Real Talk on Reality

Leaking is high risk

9 min readJun 9, 2017

On June 5th The Intercept released an article based on an anonymously leaked Top Secret NSA document. The article was about one aspect of the Russian cyber campaign against the 2016 US election — the targeting of election device manufacturers. The relevance of this aspect of the Russian operation is not exactly clear, but we’ll address that in a separate post because… just hours after The Intercept’s article went live the US Department of Justice released an affidavit (and search warrant) covering the arrest of Reality Winner — the alleged leaker. Let’s look at that!

The medium is the message

The timing of the DoJ release was clearly premeditated to send a message to would be leakers that the long arm of the law moves fast. The implied narrative is that mere hours after the leaked document was released they had already collared the leaker. Additionally, the search warrant is worded to throw as much blame on The Intercept as possible. The truth is that Ms Winner was doomed, regardless of what The Intercept did to protect their source – which was, basically, nothing.

Timeline of events

A timeline reveals that the reality is more complicated than the emerging narratives (“DoJ caught Ms Winner in hours”[0], “The Intercept grassed up their source”[1], “it is impossible to leak safely.”[2])

May 5th: NSA disseminates the document
May 9th: Ms Winner searches for keywords that surface the document which she prints, smuggles out of the secure work facility and, “approximately a few days later,” mailed to The Intercept. This was the only document she printed the entire month.
May 24th: A reporter from The Intercept contacts a defence contractor via “text message” (probably Signal, because end to end encryption). The reporter asks the contractor to verify documents which were mailed from “Augusta, Georgia” and sends images of the docs. The reporter suggests that the documents come from Ms Winner’s workplace. The contractor says the docs are fake.
May 27–29: Ms Winner travels to Belize.
May 30: The Intercept contacts NSA for verification. They provide NSA with a copy of the document. NSA negotiates to redact certain parts to limit the exposure of sources and methods.
June 1st: The Intercept reporter contacts the contractor to inform them that the documents are authentic.
June 1st: The contractor reports the media contact from The Intercept, the images of the report and the report identification number.
June 1st: NSA audits access logs to determine who read the document. They also, based on the copy provided by The Intercept, filter that search for people that printed the document. This gives them 6 suspects.
June 1st: NSA examines the workstations of all 6 suspects and determine that Ms Winner had previously had a link to The Intercept — email contact. (This was on March 30th in relation to The Intercept’s podcast.)
June 2nd: The FBI conducts surveillance on Ms Winner to verify her vehicle, her residence, and her mobile phone.
June 3rd: FBI interviews Ms Winner who admits to accessing and printing the document (which was in the logs), and not having a “need to know,” i.e. she did not access the document as part of her job requirements. During the interview they also get her to confess to removing the printout and mailing the printout to The Intercept. She is arrested.
June 5th: The Intercept posts their article. A major scoop that provides almost no additional new information beyond what was already known and reported on multiple times.
June 5th: The DoJ releases their press release about Ms Winner.

It is obvious that from “leak to lockup” was a period of almost a month. Rather than the “few hours” implied by the DoJ press release, the investigation still took a couple days to conclude and it wasn’t even started until weeks after the documents were leaked.

Lesson: Even the worst tradecraft errors typically aren’t immediately fatal, but rather take time before they manifest (the opposition has to learn that there is a secret and then attempt to uncover it.)

[0]: False. It took longer: weeks to start and about 2 days to conclude.

[1]: True-ish. But also not relevant to the ultimate outcome of the investigation.

[2]: False-ish. Stealing and releasing classified data means you forfeit your future, same as any other offensive action against the state. The odds are that you’ll end up: jailed; in exile, or dead.

For want of good tradecraft a source was lost

There has been a great deal of discussion about who is to blame for the arrest of Ms Winner. That is easy — Ms Winner, who chose to commit the crime, is to blame for her own actions. But, that is not the interesting answer. People would prefer to have some Lessons Learned from the debacle of the Reality Winner case, so lets look at the mistakes made and possible remediations.

Where it all went wrong

The first and last mistake, as the jihadis say, was to print and mail the document to a news organisation. Journalists have a code of ethics that they follow which includes “if a source provides a document they give the reporter authority to do anything with it.” The converse side to this is, of course, don’t give reporters anything that you wouldn’t want printed. Lesson: Sources cannot simply rely on journalists to provide protection for them.

This is the cutthroat world view of journalists. They will do whatever they want for the story, and the safety of their source is of secondary concern [3]. Of course, some journalists will treat source protection as important and you should probably try to select for that when choosing who to entrust with your data.

The only thing you can rely on is that you will have to take security measures into your own hands, and that no one is going to go to jail for you. Your security is your concern.

[3]: generally speaking. There are, of course, many exceptions. On the other hand, The Intercept promoted themselves as an exception.

Journalists verify* and make information public

Reporters that receive documents have to verify their bonafides. That means they will contact the source of the document and seek confirmation. Journalists have to do this to ensure they aren’t being fed fake documents. The only way around this is with a trusted relationship between the source and the journalist, and even then the journalist has a responsibility to ensure the authenticity of the documents. The best solution here is – don’t provide the documents, provide the content. The goes for both the source and the journalist.

Retyping a leaked document to strip potential embedded metadata is by no means a new concept for journalists. A decade before Ms Winner was born reporters were aware of the need to not release original documents.

(Aside: this type of approach to identifying a leak is known as a barium meal.)

Lesson, Journalists: best practice is to not provide the government agency with the original document, but rather to supply them with the title and date. Discuss the content and verify the document like that, rather than handing over a potentially incriminating piece of evidence.

Lesson, Sources: it is safer to develop a relationship with a journalist that you can trust and leak the content of the document to them rather than the document itself. Call them up and tell them about the document. There is still risk, however an ephemeral call (using an encrypted voice communication app, e.g. Signal, Wire, WhatsApp) is significantly safer than a printed out original document. The counter example here is Kim and Rosen.

The Intercept is not the issue here, dude

The DoJ affidavits and press release do a lot of heavy lifting to place as much blame as possible on The Intercept, but they had almost no material impact on the investigation. The language of the search warrant affidavit implies that The Intercept was not operating safely and essentially grassed up their source in the rush to get a scoop — apparently the Russians were involved in hacking during the 2016 US election (something that has been heavily reported on since June 2016…a year.)

The real investigation was much more simple:

The NSA was alerted that a document was leaked, they examined the audit logs of everyone who’d access and printed the document. This gave them their list of primary suspects, all 6 of them.
The NSA’s investigation found a link between Ms Winner and The Intercept and so they placed her at the top of the list. The FBI was called in to handle the counterintelligence surveillance, interrogation and arrest.
During the interview Ms Winner confessed.

That is the ground facts of the counterintelligence investigation — the tradecraft errors that The Intercept made were not materially relevant to the investigation. The extremely geeky printer microdots, while an important piece of metadata, were not relevant to the investigation. There presence simply demonstrates the poor level of source protection demonstrated by The Intercept.

Not actually a perfectly good alternative.

Significantly, Ms Winner was not competent at operational security, risk assessment, or apparently anything security related. It seems she read The Intercept’s “anonymous tip guide,” but that was insufficient to prepare her for surviving the investigation.

[From her detention centre, over a recorded phone line,] Winner told her mother, “You know I’m charged with these documents, I’m screwed up.” Because Winner mentioned “documents” ― rather than a single document ― investigators are now looking into whether she has other classified information, Solari said. On Nov. 9, 2016, while still with the Air Force, Winner used her work computer to google the question: “Do top secret computers know when a thumb drive is inserted?” Solari told the court. – Source

She failed in depth.

The Intercept peed on the rug

That does not absolve The Intercept of their failures at source protection. They were the experts on this and they:

Triggered the investigation through advance notice – necessary for the job, but they would have known it would start a leak investigation. They should have followed best practice steps to ensure that they provided minimal incriminating evidence directly to the government agency.
Provided the investigation team full access to complete copies of the documents – not in line with best practice because the documents could (did!) contain copious identifying metadata, something The Intercept would have known.
Provided the investigation team additional identifying information about the origin of the documents, enabling the FBI to focus their search on Ms. Winner’s workplace.
Did not retype and recreate the documents before publishing them in their story. This would have, again, minimised the amount of incriminating evidence that was provided to the inevitable investigation.

None of these measures would necessarily have kept Ms Winner out of jail. The list of potential suspects was finite and she had made tradecraft errors of her own which would move her up the list of suspects. However, if she had been more careful and The Intercept had followed journalistic tradecraft best practices it is likely that the investigation would have taken significantly longer.

If she had retained counsel and refused to speak to the FBI, she would have lost her security clearance, but provided she did nothing further to incriminate herself maybe she could have avoided jail. The case would have had only circumstantial evidence and maybe she could have gotten away with it. We’ll never know because The Intercept failed to provide sufficient source protection, and she… has not helped her case very much.

That document rely tied the article together…

There are a number of serious tradecraft errors that The Intercept made which would have made Ms Winner a lot safer. Barton Gellman spelled them out clearly in a tweet storm.

The Intercept made serious source protection errors. Even without them, the investigation was very straightforward. While Ms Winner could not have escaped the investigation, she could possibly have survived the case. However, the case against her was sealed by the errors made by The Intercept. Her own confession and subsequent statements are sufficient for the prosecution, but that does not excuse The Intercept for failing to provide adequate source protection.