xTip: Journalist Source Protection

The Problem

Journalist sources stored at single newsrooms are vulnerable to subpoena, hacking, or insider leaks. Source exposure can be life-threatening in authoritarian contexts and career-ending in corporate whistleblowing.

Investigative journalism depends on source protection. Yet the documents, communications, and identity information that connect a source to a story are typically stored on a single newsroom's servers. A government subpoena, a targeted hack, or a rogue insider can expose the entire source relationship in one breach.

Existing tools like SecureDrop protect the submission channel but not the stored documents. Once a document is on a newsroom server, it is as vulnerable as any other file. Shield laws provide legal protection in some jurisdictions but offer no technical guarantee. A compromised server exposes every source the newsroom has ever protected.

The Old Way

The PRIVATE.ME Solution

xTip splits source documents across independent press organizations using XorIDA. Each newsroom holds only a partial share. Pseudonymous aliases decouple source identity from document custody.

When a journalist receives sensitive material, protectSource() splits the documents into N shares distributed across independent newsrooms or press freedom organizations. No single newsroom holds a reconstructable copy. A subpoena to one newsroom produces only an unintelligible share -- mathematically useless without the threshold.

Sources are identified by pseudonymous aliases rather than real names. The alias-to-identity mapping is itself split across custodians using the same threshold scheme. Even the journalist's own newsroom cannot unilaterally deanonymize a source. Document classification via classifyDocument() assigns sensitivity levels that determine the threshold and distribution pattern.

The New Way

How It Works

Source protection operates through three layers: document splitting, alias management, and classification-based routing. Each layer uses XorIDA independently.

Use Cases

Integration

import { protectSource, classifyDocument } from '@private.me/sourcesplit';

// Classify document sensitivity
const classification = await classifyDocument(documentBuffer);
// classification.level: 'CRITICAL' | 'HIGH' | 'STANDARD'

// Protect source with 3 independent newsrooms (2-of-3)
const shares = await protectSource(documentBuffer, 'ALIAS-7X92', [
  'newsroom-a.example',
  'newsroom-b.example',
  'press-freedom.example'
]);

console.log(shares.length); // 3 -- one per newsroom

Security Properties

Verifiable Data Protection

Every operation in this ACI produces a verifiable audit trail via xProve. HMAC-chained integrity proofs let auditors confirm that data was split, stored, and reconstructed correctly — without accessing the data itself.

Ready to deploy xTip?

Talk to Ren, our AI sales engineer, or book a live demo with our team.

Ship Proofs, Not Source

xTip generates cryptographic proofs of correct execution without exposing proprietary algorithms. Verify integrity using zero-knowledge proofs — no source code required.

Use Cases