Migration overview#
The previous version of SecureDrop was based on three “workstations”:
The Journalist Workstation, where Journalists downloaded new submissions or replied to Sources.
The Secure Viewing Station (or SVS), where journalists decrypted and viewed submissions.
The Admin Workstation, used by Administrators to administer the SecureDrop servers.
Each of these workstations was actually an individual USB flash drive with the Tails operating system installed, used to boot a laptop for each role (in the case of the SVS, this was always a physically air-gapped laptop).
Development on the successor to this Tails-based version of SecureDrop, dubbed SecureDrop Workstation, began in 2017. This new version of SecureDrop replaces the system of Tails USB drives and air-gapped laptops with a single Workstation based on Qubes OS. In the pilot and open beta, a Tails-based Admin Workstation was still needed for administration tasks.
As of late 2026, administrative tasks can be performed on a Qubes-based Admin Workstation. SecureDrop has transitioned completely to Qubes-based Workstations instead of the previous Tails-based USB flash drives.
The Tails-based components are no longer needed, and the Tails version of SecureDrop will no longer be supported by the end of 2027.
This guide will help you migrate your Tails-based Admin and Journalist Workstations to the new Qubes-based Workstations.
Hardware overview#
Workstations#
In the new SecureDrop, every workstation is a laptop running the Qubes operating system with additional software and configurations depending on which roles they will fill.
The Admin Workstation is used by Administrators. It is configured with the tools and credentials needed to administer and install SecureDrop Servers.
The Journalist Workstation is used by Journalists. It has SecureDrop Inbox installed and configured to connect to your SecureDrop Server.
Typically, the Admin Workstation and Journalist Workstation will be different laptops used by different people (Administrations and Journalists, respectively). However, a single laptop can serve as a combined Admin + Journalist Workstation. This configuration accommodates small or cash-strapped newsrooms, where only a single laptop is shared between Administrators and Journalists, or where a single individual fills both roles.
For the initial installation of SecureDrop, you will set up either one Admin Workstation and one Journalist Workstation, or a single combined Admin + Journalist Workstation.
After the initial installation is complete, you may add additional laptops of any type as needed for your organization.
Hardware requirements for new SecureDrop Workstations#
Qubes OS has different hardware requirements compared to Tails. You may have to procure new Qubes-compatible laptops that meet SecureDrop’s requirements in lieu of re-using the laptops you have been using with Tails.
Each Admin or Journalist Workstation requires a Qubes-compatible laptop with the following specifications:
64-bit Intel processor with virtualization support
a minimum of 32GB RAM
sufficient disk space for the Qubes OS base install and SecureDrop software (a 128GB or greater SSD is recommended)
We recommend against a device that requires an external USB keyboard or other externally-connected devices, for security reasons. In practice this usually means that you should use a Qubes-compatible laptop. Not all laptops support Qubes, and some may require additional customization. We recommend (in order) either a Qubes-certified laptop, one of the laptop models we use for development and testing, or a laptop from the community-maintained Qubes Hardware compatibility list. See our specific laptop recommendations for more detail on each of these options.
Printers#
SecureDrop now supports printing directly from the workstation where Source messages and files are decrypted and viewed.
There are several requirements for a printer to be compatible with SecureDrop. Your printer should:
Support driverless printing standards
Have a USB port
Be offline, or at least have no WiFi
These requirements are expanded below.
Driverless#
SecureDrop implements driverless IPP printing to support a large selection of modern printers. Compatible printers can be easily identified by their support for the Apple AirPrint or Moipra standards:
You may consult Apple’s list of printers that support AirPrint, Moipra’s list of certified products, or OpenPrinting’s list of printers supporting driverless printing.
USB ports#
SecureDrop only supports printing over USB, so ensure the printer you select has a USB port.
Note
In rare cases, an AirPrint or Moipra-compatible printer with a USB port may not actually support IPP-over-USB, which is required for SecureDrop to use the printer. Check with the manufacturer if in doubt.
Offline#
To maintain the isolation of SecureDrop, it is essential that your printer not be shared with other computers and networks.
Select a compatible printer with no WiFi. A printer that connects with USB only is best if you can find one, but compatible USB printers lacking both Ethernet and WiFi are rare.
In the case of a printer with Ethernet and/or WiFi, keep the printer offline and disabling WiFi (if present).
Use this printer exclusively with SecureDrop and do not connect it directly to other computers.
Other hardware#
There is no need to upgrade or reinstall the SecureDrop Application and Monitor servers. Likewise for the Network Firewall. The software, configuration, and hardware requirements for these devices are unchanged.
However, if you have been using SecureDrop for awhile, you may take this opportunity to audit your current server and firewall hardware, and replace it if it has reached end-of-life. See our complete hardware recommendations list for servers and firewalls.
Migration scenarios#
- If you are starting with only the Tail-based workstations:
- Install Qubes OS and SecureDrop Workstation packages on the desired number of laptops
One laptop to create a combined Admin + Journalist Workstation
Two laptops to create separate Admin and Journalist Workstations
Perform Admin migration to create new Admin Workstation
Perform Journalist migration to create new Journalist Workstation
- If you already have a Qubes Journalist Workstation (previously called a “SecureDrop Workstation”) and simply want to install the administrative tools on it, turning it into a combined Admin + Journalist Workstation:
Perform the Journalist migration steps on the Qubes current Journalist Workstation
- If you already have a Qubes-based Journalist Workstation and want to migrate your Tails Admin Workstation to a separate Qubes-based Admin Workstation laptop:
Install Qubes OS and SecureDrop packages on the new laptop
Perform Admin migration to create new Admin Workstation
Decommissioning Tails Workstations#
After completing your migration and testing your new Qubes-based Admin and/or Journalist Workstations, securely decommission your Tails USB Workstations.
The USB flash drives used for SecureDrop are all encrypted, either with LUKS or Veracrypt. To securely wipe this kind of storage media, it is necessary to re-format and re-encrypt the drive, following the same steps used in their initial creation. This will destroy the encryption headers, making any data on the drives unrecoverable.
You may also choose to destroy the drives by physical means, such as using a hammer or purpose-built shredder to pulverize the drive.