Wikileaks Payback - Offensive and Defensive

[Peter Lemkin]

With all the hoopla that seems eternally to surround WikiLeaks founder Julian Assange, one might easily have formed the impression that WikiLeaks is a thriving concern, and that Assange himself is still the world's most powerful and effective champion of press freedom. While it's true that WikiLeaks has accomplished great things, initiating a powerful worldwide movement toward transparency and free speech, a closer look reveals that recent defections have badly crippled the WikiLeaks organization and that the increasingly erratic, mercurial Assange may have shot his bolt. The defectors have moved on and are developing a successor site, OpenLeaks, which seems likely to take up where WikiLeaks left off.

WikiLeaks has been unable to accept submissions of new documents for over six months. According to former WikiLeaks spokesman Daniel Domscheit-Berg's recent book, Inside Wikileaks: My Time with Julian Assange at the World's Most Dangerous Website, that is because WikiLeaks is no longer in possession of the secure submission platform built by a programmer identified in the book only as "the architect." Both Domscheit-Berg and the architect broke with Assange in September 2010 along with at least four other staffers. When he departed the architect apparently packed up his intellectual property and took it with himsince he felt that WikiLeaks was not being run properly, taking his software back meant that at least he couldn't be held responsible for any disasters arising from its use.

This submission system is a maze of encryptions and techno-obfuscations spread across a worldwide network, designed to make the identity and whereabouts of potential whistleblowers completely untraceable. The implementation of such a system is far more difficult than it might sound. A few things are absolutely necessary in order to prevent all kinds of mess from occurring, both for the leak sites and for the informants they enable. First, there must be no earthly way of knowing where the material comes from, not even under the legal compulsion of a government or court. Second, the material has to be encrypted, so that it can't be read by anyone who might want to steal it. Third, the material has to be kept absolutely secure, backed up in many safe places. This is the sort of system eventually devised by the architect on behalf of WikiLeaks, before he became so furious with Julian Assange that he pulled up stakes and vamoosed.

Other whistleblower initiatives such as the Al Jazeera Transparency Unit, BalkanLeaks
et al. ask (but do not always require) that those submitting documents use the anonymous Tor network to transmit their material across the web. GreenLeaks, which is focused on environmental issues, requests submission by post: you put your stuff on a pen drive and send it along in the mail. You'd think that even one of Len Deighton's lowliest goons could foil this system (wait by mailbox in trenchcoat, etc.), but what the GreenLeaks submissions strategy really suggests is the vulnerability of Internet traffic to detection. This group has decided that, for the moment at least, the ordinary post is safer.

It seems unlikely that just using Tor servers would be enough to protect a source's anonymity completely. Apparently it is possible to track users coming in and out of the Tor network, for example. Though a knowledgeable computer user could protect himself by using anonymous public Wi-Fi connections and so on, until OpenLeaks (or equiv.) is online and able to offer a securely anonymous system for submissions, would-be whistleblowers will be taking more than the ideal zero amount of risk by sending their information over the Internet.

Packet-sniffing technology was scary enough ten years ago. Today it's safe to assume that determined parties can track nearly everything that takes place online. With the kind of heat there must be on every stray packet that even brushes up against the various WikiLeaks domains, it would be crazy for them to accept submissions until they've rebuilt a new, rock-solid system. Thus the architect's departure last September meant that WikiLeaks could no longer accept new documents safely.

In a sense, WikiLeaks has been closed for business since that day.

I don't know exactly why, as of the end of 2010, three months after our departure, the system is still not really back up on its feet. It shows that the current team is overtaxed and perhaps, to some extent at least, just not up to the job. It also shows how unsecure the system is. It has become a security risk for everyone involved.
Daniel Domscheit-Berg, Inside WikiLeaks