When journalists can’t keep secrets
Few journalists use secure communication tools that are widely available and easy to use.
Brave journalists have defied court orders and have even been jailed rather than compromise their ethical duty to protect sources. But as governments increasingly record their citizens’ every communication — even wiretapping journalists and searching their computers — the safety of anonymous sources will depend not only on journalists’ ethics, but on their computer skills.
Sadly, operational computer security is still not taught in most journalism schools, and poor data security practices remain widespread in news organisations. Confidential information is sent over regular phone lines and via text messages and e-mail, all of which are easy to intercept. Few journalists use secure-communication tools, even ones that are widely available and easy to use.
Government officials often attempt to get journalists to reveal their sources by obtaining subpoenas and compelling testimony and the required telecommunications records. But sometimes that’s not even necessary, because sources have already been exposed by their own lax communications.
Dangerous mistakes
As an expert on privacy and government surveillance, I regularly speak with journalists at major news organisations, here and abroad. Of the hundreds of conversations I’ve had with journalists over the past few years, I can count on one hand the number who mentioned using some kind of intercept-resistant encrypted communication tools. Even when journalists try to do the right thing, they still make dangerous mistakes, like relying on Skype. Skype is slightly more secure than phones but is by no means safe from snooping — which can be done with commercially available interception software.
Last month, France’s interior minister, Claude Guéant, admitted that intelligence agencies had obtained detailed lists of calls made by a journalist at Le Monde. This enabled them to identify a government whistle-blower who had revealed sensitive information about a legal investigation into the billionaire Liliane Bettencourt.
Journalists aren’t completely to blame for their lack of computer security expertise — after all, journalism schools have taught them to write, not to play “Spy v. Spy.” The blame also lies with universities that don’t teach these skills, and with news organisations that invest their tight technology budgets in fancy Web sites but not security training.
The newspaper you are reading isn’t exempt from my criticism. In June 2010, Bill Keller, then the executive editor of The New York Times, and Alan Rusbridger, editor of The Guardian, discussed WikiLeaks’s cache of classified cables over an unencrypted international telephone line, as Keller has recounted.
That The Times did not have a readily available means of secure telecommunications is troubling, given that whistle-blowers have, over the past decade, helped The Times expose numerous classified intelligence operations, including the fact that the NSA had illegally snooped on the international phone calls of thousands of Americans.
Shortly after The Wall Street Journal introduced a Web site for secure leaks in May, privacy advocates discovered critical security problems, including poorly chosen encryption algorithms, vulnerability to interception, and a privacy policy that reserved the right to disclose information about the source “to law enforcement authorities or to a requesting third party, without notice.”
Many major media organizations have distanced themselves from WikiLeaks, which, they tell us, is reckless, and does not engage in real journalism. The announcement this week by WikiLeaks’s founder, Julian Assange, that it might close because companies like MasterCard and Visa will no longer process donations to the group, highlights the threat the group faces.
But if the hallmark ofquality journalism is the ability to protect confidential sources, then WikiLeaks should, in fact, be seen as a beacon of best practices. In contrast to the shameful practices of most journalists, WikiLeaks has spectacular operational security: encrypted instant messages are used for all real-time communications, strong encryption technology is used to protect files as they are passed between individuals, and servers are hidden using the Tor Project, a popular privacy tool that enables anonymous communication.
Whatever one thinks of Assange, he is a skilled data security expert. He knows an awful lot more about information security than even the most tech-savvy journalist. His platform appears to have worked: none of WikiLeaks’s confidential sources have ever been exposed by the organisation. (Bradley E Manning, the detained Army private who has been accused of the leak, was exposed by an acquaintance.) Until journalists take their security obligations seriously, it will be safer to leak something to WikiLeaks — or groups like it — than to the mainstream press.
