Verifying leaked data: The importance of protecting whistleblowers

• Author:
• Author name

  Quantumrun Foresight
• February 16, 2022

Insight summary

There have been several high-profile data leaks and whistleblower cases against corruption and unethical activities, but there are no global standards to govern how these data leaks should be published. However, these investigations have proven to be useful in exposing the illicit networks of the rich and powerful.

Verifying leaked data context

A wide range of motivations create the incentives for leaking sensitive data. One motivation is political, where nation-states hack federal systems to expose critical information to create chaos or disrupt services. However, the most common circumstances where data is published are through whistleblowing procedures and investigative journalism. 

One of the recent cases of whistleblowing is the 2021 testimony of former Facebook data scientist Frances Haugen. During her testimony at the US Senate, Haugen argued that unethical algorithms were used by the social media company to sow division and negatively influence children. While Haugen is not the first ex-Facebook employee to speak up against the social network, she stands out as a strong and convincing witness. Her in-depth knowledge of company operations and official documentation make her account all the more believable.

However, whistleblowing procedures can be quite complex, and it’s still unclear who gets to regulate the information that is being published. Additionally, different organizations, agencies, and companies have their whistleblowing guidelines. For example, the Global Investigative Journalism Network (GIJN) has its best practices for protecting leaked data and insider information. 

Some of the steps included in the organization’s guidelines are protecting the anonymity of sources when requested and verifying the data from the public interest point of view and not for personal gain. Original documents and datasets are encouraged to be published in their entirety if safe to do so. Finally, GIJN strongly recommends that journalists take the time to fully understand the regulatory frameworks that protect confidential information and sources.

Disruptive impact

The year 2021 was a period of several leaked data reports that shocked the world. In June, the nonprofit organization ProPublica published the Internal Revenue Services (IRS) data of some of the US’ wealthiest men, including Jeff Bezos, Bill Gates, Elon Musk, and Warren Buffet. In its reports, ProPublica also addressed the authenticity of the source. The organization insisted it did not know the person who sent the IRS files, nor did ProPublica request the information. Nonetheless, the report sparked a renewed interest in tax reforms.

Meanwhile, in September 2021, a group of activist journalists called DDoSecrets released email and chat data from the far-right paramilitary group the Oath Keepers, which included member and donor details and communications. Scrutiny about the Oath Keepers intensified after the January 6, 2021, attack on the US Capitol, with dozens of members believed to be involved. As the riot unfolded, members of the Oath Keepers group allegedly discussed protecting Texas Representative Ronny Jackson via text messages, according to published court documents.

Then, in October 2021, the International Consortium of Investigative Journalists (ICIJ)—the same organization that exposed the Luanda Leaks and Panama Papers—announced its latest investigation called Pandora Papers. The report exposed how global elites use a shadow financial system to hide their wealth, such as using offshore accounts for tax evasion.

Implications of verifying leaked data

Wider implications of verifying leaked data may include: 

• Journalists increasingly being trained to understand international and regional whistleblowing policies and frameworks.
• Governments continually updating their whistleblowing policies to ensure that they capture the ever-changing digital landscape, including how to encrypt messages and data.
• More leaked data reports focusing on the financial activities of wealthy and influential people, leading to stricter anti-money laundering regulations.
• Companies and politicians collaborating with cybersecurity tech firms to ensure that their sensitive data are protected or can be remotely deleted as needed.
• Increased incidents of hacktivism, where volunteers infiltrate government and corporate systems to expose illegal activities. Advanced hacktivists may increasingly engineer artificial intelligence systems designed to infiltrate targetted networks and distribute the stolen data to journalist networks at scale.

Questions to consider

• What are some of the leaked data reports you have recently read or followed?
• How else can leaked data be verified and protected for the public good?