journalistic insecurity and facilitating whistleblower privacy

[coderman]

more fallout from the top sekrit "national security letters"
(30,000 issued per year, wonder how high this has increased with the
new focus on journalistic sources?)

"""
On Tuesday, an email arrived from Dan Eggen, Justice Department
correspondent for The Washington Post. Dan wanted a copy of the letter
and more information on the story.

That's right I write a story about how the Bush administration is
monitoring the email of journalists and a journalist fires off an
email asking me to violate the USA Patriot Act and risk certain jail
time by providing him with a copy of a letter that I'm not even
supposed to admit I have.
...
Then I checked my voice mail to find a call from Robert O'Harrow Jr.,
another Post reporter, wanting information on my sources.  Hmmm. I
write a story about how the Bush administration is monitoring phone
calls of reporters and a reporter calls me on the phone to obtain
information on my confidential sources.  Anyone see a pattern here?

Next, I get both a phone call and an email from David Armstrong of the
National Security News Service saying he is working with 60 Minutes on
a story about domestic spying by the National Security Agency. He
wants info on my sources.
...
When Mark Felt, the number two man in the FBI, served as Post reporter
Bob Woodward's primary source on Watergate, he insisted that Woodward
avoid contact by telephone and devised a scheme of planted messages in
a newspaper left at Woodward's door and meetings in an underground
garage in Arlington....

My sources know better than to use phone lines and email to contact
me. We've worked out elaborate, and always changing, methods for
sharing information.
"""


are the vast majority of journalists really this brain dead?  here is
what i'd like to know  from a reporter to whom i was about to divulge
sensitive information:

- do i _really_ trust you?  even if they turn the screws?

- do you know what physical security is (and implement it)?
  [ oops, is anyone left standing? ]

- do you use network security best practices when communicating
privately online?
  [ os up to date with security patches, unnecessary services
disabled, firewall, etc ]

- can i communicate via a secure channel?
  [ examples: whispered conversations in a noisy parking garage ;)
    off the record with mutually verified keys http://www.cypherpunks.ca/otr/
    other SSL mechanism with mutual authentication like http://openvpn.net/
    pgp/gpg encrypted email (though this seems not so popular?) ]

- do you protect your stored data appropriately?
  [ loop-aes encrypted volumes, FileVault, gpg encrypted files, etc ]

- do you use good passwords/phrases for authentication?

what other questions would you ask?


---

http://www.capitolhillblue.com/blog/2006/03/we_dont_burn_our_sources.html

We don't burn our sources
March 9, 2006 05:25 AM / The Rant .

By DOUG THOMPSON

One of the questions frequently raised by critics of this web site is
"how can you guys have sources the mainstream media doesn't have?"

Good question. We often quote confidential sources in our stories. We
have a choice of depending on such sources or not publishing the
story. If I'm satisfied the sources are accurate I go with the story.

It's a question of trust and, during my 23 years in Washington as both
a journalist and a political operative, I built up a network of
sources I trust and who trust me to protect their identity and not put
them in harm's way. More than 40 years in journalism taught me to
protect such sources at all cost.

Many of those same sources don't trust the so-called "mainstream
media" outlets because they've been burned by journalists who put the
story ahead of protecting those who provide them with the information.

Even worse, the mainstreamers can be downright sloppy when it comes to
protecting those who have such information.

On Monday, I outlined how the Bush Administration has launched an
all-out war on the press, directing attorney general Alberto Gonzales
to go after reporters with subpoenas, wiretaps, monitoring of emails
and surveillance to try and stop leaks about the many questionable
activities of the White House.

I learned about the efforts because the FBI made the incredibly stupid
mistake of sending one of their "National Security Letters" to a
company I own demanding information on one of its clients - me.

Then I confirmed the story with my administration sources and ran with
it on Monday, knowing that even acknowledging receipt of a National
Security Letter could lead to trouble.  The letter was withdrawn after
my attorney negotiated a deal.

On Tuesday, an email arrived from Dan Eggen, Justice Department
correspondent for The Washington Post. Dan wanted a copy of the letter
and more information on the story.

That's right I write a story about how the Bush administration is
monitoring the email of journalists and a journalist fires off an
email asking me to violate the USA Patriot Act and risk certain jail
time by providing him with a copy of a letter that I'm not even
supposed to admit I have. In fact, I don't have it. I never did. The
FBI sent the letter to my web hosting company offices which are 300
miles away from my home and studio. At my instructions it went from
the employee who received it straight to my attorney and he dealt
directly with the feds. I never saw the letter, do not know what
happened to it and am not privy to details of what it said. I don't
want to know. That's why I'm still sitting here and not on my way to
Gitmo.

Then I checked my voice mail to find a call from Robert O'Harrow Jr.,
another Post reporter, wanting information on my sources.  Hmmm. I
write a story about how the Bush administration is monitoring phone
calls of reporters and a reporter calls me on the phone to obtain
information on my confidential sources.  Anyone see a pattern here?

Next, I get both a phone call and an email from David Armstrong of the
National Security News Service saying he is working with 60 Minutes on
a story about domestic spying by the National Security Agency. He
wants info on my sources.

Let's see. A reporter uses both the telephone and email to request the
names of confidential sources on a story about how the National
Security Agency monitors telephone and email use of, you guessed it,
reporters.

Sorry guys. I'm not about to burn my sources when you take so little
precaution in seeking information from me.  Besides, I wouldn't help
60 Minutes if they were the only news outlet left on the face of the
planet.

In 1981 I served on a panel discussion with Fred Graham, then legal
correspondent for CBS News.  During a break I told him about a paper I
once worked for, The Alton Telegraph in Illinois, which had lost a
landmark libel suit for something they never published. I thought it
might make a good story about injustice.

Instead, Graham turned the story over to Morley Safer and 60 Minutes
and they put together a hatchet job on the newspaper and told the
story from a trial lawyer's point of view. Instead of defending
freedom of the press, Safer and his crew sensationalized the story for
ratings.

Some years later, we would learn again just how 60 Minutes and CBS
News hangs people out to dry. Jeffrey Wigand, a fired corporate vice
president for Brown & Williamson Tobacco Co., blew the whistle on the
company's campaign to hide the true dangers of nicotine. But 60
Minutes and Mike Wallace caved to corporate pressure and shelved the
story after revealing Wigand's identity. His reputation was ruined by
the network's incompetence.

Given such track records, why should any source trust the
mainstreamers?  The Washington Post sends an unsecure email openly
asking me to violate federal law by turning over a classified document
and I'm supposed to believe they will protect sources that I've
cultivated and protected for more than two decades?

When Mark Felt, the number two man in the FBI, served as Post reporter
Bob Woodward's primary source on Watergate, he insisted that Woodward
avoid contact by telephone and devised a scheme of planted messages in
a newspaper left at Woodward's door and meetings in an underground
garage in Arlington.  Felt knew using the telephone or other standard
communications means of the time would lead the secrecy-obsessed Nixon
White House to his door.  Felt's identity remained a secret for 31
years.

My sources know better than to use phone lines and email to contact
me. We've worked out elaborate, and always changing, methods for
sharing information. I'm not about to risk their confidentiality with
reporters who are less careful.

I've been hauled in front of grand juries by overzealous prosecutors
who wanted names of sources. They didn't get them. As a journalist, I
was trained to develop my own network of sources, not call other
reporters and ask them to give up theirs.

Maybe I'm too old-fashioned for today's pop-culture journalism. Maybe
it's out of style for reporters to do their own legwork and research
instead of depending on Google and others to do it for them.

Or maybe I'm just too old to change and too damn suspicious to get
trapped by youngsters. My mama drowned the dumb ones.
---

more on the national security letters here:
http://www.aclu.org/safefree/patriot/17458res20040929.html

and here:
http://www.washingtonpost.com/wp-dyn/content/article/2005/11/05/AR2005110501366.html