Unredacted Wikileaks cables leak due to Guardian reporter publishing password in book
September 2, 2011 | 3:15 pm
Wikileaks, emblematic of the changing face of on-line journalism, is in the news again lately as a huge load of files have leaked—but this time they were leaked despite Wikileaks instead of (directly) because of it. The controversy arises because these leaked cables haven’t been redacted to remove the names of sources who could potentially be targeted by their countries’ governments.
A lot of newspapers are crucifying Wikileaks for this new leak, but as nearly as I can tell most of the blame seems to lie squarely on The Guardian, the newspaper that was partnering with Wikileaks in an effort to review and redact the files before their release. Wikileaks was trying to do the right thing—to have the files reviewed by experienced, reputable journalists prior to their public release. And, apparently, someone at The Guardian is responsible for the leak.
Security maven Bruce Schneier summarizes the chain of events on his blog, and Der Spiegel goes into greater detail. Essentially, Wikileaks sent The Guardian the link to an encrypted file in a hidden directory on its website, and gave Guardian representative David Leigh a password (part of which was intentionally not written down—Leigh was told to remember it).
Subsequently, due to a falling-out among Wikileaks members, a number of encrypted Wikileaks files started circulating on the Internet, including the one encrypted with that password Leigh was given. The files couldn’t be opened without the password, but Wikileaks fans kept circulating them anyway just in case passwords should someday be forthcoming.
And meanwhile, Leigh had written a book about his encounters with Wikileaks founder Julian Assange—and as part of it, recounted the encounter in full where he was given the password, including the complete (written and verbal) password. Predictably, sooner or later someone put that password together with the encrypted files already circulating—and the rest is history.
It’s true that Wikileaks was sloppy in not bothering to remove the file immediately after the Guardian had downloaded it—but on the other hand, publishing the encryption key in full, including the part that was intentionally not committed to writing originally, is all but unforgivable from a security standpoint.
For its part, the Guardian claims that “we were told it was a temporary password which would expire and be deleted in a matter of hours.” But a security expert would tell you that’s like saying “that gun isn’t loaded.” It doesn’t add anything to the book to know the exact words that Assange encrypted the file with, and it entirely removes the layer of protection that was meant to protect the cables in case the encrypted file did leak. If not for that book, there would have been no way to decrypt that file, whether Wikileaks had been sloppy with it or not.
Naturally, given the choice between an established journalistic organization and a hacktivist information-freer, a lot of news publishers are circling their wagons around The Guardian. I don’t agree with everything Wikileaks stands for, but this seems to be a case where it was explicitly trying to release its leaks in a responsible way by having journalists vet them first—and then got burned by negligence of one of those journalists.