Whistle Blowing in the Orwellian Universe: from Wired Magazine

The Whistleblower’s Guide to the Orwellian Galaxy: How to Leak to the Press

• By Nicholas Weaver

Photo: Vertigogen / Flickr

Editor’s Note: An earlier version of this article ran in Wired Opinion last month (“Hear Ye, Future Deep Throats: This Is How to Leak to the Press”). It has been updated given recent events and reflects the author’s new findings about government recording of mail. 
Daniel Ellsberg, Mark Felt, Jeffrey Wigand, Sherron Watkins, Bradley Manning, and now… Edward Snowden. (He’s just the latest informant caught in the web of government administrations that view George Orwell’s 1984 as an operations manual.)
But while the list of government (and corporate) whistleblowers continues to grow, their options for leaking continue to shrink. It is, as one commenter noted, “a dangerous time to be right when the government is wrong.” We now live in a world where public servants informing the public about government behavior or wrongdoing must practice the tradecraft of spies and drug dealers à la The Wire. Even the head of the CIA can’t email his mistress without being identified by the FBI. And privately collected data isn’t immune, either; highly sensitive metadata is particularly vulnerable thanks to the Third Party Doctrine.
So how can one safely leak information to the press, let alone coordinate a Deep Throat-style meetup? The obvious choices: email, phone, and mail … but you’ve got to be really careful. Here’s a guide.

The parking garage where Bob Woodward met Mark Felt (Deep Throat). photo: martin_kalfatovic / Flickr

Leaking by Email

Nicholas Weaver

Nicholas Weaver is a researcher at the International Computer Science Institute in Berkeley and U.C. San Diego (though this opinion is his own). He focuses on network security as well as network intrusion detection, defenses for DNS resolvers, and tools for detecting ISP-introduced manipulations of a user’s network connection. Weaver received his Ph.D. in Computer Science from U.C. Berkeley.

The CIA supposedly already provided a guide to secure email, which the Russian Federal Security Service (FSB) translated back to English — convenient, given the situation we now find ourselves in.
Get a dedicated computer or tablet: the cheapest Windows laptop will do. And pay cash, as our normal laptops have a host of automatic synchronization and similar services. Our personal web browsers also contain all sorts of location-identifying cookies. Even if you’re logged in to but don’t actually visit Facebook’s home page, a subpoena to Facebook can still reveal where you connect and what pages you visit — every “Like” button reports to Facebook that you are visiting that particular page, at a particular time, from a particular IP address.
Leave your cellphone, your normal computer, and your metro card (like SmarTrip) at home: anything that speaks over a wireless link must stay behind. Then go to a coffee shop that has open Wi-Fi, and once there open a new Gmail account that you will only use to contact the press and only from the dedicated computer. When registering, use no personal information that can identify you or your new account: no phone numbers, no names.
Don’t forget: if you get anything at the cafe, or take public transit, pay cash. Be prepared to walk a bit, too; you can’t stay close to home for this.
Of course, the job still isn’t finished. When you are done you must clear the browser’s cookies and turn off the Wi-Fi before turning off the computer and removing the battery. The dedicated computer should never be used on the network except when checking your press-contact account and only from open Wi-Fi connections away from home and work.

Leaking Over the Phone

Again, start by leaving all electronic devices at home. Go to a small liquor store in a low-income neighborhood, and buy a pre-paid cellphone (TracPhone or similar) with cash. Make sure it has enough airtime to not expire for a few months — T-mobile prepaid is particularly good since the pay-as-you-go plan doesn’t expire for a full year if you buy $100 of airtime.
By the way, I would personally look for a store with security cameras that look old — a continuous tape or similar setup — since once the FBI has the number, the next step is to contact the store that sold the phone. Alternatively, you can get someone else to walk into the store and buy it for you.
You now own your very own “burner” phone — remember The Wire? – and this phone must remain off with the battery removed at all times. Because every active cellphone is effectively a continuous GPS, monitoring your location and feeding the information to the phone company which retains this information for weeks, months, even years. Just a warrant-step away.
Now, to use the phone … Once again, go to a different location without carrying your normal devices, turn on the phone, check your voicemail, make your call, turn it off again, and pull out the battery. Your phone calls are now (hopefully) anonymous so that when the FBI leak-hunt starts, there is no trail for them to follow.
Of course, the burner laptop or phone could still identify you if it’s ever found, as they both contain network identifiers built into the hardware. So if you ever need to abandon your device, first wipe the device back to its factory fresh configuration using any “secure erase” options available, then take a hammer and break the device. Put it in some other piece of trash (like an empty McDonald’s sack), go for another stroll, and drop in a public trashcan.
But if the feds are already following you, you’re caught anyway, so it doesn’t matter if they catch you taking out the trash instead of finding something when they search your home.

Leaking by Mail

Investigative journalist Julia Angwin of the Wall Street Journal pointed out that physical mail, dropped in a random post-box with a bogus return address, is perhaps the best way for anonymous one-way communication. Perhaps the best use of mail is simply to send the reporter a burner phone pre-programmed to only call your burner.
Believing that the U.S. Postal Service recorded specific mail address information only when asked by law enforcement, I had previously argued that there’s no history with mail — and even if there were, it could only be traced to the processing post office.
However, The Smoking Gun spotted — buried in an affidavit! — that the U.S. Postal Service records the outside of mail. According to the full affidavit (also available on RECAP; see page 5) the machine used to automate mail operations, the Automated Facer Canceler System, contains a “Mail Isolation Control and Tracking” program that photographs every single piece of mail and maintains this information for future access by law enforcement.
Although there’s no mention of optical character recognition to allow indexing by recipient rather than by postmark, leakers must now assume that the U.S. government is indeed recording the outside of everything we mail. A leaker should therefore access a public postbox in the same way s/he uses a burner phone:  Leave all devices behind, walk to a remote postbox, and follow all the other guidelines above. But be sure to include a note to the reporter telling him or her to trash the envelope immediately.
***
All of this may seem like a script for a fictional T.V. show. But such extreme measures are a modern necessity if you want to leak information. Any future Deep Throat needs to follow these sorts of procedures if he or she wishes to talk to the press.
Though just imagine if Mark Felt had to do all of the above when leaking to Woodward and Bernstein. Snowden might have been willing to out himself … but not everyone is.


Miscellaneous Commentary from various people commenting on the post in wired magazine follows:

Rule Number One: Only leak to the US Press when a republican occupies the White House.
Rule Number Two: All governments use force of suppress descent.
Rule Number Three: When the people fear the government there is Tyranny.
Rule Number Four: When the government fears the people there is Liberty.

Leaking by mail is a BAD IDEA.
- The envelope is tracked.
- Using ANY modern printer leaves identifiable micro ID marks on the printed page, tracking it back to it's point of origin.
If you were to follow the advice on electronics, and do a bit of research on computer security (like using BackTrack5 on a USB/SD card), you might have the tiniest chance in hell of not getting caught. The FBI/CIA/NSA are a lot better at their job than you would be at playing secret agent.
The real question you need to ask yourself: Is doing the 'right thing' worth being water-boarded and prison raped?

Don't go to the ATM just before you start leaking your information. It could be the piece of the puzzle that puts everything else together. Collect the cash you're going to use over time.

VPNs and tor would help as well for one way communication.

Don't forget not to use any Windows or Apple OS. Download a Linux system in source-code format and compile it yourself. Microsoft has now admitted that they have back-door monitors on all their systems since 1999 and, although they deny it, Apple probably has also.

Leak it to a foreign press agency. Everybody in the US is bought and paid for.
It's a matter of jurisdiction and impact - if you turn out to be located in Nigeria, Belarus or some other place where the authorities are uninterested in bringing charges. There's also little value in tracking them down unless they've dinged someone powerful for something of great value.

You may want to change the MAC address of the WiFi NIC after each WiFi use as well, as there is probably a record of your connection with the open hotspot, linked to the NIC's MAC address, and then there is probably a record about which NIC with which MAC address was put into which computer and where was that computer sold. The vendor may then remember a nerdy looking man with glasses and a fledgling beard.

There may be another backdoor in the hardware, perhaps Cisco or whoever manufactured your WiFi NIC, has - on government demand - put in some extra data that is communicated or collected or a chip that remembers which access points you have connected to, and perhaps this chip uploads this information on a regular basis to a certain server that is screened by the CIA.

"The dedicated computer should never be used on the network except when checking your press-contact account"
Never ever log into the same account. They monitor newspapers and once you log in with the same username or send to the same e-mail address they can locate your IP-address/location within seconds or provide you with a faked email service.
Don't even try to establish a two-way communication, just drop the material physically. If you are going to print it out, beware that most printers write identifications numbers that can be tracked

Beware of ~ set up internet cafes where you may be exposed to an email interception programme and key-logging software to spy on delegates use of computers.
Dont go back to the same cafe/brand of cafe after the first email.
Never trust any generation of MS or Apple filesystem/OS.
Something might be waiting for you to log in again.

And...Mind the cameras - even when sending an email from some coffee shop, there is a chance you get picked up by CCTV on your way there. If the authorities have any other indication that it could be you, this might be enough for them to connect the dots.

Buy a wireless dongle using cash. Turn off the laptop wireless completely and use the dongle for wireless, then if the ISP captures the MAC address it will be for the dongle that you dump on the way home.

Search on MAC spoofing.There should be software for every platform that allows you to alter the MAC address your device exposes via wireless. Change it for each new leak connection.

Many laptops could be direct from a corporate or gov bulk sale. The barcode on the back is for a MAC and laptop serial number.  Once your leaking MAC is "seen" online, tracking it back as corporate or gov unit and its sale might be easy. You are then on CCTV in that part of the city buying a laptop. They have your face.

Switch to Linux. Those systems have had the ability for years to change your MAC number from the keyboard.

When you are done ... turn off the Wi-Fi before turning off the computer and removing the battery' to prevent the computer from automatically logging into a network next time it's turned on, which might or might not be in a secure location. By getting ahead of this cycle, you avoid mistakes, or turn the mistake of turning your laptop on in one of your locations into a trivial one, rather than a game-ender.

And then there is this rather interesting submision:

It takes a hero to act without regard to the suffering he will endure at the hands of those who are ill-informed or in pursuit of a dictatorial agenda. No wonder heroes are generally found among the young. The old are too self-interested and afraid; they'll endure anything, permit anything, perpetrate anything in the hopeless endeavor to avoid scrutiny and preserve their deluded sense of personal security. That is why it is always a nation's youth that constitutes its conscience.
Moreover, you may not have noticed, but education is as much a part of the "real" world as the witlessness of the unschooled and the untaught. Maybe if you lived in the "real" world you would understand things better. But you obviously live in a fantasy world. This country is made stronger by those who refuse tyranny, not pettifogging fools who can't distinguish between legitimate security interests and despotism. Your comparison of Snowden to the Rosenbergs is ludicrous, it demonstrates nothing so much as your own ignorance. Those countries you name have known for years pretty much the full extent of domestic spying in the US. This will probably come as a shock to you, but they use virtually the same technologies for the same purposes, in some instances that which may actually be superior to ours. Snowden leaked information to the domestic public which was hidden only from the domestic public. He did not pass information to a foreign enemy. Indeed, as only a young man would, he relinquished a bright and comfy future terrorizing his fellow countrymen (yep, that's what the NSA and its sister agencies do) in favor of doing what is in the best interests of his fellow countrymen.
Those who engage in domestic spying, those who amass and analyze the contents of private communications and data associated with such communications in the absence of specific information rising to the level of probable cause, those who resort to clearly unconstitutional "blanket warrants," and those who acquiesce in those activities are they who represent the most insidious threat to liberty. Every policy maker who participated in or knew of such spying and took no affirmative action to expose and halt it should be hung on the public square with marching bands in attendance.
As a final word, I point out that despite your grandiose airs you possess the same dearth of knowledge as those who you so blithely disparage. Not only do you know nothing worth leaking, you have nothing worth saying or writing.

Diplomatic challenges do not constitute a rational basis for dismantling the US Constitution.
The assertion that the Constitution is outdated and unsuitable for modern circumstances simply will not withstand the test of history. To suggest that the US government needs or (as has been discussed elsewhere) can even effectively utilize "blanket warrants" for the proffered purposes is ludicrous. We must not succumb to the fatalistic assumption that the surrender of our freedom is a prerequisite to the preservation of our way of life. Such an assumption is self-defeating. Indeed, if we accept surrender then our way of life ceases to exist.

Government will always abuse its power. That is the nature of the beast. If you disagree, prove me wrong. Just give me an single example of a government power that was not, eventually, given enough time, misused to hurt some of our citizens.