{"action":"created","issue":{"url":"https://api.github.com/repos/globaleaks/GlobaLeaks/issues/1422","labels_url":"https://api.github.com/repos/globaleaks/GlobaLeaks/issues/1422/labels{/name}","comments_url":"https://api.github.com/repos/globaleaks/GlobaLeaks/issues/1422/comments","events_url":"https://api.github.com/repos/globaleaks/GlobaLeaks/issues/1422/events","html_url":"https://github.com/globaleaks/GlobaLeaks/issues/1422","id":105736316,"number":1422,"title":"Let the whistleblower to limit the audience of the material attached to an existent submission","user":{"login":"infosquatter","id":6072447,"avatar_url":"https://avatars.githubusercontent.com/u/6072447?v=3","gravatar_id":"","url":"https://api.github.com/users/infosquatter","html_url":"https://github.com/infosquatter","followers_url":"https://api.github.com/users/infosquatter/followers","following_url":"https://api.github.com/users/infosquatter/following{/other_user}","gists_url":"https://api.github.com/users/infosquatter/gists{/gist_id}","starred_url":"https://api.github.com/users/infosquatter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/infosquatter/subscriptions","organizations_url":"https://api.github.com/users/infosquatter/orgs","repos_url":"https://api.github.com/users/infosquatter/repos","events_url":"https://api.github.com/users/infosquatter/events{/privacy}","received_events_url":"https://api.github.com/users/infosquatter/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/globaleaks/GlobaLeaks/labels/A:%20Peruleaks","name":"A: Peruleaks","color":"fbca04"},{"url":"https://api.github.com/repos/globaleaks/GlobaLeaks/labels/F:%20AdopterRequest","name":"F: AdopterRequest","color":"d4c5f9"},{"url":"https://api.github.com/repos/globaleaks/GlobaLeaks/labels/F:%20Submission%20Fields","name":"F: Submission Fields","color":"d4c5f9"},{"url":"https://api.github.com/repos/globaleaks/GlobaLeaks/labels/T:%20Enhancement","name":"T: Enhancement","color":"207de5"},{"url":"https://api.github.com/repos/globaleaks/GlobaLeaks/labels/U:%20Receiver","name":"U: Receiver","color":"009800"},{"url":"https://api.github.com/repos/globaleaks/GlobaLeaks/labels/U:%20Whistleblower","name":"U: Whistleblower","color":"009800"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-09-10T05:45:55Z","updated_at":"2015-10-14T08:24:46Z","closed_at":null,"body":"It was asked by Peruleaks media organizations.\r\n\r\nNeed: to be able to communicate privately with the source AFTER submission is done. It applies both to messages and new uploaded files.\r\n\r\nProblem: the claim is that in the case of a multiple receiver submission, one of the media organizations can start doing its investigation in complicity with the source and - as in the current situation - doing so could just be helping other organizations in their research, thus establishing an unfair competitive dynamic. A receiver should be allowed to communicate and receive files of a submission without helping other receivers in their investigations.\r\n\r\nWorst case scenario: \r\n\r\n1. Source sends files to organization A and B. Organization A is not interested - at first - in the material (or do not have time to investigate it). Meanwhile, organization B is interested and have potential to investigate.\r\n2. Organization B starts a conversation with the source because the files came incomplete or lacking means of authentication.\r\n3. Source sends new files and give further relevant information for the investigation.\r\n4. Step 2 and 3 repeat.\r\n5. Organization A came back to the submission interface and see a lot of new stuff: more files, more information from the source. Organization A decides to publish the information very quickly.\r\n6. Organization A publishes the information before organization B and organization B - who was really keen on making a deep investigation on the issue - loses exclusivity.\r\n\r\nThere are a lot of other case scenarios in which these conditions would be unfair. The basic idea is that an organization cannot take profit of the efforts of another organization in this fashion.\r\n\r\nAlso, source can have different degrees of trust regarding different organizations, despite the fact it submitted the files to these different organizations at the same time.\r\n\r\nMy view: i totally agree. Also because I´m somehow confident that the messaging system of Globaleaks has never actually worked in the way we all expected (maybe because of this issue) and it seems the partners in Peru are really interested in this feature (probably due to conditions of whistleblowing in Peru, which they are all already used to)."},"comment":{"url":"https://api.github.com/repos/globaleaks/GlobaLeaks/issues/comments/147971869","html_url":"https://github.com/globaleaks/GlobaLeaks/issues/1422#issuecomment-147971869","issue_url":"https://api.github.com/repos/globaleaks/GlobaLeaks/issues/1422","id":147971869,"user":{"login":"fpietrosanti","id":770363,"avatar_url":"https://avatars.githubusercontent.com/u/770363?v=3","gravatar_id":"","url":"https://api.github.com/users/fpietrosanti","html_url":"https://github.com/fpietrosanti","followers_url":"https://api.github.com/users/fpietrosanti/followers","following_url":"https://api.github.com/users/fpietrosanti/following{/other_user}","gists_url":"https://api.github.com/users/fpietrosanti/gists{/gist_id}","starred_url":"https://api.github.com/users/fpietrosanti/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fpietrosanti/subscriptions","organizations_url":"https://api.github.com/users/fpietrosanti/orgs","repos_url":"https://api.github.com/users/fpietrosanti/repos","events_url":"https://api.github.com/users/fpietrosanti/events{/privacy}","received_events_url":"https://api.github.com/users/fpietrosanti/received_events","type":"User","site_admin":false},"created_at":"2015-10-14T08:24:46Z","updated_at":"2015-10-14T08:24:46Z","body":"This feature could be maybe implemented trying to address only minimal changes such as:\r\n\r\n- Add on API an optional recipient identifier for a specific file upload\r\n- Add on Database an optional recipient identifier for a specific file upload\r\n- Change backend to return the file list for \"those who have no recipient identifier\" + \"those who have recipienti identifier = logged receiver\" \r\n\r\n- On the UX two modifications side:\r\n  - while clicking \"Upload file\" rather than immediately opening up the file browser to select the file to be uploaded, provide a selector to choose the recipienti \"All | Receiver1 | Receiver2 | Receiver3 | etc...\" \r\n - while displaying the file list, if a file has a specific recipient, display which is the receiver to which it has been sent\r\n\r\nWith this approach, it could be likely possible to implement the feature with minor code changes.\r\n"}}