How to leak
How to leak stuffs and hopefully not get caught, slandered, and tortured. A guide
You have just stumbled across a stash of files on the Evil Government Agency, aka your employers, computer network. They detail some nasty things that the world MUST know! What should you do first? Go home and think about it. Sleep on it. Ask yourself this question: Is what you found truly information of significant public interest? What would constitute such information? You probably would know it when you see it, but it would likely be evidence or documentation of crimes or large ethical violations by the government or large corporations and would have the potential for backlash against you in some way that would be quite undesirable for you and maybe even your loved ones (whether it be the press going on a witch hunt to completely discredit you or being waterboarded in a certain part of Cuba). If the press isn't likely to bat an eyelash it probably isn't something you should leak (especially if it causes damage or danger to anyone/anything). It also isn't of true significant public interest if it involves a celebrity and underaged fans, though TMZ may be willing to pay you for that kind of leak (Skip this guide and head straight for TMZ.com) You should be aware that leaking sensitive information may very well be a criminal offense and you shouldn't want to leak just to leak stuff. You need to be willing to risk literally everything for the common good and understand that no matter how safe you are, you are at great risk. Whatever it is, consider all of this and spend time thinking about this. Weigh the pros and cons (in your head or burn the paper). Don't seek advice from others. Don't tell a soul (depending on what it is, a lawyer or priest may be an exception. Only you will be able to figure it out, and if you can't don't tell them either). Spend at least two weeks of considering on how you should proceed before, well, proceeding.
Get the dirt
If your gonna leak something, you actually need the proof. You can't just walk into a starbucks and tell Glenn Greenwald that the US is plotting an invasion of Canada. He will probably laugh at you cause that sounds absurd and also you have nothing to back up your claims (and no actual source material for him to write about). To get the stuff, you need to carefully and deliberatly extract it from the environment that it is in.
- If your find is on a computer or computer network, assume everything is being monitored, tracked, has lojack, and other protections against leaks. Even the printers. Even the power strip(Overkill? Probably. But this should be your mindset now). How can you get these documents? You can move stuff to a thumb drive, but this will leave a trace. Remember, everything is being monitored. Be creative, perhaps you could use a cheap camera to take pictures of documents or film any video. Though if there is a large amount of data, you might just have to take a larger risk and move it to a thumb drive after all or print it out. If you can, use another workstation to do this with another persons account. (Illegal, but perhaps necessary)
- If your find is in a filing drawer, the stuff is probably on paper. You cant copy these... but you can take pictures. If nobody will miss them for a while, take them home with you on a holiday weekend. Go to a kinkos and make copies of them. Pay with cash. Get the papers back before any eyebrows are raised. If this isn't an option, you can again use a cheap camera and take pictures. Try to make sure they come out good.
Go to the press
Now that you have the water your going to leak, you need to bring it to someone with the resources to pour it out into the publics ready eyeballs. This is gonna have to be reworded.
- Seek out (a) news organization(s) that actively look for leaks from the public or has been known to publish leaks(eg. The Guardian, The New York Times, or even Wikileaks. They count too!) This organization knows what to do with this stuff once its left your hands and, depending on your jurisdiction, has legal protections for your identity and stuff. You will still want to protect your identify yourself and if possible remain anonymous even to the leakee. In choosing where you are leaking keep in mind that its probably not a good idea to leak to someone of whos website you visit often at work.
- Once you have chosen your desired leakee(s), find out how to securely contact them. And then make sure you use tools (such as tor and cryptocat ) to further protect yourself. Some news outlets have special file submission tools which allow you to easily submit content via tor.
- Delete any digital trails and copies of the material you have leaked. Use Tails when dealing with leak related tasks to make sure you leave little to no trace.
Resources
- Tor - Reroutes your web traffic to help mask your identity and protect your privacy. Used by journalists around the world.
- Cryptocat - Secure chat software.
- Tails - An operating system made to forget all the naughty things you do on it. Comes with TOR and other potentially useful tools.
- Hide your data - A guide to encryption using truecrypt.
- Encrypt Everything Encryption encryption and privacy information by the Canadian Pirate Party
- New Yorker Strongbox - Leak to the New Yorker!
- Forbes Safesource - Leak to Forbes!
- The Intercept SecureDrop - Leak to The Intercept!
Further Reading
- The Whistleblower’s Guide to the Orwellian Galaxy: How to Leak to the Press
- How to leak to Gawker - Gawker Medias guide to leaking.
- A brief guide to leaking - By Nicky Hager