Hacks, Leaks, and the Future of Investigative Journalism

In an era defined by an unrelenting digital deluge, where every keystroke and server configuration holds the potential for revelation, a new breed of investigative journalist is emerging.

These are the navigators of the data ocean, the cartographers of leaks, tasked with sifting through terabytes of raw information to unearth truths that traditional reporting methods often miss.

At the forefront of this crucial field stands Micah Lee, an investigative data journalist, digital privacy expert, and Director of Information Security at The Intercept, who has now penned a definitive guide to this complex landscape: “Hacks, Leaks and Revelations: The Art of Analyzing Hacked and Leaked Data.”

Lee, a veteran of monumental disclosures from the Snowden leaks to the recent BlueLeaks dataset, offers a masterclass not just in technical prowess but in the profound ethical considerations that define this work.

His book, a rare blend of practical instruction in command-line tools, Python, and SQL, interwoven with gripping tales of past investigations, is a clarion call to journalists, researchers, and activists alike.

He argues that the skills to analyze these vast datasets are no longer niche but essential for anyone committed to exposing wrongdoing in the 21st century.

The sheer volume of leaked data is, as Lee describes it, “insane.”

New datasets surface almost daily, escalating in size from megabytes to gigabytes, and often, to terabytes.

This isn’t merely a trend; it’s a consequence of our hyper-digitized world, where virtually all information resides on computers and is, therefore, vulnerable.

The reasons are manifold: sophisticated hacks, certainly, but also astonishingly simple human errors.

Misconfigured Amazon S3 buckets left open to the public, or Google Drive folders containing sensitive information accessible to anyone with a link, are distressingly common.

Lee points to the American College of Pediatricians, a group labeled a “fringe anti-LGBTQ hate group” by the Southern Poverty Law Center, which inadvertently exposed 20 gigabytes of data by leaving a Google Drive folder openly accessible.

Such incidents underscore a critical vulnerability: the more data we create and store, the greater the likelihood of its unintended exposure.

For newsrooms, navigating this torrent presents a thorny challenge.

Traditional legal departments, often risk-averse, have historically imposed restrictions on using leaked data.

Yet, Lee contends, this stance is increasingly untenable.

News organizations have an ethical imperative to examine these leaks, but with immense caution.

The core principle, he stresses, is the protection of privacy.

Journalists must meticulously ensure that any published information serves a clear public interest, exposing corruption or wrongdoing, and meticulously redact details pertaining to individuals unrelated to the investigation.

It’s an ethical tightrope walk, demanding discernment to separate newsworthy revelations from mere voyeurism.

Perhaps the most startling revelation from Lee’s insights is the vast, untapped potential lying dormant within already public leaks.

The BlueLeaks dataset, for instance – a 270-gigabyte collection of police documents hacked and released in 2020 during the Black Lives Matter protests – continues to yield significant stories years after its initial disclosure.

Recent reports from Wired and The Guardian, exposing everything from a police department’s use of DNA evidence for speculative facial recognition to secret White House surveillance programs and US law enforcement’s ties to Israeli intelligence, emerged from BlueLeaks long after its initial release.

This “long tail” of revelations highlights a critical shortfall: there simply aren’t enough journalists with the technical expertise to fully explore these massive troves.

Most data journalists, Lee admits, can only scratch the surface of these datasets before moving on to the next urgent project, leaving countless stories buried.

The risks associated with handling such sensitive information are equally profound and multifaceted.

Lee categorizes datasets by their sensitivity, from the “incredibly sensitive” Snowden documents, which necessitated extreme precautions like air-gapped computers and physical destruction of transfer media to guard against hostile intelligence agencies, to “medium sensitive” patient data, which still demands rigorous local encryption and strict privacy protocols.

Beyond the geopolitical implications and source protection, there’s the more insidious threat of malware.

Malicious documents, embedded with exploits or macros, can compromise a journalist’s computer upon opening.

To counter this, Lee advocates for tools like Dangerzone, which digitally “prints” and “rescans” documents to remove malicious code, or the use of virtual machines and indexing tools like Aleph, which allow for safe viewing without direct interaction.

The psychological dimension of this work is also striking.

Lee describes the “surreal” experience of sifting through someone else’s personal emails, a task that demands a focused, goal-oriented mindset while simultaneously fostering a deep awareness of one’s own digital footprint.

It’s a stark reminder of the pervasive nature of digital existence and the constant potential for one’s private communications to become public.

In a powerful move to democratize these essential skills, Lee has released “Hacks, Leaks and Revelations” under a Creative Commons license, making it freely available online at hacksandleaks.com.

This gesture underscores his belief that access to this knowledge should not be a barrier, especially for those in less privileged circumstances.

It’s an invitation, and indeed a challenge, to a new generation of truth-seekers to arm themselves with the tools necessary to navigate the complexities of our digital age and hold power accountable, one leaked dataset at a time.

The future of investigative journalism, it seems, will be written in code, parsed from databases, and ultimately, revealed through courage and ethical rigor.