays, so the transfer service sees only a random exit node, not the uploader's real IP. For countries blocking Tor directly (China, Iran, Russia at various times), bridges like obfs4 and meek-azure disguise Tor traffic as ordinary HTTPS.
OnionShare deserves a direct mention because it's built for this exact use case. It runs a temporary Tor hidden service on the user's own computer, generates a .onion URL, and lets the recipient download directly. No third-party server, no central logs, nothing to subpoena. The trade-off is that sender and receiver both need to be online simultaneously (unless running OnionShare on a persistent server).
Signal for Link Delivery, Not File Transfer
Signal is the gold standard for messaging but a mediocre file transfer tool. Its attachment size cap (100 MB at time of writing), stored briefly on Signal's servers in encrypted form, makes it unsuitable for anything larger than a small document bundle. Use Signal to deliver transfer links and decryption passwords, never the same channel for both. A link in Signal, the password over an in-person meeting or a separate Session channel, keeps the two halves apart if one endpoint is compromised.
Session (built on the Loki network), Briar (peer-to-peer over Tor and Bluetooth), and Matrix with Olm/Megolm encryption on self-hosted homeservers are alternatives when Signal itself is blocked or when phone-number-based signup is too exposing.
Client-Side Encryption Services
For the file itself, pick services that encrypt in the browser before upload:
- Cryptpad (French, GDPR-compliant, zero-knowledge by design)
- HexaTransfer (client-side AES-256-GCM, no account, 7-day max retention, 10 GB cap)
- Tresorit Send (Swiss, client-side encryption, password-protected links)
- Proton Drive Share (Swiss, integrated with ProtonMail)
Avoid: WeTransfer (server-side only), Google Drive (subject to US legal process, scans for some content types), iCloud (same), any service requiring a phone number for signup.
Check two things in every privacy policy: the IP retention period and the jurisdiction. Switzerland and Iceland have strong legal protections; the US and UK have broad warrantless request powers under CLOUD Act and the Investigatory Powers Act respectively.
Metadata Is Often More Dangerous Than Content
A .jpg pulled from a phone carries GPS coordinates, device model, and sometimes serial-number-derived identifiers in EXIF. A .docx embeds the author's OS username. A .pdf embeds creation software and often author name. Before sharing, strip it.
For images: exiftool -all= photo.jpg clears EXIF on Linux and macOS. On Android, Scrambled Exif is a trusted F-Droid app. For documents: export to .pdf then run Adobe Acrobat's "Sanitize Document" or use LibreOffice's "Remove personal information" option under Tools > Options > LibreOffice > Security. For videos, ffmpeg with -map_metadata -1 removes container metadata.
Rename files before upload. report-draft-v3-alice.pdf gives investigators three data points. file.pdf gives none.
Compartmentalization of Devices and Accounts
Use a dedicated device or VM for activism work. A Tails USB boot (Tor-routed, amnesic) leaves no trace on the host computer. Whonix runs two VMs (gateway and workstation) that force all traffic through Tor. Qubes OS isolates each activity into its own VM.
On the account side, every sensitive activity gets its own email, funded through anonymous means if payment is required (cash-bought gift cards for VPS services, Monero for anything requiring crypto). The goal is that compromise of one account or device doesn't cascade to the others.
Dead Drops and Plausible Deniability
Sometimes the safest transfer is one that doesn't look like a transfer. Dead-drop patterns: upload an encrypted file to a public paste service under a random name, share the URL and decryption key through separate channels. Hidden volumes in Veracrypt containers let an adversary who compels disclosure of a password see only innocuous files, while the real payload remains in a hidden volume whose existence can be denied.
For higher-risk work, SecureDrop (run by the Freedom of the Press Foundation, deployed by The Guardian, The New York Times, Washington Post, and others) provides a Tor-only submission system where sources upload through a hidden service and journalists retrieve via air-gapped workstations. SecureDrop is purpose-built for the leak-to-journalist pattern and is worth learning if that's the use case.
What to Do If a Device Is Seized
Assume compromise when a device leaves your physical control. At border crossings, before detentions, or after a known targeted attack, devices should be considered fully compromised. Practical steps:
- Use a burner device for travel with only the apps and accounts you can afford to expose
- Enable full-disk encryption (FileVault, BitLocker, LUKS) with a passphrase not reused elsewhere
- Power off before crossing borders (encryption keys wipe from RAM on cold boot)
- Have a pre-agreed duress signal with trusted contacts (a specific phrase in the next message means "account compromised, disregard prior messages")
After seizure, rotate every password, revoke every active session (Signal: Settings > Linked Devices; Google: Security > Your Devices), and assume any file you transferred in the past week is in adversary hands.
Resources Worth Bookmarking
The Electronic Frontier Foundation's Surveillance Self-Defense (ssd.eff.org), Access Now's Digital Security Helpline (accessnow.org/help), Tactical Tech's Security in a Box, and the Freedom of the Press Foundation's training materials cover this ground in depth. For region-specific threats, local digital rights organizations (Derechos Digitales in Latin America, APC globally, 7amleh in Palestine) publish context-specific guides.
Try it at hexatransfer.com — free, no account, 10 GB max.
Send large files securely with end-to-end encryption
Transfer files up to 10 GB for free with end-to-end encryption. No account required. Your files are encrypted in your browser before upload — no one else can read them.
Send a file