2026-09-26
Contact me (PGP-encrypted)
- Email: samuel.da.shadrach.1@proton.me
- PGP pubkey: horse.pub
What security level do you require?
- For low security
- For medium security
- Use the PGP-encrypted email address listed on this page. I do not check messages frequently on this address, as mentioned.
- For highest possible security
- I do not have security setup sufficient for this. In particular, if you have leaked information you wish to publish, then either submit it to a server listed on the official SecureDrop server directory, or redact and publish it yourself to ethereum blobdata or similar.
Security tips for you
- I recommend creating an anonymous throwaway email just for this chat. Protonmail lets you register anonymous address using cryptocurrency.
- I recommended using PGP encryption.
- By default, I will assume anything sent to me on this address can be shared with no one. I will ask explicit permission before sharing anything.
- A full security guide for you is out of the scope of this post.
Security-related information
- Proof of identity: Video: Proof (2026-09-26)
- Frequency of checking emails: Last checked 2026-09-25. I will check my emails atleast once in three months.
- Warrant canary: Last updated 2026-09-25. I have not received any demands involving access to samuelshadrach.com, the PGP key listed on samuelshadrach.com or the PGP-encrypted protonmail address listed on samuelshadrach.com, either made via legal means or made via credible threats of significant harm. I will update this paragraph atleast once in three months.
- Proof of date: Ethereum block height 26054145, block hash 0xb8fcb9eb649aaca655108057ac2528fd789627cbae2a0c7f32d768444e841106. This proves this document was edited at date equal to or later than 2026-09-25
Security practices I follow
Security, digital
- Dedicated PC for this purpose.
- Inbox and keys accessed on TAILS only.
- 128-bit memorised seedphrase (never used outside of tails) + 128-bit seedphrase in secure physical location (never used outside of tails) + PGP privkey (has left tails). All 3 pieces of info required to decrypt.
- All emails are deleted within 1 month of being read.
Security, physical
- This inbox is only operated from secure physical location. Seedphrase (mentioned above) stored in secure physical location.
- I do not live 24x7 in a secure physical location. I visit secure location to operate the inbox.
- My physical location is not secret. There exist people (including people I don't trust) who know where I live.
Security, social circle / psychological
- Operating solo. No dedicated team
- Only operating part-time not full-time
- No social isolation practised
- Keeping secrets solo may be psychologically unsafe
- Sober since 2026-02
- I blog about my life, which could leave clues about me or my social circle.
Legal
- Do not have significant legal budget
- Likely to cooperate with law enforcement in India in case of investigation. Discretion used on case by case basis.
Server host
- Proton may be preserving email content and metadata (timestamps, file sizes, email addresses used, browser fingerprints, etc)
- Proton has previously cooperated with law enforcement in investigations
- Proton has never encountered a significant breach of data or passwords, as of 2025-06
Why do I maintain a PGP-encrypted email address that I only check once in 3 months?
- You are welcome to contact me on this address for any purpose whatsoever.
- The primary reason I decided to maintain this email address is for a worst-case scenario where you have some leaked information or documents that you wish to publish, but are unable to work with a journalist operating SecureDrop. For example, this could happen if the US govt became more authoritarian and prevented journalists living on US soil from publishing your leak. Since I live in India, it may hence be easier for me to redact and publish your leak.
- As of 2026-09, this is a highly unlikely scenario. In most scenarios, you should not be working with me. You can either submit your leak to a SecurDrop server, or redact and publish the leak yourself. Journalists operating Securedrop typically have a bigger legal budget than I do, they have more previous experience doing redaction than I do, and they may have some political immunity provided by the people funding their media house.
- If however, we end up in a worst case scenario where you are relying on me to redact and publish your leak, then I will probably do my best to actually upgrade my security practises. My current security level as of 2026-08 is only Medium, but there are steps I can take to bring it closer to High, if it were absolutely necessary.
Subscribe
To subscribe, enter "Subscribe " followed by Signal username, email address or whatsapp phone number. You will receive atmost one update per month.
Alternatively, you can subscribe via RSS, or a third-party service like blogtrottr
Comment
Enter comment