| |

I'm a privacy pragmatist, writing about the intersection of law, technology, social media and our personal information. If you have story ideas or tips, e-mail me at khill@forbes.com. PGP key here. These days, I'm a senior online editor at Forbes. I was previously an editor at Above the Law, a legal blog, relying on the legal knowledge gained from two years working for corporate law firm Covington & Burling -- a Cliff's Notes version of law school. In the past, I've been found slaving away as an intern in midtown Manhattan at The Week Magazine, in Hong Kong at the International Herald Tribune, and in D.C. at the Washington Examiner. I also spent a few years traveling the world managing educational programs for international journalists for the National Press Foundation. I have few illusions about privacy -- feel free to follow me on Twitter: kashhill, subscribe to me on Facebook, Circle me on Google+, or use Google Maps to figure out where the Forbes San Francisco bureau is, and come a-knockin'.

Contact Kashmir Hill
Loading...
Tech 38,500 views

Dear Journalists at Vice and Elsewhere, Here Are Some Simple Ways Not To Get Your Source Arrested

You forgot to scrub the metadata, suckers.

Computer security millionaire John McAfee’s surreal flight from Belizean law enforcement came to an end this week when he was detained (and then hospitalized) in Guatemala, as has been widely reported. A piece of the story that hasn’t been included in much of the reporting is how authorities figured out that McAfee — who was wanted for questioning in the shooting death of his neighbor — had fled Belize for Guatemala. McAfee’s location was exposed after he agreed to let two reporters from Vice Magazine tag along with him. Proud to finally be in the thick of a story rife with vices — drugs, murder, prostitutes, guns, vicious dogs, a fugitive millionaire and his inappropriately young girlfriend — they proudly posted an iPhone photo to their blog of Vice editor-in-chief Rocco Castoro standing with the source of the mayhem in front of a jungly background, saying, “We are with John McAfee right now, suckers.

With that posting, they went from chroniclers of vices to inadvertent narcs. They left the metadata in the photo, revealing McAfee’s exact location, down to latitude and longitude. McAfee tried to claim he’d manipulated the data — a claim that Vice photographer backed up on Facebook in a posting he’s since deleted — but then capitulated, hired a lawyer, and tried to claim asylum in Guatemala. Guatemalan authorities instead detained McAfee for entering the country illegally. All of which was dutifully reported by the Vice reporters, with no mention of their screw-up. Mat Honan at Wired excoriated Vice for its role in events:

This was deeply stupid. People have been pointing out the dangers of inadvertently leaving GPS tags in cellphone pictures for years and years. Vice is the same publication that regularly drops in on revolutions and all manner of criminals. They should have known better.

And they have the resources to do it better. Vice is a $100 million operation.

Then, it followed up this egregiously stupid action with a far worse one. Vice photographer Robert King apparently lied on his Facebook page and Twitter in order to protect McAfee. Like McAfee, he claimed that the geodata in the photo had been manipulated to conceal their true location. …

But the coverup, as always, is worse than the crime. In claiming the geodata had been manipulated when it had not, Vice was no longer just documenting. Now it was actively aiding a fugitive wanted for questioning in the murder investigation of his neighbor Gregory Faull, who was shot dead at his own home.

Via How Trusting In Vice Led To John McAfee’s Downfall – Wired.

It was indeed deeply stupid. Journalists are professional dealers in information but many are terrible about protecting it. While willing to go to jail to protect their sources, journalists may wind up leaving them exposed instead through poor data practices. In a New York Times editorial last year, Chris Soghoian, now chief technologist at the ACLU, warned that “secrets aren’t safe with journalists” explaining that “ the safety of anonymous sources will depend not only on journalists’ ethics, but on their computer skills.”

There are three very basic things journalists should be doing to shield their sources:

  1. Scrubbing metadata from photos, documents and other files.
  2. Resisting the desire to save copies of everything.
  3. Encrypting communications.

Technologist Ashkan Soltani walked me through some simple tools for doing this. They’re not foolproof, but they’ll make it a little less likely that your blog post will wind up sending the person you’re profiling to jail (unless that’s your intent).

1. Scrubbing metadata.

“All files — photos, Word docs, PDFs — include some kind of metadata: author, location created, device information,” says Soltani. If you leave the metadata attached, you run the risk of exposing private information about the person who gave you the file, or, in the case of Vice, the location of the person trying to keep his location under wraps.

  • Before you share a Word doc with the world that a source sent you, run it through a scrubber. Otherwise, it may reveal where the doc was created, who authored it and anyone who has ever made changes to it. There’s Doc Scrubber for Microsoft Word.
  • For PDF docs, use a tool like Metadata Assistant. Or use Adobe Acrobat’s “Examine Document” tool which will scan the doc for hidden information.
  • For photos, think about turning off geotagging on your phone or digital camera so that the information doesn’t get included in the first place. You’ll usually do that in your phone’s “Location Settings.” Instructions here.
  • You can run your photos through a metadata scrubber. Or, if you don’t care much about the resolution, you can just take a screenshot of the photo and use that metadata-free version.

Some photo-hosting services do you the favor of scrubbing metadata. Facebook, Twitter and Instagram all have this privacy-protective measure in place.

2. Resisting the desire to save copies of everything.

We live in a time when it’s easy to save everything, meaning we’ve all become digital hoarders. Why delete an email or chat when you can just archive it? It could come in handy later. Or it could come back to bite you later.

  • “Disable chat logs in whatever program you’re using, Gmail or Skype,” says Soltani. In Gmail, that means switching chats to “off the record.” In Skype, it means turning off the feature that automatically saves your chats to anywhere you log in. (Added privacy bonus: That could keep your boss from winding up getting his hands on a sexy chat you had on your home computer.)
  • If you need to keep a record of a chat, save it as a Word file on your own computer, and encrypt it.
  • “Don’t keep emails around for years and years,” says Soltani. “Practice better data hygiene.”
  • Soltani says journalists and sources might consider setting up temporary email accounts to communicate about a story, and then to delete the accounts after the story’s complete. He compares it to using a burner cell phone.

3. Encrypting your communications.

This may be the most labor intensive of the recommendations from computer security professionals, but if it’s important that your communications with someone not be compromised, it’s worth it. This means your emails will appear as gibberish to anyone you don’t want reading them. Had David Petraeus and Paula Broadwell encrypted their emails to one another rather than saving them in a drafts folder, their exposing themselves to each other wouldn’t have been exposed to the world. “This allows you to communicate securely and protects your messages if your account is compromised,” says Soltani.

  • For chat, consider using Adium’s OTR.
  • Use a Virtual Private Network or create your own SSL.
  • Take 30 minutes (more or less, depending on your savvy level) to set up SMime or PGP for Gmail so that the emails you send from whichever provider you use are encrypted. The only limitation here: you need to get the person you’re communicating with to enable encryption as well.
  • Rather than calling someone from your landline or cell phone, use Skype or Silent Circle.

***

A journalist’s job is to bring information to light. Using these tools, you’ll retain some control over which information gets lit.

Post Your Comment

Please or sign up to comment.

Forbes writers have the ability to call out member comments they find particularly interesting. Called-out comments are highlighted across the Forbes network. You'll be notified if your comment is called out.

  • nistor nistor 2 years ago

    Skype is not secure. Are you kidding? And yet people say that “of course, we already knew that”. But it’s obvious not everyone does.

    Use Jitsi (https://jitsi.org) as an alternative to both Adium and Skype. It’s also cross-platform, not just for Macs, because even if you rich journalists out there might use $2000 Macs, your source might not.

  • Ryan Mac Ryan Mac, Forbes Staff 2 years ago

    “rich journalist” = oxymoron

  • Omar Shaik Omar Shaik 2 years ago

    Haha maybe for some. Walt Mossberg made a cool $1 million USD last year.

  • Kashmir Hill Kashmir Hill, Forbes Staff 2 years ago

    Skype is better than using a regular landline or cell phone. I try to make my privacy advice as simple as possible. The easier it is, the more likely people will actually act on it. Of course, the amount of security you need depends on your threat model.

  • Two reactions to this post:

    (1) Stupid fugitives almost always get caught. Stupid, arrogant fugitives always get caught.

    (2) Vice magazine had to be in on the bust. It is difficult to believe that a publication specializing in, well, VICE could be this careless in its reporting. Of course, all that vice takes a toll on mental function, so who knows.

  • Kashmir Hill Kashmir Hill, Forbes Staff 2 years ago

    I don’t think they intended to get McAfee caught. This was just a blunder.

  • medialawguy medialawguy 2 years ago

    As a lawyer who represented numerous journalists over the years who used confidential sources I would add a couple of other suggestions, particularly where the identity of the source is paramount (as opposed to the contents of the communications).

    1. don’t reveal the identity of the source to anyone, including your editor (unless required to do so by your employer and the employer will likewise protect the source). Your editor and others are subject to being deposed in a civil suit or interrogated in a government investigation and their willingness to protect a source may be less than yours, particularly if faced with contempt or obstruction of justice charges if they refuse to identify the source. They can’t reveal what they don’t know.

    2. Never write down the source’s name (or descriptive information) anywhere or speak the source’s name in any communications, written or oral. Phones may be tapped, encrypted communications may be broken and deleted files may be recovered. Use a code name if a name must be used. Face to face communications are the most secure.

    It is also a good idea to ascertain (1) whether the relevant legal jurisdiction has a shield law which protects journalists from forced revelation of confidential sources and (2) whether you are covered if you are not a member of the mainstream media. Journalists should be realists, however, and understand that the identity of a source is difficult to hide from a determined adversary or prosecutor. The decades long secret of the identity of Deep Throat of Watergate fame is the exception rather than the rule.

  • Kashmir Hill Kashmir Hill, Forbes Staff 2 years ago

    Great advice, Randy! It’s hard in that it goes against all your habits as a journalist to capture and retain as many details as possible.

  • What a technology that Apple has implemented in their Iphone to track their users by Location services. That sounds a bit like, if you buy IPhone “They” will know where you are at all times. Seems like we do not have privacy anymore, Why should someone buy phone for 800 dollars and then pay for apps that should secure its cell, when spy software is preinstalled by the manufacturer?

  • Kashmir Hill Kashmir Hill, Forbes Staff 2 years ago

    There is definitely a privacy-by-design argument to be made here. Apple could make phones default to scrubbing metadata and only add it if phototaker opts in. That would have been a big help to Vice.
http://www.forbes.com/sites/kashmirhill/2012/12/07/dear-journalists-at-vice-and-elsewhere-here-are-some-simple-ways-not-to-get-your-source-arrested/?commentId=comment_comment.id
www.forbes.com
crawl=CC-MAIN-2015-11
100756
application/http; msgtype=response
sha1:VY7M4BW2VQXB5CXU4MFPJLW7PFTOKEZM
<urn:uuid:bb3b3677-ff1d-4220-b5c3-1bd2420d7515>
2015-03-03T05:00:34Z
23.3.13.19
sha1:Y2VR3NTNK6CZ6O4MC4GBUVF7ZGEY2IQ7
<urn:uuid:25e12817-630b-4908-b335-19a09a049ce7>
http://www.forbes.com/sites/kashmirhill/2012/12/07/dear-journalists-at-vice-and-elsewhere-here-are-some-simple-ways-not-to-get-your-source-arrested/?commentId=comment_comment.id
response
<urn:uuid:406d4b34-2d04-400a-81fa-f6c76b16f59b>
robots: classic
hostname: ip-10-28-5-156.ec2.internal
software: Nutch 1.6 (CC)/CC WarcExport 1.0
isPartOf: CC-MAIN-2015-11
operator: CommonCrawl Admin
description: Wide crawl of the web with URLs provided by Blekko for February 2015
publisher: CommonCrawl
format: WARC File Format 1.0
conformsTo: http://bibnum.bnf.fr/WARC/WARC_ISO_28500_version1_latestdraft.pdf