This article concentrates on the extreme lengths sources and reporters may have to go to maintain anonymity and still disclose illegal, unethical or immoral activities.
I had a deep education of covert and surreptitious communications when I was in Special Forces. In the past few years dealing with some sources who are in not-s0-well protected countries I have learned many new secure, encrypted communications techniques. Often they are called circumvention technologies, meaning they are deliberately designed to maneuver around firewalls, blocked addresses, and government censorship.
Using these technologies appears to be the status quo for working in today’s world, in many situations. Imagine any of these characters discovering the name of the original source, what would happen? Imagine these reporters becoming known to the scofflaws discovered here, their stories may have never been properly researched and written. They might have been “spiked”, sometimes literally.
</end editorial>
AUTHOR: ANDY GREENBERG.ANDY GREENBERG SECURITY
DATE OF PUBLICATION: 04.04.16.04.04.16
TIME OF PUBLICATION: 9:17 AM.9:17 AM
WHEN DANIEL ELLSBERG photocopied and leaked the Pentagon Papers to the New York Times in 1971, those 7,000 pages of top secret Vietnam War documents represented what was then the biggest whistleblower leak in history—a couple dozen megabytes if it were contained in a modern text file. Almost four decades later, WikiLeaks in 2010 published Cablegate, a world-shaking, 1.73-gigabyte collection of classified State Department communications that was almost a hundred times bigger.
If there’s some Moore’s Law of Leaks, however, it seems to be exponential. Just five years have passed since WikiLeaks’ Cablegate coup, and now the world is grappling with a whistleblower megaleak on a scale never seen before: 2.6 terabytes, well over a thousandfold larger.
On Sunday, more than a hundred media outlets around the world, coordinated by the Washington, DC-based International Consortium of Investigative Journalists, released stories on the Panama Papers, a gargantuan collection of leaked documents exposing a widespread system of global tax evasion. The leak includes more than 4.8 million emails, 3 million database files, and 2.1 million PDFs from the Panamanian law firm Mossack Fonseca that, according to the analysis of the leaked documents, appears to specialize in creating shell companies that its clients have used to hide their assets.
“This is pretty much every document from this firm over a 40-year period,” ICIJ director Gerard Ryle told WIRED in a phone call, arguing that at “about 2,000 times larger than the WikiLeaks state department cables,” it’s indeed the biggest leak in history.
Neither the ICIJ nor any of the reporters it’s worked with has made the leaked data public. But the scandal resulting from their reporting has already touched celebrities, athletes, business executives and world leaders. The documents trace $2 billion of hidden money tied to Vladimir Putin through accounts held in the names of family members and his celebrated musician friend Sergei Roldugin. Icelandic Prime Minister Sigmundur Gunnlaugsson is facing demands from the previous Icelandic prime minister that he resign after the Mossack Fonseca documents showed that Gunnlaugsson may have failed to disclose ownership of a stake in certain Icelandic banks under the government’s rules for officials. And the leaks drag FIFA officials back into the news, showing that even an ethics lawyer for the world soccer body had financial ties to another FIFA official already accused of corruption.
But beyond those revelations—and there will likely be more as the reporting around the Panama Papers continues—the leak represents an unprecedented story in itself: How an anonymous whistleblower was able to spirit out and surreptitiously send journalists a gargantuan collection of files, which were then analyzed by more than 400 reporters in secret over more than a year before a coordinated effort to go public.
How You Coordinate History’s Biggest Leak
The Panama Papers leak began, according to ICIJ director Ryle, in late 2014, when an unknown source reached out to the German newspaper Suddeutsche Zeitung, which had reported previously on a smaller leak of Mossack Fonseca files to German government regulators. A Suddeutsche Zeitung reporter named Bastian Obermayer says that the source contacted him via encrypted chat, offering some sort of data intended “to make these crimes public.” But the source warned that his or her “life is in danger,” was only willing to communicate via encrypted channels, and refused to meet in person.
“How much data are we talking about?” Obermayer asked.
“More than you have ever seen,” the source responded, according to Obermayer.
Obermayer tells WIRED he communicated with his source over a series of encrypted channels that they frequently changed, each time deleting all history from their prior exchange. He alludes to crypto apps like Signal and Threema, as well as PGP-encrypted email but declines to say specifically which methods they used. Each time the reporter and source re-established a connection, they would use a known question and answer to reauthenticate each other. “I’d say ‘is it sunny?’ You’d say ‘the moon is raining’ or whatever nonsense, and then both of us can verify it’s still the other person on the device,” Obermayer says.
After seeing a portion of the documents, Suddeutsche Zeitung contacted the ICIJ, which had helped to coordinate previous tax haven megaleaks including a 2013 analysis of leaked offshore tax haven data and another leak-enabled investigation last year that focused on assets protected by the Swiss bank HSBC. ICIJ staff flew to Munich to coordinate with Suddeutsche Zeitung reporters.
Meanwhile, the shipments of leaked data continued piecemeal. “Over time we got more and more until we had all 11.5 million documents,” Ryle says. Obermayer declined to explain how their leaker sent Suddeutsche Zeitung hundreds of gigabytes or even terabytes of information at a time. That’s far too much to send over email, of course, though that quantity of data could easily be sent anonymously in the form of shipped encrypted hard drives. “I learned a lot about making the safe transfer of big files,” Obermayer says elliptically.
We’re not WikiLeaks. We’re trying to show that journalism can be done responsibly.
ICIJ DIRECTOR GERARD RYLE
The ICIJ’s developers then built a two-factor-authentication-protected search engine for the leaked documents, the URL for which they shared via encrypted email with scores of news outlets including the BBC, The Guardian, Fusion, and dozens of foreign-language media outlets. The site even featured a real-time chat system, so that reporters could exchange tips and find a translation for documents in languages they couldn’t read. “If you wanted to look into the Brazilian documents, you could find a Brazilian reporter,” says Ryle. “You could see who was awake and working and communicate openly. We encouraged everyone to tell everyone what they were doing.” The different media outlets eventually held their own in-person meetings, too, in Washington, Munich, London, Johannesburg, and Lillehammer, Ryle says.1
Remarkably, despite all that broad access and openness, the full leaked database has yet to leak to the public—perhaps in part because it’s so large and unwieldy. Obermayer admits that rumors of the massive leak spread, but says that the data itself remained contained. “Last fall I was really nervous, thinking ‘a lot of people know,’,” he says. “Word leaked out at places. But it never got further.”
Ryle says that the media organizations have no plans to release the full dataset, WikiLeaks-style, which he argues would expose the sensitive information of innocent private individuals along with the public figures on which the group’s reporting has focused. “We’re not WikiLeaks. We’re trying to show that journalism can be done responsibly,” Ryle says. He says he advised the reporters from all the participating media outlets to “go crazy, but tell us what’s in the public interest for your country.”
Weeks before contacting the subjects of the investigation, including Mossack Fonseca, Obermayer took one final precaution: he destroyed the phone and the hard drive of the laptop he’d used for his conversations with the source. “This may have seemed a little overachieving,” he notes, “But better safe than sorry.”He notes that even now, he doesn’t know who the source actually is. “I don’t know the name of the person or the identity of the person,” Obermayer says. “But I would say I know the person. For certain
He notes that even now, he doesn’t know who the source actually is. “I don’t know the name of the person or the identity of the person,” Obermayer says. “But I would say I know the person. For certain periods I talked to [this person] more than to my wife.”
A New Era of Megaleaks
The leaks are bound to cause ripples around the world—not least of all for Mossack Fonseca itself. The firm didn’t respond to a request for comment from WIRED, but it wrote to the Guardian that “many of the circumstances you cite are not and have never been clients of Mossack Fonseca” and that “we have always complied with international protocols … to assure as is reasonably possible, that the companies we incorporate are not being used for tax evasion, money laundering, terrorist finance or other illicit purposes.” Another letter posted to WikiLeaks’ Twitter feed, meanwhile, purports to show how the firm has responded to its own clients:
The leaks are bound to cause ripples around the world—not least of all for Mossack Fonseca itself. The firm didn’t respond to a request for comment from WIRED, but it wrote to the Guardian that “many of the circumstances you cite are not and have never been clients of Mossack Fonseca” and that “we have always complied with international protocols … to assure as is reasonably possible, that the companies we incorporate are not being used for tax evasion, money laundering, terrorist finance or other illicit purposes.” Another letter posted to WikiLeaks’ Twitter feed, meanwhile, purports to show how the firm has responded to its own clients:
Mossack Fonseca and its customers won’t be the last to face an embarrassing or even incriminating megaleak. Encryption and anonymity tools like Tor have only become more widespread and easy to use, making it safer in some ways than ever before for sources to reach out to journalists across the globe. Data is more easily transferred—and with tools like Onionshare, more easily securely transferred—than ever before. And actual Moore’s Law continues to fit more data on smaller and smaller slices of hardware every year, any of which could be ferreted out of a corporation or government agency by a motivated insider and put in an envelope to a trusted journalist.
The new era of megaleaks is already underway: The Panama Papers represent the fourth tax haven leak coordinated by the ICIJ since just 2013. The Intercept, the investigative journalism outlet co-founded by Glenn Greenwald, Laura Poitras and Jeremy Scahill, has also shown how encryption tools can be combined with investigative journalism to yield leaks like last year’s Drone Papers and a collection of 70 million prison phone call records. Dozens of media outlets, including the Intercept, now host anonymous upload systems that use cryptographic protections to shield whistleblowers. All of that—unfortunately for companies and governments trying to keep hold of their dirty data, but fortunate for public interest—means that the widening pipeline of leaks isn’t likely to dry up any time soon.
Source: http://www.wired.com/2016/04/reporters-pulled-off-panama-papers-biggest-leak-whistleblower-history/
Filed under: Corruption, CounterPropaganda, Information operations, Information Warfare Tagged: Corruption, Panama Papers, Secure Communications, Secure Messaging
Almost lost among the many revelations is the fact that Russia’s biggest bank uses The Podesta Group as its lobbyist in Washington, DC. Though hardly a household name, this firm is well known inside the Beltway, not least because its CEO is Tony Podesta, one of the best-connected Democratic machers in the country. He founded the firm in 1998 with his brother John, formerly chief of staff to President Bill Clinton, then counselor to President Barack Obama, Mr. Podesta is the very definition of a Democratic insider. Outsiders engage the Podestas and their well-connected lobbying firm to improve their image and get access to Democratic bigwigs.
Which is exactly what Sberbank, Russia’s biggest financial institution, did this spring. As reported at the end of March, the Podesta Group registered with the U.S. Government as a lobbyist for Sberbank, as required by law, naming three Podesta Group staffers: Tony Podesta plus Stephen Rademaker and David Adams, the last two former assistant secretaries of state. It should be noted that Tony Podesta is a big-money bundler for the Hillary Clinton presidential campaign while his brother John is the chairman of that campaign, the chief architect of her plans to take the White House this November.
Sberbank (Savings Bank in Russian) engaged the Podesta Group to help its public image—leading Moscow financial institutions not exactly being known for their propriety and wholesomeness—and specifically to help lift some of the pain of sanctions placed on Russia in the aftermath of the Kremlin’s aggression against Ukraine, which has caused real pain to the country’s hard-hit financial sector.
It’s hardly surprising that Sberbank sought the help of Democratic insiders like the Podesta Group to aid them in this difficult hour, since they clearly understand how American politics work. The question is why the Podesta Group took Sberbank’s money. That financial institution isn’t exactly hiding in the shadows—it’s the biggest bank in Russia, and its reputation leaves a lot to be desired. Nobody acquainted with Russian finance was surprised that Sberbank wound up in the Panama Papers.
Since the brothers are destined for very high-level jobs if the Democrats triumph in November, their relationship is something they—and Clinton—need to explain.
Although Sberbank has its origins in the nineteenth century, it was functionally reborn after the Soviet collapse, and it the 1990s it grew to be the dominant bank in the country, today controlling nearly 30 percent of Russia’s aggregate banking assets and employing a quarter-million people. The majority stockholder in Sberbank is Russia’s Central Bank. In other words, Sberbank is functionally an arm of the Kremlin, although it’s ostensibly a private institution.
Certainly Western intelligence is well acquainted with Sberbank, noting its close relationship with Vladimir Putin and his regime. Funds moving through Sberbank are regularly used to support clandestine Russian intelligence operations, while the bank uses its offices abroad as cover for the Russian Foreign Intelligence Service or SVR. A NATO counterintelligence official explained that Sberbank, which has outposts in almost two dozen foreign countries, “functions as a sort of arm of the SVR outside Russia, especially because many of its senior employees are ‘former’ Russian intelligence officers.” Inside the country, Sberbank has an equally cosy relationship with the Federal Security Service or FSB, Russia’s powerful domestic intelligence agency.
Ukraine has pointed a finger at Sberbank as an instrument of Russia’s aggression against their country. In 2014, Ukraine’s Security Service charged Sberbank with “financing terrorism,” noting that its branches were distributing millions of dollars in illegal aid to Russian-backed separatists fighting in eastern Ukraine. Kyiv’s conclusion, that Sberbank is a witting supporter of Russian aggression against Ukraine, is broadly supported by Western intelligence. “Sberbank is the Kremlin, they don’t do anything major without Putin’s go-ahead, and they don’t tell him ‘no’ either,” explained a retired senior U.S. intelligence official with extensive experience in Eastern Europe.
In addition, Ukrainian intelligence has alleged that the FSB collaborated with Sberbank in the bombings of two of the bank’s branches in Kyiv, Ukraine’s capital, in June 2015. The attacks caused no casualties but got major coverage in Russian state media as “proof” of Ukraine’s instability and violent anti-Russian nature. Although the notion that Russian spies would plant bombs as a provocation, what the Kremlin terms provokatsiya, may sound outlandish to those unacquainted with espionage, in fact Russian spies have been doing such things since tsarist times. What I’ve termed“fake terrorism” is a longstanding Kremlin core competency, and it can only be pulled off with logistical support, including with finances.
Predictably, Sberbank has blown off the Panama Papers revelations as nothing of consequence, but the fact that they are an arm of the Kremlin and they do plenty of shady things in many countries is a matter of record. As is the fact that the Podesta Group is their lobbyist in America.
Among the Sberbank subsidiaries that the Podesta Group also represents are the Cayman Islands-based Troika Dialog Group Limited, the Cyprus-based SBGB Cyprus Limited, and the Luxembourg-based SB International. As reported this week by the Organized Crime and Corruption Reporting Project, a consortium of journalists exploring the Panama Papers leak, Sberbank and Troika Dialog are used by members of Mr. Putin’s inner circle to shift public funds into sometimes questionable private investments. In other words, this is top-level money laundering of a brazen kind. As the OCCRP stated plainly, “Some of these companies were initially connected to the Troika Dialog investment fund, which was controlled and run by Sberbank after the bank bought the Troika Dialog investment bank. Troika and Sberbank declined to comment.”
Adding to shadiness of all this, the Podesta Group is playing along with the useful charade that Sberbank is simply a private financial institution, rather than the state-owned bank that it is, since that would require the lobbyists to register as agents of the Russian government under the Foreign Agent Registration Act.
John and Tony Podesta aren’t fooling anyone with this ruse. They are lobbyists for Vladimir Putin’s personal bank of choice, an arm of his Kremlin and its intelligence services. Since the brothers Podesta are presumably destined for very high-level White House jobs next January if the Democrats triumph in November at the polls, their relationship with Sberbank is something they—and Hillary Clinton—need to explain to the public.