[kurtsiegfried]

WSJ Terms about Confidentiality:

3. Request Confidentiality: If you would like us to consider treating your submission as confidential before providing any materials, please make this request through this online submission form. Please note that until we mutually decide to enter into a confidential relationship, any information you send to us (including contact information) can be used for any purpose, as outlined in point 1 above, and described more fully below in the Limitations section). If we enter into a confidential relationship, Dow Jones will take all available measures to protect your identity while remaining in compliance with all applicable laws.

Wikileaks version:

2.3 Protection for you

Wikileaks does not record any source-identifying information and there are a number of mechanisms in place to protect even the most sensitive submitted documents from being sourced. We do not keep any logs. We can not comply with requests for information on sources because we simply do not have the information to begin with. Similarly we can not see your real identity in any anonymised chat sessions with us. Our only knowledge of you as a source is if you provide a coded name to us. A lot of careful thought by world experts in security technologies has gone into the design of these systems to provide the maximum protection to you. Wikileaks has never revealed a source.

[lucasjung]

If wikileaks knows so little about their sources, how do they establish the legitimacy of the documents they receive? In other words, what's stopping me from using previously leaked documents as a sort of "style guide" for forging new documents and then "leaking" them to wikileaks?

EDIT: I should point out that, in practice, somebody from the originating organization inevitably confirms the authenticity of the leaked documents through contacts with more traditional journalists. But what would happen if a set of documents were leaked and nobody was able to confirm them?

[hugh3]

Very little. And one day this will happen and it'll be a major wake-up call for leak journalism.

[georgieporgie]

There's a humorous example of verification given in Assange's TED conversation, starting around the twelve minute mark: http://www.ted.com/talks/julian_assange_why_the_world_needs_...

[lucasjung]

This still leaves open the question: what happens if nobody can or will verify? What if the company in the cited incident had instead played the line: "We want to know who gave you those documents because they are fraudulent and we want to pursue libel action against the party who released them," or even, "if you don't turn over the source, we'll pursue libel action against wikileaks."

Alternately, what if a set of documents really are forged, but it's an inside job? The same person or persons who "leak" the document to wikileaks could then "verify" it to journalists "on condition of anonymity." The journalists would know that their sources are from the appropriate organization, but nobody would have all of the information necessary to connect the dots that the leaker and the verifier are the same person or group. I could definitely see this being used as part of a corporate power struggle (make a rival look bad, get him fired; or do the same to your boss) or a political struggle in government (use politically sympathetic career bureaucrats to generate a scandal for an incumbent six weeks before election day).

[eli]

I could see how others might disagree, but I think the WSJ's terms are reasonable. The WSJ also has an admirable policy of not respecting embargoes slapped on press releases unless there's an agreement in advance.

If what you're leaking is so secret that you can't even discuss it with them in advance, then you shouldn't trust them period. It's on you as the leaker to make sure they have no way to determine your identity in the first place.

[rhizome]

Only one of the two has proven themselves to be trustworthy at all, and only one of them doesn't use weasel words in their terms. If your criteria is whether the leaker is unsure of being able to discuss their material, the WSJ is even more useless.

Basically, it appears you're arguing for the case that the WSJ is a great place to send your leaks if you already know there won't be repercussions (via your own precautions or their flaccid protections), which is pretty much what they have now. What's the difference between this and a link to "[e-mail]"?

[eli]

No, not at all. I'm arguing that the new system is good for people who already want to leak things to the WSJ. If you don't trust the WSJ to protect your identity then you obviously should not leak to them, period.

It's different from emailing [e-mail] because there's an explicit promise to minimize identifiable information and to limit access to messages. It's also tough to send large files by email.

[rhizome]

Is there a gray area between this project and normal source protection by reporters? I'd say on the face of it that the WSJ Fakeyleaks is less protective than contacting a reporter directly, since the investigative reporter's reputation hinges on not burning their sources.

So, if you already want to leak things to the WSJ, that mechanism already existed. If anything this is probably just Rupert being butthurt over his loss of control over the mass-media news landscape and "me too!"'ing on WL. Nice try, old man.

[msredmond]

I just posted a comment about that elsewhere on this thread -- that's what disturbs me so much about this. It's creating a separate level of protection that people won't understand (journalism ethics proscribe that you don't give up your source, ever). The WSJ needs to stay out of this unless its going to protect these submitters to the same level as any other source (and you don't give people up because you're being sued).

[bugsy]

Thanks very much for digging that up. It makes things very very clear.

[cowkingdeluxe]

Also worth noting, is that News corp (Foxnews etc) owns the WSJ.