Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/371 Thanks!
So great to have you all here
for the last talk today, the talk
is doing right by sources done right.
I guess every one of you read and
heard a thing or two in the past years
about whistleblowers.
And so you all also know that
in order for whistleblowers to achieve
their goals, namely to bring the stories
out, they rely on journalists.
And as these journalists responsibility
to make sure that these sources get
protection, which is a very complex
matter. But we're hugely
honored to have here tonight Sarah
Harrison and Grace North, who are experts
in this field and are going to explain to
us how to do that, how to not fuck up
and how to protect these sources.
So please do me a favor and give a big
round of applause for Sarah Harrison,
Ungraceful and John.
Got it on there again,
sir. Yes, sir, my name is Sarah Harrison,
I'm a journalist at WikiLeaks, but I'm
also currently the acting director of an
organization called the Courage
Foundation.
And this was launched last year as an
international organization to protect
truth tellers.
Courage acts as a first line defense in
the highest risk cases where others
can't or won't act due to the risks and
dangers and difficulties in association
with helping those who've risked so much
for our right to know.
We currently run the Edward Snowden and
Jeremy Hammon's defense funds
and their support websites along with
other projects that we started and
are beginning more next year.
We'll be speaking about the protections
for truth tellers by the media and
public, the issues where and how
improvement can happen.
And I'm here today with Grace, who heads
the Jeremy Hammon's Defense Committee
and who'll be giving a more in-depth
example of some of the protection issues
that Jeremy had to deal with.
So there's currently a lot of discussion
generally at the moment around online
Dropbox's and how
this handover points in the process
can be solved online.
However, if we actually look at the
past, this is in fact just one area
and has often been that of the
last issue.
So if we think of the big cases in the
last year, it wasn't the handover
of the documents that actually caused the
legal problems for the following source.
Alleged sources Chelsea
Manning was identified after
a conversation she had had with the US
government informant that posted
posts the alleged action.
Another alleged source, Jeremy Hammond,
was caught after an infiltrator was
working with the US government turned him
in. Edward Snowden decided to
go public himself and then was left in
Hong Kong by The Guardian.
The journalist, the journalist that
Jesselyn Radack had contacted didn't
redact her name from the documents
leading to the pursuit of her by US
courts. John Kiriakou had agreements
broken by journalists, which then
assisted the US governments in
persecuting him.
All these examples have led to truth
tellers being involved in long,
debilitating legal cases,
large prison sentences and indictments.
Yet not one was the document handover
point itself that caused the main issue.
And yet the other parts of the full
source protection process are not being
much discussed.
Total source protection is a complex
topic can often depend very much
on the situation where the sources in
terms of jurisdiction job,
their technical capabilities, the
journalists technical capabilities,
the type classification, format, size
material they wish to disclose who the
adversary is and also the political
environment for sources in general.
There are five areas specifically
that I just want to go through
briefly for each one that you should be
thinking about if you're dealing with
source protection issues at all.
So there's the initial contact period,
the hand over point publishing,
the documents and articles, continuing
contact and then aftercare.
So for initial contact, a lot of people
think that sources just sort of
anonymously want to hand over documents
and they'll just drop something
somewhere. But actually and if anyone saw
Laura and
Julius talk yesterday, it was very clear
that often sources are cultivated
by journalists.
Now, this happens a lot for official
government, US sources.
Now, these can often be
given give quotes to journalists
anonymously, I think, with the general
hope that if they've done it anonymously
and it's somehow secret, this will get
some more impetus for what's basically a
government talking points.
In these cases, there are no
repercussions for the media, journalists
or source because it's just the official
government sliding that points out in
other ways, of course, when exactly
the same thing happens for the public's
right to know with an unauthorized
government source, the repercussions are
dire.
So this initial contact with sources or
potential sources, when that starts,
there are a number of operational
security issues to take into account.
I know others have had a lot of more
detailed talks about this, so I'll just
brush over them quickly.
So your phones, whether you're being
followed emails and other online data
trails, there are various methods to
mitigate these depending on the
circumstances and threat model.
So that includes, obviously, encryption
burner phone set up, not just to talk
to not tie them to your identity, but
you can also specifically obfuscate the
identity that they're tied to
pretty assigning a moving meeting, places
that you set up in person, and then a big
one cover if you can create
a lot of other cover, whether it's
traffic online or cover meetings.
So, for example, next C.C.C.
would be a great place to arrange to meet
your sources
when dealing with source protection.
It's very important that you split up the
investigative resources of the opponents.
So the more different types of cover, the
more trails that you're setting
that they have to follow, whether these
by the financial data
or otherwise, the larger the anonymity
put anonymity pool that you're creating,
the better.
Often when speaking to sources,
journalists want to get a lot of
information from them.
This slide outlines the
AP's standards for
what it means for on the record, off the
record, background and deep background.
And as you can see, they have various
supposed ethical
obligations of what they what they print
and what they don't.
There are many cases where journalists
don't actually describe these properly to
sources. The impetus is always on the
source for them to try and understand
what's what, whether what they're saying
will be printed and used.
And as you can actually see here, the
AP's this is taken straight
from the AP's website.
Their official policy is to try as
vigorously as possible to try and force
the source to put on the record
information that they wanted to keep off
the record in the first place.
I think that when you're dealing with
sources who are taking huge risks and
have potentially dire consequences,
bullying them into doing something that
way, you don't necessarily understand
their situation. And the risks they're
facing is and isn't actually the
the ethical way to go.
The burden in these cases really should
be on the journalists to be ethical and
to explain to the source precisely
what they're doing.
Similarly, a journalist and media
organizations should be very upfront
about what protections and assistance
will or won't be given.
Will the journalist fight subpoenas and
risk jail themselves to protect the
source? Will the media organization
pay or legal legal bills?
There have been cases where media
organizations tell the source that they
will and then and then they renege
on this promise and they think this is
actually worse than if the source were to
understand that these these did not
exist in the first place.
And it's not just the contact between the
journalist and the source that can cause
issues.
There's an example of John Kiriakou
and Matthew Cole, who's a former ABC
News producer.
Cole wrote to Kiriakou, who is now in
jail for exposing CIA torture programs.
When Cole was writing a book about a CIA
rendition in Italy, he wrote to Kiriakou
asking if Kiriakou knew the name of the
CIA officer involved.
There was a bit of an email exchange and
eventually Kiriakou said
that, yes, he had remembered it,
then sent the name of the officer that
he'd been given to a defense investigator
at Guantanamo Bay.
This name ended up in a classified court
filing, caught the attention of the FBI
and became the final piece of evidence
that leaked the links to Kiriakou.
So, as you can see, there are many
examples of just while you're having
just contact with your with your source
of the sorts of mistakes that can be made
to the hand over points of documents is
the area that has gotten the most
attention in the last year.
A number of news organizations are
setting up online drop boxes.
And whilst there's grace, of course, they
only work if the operational security on
both sides of the source and the
journalists have performed precisely
as a general rule in Dropbox,
as the source should have to think about
as little as possible, there should be as
little burden on the source as possible.
The impetus really should be on the
journalist. And having worked with quite
a few journalists, I'm aware of how much
training and understanding they need to
be able to do this properly.
The other issue I find with the current
state where so much importance is placed
on the Dropbox itself, is that in many
of these cases, this just won't work a
lot.
Rely on Tor, which is unavailable in some
parts of the world or people's work
places.
Document sets might be too big,
too large to hand over a few notes in
Laura's film, I'm sure many of you saw
last night they were using
async and then in-person handover's.
So whilst of course the handover is an
important part in the journalistic
process, it should be noted that all
other parts of the process have just as
much security, technical
and operational issues that can arise.
And nor does it actually work in all
conditions of the point.
It's trying to solve the problem.
So then we move on to publishing
the next part of the sourcing processes,
of course, publishing.
Now, the obvious point here is do not
publish identifying information about the
source and certainly not their name.
However, apparently not all journalists
can even stick to that.
Michael Isikoff of Newsweek reporter
published emails he received from a
source, Jesselyn Radack, regarding a case
of a captured suspected Taliban member
in Afghanistan and whether he had
a right to an attorney or not.
Jesselyn at the time works in the ethics
department of the Ethics Department of
the DOJ, and
she was contacted and confirmed that,
yes, he did have a right to an attorney
under duress, though.
Back in Afghanistan, John Walker Lindh,
the detainee, waived his right, although
his parents back in the US had already
secured secured him a lawyer.
As the case progressed, Radack was aware
that Lynn's legal rights have been
violated and started to take action
initially internally when
this resulted in retribution at work and
files going missing about the case, she
went to a reporter with her emails.
The result was that he didn't take the
name out of her emails.
They were printed, ended up in court
cases. She lost her job.
Almost got disbarred and a tough legal
case began for her
and other important points and source
protection at the publishing stage is the
language that the journalists use when
writing articles.
One of WikiLeaks main policies is never,
ever talk about sourcing.
Never, ever confirm
or deny a person or people might be your
source.
The issue here is it's a slippery slope.
Even if the source wants to become public
and you can associate certain documents
with them. What if someone else from that
organization comes forward afterwards
with similar documents, but they want to
remain anonymous?
Now you have to publish articles
that that would potentially
be for the person from the person you
were previously naming.
But now you're not naming that person as
a source.
So if you don't want to attribute them,
you're now waving a big red flag
to the government or whoever the
documents came from saying, hey,
we've got someone else that you should
start a large manhunt for
any organization.
Source protection policies in this way
should be severed, severed totally
from the publication process.
So if you do wish to write about an
alleged source, you should distance it
from other stories.
Don't start writing about speculations,
attributions, tweeting about who
or who might not be sources.
Essentially, when it comes to sourcing
and publishing, just shut the fuck up
any and all language.
Any and all language you use when
publishing that is in any way related to
sources is extremely important, mainly
for your source, always
used alleged use, disclosed versus
leak we often use, for example,
WikiLeaks obtained.
You take the impetus away from the
source.
These have onward implications for any
potential court cases for you and your
sources.
And when the government is out to get
someone, they will go through every
tweet, every article and every
word to see if they can use it in any
way to bolster their case.
If you're in any doubt at all, check with
a lawyer and not necessarily
a media lawyer.
They're there to protect the media
against libel, et cetera.
They're not specifically trying to
protect whistleblowers.
There are whistle lawyers around the
world who be happy to talk about those
issues. But if you still have any doubts
at all, shut the fuck up.
The only time you should talk about a
source is if you're lying.
And lastly, within the publishing
elements, there are the documents
themselves clearing anything at all that
could identify or lead to the
identification of a source.
This is very varied process that depends
on the situation. It's impossible to go
through them all here. So just to be
brief, peek metadata, of course,
is reasonably well known and
of course, in these circles as well under
understood issue.
But there can also be watermarking within
the text itself.
So when you're publishing the documents,
the big thing that you should do in the
process is to look at actually the
organization itself and the workflow
within them who definitely has access to
exactly what copy of the documents, who
they distributed to, who officially
gets it. But what are the sysadmins,
receptionists, what other people are they
allowed to distribute to?
And this will give you an understanding
of exactly the type of
exactly the copy of the document, how
many people have access to that, and
therefore what your anonymity pool is.
So, for example, contracts that large
companies, whilst they're being sent
around like a merger contract, for
example, for example, and worked on,
they'll often contain tiny word of
formatting changes.
A comma is added.
Double spaces put somewhere
so that a potential source could be
identified.
So if you're dealing with documents like
these, the media should be going through
a process to standardize and remove any
possible inconsistencies that potentially
lead to a certain source adding plourde
plausible deniability.
So other examples as well in in
prepping documents, publication for
source protection.
A couple of examples from WikiLeaks.
We had a
disclosure that came to us from a secret
society at MIT and
we were publishing the ritual magic
manual of it.
And we discovered that the sources had
taken photos of the manual of each page.
This is how they'd got it.
And each manual had a number
on the front page, which was the
chapter of the society that it was.
It was an identifying number for that
chapter.
So the source had edited this out using
Photoshop, and they'd done that very
well. And that was all great.
But what we noticed is it was it was
double sided prints.
And when you turned over to the onto the
other side, if you didn't
and a very good image enhancement,
you could still see a shadow of the next
from the next page of the number coming
through. So that was really checking
very, very closely each page
of the documents.
There was another example where the legal
filing number used on the documents
was on the documents.
This was something that was
was allegedly from a lawyer who
got the docs through discovery, but they
actually came through our legit
source was another legit
source that was a middleman.
And this actually often happens that the
sources will reach out or you'll get
documents that come via someone else.
So if your source says, oh, yes, yes,
that's fine, it may be fine for them, but
is it fine for the original source?
So you have to be independent when you're
assessing this as well.
And moving on to my next category,
continuing contacts and relations.
This is a pretty standard thing in the
world of journalism that they will want
to maintain contact with a source.
Maybe they want to ask questions about
the documents or they want to try
and get more documents
here. It's actually even more crucial
that there's tight operational security
because just because the journalist's
story is out doesn't mean the potential
legal issues for the source are over.
In fact, I would say they've increased.
It's one of the more sensitive times
because, of course, the government or
organization is now alerted that there's
a leak. They're going to be on the hunt.
Moreover, journalists can be subpoenaed
as they are the eyewitness to the crime.
So for everyone involved at this time,
security is crucial.
And speaking of subpoenas, just a little
tidbit for C.C.C..
WikiLeaks will be doing more on this next
year. But I got a really nice Christmas
present from Google.
Of course, no one at WikiLeaks is
using Google services for anything except
sensitive. But I had
a long time ago
done something in the past and as part
of the US case against Julian, the
US grand jury that's going there,
Kristen, who is our spokesperson,
myself and other people relating to
Julian and WikiLeaks receives literally
the day before Christmas.
Oh, that was murder.
I'm forgetting my slide sorry,
received this lovely document
here, so this is a now unsealed
search warrant that was
sent by the Google Department.
It's related to the espionage
case against Julian in the United
States. The seventy nine three G is the
legal is the legal code for that.
So as we can see, this this case against
Julian is still still continuing and they
they continue to spread the net.
So aside from subpoenas that
they can try and get you with,
this doesn't just apply for for the media
who the source went to.
The security that you need to have at
this point, ethical journalism practices
should be protecting all whistleblowers.
So Scott Shane from the from The New York
Times was writing an article on John
Kiriakou.
He had not been his source,
but he was writing writing on him.
And when he when
Kiriakou agreed to the interview, part of
the conditions he put was that Shane
would run the
quotes by Kiriakou, his legal team, just
in case the phrase in Kiriakou was used
was potentially legally damaging
for him.
Shane actually ended up reneging
on this promise and some of the wording
was then used in Kiriakou sentencing
case against him assisting
the prosecution in getting him an
overbearing sentence.
Journalists should definitely be aware
that at this point it's hugely stressful
and a lonely time for whistleblowers.
Many have had their lives, families and
jobs all destroyed.
They're under a lot of pressure.
Some will reach out to others for
comfort.
This can have disastrous consequences.
A well known case of this is, of course,
Chelsea Manning, who reached out and
placed trust in someone she thought was a
priest and therefore had obligations of
confidentiality.
Of course, Lamo had lied and instead
turned Manning into the authorities and
went to his mates. Poulsen at Wired, who
wrote an article cherrypicking the
alleged chat logs in a way that was very
damaging for Manning.
Now, of course, I can appreciate that in
some instances, this for the source
themselves, it's it's risky
if the media have a lot of contact.
But there are organizations there's
actually a gentleman in the audience
here, Gavin McFadzean, who runs an
organization that Carriageworks with in
the UK called Whisler, that deals
with this precise issue is part
of aftercare for
for whistleblowers.
So journalists, for example, could refer
them to them. And anyone dealing with
source protection or whistleblowing
should be aware of these organizations
around the world.
And then finally in the aftercare stage,
there's something that annoys me hugely.
And this is the excuse by journalists
that they can't assess their alleged
source for fears of this phase of this
story is becoming biased.
I've seen too many cases of what I refer
to as asset stripping, and then the
journalists just leave.
My stance is if you're a good journalist,
your stories will speak for themselves
or someone else that the organization
could write. It doesn't mean that you
can't write positive articles about them,
as so many media alleged for so long
regarding Manning, it doesn't mean you
can't assist them when they're stuck in a
foreign land and leave them there, as the
Guardian did with Snowden.
It doesn't mean you can't write to the
judge for leniency, as most Western media
did in the case of Jeremy Hammond,
alleged Stratfor whistleblower.
And here is Grace to tell us more about
Hammond's case.
I, uh.
OK, so
for those of you that might not know who
Jeremy Hammond is, he was a member
of Anonymous who
hacked Stratfor, stands for Strategic
Forecasting Inc, which is a private firm
that does it's a private intelligence
firm. Anybody with the money can hire
them to investigate
whoever they want. And Stratfor did
a lot.
Shapiro was hired by the US government,
by corporations
such as Coca-Cola, Dow Chemical,
to spy on activists that
they basically didn't agree with, didn't
like what they were saying.
And this all came out when Jeremy
hacked their email systems and
allegedly released them,
allegedly release them to
WikiLeaks.
So end.
Yes, so that and one
of the major one of the major
ways that he was caught was by an FBI
informant named SÃ¢rbu, real name Hector
Monsegur, who is going to figure
in a little bit later.
But that was one of
the main ways that he was caught.
Another hacker was turned state
witness against him, which is
another issue that it's
OK to say have.
All right, well, first of all, one of the
first things that I really wanted to talk
about was what is a whistleblower?
What is what is what is a truth teller?
What are our ideas around that?
Obviously, we we think of somebody who
may be within a system, who has
information, who then comes forward with
it. But I honestly think that we really
need to expand our definition of what
a whistleblower is, what a truth teller
is.
For example, I very strongly believe
that the PayPal 14 who were
14 individuals that were arrested
as part of a direct attack against
PayPal for blockading the funding
of WikiLeaks, I very strongly believe
that they should also be considered and
given the same protection and
honor as other truth tellers, as
other whistleblowers, because they saw an
injustice that was occurring, the
PayPal refusal to
process donations from WikiLeaks.
And they did something about it.
They called attention to it, which is
what I think one of the main
main acts of what a whistleblower
does. They call it they call attention to
something. So I think that honestly,
we need to expand that definition
to include people that have been
arrested, maybe not for doing the
traditional quote as we think of
truthtelling activities,
but it's really crucial because what
happens in these cases is
when somebody comes forward with
something, they are punished with these
these draconian laws, with these
outrageous sentences, which then
causes future truth tellers
to maybe not want to come forward.
So protecting your
truth tellers and protecting your
whistleblowers is an incredibly
important thing, as we were learning,
because really these
truth tellers that are coming forward are
being prosecuted so harshly
and.
If that flow
of information is going to continue, they
need to know that they are going to be
protected, that
the media and that people around them
will not leave them high and
dry in Hong Kong or
whatever the case may be.
I think it's just I think it's
interesting as well that in most
countries there's no
public interest defense.
They can't say whether they're inside or
outside of an organization.
While I was doing this for the public
good, I've caused greater, greater good
by my supposedly illegal
action than if I hadn't done
anything. And I think that this is
something that should be pushed for
change as well on that point.
Yes, I absolutely agree with that.
So another point that I wanted
to make is that after
sort of after care, that's sort of my
specialty. Jeremy asked me to take over
his defense fund in June
of June or July of 2013.
And after care is so important, these
people have sacrificed everything to,
you know, bring us this this
in this information.
And it's
important that we show our
respect both as people, as journalists,
to write these articles who then build
their career off off of it.
I believe that respect needs to be shown
to the source
after.
And that's a very important part of
Africa, especially for those that are
identified and arrested.
Because, you know, John, John
Kiriakou should not have to fundraise
on the Internet to save his house because
he's not there.
You know, that should be that should be
something that is taken care of by both,
you know, the media that help that
were his contact people and
by the people that have benefited
from the information that
he shared.
A strong ideal that Jeremy holds and that
I hold as well is is
mutual aid and saw and
solidarity.
And part of that means you don't leave
your source behind. You don't leave
somebody who has sacrificed everything.
You don't leave them behind.
It was interesting when we worked on for
the with the Hammond case
WikiLeaks put together when it came to
the sentencing time, we
tried to put together as large a
signatory letter of all the media
organizations. And we'd worked with a lot
on the Stratfor files and
we tried to get as many of them to sign
just to ask for leniency in the
sentencing case.
And what was very interesting was a
complete break between
how the global south and how the West
reacted to this.
So the West either completely
ignored the email.
In general, there were two very good
journalists who I will just name
Stephania Moezzi from Italy.
And John gets here in Germany
that actually were willing to put their
name to it. And other than that, we were
in either entirely ignored or they
refused.
When it came to the global south, we had
media organizations going, well, we'll
sign and I'll get so-and-so in Argentina
to sign.
So people that it never like works on
even the Hammond documents when we when
we were first making making partnerships.
So this was quite an interesting
phenomenon that I think that the West has
become so bad at.
And you can see that in that example
where you're looking at the difference
between how the Western media are
reacting to the global south, that it
doesn't have to to be like that.
And I agree completely agree.
Do you want to talk just a bit about
Jeremy at the moment?
I'm sure Jeremy Jeremy is currently
serving a 10 year federal prison sentence
for his role in the Stratfor and another
hacks that were all politically
motivated.
He's doing pretty well.
Last time we talked was Christmas Eve.
He says hello to everybody.
And he right now he's it's
prison is just a daily grind
that you have to live every single
day. And it's especially hard for people
who may be antiauthoritarian like
Jeremy is.
Maybe you've noticed
who spent their whole life trying to
dismantle that system to then become
completely controlled by it.
So.
Aftercare by the general public really
helps things like writing letters,
donating so that he has money in his
commissary, sending books, things like
that superimportant.
And can you just explain so they
understand a bit about how he keeps going
in and out of shoe?
And, yes, that's been
an ongoing issue.
Documents, it
honestly started, oddly enough,
when documents were dropped by
Anonymous that were
the unredacted Lussac warrants,
and I got frantic calls from lawyers
at nine 30 at night
saying the government is very upset with
Jeremy for this
and. Well, well, why?
Why are they upset with Jeremy?
He's in jail. He didn't release them.
Well, they think that they you know,
they think that he gave it
to them.
So there are very real consequences
for a
mishandled, you know, a
very, very real consequences for
mishandled in information,
especially when that person has already
been identified and may be in jail.
The government has punished Jeremy
with overly harsh punishments
for minor infractions.
He keeps he's gone in and out of SHU,
which is solitary confinement
center, these segregated housing unit.
He's gone in and out of there more times
than I can count.
And every time they put him in
the he loses what's called his good time.
He earns good time off
of his sentence for every month that
there are no infractions.
Well, if the staff decides
to bump up his infraction level based on
what he did, his good time is gone.
Like I just checked a couple weeks ago
and found out that his release date had
been pushed back a month
because of a
situation that happened where he was
overly punished for something that should
be his absolute right to do.
And his release date got pushed back
a month, which means he's not going to be
out. He's going to have to spend another
month in prison on top of the
already unjust 10 years he will have
spent.
So
mishandled documents and mishandled
information and how you publish
your sources really does matter,
and it really does impact
your source very strongly,
especially like I said, if they've
already been identified and they have
already have that attention put on them.
And I think it's interesting in the case
of you just described, even though he's
in prison already, it's
still having an impact on how people
in the outside world are dealing with
information that he is seen
to be linked to by the government.
So, yeah,
yeah, I can tell everybody what happened.
He wrote a letter of leniency
for Barry Brown, the journalist who
was charged originally with publishing
or I'm sorry, linking to
the information that had been published
from Stratfor.
Brett Brown is was due to be sentenced
in the beginning of December for this.
And Jeremy wrote
a letter of leniency, as many
had done for Jeremy.
He wrote a letter of leniency for Barrett
Brown, and he sent it to
me to give to Barrett Brown's federal
judge.
And he was written up for circumventing
male monitoring procedures
and he had his email privileges.
I still cannot email him.
He got his email privileges taken away
for.
A month, a month
or a month and a half,
so I mean, normally things that would not
cause people to look twice, he gets
slammed for every single time.
And that's part of the government
retaliating against him for continuing
to speak out.
So it's these sorts of cases
that we we
set up a courage for
courage is working with grace
and running Jeremy Hammond's defense
fund. It was borne out of
when we worked to get Edward Snowden
asylum. We realized that actually
in these sorts of high risk cases,
there are very few organizations.
In fact, well, in that case, there were
no other organizations that can
or would assist him that
could act swiftly and securely.
So Courage was founded
by three trustees, Gavin, who
I mentioned before, who's from the Center
for Investigative Journalism in London
and Whistler.
He's here Barbara
Bakowski, who's from legal director
at Article 19 in London, and then
Julian Assange, who's the editor
in chief of WikiLeaks.
And we worked to get Snowden
asylum. And he then instigated setting
up courage, even in the midst of
all of his own legal issues with the
US grand jury, as we've just seen,
still continuing against him.
So we began with Snowden's defense fund
and protections for Snowden.
We've grown we now have Hammond as a
beneficiary.
We run these specific defense funds along
with their support websites,
including the revelations
that have been disclosed, we
are proud to say actually have the
largest collection of Snowden documents
because no one else was putting them all
in one place.
We also this year launched a new fund
for sources under investigation.
This is actually we call it the Known
Unknowns Fund, which is our little
in-joke to Rumsfeld's quotes.
And this is specifically for
sources at the point when they are being
investigated there, an alleged source,
they haven't necessarily been
they haven't been charged.
They're not necessarily identified
publicly. So to get public
money to pay for legal advice is pretty
much impossible for them to raise public
donations.
But yet they need legal advice.
They have people knocking on their doors
and raiding them.
So we were actually
this funds. There's already one person
that is actually needing
it support at the moment, and I'm sure
there will be more.
So that's one of the other projects that
we set up this this year.
And one of the big things that we've done
with work from the beginning is to
systematized these sorts of processes
and these support to set up the website,
to set up the defense fund.
And for Snowden, it was sort of almost a
test case for us, for how we did it, what
the legal loopholes, et cetera.
Were we then, of course, set it
up again for Hammond and we now
within a day can set up a legal defense
fund and a support website for anyone
else that comes forward.
This is important to be able to to move
fast because the story is pretty much
set within the first week of the public
perception.
So this fast moving defense is really
quite crucial.
And we have some plans for
this coming year.
We're going to be offering advice for
media and journalists about how to
operate securely, what to think about.
We've also started a network of
specialized lawyers for
legal advice and logistical assistance
to help sources around the world, whether
this is legal advice or escaping
from Hong Kong to get asylum.
So,
yes, so we continue our work into next
year with these that these are more
projects. So all of your help is
is very much appreciated.
And that's
in these ways and more.
We're aiming to internationally give
complete protections for truth tellers in
the hardest cases and show them that
someone will take risks for them when
others can't or won't.
And the purpose is to maximize the
amounts of truth and about the society
we live in and the public
record. And to do so whilst fostering
civil courage, we want to set
a new standard and the protections
of truth tellers by the journalists and
the public alike.
And I hope that the public generally can
start to hold those that don't give
sources the fullest protections to
account, and that here in the technical
community, we can start to think of
more ways to assist in this complete
protection, not just the drop over points
so that we will
help all of us in our right to know by
helping those that so bravely come
forward and fight for us.
So thank you.
And then we're taking questions if anyone
has questions.
Yeah, thank you so much, Sarah and Grace.
Thanks for the inspiring talk.
So luckily, we have plenty of time for
questions and answers.
Our inspiring speaker said that they will
take questions.
We have six microphones here.
One, two, three, four, six.
Please just line up there and
make yourself know that if you have a
question, I think the guy
on microphone three was first, please
state your question while I try.
So not as much
a question, but I like to point
out something can get a
little closer to the mic. So you are in
Hamburg, Germany, and the problem
is not to protect.
The security affairs
are journalists because
we had a case where
the journalist was
covert police lady.
So these problems
occur at another point here.
I'm really sorry, but I didn't quite
understand what you I think because you
started far away from the book, there's a
difference issue in Germany because.
Yeah, yeah, we have
you know, media is protected by law.
But we had a case in Hamburg
where covid police person
was the media
and now.
OK, OK, so she was undercover, pretending
to be media, not
pretending to be media undercover
in media.
OK, to try and find sources
by them coming to her because they
thought she was media.
Is that the point?
Now, the problem is I want
to protect the source so
the source has to rely on
media journalist working
properly, protecting you
against those guys
you are disclosing.
So have.
Those guys you work for
are efficiently disclosing the secrets
are the same guys who are telling the
secrets to.
So what?
Well, yeah, that sounds like a terrible
situation. Were they working for a media
organization?
Yeah. So I think that the public should
have called for that media organization
to be shut down.
Nope, not media
organization. It was an undercover cop
in media.
So so police put something
into media.
All right, well, that since I got the
feeling that there is no question
developing out of the statement.
Thank you so much for the statement.
And let's just hope that our speakers
today are journalists, as they claimed
and not as I hope
this is not what you are insinuating.
All right. So next
question, microphone one, please, and
get us the mic.
Yeah, thank you very much.
I think it's a very important point
that you were making. I'm very glad to
hear it from also from the development
of the foundation last year.
I think it's important to look
like you were mentioning the wording,
the language and the
verbal OPSEC of journalism
in that context.
I do have a question for for
Grace, what you were mentioning about
PayPal.
I do assume that you have something like
a working definition or something for for
whistleblowers if you compare it like a
situation in Germany.
Again, the wording is super negative.
You do use like the word whistleblower,
but you also use dimensioned information.
So it's like extremely negative.
So if you say we are protecting specific
cases and if you said, like,
what's the benefit in
declaring, like PayPal
guys as as whistle blowers?
So you say like, that's a protection
as such.
I'm just interested in
like, what's your working definition from
from the foundation point of view and
what's what's the actual
practical how do you protect
people?
By just saying that's a whistleblower
by definition, you know what I mean?
Well, I think that
the definition of a whistleblower or a
truth teller can be someone who sees
someone who is doing
wrong or sees and or an organization
is doing wrong and through their actions,
through their politically minded actions,
do something does something to bring
attention to that, whether it's
dropped documents, whether it's dosser
website, which I very strongly feel
should be covered under the First
Amendment as a form of free speech,
whether it's a website, whether it's
dropping emails,
they're doing something.
They're they're doing an action that
brings attention to this great political
injustice.
And I believe that should be our
definition of what a whistleblower is,
what a truth teller is, because that's
what they're doing. They are
incurring significant personal risk
and they are telling the truth,
which is what is needed right now.
I stress we need a
complete revolution in how
we think about our government and how we
relate to our government.
And revolutions are never easy and
they're never clean and they're never
messy.
Laws will get broken and laws will have
to get broken in order to call
on justice to those laws.
So I believe that we need to appreciate
the true colors that we have because they
have sacrificed their everything to bring
us their truth and
and our truth and the truth is
what's going to enable us to
fight back against those that have taken
our freedom against those
that invade our privacy.
They're the ones that are going to change
the world.
They're the ones that are going to change
the world.
And they deserve respect as such.
Thank you so much.
Next question from the Internet.
Hi. So I have a question
from Twitter to Grace.
Is it possible to ask for presidential
grace for Jeremy Hammond?
And if it's possible, how can
the public contribute to that
like a petition, petition
or campaign?
I believe it would be possible to ask for
a presidential pardon for him right now.
I don't know of any specific campaign
that anybody's
planning right now, but that is
definitely a possibility.
And what the public if that campaign
came to fruition, it would probably
be in a petition form
the government, the people.
The most important thing is obviously
sharing that, signing it
in not just sort of tweeting it out,
but sort of going to certain people
saying, hey, have you signed this
to make sure that, yes, you can get
specific? Yes, I will sign this.
Yes, I.
I will sign this.
And trust me, if that happens,
I will raise holy hell to get
my friend pardoned and home.
So there you'll know
if it happens.
All right, thank you. Next question for
microphone for you.
So from what I sent you,
you have these facts going to help
people to have money,
to help them have legal support and
stuff. But what we've seen from
WikiLeaks is that sometimes there is
money which is not accessible.
How do you make sure that the money is
accessible and the time needed end
and it keeps being accessible when
it's needed?
Are you talking about, like, our banking
blockade, like how the donations are
stopped?
OK, so this is one of the things that
which is that because this was a big
concern with the setting up the
Snowden defense fund about this, and
we actually had an almost pretests
case for that
with Julian's defense fund.
And we actually have found kind of
quite a robust way in which to do this,
which has not yet
been and has not yet been shut down.
And Julian's at that continued through
the blockade.
And so that still stands.
So that was sort of the base of the
system that we then started.
We then had to make it a faster process,
but that was the base of the type of
system and the type of structure that we
used to set up Snowden's.
And we will for the other whistleblowers,
because this was exactly what was on the
main front of our mind and anybody else
at the time that wants to help Snowden.
But because of our experience
in this, we were we were able to
actually set up the sort of logistical
bank account when where nobody else
could.
OK, but this apparently seems to
be that has to remain a secret
or we can be able to talk more about it.
So it's partly the sort of the people
it's a mixture of sort of the people that
are involved and the fact that they can't
be backed down,
which I mean, when it came to the the
banking blockade, there were
a number of organizations that
were helping us in this.
There was one that was absolutely
wonderful in it, while Holland Stiftung,
who are here as well, that
actually stood by us, although they
had their charity.
No what do you call it, status
taken away here in Germany.
But yes. But then there were other people
that didn't stand up against this.
And so our donation routes were
blockaded and a lot of sense says.
So one thing is sort of is the people
that are involved. And the second is that
the legal structure around it.
And so one of the structures that we've
used is a trust in the U.K., of
all places.
But the trust has some quite it's a long
thing to go into here. But I can explain
about it later if you want.
But a trust has some some
things that make it reasonably robust
for for these sorts of situations.
All right. Thanks. Next question from my
friend.
Oh, hi.
Thanks for the talk. Of course.
But you mentioned something about source
protection that kind of piqued my
interest around going through the
actual source material in the documents
to ensure that there's nothing personally
identifiable.
You mentioned something about double
spacing and commas.
How do you protect against maybe
if we're talking about high stakes here,
documents that are purposely manipulated
with a comma, splices or special
punctuation that the
adversary would be able to
attribute 100 percent back to a source,
at what point do you say maybe we can't
even post screenshots of the source
material? Where do you draw that line or
how do you even assume that might come
into play?
So one of the things that you do in these
cases, you essentially basically what
you're aiming for is
at a high enough level of plausible
deniability and creating
a large enough anonymity pool.
So you're basically fudging what they can
specifically relate back in the sense of
these things. So you would go through and
you do things like you standardize this
in certain ways.
So this actually means going and
and.
Taking away paragraph breaks
or these sorts of things,
because, as I say, the main thing is
to ensure that it can't be specifically
led back to that one potential source.
If you go through and do things like
standardizing through the whole
documents, et cetera, then you take
the you're adding starting to add more
and more plausible deniability to it and
taking away any specific things that
could have been put into to
pinpoint a certain source.
So as a thought example or a thought
experiment, if Snowden decided
to remain anonymous, should
they have posted the screenshots of the
PowerPoint presentations or should have
been standardized a twelve point times
new Roman completely stripped of
its original format?
Well, this is where I was saying it
depends on like the workflow, etc.
within an organization.
So if you have if
the if the documents if there's like a
large repository, which a lot of people,
a number of people are coming accessing
the documents through, you have a large
enough anonymity pool from your baseline.
So therefore, you know, it's this
sort of thing, that particular example
tends to happen a lot more with
a smaller
number of people that the document is
being spread to within the
work, within the people it's meant to go
to.
That's generally
if it's within the same organization,
they don't do it so much.
It's generally tends to happen.
So, for example, in the Trans-Pacific
Partnership, things that documents
that we published where you're looking
from, it's although
it's within a reasonably
small agreement, it's going across
country and then within those countries,
different advisers, et cetera, are
looking at this. And they want to know
maybe which country or which particular
person it's come from.
So when the Snowden documents, it's kind
of it's quite a different case because
of the nature of who had access to those
documents. So it's really it's kind of a
case by case example.
They were just very specific.
I'm not saying you now have to worry
about every comma and every document.
This was a very sort of specific type of
case. Just to give an example of the
things one should be thinking about when
you're working with this documents, who
has access to it?
How does the organization operate?
It's not just a fact of removing
the headers from the email or the
metadata from the documents.
All right. Thank you.
Thank you for everybody entering the room
right now. I would like to point out that
we're in the middle of a very interesting
Q&A, so please remain super silent.
Thank you. Next question for microphone
one.
Thank you very much for this very
important talk and thank
you for your support of Jeremy
Hammond.
And I was wondering,
um, for me, it seems
that he's a very classical political
prisoner.
And I was wondering if the traditional
or classical organization
for human rights, like
Human Rights Watch or
Amnesty International, are also
engaged in supporting him
or their role.
Can you elaborate a little bit on this
and why not?
And so on. Thank you.
I believe that sometimes for those
organizations, they have to
sort of sometimes draw a political
line, what they're allowed, what they're,
quote, allowed to support with what
they're willing to support, which I think
is sad because
your ethics should you know,
people people deserve support and
that should reach across ethical.
I'm not saying it should reach across
ethical lines, but there are certain
things that we can all agree on that, you
know, that support is
necessary and needed and it should
not, you know, reflect badly
on a news or organization,
say if they sign a letter saying this
person deserves leniency.
But often in at least in America,
it often does look bad for them.
I don't know if I'm right, but
I'm kind of assuming it has something to
do with the fact that they are Western
political prisoners, is
it can it be that there is a difference
if they would be from some, I
don't know, banana republic or
axis of evil, then they
could get more support.
But I think because they
are from, well, the US,
I don't know.
I mean, human rights
organizations have done some amazing work
within the United States
within the past several years about
issues such as solitary confinement.
But as far as supporting specific
prisoners, I would agree with what
you're saying when it comes to specific
prisons.
Yeah, they they don't issues without
faces are generally far easier to
to to support when it comes to specific
people. I think the the
alliances that organizations think that
they're having, if it's the US government
that has cracked down on someone in
there, a U.S. government based
organization, and often these
organizations get their funding from the
US government. So the last thing they
want to do is say, hey, we want to
support that guy that, you know, last
week you were trying to kill.
So
I think that completely has a lot to do
with it.
Yeah, OK, thank you very much.
Thank you. We got another question from
the Internet.
Yes, one more from the IOC, Chad,
how about developing low budget methods
for anonymous collection of secrets,
like if dropping tools for everyone
together with tutorials, how
to deploy them and a S.O.P for the
whole process?
Or is there already something like this?
Can you can you can you repeat it?
How about developing low budget
methods for anonymous collection
of secrets like eavesdropping
tools for everyone together with
tutorials, how to deploy
them and a S.O.P for the whole process?
Or is there already something like this
gathering?
I think sort of.
I mean, it depends how I don't know of
anything. As I understand it, this is for
for collecting.
Yes. The collection rather than people
specifically going and putting them.
I don't know of anything that exists
specifically like that.
I think that it would probably sounds
like would be quite a good obfuscating
tool. So if someone wants
to make a good one of those, that sounds
quite good. But I don't know of anything,
anything like that.
I think any there's
always with these sorts of solutions, I
think that there's a balance between
investing enough time,
et cetera, to make a
particular solution good enough and then
also having enough other solutions so
that you can create enough cover
possibilities and traffic to try and
obfuscate exactly exactly what
is being used.
So there's always a balance when looking
at this, but I don't know anything of
exactly what was.
Thank you, newcomers.
Please be silent.
Question for Mike.
Hi. Thank you for everything
you said. You have said that
everybody's help is welcomed,
but I found that sometimes
in helping in a more concrete
way can be
complicated.
I mean, the nation are
useful, of course, but sometimes there is
also the fear, the feeling
of the duty to do something more.
So I'd like to ask if
there are other ways for young people
who are not journalists, who are not
lawyers, who are not anything
else to help.
Yeah, I mean, we're looking for things
like translators, et cetera, as well for
the site we actually have on.
If you go to the website, you can you
can state that you want to volunteer
there. So I can't remember the the
exact email now, but it's on the website.
So you could always sign up for that if
you want to to help.
OK, thank you.
Thank you. Question from Mike, too.
OK, thanks, guys, for your work, of
course. And for coming here to speak
about. It's just a question for Sara.
You gave a lot of examples,
you know, really bad examples of
journalists making mistakes.
And it almost seems
that you're suggesting I go speak to them
because it can be dangerous.
I was wondering, did you ever consider
blacklisting certain
news organizations and how does every
day
so you let
you live with them as thinking we might
start one of those on courage.
We could have like the good pile and the
bad file and then sources can go in.
Which one shall I get thinking
we might do that?
It could it could be useful for you to
give me good.
I mean, it might get you in the hands
of media, I guess, but you
literally get to remark about Google.
I'm talking about blacklisting, you know,
tools and stuff.
You different.
I mean, yeah, it's like it's
a search warrant. Says I'll go back if
you.
So it's basically so essentially
the US governments have started saying
or they actually sent them a while ago,
we just got told about them, the ones
that we know of so far, their search
warrants for any Google services
that we have, any that we've been using
ever use.
And me, Kristen, who is our spokesperson,
has one as well.
There's some others that have come to
other people that are
connected to Julian.
We got them all literally the day before
Christmas. So I sort of haven't had that
much time to to do anything with it.
But we it's I mean, it's definitely to do
with that seven nine three
G number that you can see.
These are all like the legal
codes that the warrant says
is made under.
Yeah, but I didn't get how, you know,
the US government trying to get data
about WikiLeaks, you know,
incriminates Google.
I mean, did they respond to this warrant
or I mean, it sent to
Google.
So this was the US government's
sent a request to Google
for any information that they had
from me.
For example, this one's mine.
So it wasn't necessarily
a it was more a points about the fact
that journalists can be subpoenaed rather
than specifically Google, although
there are many bad points about Google.
But I didn't go into any of them here
necessarily.
So you don't know if Google had, you
know, replies with information
they had to comply with the information
they've got.
They've complied. And in fact, they only
had to tell us years later.
So this actually has all like this was
given only just burn out.
But it was they were giving information.
They had a deadline to start giving
information, not since 2012.
So Google have complied.
All right. Thanks very last question for
microphone six.
I have a question about your broader
definition of whistle blowing risk,
because I get the feeling that
it might be damaging to the term.
And this is because currently
the connotation of whistleblowing is
using your right to free speech,
which is usually regarded rather
highly among the rights that citizens
have. And if you expand
this definition to any
form of activism to raise or
that is used to raise.
I don't know knowledge about the topic or
something.
How would you differentiate or where
to draw the line between whistleblowing
according to your definition and
vigilante justice?
I'm going to make a very bold statement.
OK, I
am 100 percent for vigilante
justice, just f why I
just f why we have a little kind
of I'm that's the punk in me maybe
going a little DIY there,
but I am one
hundred four people, one hundred
percent for people seeing injustice,
doing whatever they feel
they are able to do to
bring that forward. Like, like I said
before, revolutions are never easy
and they're never clean and they're never
neat. And the people that are breaking
the law are the ones that unfortunately
are going to enact the most change.
And I believe that we should support that
because laws are not
what's right is not always justice and
what's just is not always right.
Thank you. I guess that's a great closing
statement. Thank you so much.
Please give it out again for Sarah
Harrison. And Great Knowles was great.
OK, thank you so much.
Awesome talk.