How do players in the free speech community, such as NGOs and journalists, make it safer to be a whistleblower? By providing secure digital platforms designed to connect them and the journalists who use the leaked information.
To find out how a Publeaks secure whistleblower platform works, IFEX spoke with Marcel Oomens and Ruth de Vries, Project Officer and Team Leader for Gender, Innovation and Safety at Free Press Unlimited; Benjamin Cokelet, from PODER, a founding member of the Mexicoleaks alliance; and Gillo Cutrupi, a digital security expert.
Heroes or snitches? Whistleblowers are not all cut from the same cloth, and may be driven by a variety of motivations, but it is hard to argue against the fact that they can play a vital role in revealing corruption and holding the powerful to account. It is equally clear that whistleblowers risk much – sometimes everything – to share their information.
You only need to take a look at the stories of Chelsea Manning, Yuliya Stepanova, Edward Snowden and others to see that being exposed as a whistleblower can change your life forever.
So how do players in the free speech community, such as NGOs and journalists, make it safer to be a whistleblower?
By providing secure digital platforms designed to connect – and protect – whistleblowers and the journalists who use the leaked information to publish stories in the public interest.
One such model is Publeaks.
How did Publeaks start?
First of all, it’s important to understand that the term Publeaks has been used to describe three different – but related – things. It is the name of the Dutch Publeaks Foundation that, along with 25 Dutch media outlets, set up the first Publeaks whistleblower platform in the Netherlands in 2015. Now it is used by Free Press Unlimited to describe the model itself, which has since been used to set up similar sites in other countries.
In 2013, Free Press Unlimited, a Netherlands-based NGO dedicated to making independent news and information freely available to all, took on an advisory role on the board of the Publeaks Foundation. That same year, the foundation launched the first secure whistleblower platform of its kind – Publeaks, which allows people in the Netherlands to anonymously give information to over 20 media partners in the country.
On the Publeaks site, whistleblowers can select particular media outlets, or leave it up to the media partners to sort out which outlets will investigate, verify and publish stories based on their leak. Neither the Publeaks Foundation nor Free Press Unlimited has access to the information being leaked or to the whistleblowers.
Since the Publeaks platform was launched in the Netherlands, the model has served as the basis for two other sites – Mexicoleaks and afriLEAKS – and is being used to develop similar platforms in Asia.
Free Press Unlimited
How does it work?
Three key players are needed to create a Publeaks platform: the NGO (Free Press Unlimited), the media partners (different in each country), and the all-important technology – Globaleaks.
1. The NGO
As a group that funds and organizes many different media development projects, Free Press Unlimited values the importance of serious investigative journalism and the media’s role in providing checks and balances in democracies. It is concerned about whistleblower safety, and the responsibility of journalists to protect their sources.
In supporting the creation of a Publeaks platform, Free Press Unlimited describes itself as a facilitator, a supporter and trainer. It helps bring the media together, connects them to the secure software needed for them to receive anonymous leaks, and then steps back and lets the local media take over ownership and the day-to-day running of their project.
Marcel Oomens, the organisation’s Project Officer for Gender, Innovation and Safety, says that while his organization is open to partners continuing to reach out to them “If they find that they require extra training in digital security […] in investigative reporting skills, data journalism”, the ideal model is one where a small amount of funding and capacity building leads to Publeaks projects becoming independently sustainable.
The Publeaks model is relatively new, and Free Press Unlimited is eager to continually improve it. With each new project they apply the lessons learned from the earlier iterations.
2. The Media Partners
In each country where Publeaks projects are active, there is a wide diversity of media partners. They include national broadsheets in the Netherlands, digital media in Mexico, and independent newspapers in South Africa. They have one thing in common: their dedication to investigative journalism and to protecting their sources.
In this model, the media partners are the only groups with access to the leaked materials and the ability to contact whistleblowers. Using the Globaleaks software and confidential keys, journalists can access material that has been submitted through the platform, as well as send messages to the source of those materials, without knowing their identity.
“Mexicoleaks does not ask for, nor does it retain, information about the identity of a whistleblower,” Benjamin Cokelet, from PODER, a founding member of the Mexicoleaks alliance, told IFEX. He added that though a whistleblower might decide to provide identifying information about themselves, this is not encouraged, and members of the Mexicoleaks alliance would never publish the information.
According to the afriLEAKS website, media partners of that alliance must meet several criteria, including “excellence in investigative journalism, integrity in content and investigative processes”.
Free Press Unlimited also looks for media partners that are credible and have public support, so that when they publish stories as a result of leaks, they will be taken seriously.
[A tweet from @Mexleaks describing the six simple steps to submitting information to the platform]
The media partners also help communicate to the public how these projects work. In the Netherlands, the Publeaks site features videos created by the Publeaks Foundation and Free Press Unlimited that explain the process, while in Mexico, the journalists shared their reasons for why Mexicoleaks is necessary.
3. The Technology
This is ultimately what connects journalists and whistleblowers in each of these projects: the open-source secure software called Globaleaks, developed by the HERMES Center for Transparency and Digital Human Rights in Italy. Physical and digital fingerprints can reveal the identities of whistleblowers, which is the main thing that this tool helps to avoid.
Free Press Unlimited had previously worked with members of HERMES in the TOR community, and using TOR is still part of the process for submitting files to any of the Publeaks platforms. According to Oomens, the relationship with the Globaleaks developers is very collaborative: “We work very much together on what features are required, and at the same time to also trust that they do a good job implementing those features in a way that is secure.”
When setting up afriLEAKS, HERMES had trainers teach the participating journalists how to use the software and other secure technologies. Regional organisation Code for Africa now does training in the region, while HERMES provides back-end technical support for the platform.
Oomens stressed that it is near impossible to claim 100 per cent security in an online platform such as Publeaks, but the cryptographic software and technologies that are used make it very expensive and time-consuming for anyone who tries to compromise the whistleblowers using the platform.
Mexicoleaks, afriLEAKS and beyond
Free Press Unlimited helped set up Mexicoleaks in 2015. With only eight media partners, a higher level of collaboration was possible. All the media partners agreed that they would jointly investigate all the leaks that they received. This type of working relationship has provided a sense of safety in numbers in Mexico, where the risks for publishing sensitive information are extremely high.
As Cokelet told IFEX via email, “The highly collaborative nature of the members of the Mexicoleaks alliance […] both maximizes readership and protects an individual media outlet from unwanted reprisals”.
afriLEAKS was also launched in 2015, with 19 media partners from across the continent. On the day of the launch, the South-African paper Mail & Guardian, one of the project’s media partners, published a story calling on whistleblowers to participate.
A notable characteristic of the afriLEAKS project is that, in addition to the emphasis on the digital security of whistleblowers, it is concerned with bringing journalists up to speed on how to safeguard themselves online, since historically there has been a gap in understanding the risks they face in investigating leaks.
Gillo Cutrupi, a digital security expert who was involved in training the afriLEAKS journalists, said that in addition to training in Globaleaks and TOR, they were also taught how to use PGP email encryption to communicate securely with their partners in the media alliance.
While the technology is integral to the success of these projects, Cutrupi stressed how important it is to involve journalists who do good investigative work and know how to make connections and build trust with sources. He said that the participation of an NGO like Free Press Unlimited has made certain that these considerations are taken as seriously as the need for secure technology.
According to Free Press Unlimited, media in Malaysia, and, in the wake of the Panama Papers leaks, groups in Indonesia, have expressed interest in the whistleblowing platform.
Positive Steps
While governments and corporations continue to fear and fight whistleblowers, their attitude is not necessarily shared by the general public in the countries where Publeaks projects are based.
In the fall of 2015 the Mexico platform really found its stride, and there was an increase in the number of media stories resulting from leaks.
Mexicoleaks’ Cokelet says that all of the stories they have published as a result of the leaks have had noticeable impact in Mexican society. Two he singled out for emphasis: a story that revealed corruption and mismanagement of a construction project that destroyed archaeological remains, and another that told how a housing trust lost investments entrusted to it by members of the working class.
According to Oomens, “[t]he fact that they’ve been much more in the spotlight means that people are getting much more aware of the role that whistleblowers have to play in societies.”
Awareness of the role of whistleblowers is an important step. It translates into support for projects like the Publeaks platforms, which are making it possible for people to learn about – and fight – corruption that would not otherwise be brought to light.