06leaks.md 15 KB
Whistleblowing, a friendly double edge sword
Whistleblowing is an ancient practice that has been called many names and is not ethically bound. It can be the link between the source and the journalist, or between the snitch and the military. In both cases, a reserved information goes in the hands of a person considered trustworthy, which transforms this information into an action. Wikileaks and Snowden have made whistleblowing come back full powered, showing how digital communication can simplify the process and protect the integrity of communications between sources and recipients. Anonymity and encrypted storage technologies have propelled this, revolutionary, framing.
I say framing because whistleblowing does not have an ethical value per se, what identify its nature is the political cause motivating it. So if you are a single person going against a powerful organisation, like the US state department, the intelligence community, the financing system, or the Vatican you might be remembered for your heroic behaviour, like Chelsea Manning [^1], Bill Binney [^2], Herve Falciani [^3], Paolo Gabriele and Claudio Sciarpelletti [^4]. Becoming famous in this field often means you have been caught, denounced or that you are in the run, hopefully those outcomes do not apply to all whistleblowers as we will see.
Your informations can empower the citizen in understanding the power dynamics in play, but institutions themselves can also take advantage of those. If the ultimate goal of whistleblowing is making society more transparent in the interest of society itself, this might sound fascinating if you want a revolution, but it can be also very irresponsible for other reasons. Nobody really wants a society in which everyone can be a spy or an anonymous snitch.
This society would just strength the currently established institutions in power. Regimes in which a person can be economically rewarded for snitching on other citizens exemplifies this misuse. Added to that, any structure with some type of power, even your small NGO or political team, benefit of agreements and contracts which are kept private because they require some level of confidentiality. No resistance without well kept secrets is possible.
Transparency for the State (or for “who has enough power to shape our reality”) and privacy for the rest of us? This could work as a nice simplification, but then we should respect this separation in all our political actions and never, ever, expose any private information of other citizens.
I worked with the globaleaks.org team on the creation of its software platform. Our dream, was to create a “portable wikileaks” that could be unleash in every city, media and public company. After all, white collar crime and other corporate misbehaviour can’t be detected neither understood without an insider. My experience comes from deploying it for different groups with different needs. Departing from the made up story below, will see how digital whistleblowing can enhance your political actions and what you should take into account when planning your leak initiative.
Once upon a time...
There was a river getting heavily polluted. Some facility operates nearby and it is clear they are disposing chemical waste. There are rules, periodic checks, policies, but at the end of the day, flora and fauna are getting poisoned. Someone inside must know, but you don’t know anybody who works at the facility.
Your team creates a campaign and solicit sources, but criticism starts because your wordpress blog to receive the leaks has not strong security properties. Therefore you set-up a proper platform (SecureDrop or GlobaLeaks [^5]) that can guarantee anonymity for the source, and encryption for the information exchanged. Even a seizure of the server can’t compromise the security of sources nor your active investigations. This is a privacy by design setup. However despite the platform pick, you know that your initiative is shaking some established power and you fear retaliation. You develop a mitigation plan based in splitting responsibilities among a larger group composed by environmental lawyers, local journalists and some foreign analyst which also receives the leaks. This way, if a person get stopped, the initiative will keep running. However, despite all this security management, after two months you have received zero leaks.
Sadly, we are closed in our bubble, our circles. We communicate to our intended audience and despite our efforts at the end of the day we talk only to persons similar to us. So, nobody working at the facility was in your comfort zone. You’ve to hunt these sources, advertise them personally or massively. In the beginnings, nobody understand why your cause is important. Then you re-frame your message making clear why it matters for the environment, why their role is important, and after some weeks, the first timid source might arrive.
This is just the beginning and when the first article is published, you know this story will be read by facility employees because they talk about their company. And then you explain again why their role matters, how they can send anonymous tip-off, that they are not the first and can do it safely. Gradually, step by step, gaining trust from persons with different values and knowledge, you are getting the flow of information that might be transformed in political outrage, strength, actions. After a while, society takes action and the facility has to take responsibility for its environmental impact.
This example can take place in different contexts in which abuses happen. But let's see if all the outcomes of leaking are positives and correctives or if they can be damaging as well?
Practical steps
Suppose you are lucky enough to receive an anonymous document detailing a lobbyist plan to influence the new policy about environmental preservation. The first urge might be to publish it immediately. Let citizens make their own mind, and check if the information contained in the document fits their own knowledge. Some readers might confirm, deny, or integrate new information within the original source.
But this is not journalism and it is not information, it is just a naive action of disintermediatied radical transparency. Ten years ago, WikiLeaks used to work that way. It was a platform in which sources could upload documents and have other readers perform its analysis, investigation and publication. In 2007, it could be comprehensible behaviour, but when Buzzfeed [^6] does the same 2017 publishing an invalidated report about Russians and Donald Trump.
Such release method are dangerous and extra tempting if you are operating in the information ecosystem. Messages speed do not let persons evaluate the information in its context, neither understand how much of it is plausible and which are the parties involved. Nowadays only the title, the subtitle, and maybe for a small percentage, the actual content is actually spread. It is impossible to ask for a public revision and when unvalidated news get viral, the effect is to split the audience in two polarized groups.
Trust is key because a leak might not lead to changes. It can be ignored, silenced, accepted as daily life. An anonymous document should be published, but it is expected a trustworthy person, such as a journalist of mainstream media, visible activist or human rights defenders states: “I know the source, I vouch for the source, I’m protecting the source”.
Leaks are information you might use as accountable tools for transparency. They can also be legit tools integrated within civil society investigation, which results can be considered as part of the academic, scientific and political communities. Bringing changes is not something that can be implemented in technology. On top of technically defined properties, you need to implement your political and ethical values.
Whistleblowing powered campaigns as processes.
The best validation method we saw so far, is to only spread leaks validated by independent investigation. If the investigation hasn’t lead anywhere, then the leak has to be considered not valid.
To do so, you might also need to interact with the source. Luckily, platforms permit to comeback to them and confirm their submission, provide updates, or answer to questions raised during the investigation. If on one side you ask for more details, in the other, you will still have to evaluate the proofs until you don’t fully trust the source. Publishing a leak without understanding the agenda and motivations of the source can mean to be instrumentalised by it. Take in mind that leaking has been used many times for organising smear campaigns.
Having among the recipient trustworthy partners helps greatly the initiative too. It ensure the revision, source management and outreach will not be only done by one group, but will be shared through partnerships with local lawyers, journalists, policy maker, researchers. Then your group has to transform investigated and validated leaks into stories. Passionate and understandable stories to engage persons and create mass mobilization. Think about the process applied to Edward Snowden leaks where for three years now there is constant journalistic revision and gradual publications.
One key factor for a successful campaign is to remain focused on a subject, a topic, a challenge. Do not vaguely call for evidence about corruption at large. Frame your specificities in your landing page and targeted towards your audience. There should be also a specific promotion of the validated contents. And every time you have the opportunity to write for a media, remind to the readers that a safe box for tip-off is available because articles are generally read by the persons implied in the subject.
It is useful to measure what is happening as much as possible. Keep track of the event and monitor its social media presence in order to understand how to improve your campaign based on results collected earlier. By sharing these measurements, you will help other initiatives like yours. Don’t be afraid of your enemy and keep building open data on how your organisation works. Do not address the people, but the numbers, concentrate on the results, achievements and statistics.
Dangerous paths you should be cautious with
An initiative has a time window of existence, it has to define what it is aiming for, what is its next milestone and how it is going. Having unmaintained initiatives might confound future potential sources. If your activity stops, make it very clear, because nothing sounds more sketchy and worrying then a whistleblowing initiative that receive your tips and don’t answer back.
Putting a source at risk is irresponsible, and this can happen if a story contains too many identifiable details. Files need to be sanitized and metadata need to be cleaned, but you also need to ask the source about how many other persons got access to the same information. Depending of the amount (two, twenty or two-hundreds ) aware of the same secret, different justification will need to made up.
It is easy, when you're part of a conflict and you are facing an adversary, to assume that all the persons collaborating with it are your adversaries too. That's is a dangerous path. Do not aim at leaking personal information about “low-rank” workers for instance because you might just expose innocents to responsibilities they don't own. Just imagine if similar actions were used from an established power to treat a minority or a marginalised group. If you are looking for social justice, having spread whistle-blowing as a way to solve political struggles might just backfire against your agenda.
Attacking an individual is a fascist behaviour, and it has to be stigmatized despite the political reason sustaining the initiative. What has to be exposed, is the corruption of a system, not the misery of life. Whoever do the release has the mission also to protect low ranked individuals from public exposure. Otherwise, whistleblowing will just enable a "Kompromat" [^7], a set of information that might embarrass someone or be used for blackmailing individuals. Every faction in play can make use of it, so it is better to share strong ethical values in order to judge the democratic quality of initiatives.
In theory, a whistleblowing initiative is intended to empower a weak group to shed lights over a secretive oppressive organisation. But what defines power, oppression and secrets depend of contextual and subjective evaluations and thus can be rarely used as an assessment and evaluation criteria.
As a conclusion, I really believe whistleblowing can address and make good use of a lots of disgruntled employee and ethical remorse that some ex-workers experienced. Being able to empower these voices and transform their stories in changes, is a vector of leverage we have to explore maybe now more than ever.
Success cases of GlobaLeaks adoption
Interesting experiments has been created by communities around the world since 2012, the GlobaLeaks team is keeping track of a list [^8] but some of the most notable, are the submissions collected by WildLeaks, a platform against animal poaching [^9], the Italian Investigative Reporting Project Italy collecting pieces of evidence from public officers on Couch-surfing raping his guests [^10], I mention this just because the corruption cases at too much. The Spanish X-Net [^11], able to prove bankers bankrupt and state accomplishment and made a theater play out of it. PubLeaks, participate by the biggest Dutch media, who made a book with all the revelation received in 4 years, and MexicoLeaks [^12], apparently so frighting to have journalists fired even before the leaks begin to flow. And now is up to you. What’s the pandora’s box you want to open?
References
[^1] The most inspiring whistleblower of the last years perhaps? https://en.wikipedia.org/wiki/Chelsea_Manning
[^2] https://en.wikipedia.org/wiki/William_Binney_(U.S._intelligence_official)
[^3] https://www.theguardian.com/news/2015/nov/27/hsbc-whistleblower-jailed-five-years-herve-falciani
[^4] In 2012 some figure working for the Pope, Paolo Gabriele and Claudio Sciarpelletti, feed journalists with internal and reserved document about the Vatican management. Such event lead to Pope Benedict XVI to step down (an event that was not happening since 600 years).
[^5] GlobaLeaks and SecureDrop.
[^7] https://en.wikipedia.org/wiki/Kompromat
[^8] https://www.globaleaks.org/implementations
[^9] https://wildleaks.org/leaks-and-reports/