DEPRECIATED — Qubesclientresearch interview protocol

NOTE

Unsure where the below interview questions originated—they were from an older wiki, imported by Erik on the "created" date shown, here. That said, much of the below contains "leading questions"—which is discouraged. They also presume a lot of IFF crossover, which we've since learned most journalists do not have.

About you

• Can you tell me what is your name?
• What's your background? Is it journalism, technology, or something else?
• Can you tell me what your job title is?
• How long have you been working in [news org]?
• (probe if background is different than job title) and where were you working before that?
• Can you tell me what a typical day looks like for you?
• (probe):
  • How many people are in their team?
  • What type of people do you work with on a daily basis? e.g. Do you work with journalists, digital, security people, or just one type of people

About SecureDrop

• In your words, what is SecureDrop?
• Who in [news-org] uses SecureDrop?
• (probe) What kinds of people? Journalists? Lawyers? Digital/technology people?
  • Why is that?

Usage of SecureDrop

• How long have you been working with SecureDrop?
• Tell me, what kinds of things do you do with SecureDrop?
• (probe) Are there other people that do those things as well?
• (probe if necessary) Why?
• How many times do you check SecureDrop?
• (probe if necessary) Why?
• What time of the day do you check SecureDrop?
• (probe if necessary) Why?
• Tell me, how many submissions have you received through SecureDrop? Don't worry about if they were useful or not. An approximate total number is OK.
• How many documents, files do sources submit?
• What are the alternatives for a source, or whistleblower have to send [news org] submissions?
• What is the most popular method for sources to submit information to [news org]?

SecureDrop workflow

Now I'd like to focus on the last time you checked SecureDrop.

Firstly - it's important that you don't tell me specific details about the particular submission - what it was about, who sent it.

This information is confidential to your organisation, and not important to this research.

If by accident, you do tell me details about submissions, I will remove this from my notes.

Instead, I'd like you to tell me as much detail as you can about each step you had to do.

Physical access

• Tell me about what you have to do to get to the SecureDrop servers and workstations?
• (probe) is access to them restricted? (more than 1 person)
• (probe) what kind of people have access to them?
• (probe) How long did it take you to get access to them?

Downloading files/messages

• So, once you've gotten access to the SecureDrop workstation, what happens next?
• (probes)
• Do you download them or does someone else?
• Do you store them in the same room, or somewhere else?
• Once you've downloaded the files, what do you do next?
  • Do you decrypt them in the same room, or somewhere else?

Inventory of submissions

• Once you've downloaded the files, what do you do next?
• (probe) for example, do you keep a record of submissions?
• How do you update the record?
• (if yes) can you tell me about what that record looks like? Again, I'm interested in how that record looks, not the contents
• Why do you do it like that?
• How do you deal with the metadata, and redacting information in submissions you'd receive?
• What concerns do your journalists have about publishing?
• Do you publish documents? Why?

Useful or not

• So, tell me about what happens next?
• (probe) How do you know if the submission is useful or not?
• What decisions do you make to decide if you're going to use it?
• Where does this decision process happen? In SecureDrop? Outside it?
• Where should this decision process happen?

Getting the submission to Journalists

• So, you've made the decision that the submission is useful, what happens next?
• (probe) how does the submission get to journalist?

General questions?

• How long can this process take?
• Does every submission take the same amount of time?
• How long can it take for a submission to become a story?
• (probe) Is there only 1 message, or does a story take more than 1 message?
• What's wrong with this process?
• How could it be better?
• What other software do you need to use with SecureDrop?
• Are there any issues sources have had with Securedrop?