(THIS ARTICLE IS MACHINE TRANSLATED by Google from Norwegian)
Alerting has always been an activity for the bravest among us. In a democratic society, it is essential that information on critical matters is released so that people in positions of power can be held accountable. Equally, the huge monitoring capacity that has developed over the past decades – along with strong retaliation against whistleblowers who have emerged – has made the threshold for alert very high.
It is the responsibility of the press to report on matters people should know about – but this assignment depends on having sources. What should today's media houses do to better facilitate notification?
An impossible choice. Let's try to see it all from the whistleblower's point of view. A potential forerunner is like everyone else, until the day she stumbles upon information that can't withstand the light of day – and who should just see it for that reason. Probably the potential alerter gets this information through their job. The inevitable choice is an impossible choice: to be silent, and thus to be part of something that is contrary to one's own conscience, or to warn, and to have his life systematically thrown into gravel. Most people choose to remain silent, and that is not without reason. When Daniel Ellsberg in 1971 warned that US authorities had led the people to light on the situation in Vietnam, he was prosecuted under the Espionage Act of 1917. The case was rejected when it was revealed that the FBI had used illegal interception to gather evidence against Ellsberg. However, during Obama's presidency, US authorities have repeatedly used the Espionage Act against whistleblowers repeatedly, including Chelsea Manning (formerly known as Bradley Manning) and Edward Snowden.
The possibility of being dragged through a costly lawsuit during an indictment that portrays notification as a country fraud is bad enough – but it doesn't stop there. If one reveals system failure in powerful organizations, one must expect to both lose the job and be shadowed and harassed by his former employer. One cannot expect to be relevant to other employers, and so it becomes to have the status of notifications almost equivalent to giving up their profession and career, and accepting an uncertain financial future.
Dramatically. This description of reality applies to both sides of the Atlantic. Last week, the whistleblowers Kathryn Bolkovac and Mariah Bamieh visited Oslo in connection with "Whistleblower Week" organized by the Nansen Peace Center and the Norwegian Peace Council. Both have warned of critical issues within international organizations that would assist in the reconstruction of law and order in the Balkans – and both could tell that the warning had been a huge personal burden that also resulted in unemployment and financial difficulties. Bolkovac served in Bosnia in the late 90s, warning of human trafficking and forced prostitution, involving both international police investigators, UN staff and diplomats. She never got a job as a police investigator again. Bamieh lost her job as a prosecutor in the anti-corruption organization EULEX in Kosovo last year, after announcing corruption inside the organization, and was clearly marked by the dramatic changes in the life situation her status that has resulted in.
The monitoring capacity of the world's intelligence services is galloping.
The threat. If you are to accept that these are the potential consequences that you are facing as notifiers, you should at least know that the thing you are notifying is taken seriously and brought to light by the media before deciding to take the full step. But when the monitoring infrastructure is as complete as it is today, even investigating the possibility of alerting can be a risky act. Maybe you want to investigate the legislation around the case you want to notify, look up which media and journalists may be relevant to handling the case, and investigate technical solutions for anonymous online notification? Such actions will be red flags that may put the potential alert in the spotlight to the government or employer. Prior to the Internet's emergence, one might have copied documents manually, called a journalist from a telephone booth and agreed to some form of physical handover. The possibility of being discovered at the wrong time was very much present, but still the threat picture was far easier to see than it is today.
Confidence is crucial. Assessing the threat picture that you are facing as a warning today requires far more technical expertise and knowledge of what kind of monitoring capacity lies in the infrastructure you use than before. Technical requirements, both for whistleblowers and journalists handling the cases, are far higher, and even small errors can reveal the whistleblower's identity. It does not take very many pieces of information to de-anonymize a person who wants to be anonymous. This is especially true if those who attempt to de-anonymize are intelligence services with access to monitor large portions of the infrastructure both on the Internet and mobile networks. The sources are also vulnerable to errors made by journalists handling the material. Runa Sandvik, who is a data security and privacy advisor for the Freedom of the Press Foundation, revealed during the Nordic Media Days in May that a large Norwegian media house recently released its own sources in a sensitive case by posting gossiped images online where the names of the sources were a part of the html code. Sandvik also criticized Aftenposten for offering a "safe" alert method that is in fact uncertain – an offer Aftenposten still claims to have after being made aware of the security holes. Such mistakes and shortcomings must be avoided by Norwegian media houses and journalists if it is possible for prospective whistleblowers to have confidence that their case is in good hands.
To notify anonymously. Building technical solutions to protect the identity of whistleblowers has been high on the agenda for a new generation of hackers and activists over the past decade. Wikileaks attracted whistleblowers who put on highly explosive material by providing a platform for anonymous notification where even the recipient of the documents could not find out who was behind the alert. Wikileaks' platform went down in 2010 after a defender took both the encryption key and unpublished documents on the organization. Since then, several other solutions have been built around the same idea. Some have tried to start centralized organizations modeled by Wikileaks, while others have focused on creating software that media and journalists can use to set up a secure method of notifying them directly.
Freedom of the Press Foundation offers the Secure Drop program that among other NRK Beta users. Another alternative is GlobaLeaks. Both are free open source programs, and set up alert platforms on the dark web that you must use the anonymization tool Tor to access. In this way, neither the recipient of the documents nor outsiders who monitor the traffic can find out who was notified. In early May, the news came that Wikileaks has also come up with a new platform for anonymous notification on its website, after over four years down. The monitoring capacity of the world's intelligence services is evolving, and it is therefore a challenge to maintain an alert platform that can keep even the NSA at a distance. The former Wikileaks platform – used by Chelsea Manning in 2010 to leak documents on Afghanistan and Iraq, among others – is today outdated and uncertain.
What does an alert need to think about? Are you one of those people with information you think belongs to the public but unsure of how to proceed? Then there are some considerations worth thinking about. The first thing you should decide on is whether you want to remain anonymous or whether you want to stand up. You should also think about whether anonymity is possible at all: Maybe there are so few who have access to that information that you are likely to be disclosed even with anonymous notification? Or maybe it is necessary that a person openly stand up to raise awareness of the matter? If you want to stand out, you first and foremost need a media strategy and a strategy for any legal issues. However, if you prefer – and have the opportunity – to remain anonymous, it is important that you do not change your habits online, do not tell anyone about the alert plans, and do nothing about the computer you use for work. Take a laptop with you to an internet cafe, install the Tor tool, and read up on how you can notify anonymously using Torbrowser. The services that offer anonymous notification also have detailed instructions on how to do this. In this way, you minimize the risk of someone noticing that you are considering notifying.
Finally, you should also consider which recipient is best suited to take the case you want to notify further. Wikileaks specializes in major document leaks of global importance, and a threat that includes the military and intelligence services in the most powerful countries in the world. However, if you wish to notify anonymously of a more local case in Norway, the possibilities are unfortunately much more limited. In addition to NRK Beta and a few others, it is thin in the ranks of media houses that offer anonymous notification, and which has the competence to protect notifiers from being revealed through a technical slip. Here, the Norwegian media clearly has a job to do.
Aarseth is a freelance writer and regular contributor to Ny Tid. tori.aarseth@gmail.com.
