The smallest actions can have massive repercussions. The US army's decision to enlist Bradley Manning as an intelligence analyst and deploy him to Iraq may, if he is found to have indeed been WikiLeaks' source, have led to the biggest series of military and diplomatic leaks in history.
But the reason Manning is now in military detention, awaiting court martial, perhaps ultimately lies in a smaller action still, an error thousands of email users make daily: choosing "cc" rather than "bcc".
In a plea for donations sent in 2009, that simple error led Julian Assange to inadvertently reveal the identities of WikiLeaks' first 58 supporters to each other. One, ex-hacker Adrian Lamo, decided to use this as an opportunity to test the whistleblowing site's honesty – and "leaked" the email list to WikiLeaks.
WikiLeaks passed Lamo's test, and published its own donor list in full, attracting coverage on tech and security sites across the internet.
And it seems that's how, a year later, when an isolated Bradley Manning was looking for someone to talk to, someone he could trust, he apparently happened upon Lamo.
If logs documenting the interactions between the two, released this week, are genuine, Manning introduced himself, they talked, and within minutes spilled out secret after secret about the masses of documents he'd passed to a "crazy white haired Aussie who can't seem to stay in one country very long".
The rest is history. Lamo turned over the chatlogs to US authorities. Manning was promptly arrested. Wired magazine received the chatlogs from Lamo a year ago, and published extracts. On Wednesday, more than a year later, they published them in full.
The new material in the chatlogs is revealing and disturbing. Shortly after assuring Manning of the confidentiality of their discussions – "I'm a journalist and a minister. You can pick either, and treat this as a confession or an interview (never to be published) & enjoy a modicum of legal protection" – conversation turns to WikiLeaks.
"I've been a friend to WikiLeaks," writes Lamo. "I've repeatedly asked people who download Hackers Wanted to donate. Whether I've given material, isn't material. Semi-pun intended."
"I know," Manning replies. "Actually how I noticed you."
Would Manning still have found and trusted Lamo without the leak a year before? It's impossible to say, and certainly unfair to lay the blame for Lamo's actions at WikiLeaks' door – but what the incident does underscore is that source protection is about far more than computer security.
Throughout the logs, this is a truth Lamo seems to understand while Manning does not. The two make a human connection: they discuss mutual acquaintances, LGBT issues and the Washington gay scene. Lamo even – to an extent – flirts with Manning and compliments his appearance.
If Lamo was always intending to turn Manning in, such conversation and apparent support makes difficult reading. Lamo even offers Manning apparent warning of the danger of trust: "I feel connected to everybody … like they were distant family," Manning says.
"I get that," Lamo responds. "Which is why I'm sad for the people i sometimes have to hurt."
Later, he warns "only the people you trust can fuck you – infowise".
The logs, which are impossible to authenticate but which are consistent with other sources, show Manning and Lamo were communicating via encrypted instant messaging. They discuss at length the security precautions – the anonymising tool Tor, a secure channel and an encrypted online server – Manning took when allegedly leaking the material, which Lamo praised as robust. Manning boasted "an NSA guy" on the site had noticed nothing.
Manning didn't appreciate that the electronic security of the connection between source and recipient is a tiny part of the leaking process. On the technical side, access and traffic logs on the military network are totally unaffected by the security – or lack thereof – of WikiLeaks' or any other submission network.
What is covered even less is human frailty. Manning emerges from the logs as intellectually confident, politically courageous, but personally enormously vulnerable. In need of support, Manning spoke to strangers he believed would be sympathetic.
Could Manning have spoken to WikiLeaks for this reassurance? It seems not. Julian Assange boasts of "systems" in place to ensure he can have no idea as to the identity of a source. These – as these logs corroborate – are non-existent: Manning communicated directly with Assange.
Assange was keen to keep this relationship remote, likely believing this best protects both him and his sources. "He knows very little about me," Manning wrote. "He takes source protection uber-seriously. 'Lie to me,' he says."
Assange may never have known Manning's name, his motivations, or other details. The extent of the relationship would matter little for the source's (virtually non-existent) legal protection, certainly under US law. It is difficult to see who is protected by an arm's-length relationship with regular sources, other than WikiLeaks itself.
Sources are often vulnerable. By passing secrets or documents from the organisations they are committed to – especially in all-encompassing environments like the military – they further isolate themselves from those around them. Forging a human relationship is often necessary for both source protection and often human decency.
WikiLeaks' submissions page – which still cannot accept electronic submissions – makes a series of boasts: "WikiLeaks has never revealed a source," it says. "We cannot comply with requests for information on sources because we simply do not have the information to begin with. Similarly we cannot see your real identity in any anonymised chat sessions with us."
Such statements are technically true. But what matters is not who reveals a source, but whether a source is found. Solving just one technical problem is not enough. WikiLeaks has also boasted of legal protections offered to sources. "Submitting documents to our journalists is protected by law in better democracies," it claims, reassuringly.
When the Wall Street Journal set up a site whose terms and conditions set out in detail the legal limitations of protections the site could offer, it was ridiculed on the WikiLeaks Twitter feed.
But perhaps the Lamo/Manning chatlogs offer WikiLeaks an opportunity to simplify their thinking. What matters is whether public interest whistleblowers are protected, and stay anonymous – not who reveals them.
WikiLeaks' greatest source is currently in prison. Instead of stressing no one has been caught through WikiLeaks actions, or boasting of security, WikiLeaks – and everyone else working in that world – should take a long look at what they can do better, and put the results into action.
If not, Manning may not be the last whistleblower to face the consequences.
James Ball @'The Guardian'
But the reason Manning is now in military detention, awaiting court martial, perhaps ultimately lies in a smaller action still, an error thousands of email users make daily: choosing "cc" rather than "bcc".
In a plea for donations sent in 2009, that simple error led Julian Assange to inadvertently reveal the identities of WikiLeaks' first 58 supporters to each other. One, ex-hacker Adrian Lamo, decided to use this as an opportunity to test the whistleblowing site's honesty – and "leaked" the email list to WikiLeaks.
WikiLeaks passed Lamo's test, and published its own donor list in full, attracting coverage on tech and security sites across the internet.
And it seems that's how, a year later, when an isolated Bradley Manning was looking for someone to talk to, someone he could trust, he apparently happened upon Lamo.
If logs documenting the interactions between the two, released this week, are genuine, Manning introduced himself, they talked, and within minutes spilled out secret after secret about the masses of documents he'd passed to a "crazy white haired Aussie who can't seem to stay in one country very long".
The rest is history. Lamo turned over the chatlogs to US authorities. Manning was promptly arrested. Wired magazine received the chatlogs from Lamo a year ago, and published extracts. On Wednesday, more than a year later, they published them in full.
The new material in the chatlogs is revealing and disturbing. Shortly after assuring Manning of the confidentiality of their discussions – "I'm a journalist and a minister. You can pick either, and treat this as a confession or an interview (never to be published) & enjoy a modicum of legal protection" – conversation turns to WikiLeaks.
"I've been a friend to WikiLeaks," writes Lamo. "I've repeatedly asked people who download Hackers Wanted to donate. Whether I've given material, isn't material. Semi-pun intended."
"I know," Manning replies. "Actually how I noticed you."
Would Manning still have found and trusted Lamo without the leak a year before? It's impossible to say, and certainly unfair to lay the blame for Lamo's actions at WikiLeaks' door – but what the incident does underscore is that source protection is about far more than computer security.
Throughout the logs, this is a truth Lamo seems to understand while Manning does not. The two make a human connection: they discuss mutual acquaintances, LGBT issues and the Washington gay scene. Lamo even – to an extent – flirts with Manning and compliments his appearance.
If Lamo was always intending to turn Manning in, such conversation and apparent support makes difficult reading. Lamo even offers Manning apparent warning of the danger of trust: "I feel connected to everybody … like they were distant family," Manning says.
"I get that," Lamo responds. "Which is why I'm sad for the people i sometimes have to hurt."
Later, he warns "only the people you trust can fuck you – infowise".
The logs, which are impossible to authenticate but which are consistent with other sources, show Manning and Lamo were communicating via encrypted instant messaging. They discuss at length the security precautions – the anonymising tool Tor, a secure channel and an encrypted online server – Manning took when allegedly leaking the material, which Lamo praised as robust. Manning boasted "an NSA guy" on the site had noticed nothing.
Manning didn't appreciate that the electronic security of the connection between source and recipient is a tiny part of the leaking process. On the technical side, access and traffic logs on the military network are totally unaffected by the security – or lack thereof – of WikiLeaks' or any other submission network.
What is covered even less is human frailty. Manning emerges from the logs as intellectually confident, politically courageous, but personally enormously vulnerable. In need of support, Manning spoke to strangers he believed would be sympathetic.
Could Manning have spoken to WikiLeaks for this reassurance? It seems not. Julian Assange boasts of "systems" in place to ensure he can have no idea as to the identity of a source. These – as these logs corroborate – are non-existent: Manning communicated directly with Assange.
Assange was keen to keep this relationship remote, likely believing this best protects both him and his sources. "He knows very little about me," Manning wrote. "He takes source protection uber-seriously. 'Lie to me,' he says."
Assange may never have known Manning's name, his motivations, or other details. The extent of the relationship would matter little for the source's (virtually non-existent) legal protection, certainly under US law. It is difficult to see who is protected by an arm's-length relationship with regular sources, other than WikiLeaks itself.
Sources are often vulnerable. By passing secrets or documents from the organisations they are committed to – especially in all-encompassing environments like the military – they further isolate themselves from those around them. Forging a human relationship is often necessary for both source protection and often human decency.
WikiLeaks' submissions page – which still cannot accept electronic submissions – makes a series of boasts: "WikiLeaks has never revealed a source," it says. "We cannot comply with requests for information on sources because we simply do not have the information to begin with. Similarly we cannot see your real identity in any anonymised chat sessions with us."
Such statements are technically true. But what matters is not who reveals a source, but whether a source is found. Solving just one technical problem is not enough. WikiLeaks has also boasted of legal protections offered to sources. "Submitting documents to our journalists is protected by law in better democracies," it claims, reassuringly.
When the Wall Street Journal set up a site whose terms and conditions set out in detail the legal limitations of protections the site could offer, it was ridiculed on the WikiLeaks Twitter feed.
But perhaps the Lamo/Manning chatlogs offer WikiLeaks an opportunity to simplify their thinking. What matters is whether public interest whistleblowers are protected, and stay anonymous – not who reveals them.
WikiLeaks' greatest source is currently in prison. Instead of stressing no one has been caught through WikiLeaks actions, or boasting of security, WikiLeaks – and everyone else working in that world – should take a long look at what they can do better, and put the results into action.
If not, Manning may not be the last whistleblower to face the consequences.
James Ball @'The Guardian'
No comments:
Post a Comment