Protecting Leakers in the Digital Age

June 7, 2017

As volatile and unpredictable as President Trump’s first months in office have been, he has been consistent in his derision of leaks and in calling for the prosecution of those responsible for them.  (As a candidate, he conveniently held a different position.) With the first Trump-era leak prosecution now underway, it seems as if the Department of Justice has taken the president’s marching orders to heart. This is unlikely to be the only leak prosecution we will witness under this administration and Attorney General, bringing to the forefront the question of journalists' responsibility towards leakers in a digital age.

The Winner Leak Investigation

The recent prosecution has been linked to a June 5 story on The Intercept that suggested Russian interference with the elections might have been more profound than was previously known.  The news outlet published a redacted version of the top-secret NSA document upon which the story was based, which it had received through an unknown leaker. Two days before the story went online, 25-year-old government contractor Reality Leigh Winner was arrested and charged with violating 18 U.S.C. Section 793(e) for removing classified material from a government facility and mailing it to a news outlet.

Unsealed court records reveal that the arrest came after a reporter for The Intercept had contacted another NSA government contractor and officials at the NSA in an attempt to verify the document’s authenticity. (The identities of the news outlet and government agency have not been officially released, but there is little doubt they are The Intercept and the NSA.) The reporter also mentioned in at least one of those exchanges that he had received the documents through the mail and that they had been postmarked in Augusta, Georgia, which happens to be where Winner lives. He also shared photographs and copies of the document with them. This information prompted an investigation that quickly pointed to Winner as the potential leak. She confessed shortly afterwards, without the presence of a lawyer, when FBI agents showed up at her door with a search warrant.

Assessing The Intercept’s Actions

The Washington Post’s media blogger Erik Wemple analyzed The Intercept’s actions and argued, as many others have since, that the news outlet’s effort to reach out to government officials in order to assess the authenticity of the document provided authorities with an important lead in their investigation. The reporter revealed where the documents were sent from, and the documents he shared contained important clues as to the leaker’s identity, as can be gleaned from the affidavit: “The U.S. Government Agency examined the document shared by the News Outlet and determined the pages of the intelligence reporting appeared to be folded and/or creased, suggesting they had been printed and hand-carried out of a secured space.” Authorities learned that only six workers had printed the report, including Winner. Winner was the only one of the six on whose computer email exchanges with The Intercept were found. On June 6, The Intercept posted a statement claiming that the information in the government’s affidavit and search warrant contained unproven allegations about Winner and about how the FBI had come to arrest her.

In hindsight, the actions of The Intercept seem troubling. But Wemple mitigates his criticism by stating that the actions stemmed from the legitimate need to verify the documents and by arguing that Winner would have been found out anyway: “Yet the mistakes of the leaker before the Intercept even received the document would likely have sealed her fate, regardless of any clumsiness by the reporter in verifying the scoop.” I am not convinced, however, that the information contained in the affidavit warrants this conclusion. The email exchange she had with The Intercept from her work computer dates from March and contained a request for the transcript of a podcast episode, hardly a smoking gun.

None of the stories I have seen so far emphasizing the ease with which investigators caught Winner have made a convincing argument that the same would have been true had the document not been made available to them by The Intercept. They often seem to assume that ultimately the document would be published, dooming Winner’s chances of remaining anonymous. But news outlets routinely report on classified information without sharing the actual documents with their readers or authorities. Why did this happen here? Making these documents available in their original form amounted to providing the FBI with a roadmap to its target.

As this blogger and security expert points out, the document posted on The Intercept contained enough meta information to determine the serial number of the printer used and the exact time when the document was printed. Like most modern printers, Winner’s printer leaves hard-to-see yellow dots on a document containing this information:   “The document leaked by the Intercept was from a printer with model number 54, serial number 29535218. The document was printed on May 9, 2017 at 6:20.”  Simply scanning the document in black and white before posting it would have eliminated this problem: “To fix this yellow-dot problem, use a black-and-white printer, black-and-white scanner, or convert to black-and-white with an image editor.”

It would be false and unfair to state that The Intercept does not care about the fate of people leaking to them. On its site, it offers potential leakers advice on how to become a whistleblower without being detected.  However, as one security expert noted, the guidelines focus on sending information without being caught, but says nothing about covering your tracks in obtaining the information.

It also makes the following commitment: “At The Intercept, our editors and reporters are committed to high-impact reporting based on newsworthy material. If we decide to go forward with a story, we will have a discussion with you about what risks of retaliation you might face and whether you want to remain anonymous. We will be explicit with you about the parameters of our agreement to protect your anonymity, and we will honor our commitments.”

However, in this case, the news outlet did not know the identity of the leaker and therefore could not engage in this back and forth. But of course, this does not absolve reporters and editors from their obligation to do everything in their power to protect others from identifying the source. Reporting on the document without sharing it in its original form with authorities and readers would have been a more prudent course of action. Perhaps investigators still would have been able to identify Winner as the source, but this speculative assessment has little bearing on the ethical analysis. The SPJ Code of Ethics requires journalists to minimize harm and The Intercept failed to meet this requirement.

The Positive Duty to Protect Leakers

The leaker-reporter relationship is fraught with inequality.  Leakers put everything on the line when leaking classified information. Not only do they risk losing their job when found out, but also their freedom. When they are leaking classified national security information as Winner did, they are typically prosecuted under the 1917 Espionage Act and are facing experienced federal criminal prosecutors, long prison sentences and astronomical legal bills.

Take the case of Stephen Jin-Woo Kim, a State Department contractor who in 2009 leaked highly classified information about North Korea to Fox News reporter Jay Rosen. The journalistic community was up in arms when Rosen was named in an affidavit as a co-conspirator so that a judge would approve a warrant to search his emails (Rosen was never indicted, nor was he ever going to be), but did not bat an eye when Kim pleaded guilty and received a 13-month prison sentence. (Ironically, The Intercept was one of the few media outlets that reported on the devastating effect of the episode on Kim).

Reporters on the other hand, have relatively little skin in the game. As a matter of prosecutorial tradition, journalists are not prosecuted for printing classified information.  No administration (until now) wants to wage a war against the press by putting reporters in jail. Whether the First Amendment precludes them from doing so is not clearly established, and I would not be surprised to see developing case law on this issue under the current administration. However, by and large, reporters do not face the same risks leakers do.

Given this unequal distribution of risk, media organizations should be aware of all the digital trails that leakers can leave behind, and help them erase them, instead of adopting a leaker-beware approach. As is often the case for leakers facing prosecution, Winner was not the most sophisticated leaker. She was not as well-versed in the game of leaks as many D.C. insiders are. But this made her more deserving of moral consideration, not less.  And while The Intercept was unaware of who she was, this ignorance should have lead them to assume she was a source vulnerable to detection. Instead, its actions compounded the mistakes Winner allegedly made.

Digital technologies have made it easier for media outlets to obtain troves of information through leaks and data dumps, but they have also made it easier for the government to follow the digital trail back to the leaker. Traditionally, the source-reporter relationship has mainly required that reporters keep their promises of confidentiality.  Nowadays, a digital trail is more likely to reveal an anonymous source than a reporter’s loose lips, and journalists need to do more than just keep their mouths shut in order to protect the identity of their informants.

Whereas leak investigations were a rarity before this century, the Bush and -especially- the Obama administrations have been much more aggressive in going after leakers, prosecuting more of them than all the previous administrations combined.  This changed landscape leaves leakers in a more vulnerable position than ever before, making it not only the media's positive duty to protect their identity at all cost, but also to advocate for, rather than blame, leakers once they have been caught. As the story unfolds and more facts become known, our assessment of what happened might alter, but this lesson won't.

Bastiaan Vanacker's work focuses on media ethics and law and international communication. He has been published in the Journal of Mass Media Ethics. He is the author of Global Medium, Local Laws: Regulating Cross-border Cyberhate and the editor of Ethics for a Digital Age.