The quoted article that the author has is pretty hard to read when browsing with a dark theme, so I'm re-posting the section as I feel its worth a read:

----------------------------------

Hosting Under Duress

By Milo Trujillo (illegaldaydream@ddosecrets)

On June 19th, Distributed Denial of Secrets published BlueLeaks, approximately
270 gigabytes of internal documents from U.S. local-LEA/federal-agency fusion
centers, municipal police departments, police training groups, and so on. The
documents have revealed a range of abuses of power, from tracking protestors
and treating journalists and activists like enemies, to willful inaction
against the alt-right, with additional BlueLeaks-based stories emerging each
week. Thank you, Anonymous, for leaking this data!

The retaliation against DDoSecrets has been significant. Twitter promptly
banned @ddosecrets, followed by Reddit's bans of /r/ddosecrets and
/r/blueleaks, all for violating content policies regarding posting personal
information and hacked material. Both blocked the ddosecrets.com domain name in
posts, and Twitter went as far as blocking it in DMs, and blocking
URL-shortened links by following them with a web spider before approving the
message. German police seized a DDoSecrets server on behalf of U.S. authorities
(our hosting providers are geographically scattered), and goons from Homeland
Security Investigations paid a visit to some folks operating a mirror of
DDoSecrets releases, asking questions about the BlueLeaks documents and the
founder of DDoSecrets, ultimately attempting to recruit them as informants and
offering money for info that led to arrests.

None of these actions have hindered distribution of the BlueLeaks documents,
which were released by torrent, and all are directed at the publishers of the
documents, not the hackers that leaked them. Wikileaks maintains an active
Twitter account and has faced no such domain banning. What we have is a
warning: publishing information on U.S. law enforcement, even when clearly in
the public interest, will not be tolerated.

So how do you design server infrastructure to operate in this hostile space,
where third party corporations will ban you and self-hosted servers are liable
to be seized? Distribution, redundancy, and misdirection. All the documents
published by DDoSecrets are distributed by torrent, so there is no central
server to seize or account to ban to halt distribution, and data proliferates
so long as there is public interest. But leaking data is only half of the
DDoSecrets mission statement: raw documents aren't valuable to the public, the
ability to extract meaning from them is. Therefore, DDoSecrets works closely
with journalists and academics to help them access and analyze data, and runs a
number of services to make analyzing leaks easier, like Whispers
(https://whispers.ddosecrets.com/), a search tool for Nazi chat logs, or X-Ray
(https://xray.ddosecrets.com/), a crowd-sourced transcription tool for leaked
business records with formats too challenging to OCR. These services have to be
hosted somewhere.

Static services like Whispers or the homepage are easy: They're set up with
backups and Docker containers and Ansible scripts. If a server disappears, rent
a new one from a different hosting provider and re-deploy with a couple lines
in a terminal. A few services aren't quite so easy to replicate, though. The
Data server maintains a copy of every leak, available over direct HTTPS, mostly
so we can give a URL to less technical journalists that "just works" in their
browser, without walking them through using a torrent client. All the data is
available by torrent and nothing unique is on the server, but finding a new
hosting provider to spin up a 16-terabyte system (not counting redundant drives
in the RAID) and then re-uploading all that data is, to say the least,
inconvenient. The same goes for Hunter, the document-ingesting cross-analyzing
leak search engine. It would be nice if we only had to migrate these servers
infrequently.

The solution for these large servers is to hide them away forever, and make a
repeat of the German seizure unlikely. These servers are now hosted only as Tor
onion sites, and are only connected to, even for administration, via Tor. A
tiny "frontend" virtual machine acts as a reverse-proxy, providing a
public-facing "data.ddosecrets.com" that really connects via Tor to the much
larger system. The reverse-proxy can be replaced in minutes, and doesn't know
anything about the source of the data it's providing.

We'll end with a call to action. None of the design outlined above is terribly
complex, and with the exception of the Tor reverse-proxy, is pretty common IT
practice in mid-sized companies that have outgrown "a single production server"
and want scalable and replaceable infrastructure. The technical barrier for
aiding the cause is low. Hacking has always been about challenging authority
and authoritarianism, and that mindset is needed now in abundance, at
DDoSecrets and beyond. No time to waste - Hack the Planet!