The ethics of large data leaks
This September, a firestorm erupted when WikiLeaks put the entire unredacted cache of leaked US embassy cables up on its website. Vulnerable individuals named in the cables panicked, the media and civil society expressed confusion and outrage, and WikiLeaks was widely blamed for irresponsibility and indifference to the harm its leaks could cause, suffering more defections from its ranks. Just prior, Julian Assange squarely blamed David Leigh of The Guardian for publishing in a book the secret passcode to the encrypted file, which WikiLeaks had transmitted through a secure server. Leigh responded that he had been told the code was temporary and would expire. However, shortly before Assange was arrested on 7 December 2010, the encrypted material was also posted on BitTorrent. In August, 2011, WikLleaks defector Daniel Domscheit-Berg tipped off a German magazine where the file could be found on the internet, and the news began to circulate. But responsibility for the revelations was even more tangled and diffuse.
Wikileaks long had serious leaks within its ranks. More news organizations than the initial four obtained and ran stories on the cables. Israel Shamir, a one-time WikiLeaks insider, appears to have given the cache to Belarus dicator Lukashenko in 2010, prompting allegations that Belarusian activists then suffered retaliation. Wikileaks also distributed the cables to many more media outlets, saying it had roughly ninety media partners by mid-2011. Further leaks sprang from the ranks of the media partners. By April, WikiLeaks staff believed that most major intelligence agencies likely had obtained the entire unredacted cache. In late August, as the connection between the passcode and the location of the encrypted cache was about to go viral, it seemed the only audiences that might still not have access were the general public and the very individuals who might be at risk of serious human rights abuse due to their exposure. WikiLeaks sent out a few quiet warnings, and then posted the unredacted material itself.
The WikiLeaks publication of the unredacted cables did alert vulnerable sources, several of whom left their countries to protect themselves. It also ensured that no party intent on retaliating against US sources would have difficulty identifying prey. We can recognise this without vilifying Wikileaks; like any publisher, they faced difficult decisions with limited knowledge, and under a great deal more pressure than most.
Even so, WikiLeaks’ acts in relation to the cables give the free speech community whiplash. On the one hand, there is no doubt that the vast majority of this information was of public interest — to many publics and in many ways, including the quintessential rationale for journalistic leaks, whistleblowing. If Julian Assange could be prosecuted in the US under the Espionage Act for mere publication, so could any major media enterprise or human rights group, a tremendous blow to freedom of expression and the right to information in a jurisdiction that often leads in protecting these rights. On the other, many human rights activists are disturbed at the willingness of WikiLeaks to further expose individuals to reprisal in the name of freedom of information. A bright line in values had been crossed.
WikiLeaks had taken a different approach with the US diplomatic cables than it had with the Afghanistan war logs, pacing its releases, redacting more carefully, and soliciting input on risks, even from the US government. This made its unredacted dump the more surprising. The publication of the raw cables by others did not absolve Wikileaks of responsibility in its own publication. By providing additional publicity and an implicit authentication, it may have added to tangible risks, but just as important, it undercut its own claim to concern for protection of individuals from abuse. The function of alerting persons who might be named in the cables could have been performed much earlier, and in ways that publicly acknowledged the wide dissemination of the cables by early 2011. And by the time Wikileaks published, the more debatable function of providing unredacted access to the global public was underway at other websites.
What lessons should publishers draw? The first is that it is hard to keep confidential information secret, and this is as much a human as a technical problem. Information not only “wants to be free,” as Stewart Brand noted it also has value, and people want to trade it. Digital information is especially easy to amass and pass in the internet age, and large data leaks are likely to proliferate.
Next, large data sets are hard to handle responsibly. They require large resources to review, analyze and redact, as my organisation, Human Rights Watch, has discovered when it secured troves in Kurdistan, Chad and Libya. WikiLeaks appropriately went to major newspapers that could muster the resources to handle it well. Yet it is governments and intelligence services that have the most resources to analyze and mine large data sets (and correlate information to other intelligence), making it all the more important for those who publish whistleblowing to try to protect individuals at risk.
Not everything is worth the effort of publishing in a responsible way. Newspapers know this, because they have to pay for newsprint. But there is a moral economy as well, where the more attenuated the public’s interest, the more other values and goals might weigh against exposure. Most researching professions, to ensure their moral legitimacy, aim not only to increase knowledge but to protect human security, privacy, and dignity. Sometimes preserving rather than uploading can be a reasonable alternative.
Finally, we should strive to create a culture of ethical transparency, because without an ethical underpinning, it will be difficult to resist growing efforts to tighten up laws that punish leaks. Part of that is cultivating some modesty about our ability to fortell the full consequences of either exposure or concealment, and a willingness to be responsible for decisions either way.
Dinah Pokempner is General Counsel of Human Rights Watch.
