Endless Thread - How to responsibly leak information to the press

Episode Date: March 28, 2025

Well, the messaging app Signal has been in the news recently, thanks to a snafu in which prominent federal defense officials mistakenly added The Atlantic's editor-in-chief, Jeffrey Goldberg, to a group chat in which they discussed military strikes in Yemen. This whole situation reminds us of another conversation we've been having as a team about how to responsibly leak information to the press, and if there is such a thing as a "secure line." To answer this question, we reached out to our WBUR colleague, investigative and data reporter Todd Wallack. If you have a story you would like to share with us in a secure way, you can reach us on Signal (yes, Signal) at 646-456-9095 or email us at [e-mail]

Support for endless thread comes from MathWorks, creator of MATLAB and Simulink Software, to design and develop engineered systems, accelerating the pace of discovery in engineering and science. Learn more at Mathworks.com. Support for this podcast comes from Nature is the Solution, a podcast from the Nature Conservancy. This show tells climate stories like a stubborn optimist

because hope, innovation, and nature itself are key to solving the challenges ahead. Follow on your favorite podcast app. Okay, before we get to today's episode, just want to remind you that we are looking for your stories about how AI is playing a role in your relationships today. So these could be romantic relationships, but we're not really looking for like,

I have an AI significant other. It's more like... Did I get a foot rub from an AI? You didn't. Did me and the AI play child? Did we, sorry. Yeah, no, but you're, yes, you're picking up what I'm putting down here, Ben, which is we're looking for how is AI playing a role in your work relationships, in your family relationships? What role is AI taking on?

What is it putting on your plate, taking off your plate? Tell us about all of your interesting AI relationship stories. How did they do that, Ben? You can email us at endless thread at WBUR.org. Yeah, and we'd love it if you sent us a voice memo in particular because we want your voices. Not in a creepy way, actually. But you can also, of course, send a written message if that's more your jam. Endless thread at WBUR.org.

Okay. Here's the rest of the show. WBUR Podcasts, Boston. So, Amory, we were going to put a whole different episode in the feed this week. And then we decided to switch it out with something else we've been working on. Because the messaging app signal has been kind of big in the news this week. I don't know if you heard, papers read all about it. You know, I happened to hear, in fact, that Jeffrey Goldberg, an investigative reporter

and the editor-in-chief at the Atlantic, has been in a TED-a-Tet with top defense cabinet members who added him to the chat when discussing U.S. military strikes on Yemen because of Houthi fighters who have been disrupting shipping there. I feel like there was an endless threat episode that kind of mentioned some of this a couple of weeks ago. You know, that's ringing a bell. You probably have heard plenty about that. So we're not going to go too deep into that right now.

But we did decide to drop this episode in your feed this week because, you know, signal chats are a thing right now. For us, signal chats and their relative security were the topic of a whole, conversation that we have been having over the past weeks and months about how to responsibly and carefully leak information to the press. I'll tell you one way not to do that. Add J.G. to your fellow Trump administration signal chatters without checking on who J.G. is. It's accomplished journalist Jeffrey Goldberg. In fact, this week's big story is a master class in how not to do it, which starts with

knowing who you're talking to. Yeah, seriously, Signal has long been a communications tool used by journalists precisely because of its security and the ability to protect sources and sensitive information. And as we've been watching the endless litany of stories about what Doge and Elon Musk are doing inside the federal government, to say nothing of this week's story about military officials using Signal. As we've seen some of those stories leak into the world via, like the Fed News subreddit, for instance, and other places. And we've been having this conversation on our own subreddit about how or whether to cover

this kind of news. We had this question. What is the best way for a source to get in touch with a journalist and let them know about something that really Americans need to be aware of? What in the year of our Lord 2025 is a secure line? Well, we've kind of got an answer for that now. You can email us at WBUR Secure Tips at Proton.m e. That is Protonmail, the secure email service. You can also text or call us on Signal, and the number for that is 646-456-9095. So again, that is WBUR Secure Tips at Proton.m. Or you can text or call us on Signal 646-456.456. But it's not quite that simple. We wanted to learn and to share some other best practices with our listeners. And for that info, we reached out to a guy a few cubicles over from us, Todd Wallach.

For the good people, Todd, tell us what you do at WBUR. Sure. I'm an investigative and data reporter for WBUR. Okay, but before WBUR, you worked at the Boston Globe. Yes. I worked for the Boston Globe for 14. years, most of that time on the Boston Globe Spotlight Team. The Boston Globe Spotlight Team might be the oldest investigative team of any newspaper across the country. And it was made famous by Spotlight the movie, which recorded the well-known investigation that the spotlight team did of the Catholic Church in sex abuse. And am I correct that for a while you were the person in

charge of the spotlight tip line? I did manage that for a while. So I saw all sorts of different emails and phone calls coming in, had to spend a lot of time listening to voicemails. What kind of tips does a tip line minder like you enjoy getting? And what kind of tips does a tipminder not enjoy getting when they're manning the spotlight tip line? Yeah, well, first of all, I should say that tips are really important for journalists. I think that the public might imagine that if they don't see a story, that the media is just not interested or they're covering it up, but often we don't know about it or we don't have the information needed to actually report it and tell the public. So tips are really crucial in alerting us to issues that we might not know

are going on or providing us with names and documents and information. that we actually can use to tell that story. So the tips that are most helpful are very specific and very concrete. It might be, hey, this public official lied about their resume, and here's how you can prove it, or here's evidence. They might include documents or pictures that prove what they're saying, or they might have names and contact information of people who can back it up or other specific details. It's harder when people say, hey, there's something going on with the Biden or Trump administration.

You should dig harder. You should check that out. Or this guy must be corrupt. You should look into that. It's like, ow. My buddy's friend's girlfriend says there are aliens. You should get on that. Another one.

We get a lot of conspiracy theories. It's really hard. It's, I'm really skeptical when I get 10. that say, hey, there's this huge cover-up involving the FBI, my wife, her defense lawyer, the judges, this media station. I know conspiracies do happen, but usually people are busy with their own work and their own problems and don't have time to join up with six other organizations and people all to make some random person's life miserable.

That's totally true. And yet it does feel like we're living in a slightly different time right now with regards to the lack of transparency around really consequential things that the federal government is doing. You know, like, whereas we might have been more inclined in the past to say,

that's just a conspiracy theory. Something about this moment does feel like, oh, we might actually need to look into that. Well, I definitely think we're, at it, we're in an environment where if somebody says something happened and it sounds a little crazy, it still might have happened. We all probably saw the news that the Associated Press, one of the most respected journalism organizations, was barred from covering White House events because the AP style guide that many

people rely on refused to change their style to stop using Gulf of Mexico and didn't change it to Gulf of America. And I would have guessed that was something out of the onion. Yeah. Yeah, the onions got tough competition with reality these days, it feels like at times. You spoke a little bit to this, but just to underscore it again, what's the value of a whistleblower? Well, of course, there are different meanings by whistleblowers.

There's some people who blow the whistle within their own agency or company and report problems up the chain. And sometimes it's somebody embezzling money. Sometimes it's not following the law in some other way. And it's really important that organizations know when there's a rogue person who's flouting all the rules and doing something wrong. Otherwise, they can't take action. There are also lots of cases where people can't trust the organization. organization they work for, and they go to the press. They go to reporters, and they try to find somebody to expose a problem that they think is really

serious and can't trust their organization to take care of it on their own. Can you talk about how, you know, you were just talking a minute ago about the tip line. Can you talk about what a secure drop is and why someone might want to use that kind of thing when they're communicating with journalists? Sure. So obviously many whistleblowers who go to the media are worried about being fired,

being publicly embarrassed, getting in trouble in some other way if they're publicly known. So want to find some way to confidentially give journalists information. In some organizations, like The Washington Post and New York Times

and pro-public, have set up essentially a big safety box that people can drop off documents electronically without giving up their name or identity. So a secure place to upload files. And can you say more about what a secure place is? Like, how do you upload something or email something or leave a voicemail for something without maybe revealing your location, what device you're on,

any trace of your identity, if that's possible? There are lots of ways that people can communicate with journalists and keep their identity secret. I mean, the most famous was probably Deep Throat. The tipster involved in the Watergate scandals. And Deep Throat kept his identity secret by meeting with Bob Woodward, Washington Post reporter in person.

In this non-descript. In a dimly lit parking garage. Exactly. A dimly lit parking garage. We now know that it turns out deep throat knew a little bit about security. He was deputy chief of the FBI at the time. So he had a lot of inside knowledge about how to protect himself. But there are lots of other ways that people can do it.

I mean, clearly talking to somebody in person, is really secure because you're not leaving a paper trail and you're not leaving an electronic trail. For most people, you know, just using their personal phone or their personal email is fine. If you're not dealing with national security secrets, if you work for a company or you work for even, you know, many government agencies and you're not dealing in security, as long as you're not using your work email and your work phone, your bosses aren't going to be able to trace who talked to a reporter. For people who work, who do handle national security secrets or handle really sensitive stuff like IRS files, they have to take a lot more precautions. There's also proton mail, which is an email service that encrypts email. So I know that's used by a lot of people to send sensitive messages.

Another way that people can hand off files is they can do it in person handing off a CD or a hard drive. and they can send it to the mail. Believe it or not, the good old U.S. mail system is one of the more secure ways that people can send information, just dropping off mail at a mailbox, and there's usually no trace of who sent it. And in fact, U.S. mail is the way that a leaker leaked Donald Trump's tax returns to the New York Times

and the way the same person leaked tax returns or tax data on many wealthy Americans to ProPublico. And interestingly, neither publication knew who sent them the data. So the hardest part for them was once they got the information was verifying that it was real. More from Todd in a minute. At Radio Lab, we love nothing more than nerding out about science, neuroscience, chemistry. But we do also like to get into other kinds of stories. Stories about policing or politics. Country music.

Hockey. Sex. Of bugs. Regardless of whether we're looking at science or not science, we bring a rigorous curiosity to get you the answers. And hopefully make you see the world anew. Radio Lab. Adventures on the Edge of what we think we know. Wherever you get your podcast.

Support for this podcast comes from Is Business Broken, a podcast from the Marotra Institute at Boston University. On the show, host Kurt Nickish asks the thorny questions necessary for this moment about the role business plays in society. Questions like, why are executives paid so much? Why is innovation in healthcare so hard? Is ESG just greenwashing? And of course, is business broken? Follow is business broken wherever you get your podcasts. There is something powerful about the sound of the human voice. Beautifully produced audio has the unique power to connect and inspire. Tell your organization's story with a custom podcast from CitySpace Productions, the Creative Studio from WBUR's business partnerships team. Become a thought leader. Recruit new talent,

reach new audiences, whatever your goal, we can help. Discover how the magic is made at WBUR.org slash creative studio. We're talking with Todd Wallach, our colleague at WBUR, about how to communicate with journalists while protecting your identity as a source. Things like using the good old-fashioned snail mail or protecting your device

using something called a Faraday cage. It's a way to block electrical signals from computers. Yeah. Once when I worked at the Boston Globe, we had some classified materials that we needed to keep secure, and we kept them on a computer that was air-gapped, meaning there was air between that computer

and any other computer network. Because one big risk that people are concerned about is that if you have materials on a computer that are sensitive, and they're connected to other computers, and then in turn connected to the internet, they might be vulnerable. I also personally worry that if somebody handed me a bunch of files and I just inserted them on a computer,

could it contain malware that infects our own computer? Could it be a Trojan horse, in other words? So journalists also have to protect themselves and make sure that they're not inadvertently uploading viruses or some, other nefarious software to their entire network when they get sensitive files from people. You and I talked recently about some of these technology challenges

and talked about how signal the messaging service can sometimes be a simpler way to go when journalists and whistleblowers or anonymous sources are trying to talk to each other. Yeah, absolutely. And a lot of people that I know who worry about security tend to like Signal because it's not only encrypted in the entire way, but Signal, the organization also doesn't keep copies of the messages. They might have a record of who contacted who and when,

but they don't have a record of actual messages, whereas there are some other messaging services where people worry that the operator does have copies of the actual records. And so a government agency or a company might be able to subpoena those companies and get copies of those records. That is exactly what I was going to ask because I think for a while now, and we used to make this show in partnership with Reddit, for a while Reddit has been seen as like the anonymous place to go to share your stories, your tips, your leaks, your whatever, not the only place, but a place where you can be anonymous. And yet recently I've been thinking about, but what if Reddit like we've seen with Meta, where we've seen Mark Zuckerberg acquiesce to the Trump administration in a way that may be surprised some people.

What if that happens with Reddit? And suddenly, yes, your username is anonymous, but your email address is not. Reddit has all of that information. And so if we're talking about Signal, though, which does seem like it's secure in a different way, on a different level, Are there things that a source should be keeping in mind when reaching out to a journalist on a platform like Signal? Yeah. So one thing, again, is it's important not to use your work phone because if it's your work phone, the works IT department can probably tell that you've installed Signal, and maybe they would wonder why.

The another thing is that while it is true that using signal and some other systems means that the messages are encrypted on route, they're scrambled, so it's harder to intercept the messages. They're probably original copies of the messages stored on both the sender and the recipient's

phone. So if somebody got arrested and they grabbed their phone, that phone would have copies of all the messages, unless they set it to auto delete or they manually deleted it. I think a lot of people think about this in a pretty altruistic way. I mean, certainly I do because I'm a journalist and, you know, I view part of my job is part of the fourth estate, sort of being skeptical of things and, you know, helping people speak truth to power and

and all sorts of things, but any kind of leak or whistleblowing act is a risky act, both for the journalists sometimes, but really more importantly and more largely

for the source. Absolutely. And granted, most people who are going to leak aren't going to leak national security details, so the risk is a bit lower. But there are

certainly people who have shared important secrets because they thought it was important and have gotten into serious jeopardy. One name that comes to mind is reality winner, and that is a real name. She was a government employee who was concerned in hearing reports that Russia had interfered in the U.S. elections, and there were a lot of people publicly denying that. she had access to military intelligence showing that the military intelligence officials did indeed have evidence of Russia interference. So she wanted to share that story. She printed out some pages of that report, mailed it off to the Intercept.

The Intercept didn't know who she was. But in trying to verify that information, the Intercept shared it with the government. and they also, I think, posted the document later online, and the government was able to notice that there was a fold in the paper indicating it was printed, and because it was printed out at a secure national security facility, they keep elaborate records on who printed out what at each time, and there were also embedded marks that wouldn't be visible to the naked eye,

easily that had additional information about when and where it was printed out, and they were able to use that to track her down. And she wound up going to prison for five years. Charles Littlejohn, the person who shared the confidential tax returns for billionaires and Donald Trump, again, the media didn't know who he was, but because the IRS very carefully tracks the distribution of tax information and tax data, they were eventually able to figure out who did it, and he was also sentenced, I believe, to five years in prison, which was far above the recommended maximum term.

You were talking about deep throat and watergate and the specifics of how that information was leaked. But if we zoom out and we think about real world changes that have come, that have happened as a result of some of these whistleblowers and anonymous sources and leaks, what would you say are those kind of bigger real world impacts? Blowing the whistle is really important in exposing corruption or problems, systematic failures, all sorts of issues. issues that otherwise we wouldn't know about. In the case of Watergate, it brought down a presidency, and it inspired the creation of a whole flurry of laws, including the Freedom of Information Act, including laws eventually to protect whistleblowers.

So in many cases, there are legal ways that people can notify their own company or now or their own agency about problems, or they can go to government, watchdog. organizations and report problems with some security because there are laws protecting people against retaliation. I think there's greater awareness with movies about Watergate, about the importance of alerting the press to problems. And again, in 99% of the cases, people who blow the whistle are not in jeopardy of violating the law.

It is not illegal to tell a journalist that their government agency is laying off tons of people. That is probably important news. People should be aware of it, but it is not one of those national security secrets where people face legal jeopardy from informing the public about. And it is really important that people contact either their government agency or journalists to alert the public, when there is a real problem that isn't getting fixed. It seems like a good place to end. Todd Wallach, thank you very much. It's great having the conversation with you.

A reminder to our listeners that, yes, you can reach us securely via email at WBUR SecureTips at Proton.m. That's our email. Or you can text and call us on signal at 646-456-9095. And we should say WBUR is an NPR member station, and the CEO of NPR, Catherine Marr, chairs the board of the Signal Foundation, the nonprofit that supports the messaging app. And again, if there's anything you need to tell us about, we are all ears.

Secure ears. This episode was produced by Caitlin Harrop and Frannie Monaghan. It was co-hosted by me, Ben Brock Johnson. And me, Amory Siebertson. It was edited by Meg Kramer, Mix and Sound Design by our production manager, Paul Vichis. The rest of our team is Dean Russell, Emily Jankowski, Grace Tatter, and our managing producer, Sumitajoshi. See you next week.