麻豆传媒

WikiLeaks founder Julian Assange has defended the organisation鈥檚 release of all 251,000 secret US diplomatic cables that it held without the redaction of the names of informants mentioned in them.

In an interview with 麻豆传媒, Assange said the leak publishing outfit鈥檚 usual editorial 鈥渉arm minimisation鈥� procedures had become irrelevant after other websites published the full text of the unredacted cables.

That full-text publication became possible when WikiLeaks: Inside Julian Assange鈥檚 war on secrecy was published in February. Written by two journalists at the newspaper The Guardian, based in London, the book revealed the decryption key for a computer file containing all the US state department cables leaked to WikiLeaks.

The Guardian team say they believed the key 鈥� but it had not.

鈥淭hat is not how file decryption works,鈥� Assange says. 鈥淭he only thing that was temporary was the website location the file was stored in. But the password is not used for the website 鈥� it is used for decrypting the file.

鈥淲e entrusted all 251,000 cables to The Guardian so they could read them and do their journalism on them,鈥� he says. 鈥淥ur security arrangement was perfect, assuming the password was not disclosed.鈥� The Guardian鈥荣 was given a written copy of a lengthy encryption key 鈥� a passphrase 鈥� plus an additional word that he had to commit to memory for insertion at a set point within the phrase, adding security if the paper copy was lost.

Trickle of leaks

He later included these details in the book WikiLeaks, which he co-authored. So when the AES256-encrypted file was tracked down to BitTorrent sites 鈥� where WikiLeaks had supposedly placed it as a defence against denial-of-service attacks 鈥� the cables could be decrypted and began trickling onto rival leak sites like .

The publication of the passphrase and additional secret word in The Guardian鈥荣 book has horrified not only WikiLeaks but security engineers in general. Their view is perhaps best summed up by the influential BT infosecurity expert Bruce Schneier : 鈥淢emo to The Guardian: publishing encryption keys is almost always a bad idea.鈥�

The reason? Even if the passphrase had expired 鈥� it hadn鈥檛 in this case 鈥� the way it is put together, alongside knowledge of the use of an additional word, gives an attacker very strong clues as to how an organisation habitually structures its keys, passwords or passphrases. 鈥淚t describes our internal security mechanisms,鈥� says Assange.

Three weeks ago, other leak sites realised that The Guardian鈥荣 passphrase decrypted the BitTorrent file 鈥� and the unredacted US cables began appearing on non-WikiLeaks sites. 鈥淪o we contacted the US state department, Amnesty International and Human Rights Watch and told them what was occurring,鈥� says Assange 鈥� presumably so they could prepare any informants for possible trouble.

Race for knowledge

Then late last week WikiLeaks published the whole tranche of unredacted cables. 鈥淭he reason being that a race commenced between the governments who need to be reformed and the people who can reform them using the material,鈥� says Assange.

鈥淎dditionally, for harm minimisation, there are people who need to know that they are mentioned in the material before intelligence agencies know they are mentioned 鈥� or at least as soon after as possible.

鈥淏y the time we published the cables, the material was already on dozens of websites, including Cryptome, and were being tweeted everywhere. And even a searchable public interface had been put up on one of them.鈥�

Another motive for publishing the tranche, Assange claims, was the provision of a reliable source for the leaks. In the field of leak publishing, he says, WikiLeaks has become a trusted brand. Although versions of the cable tranche were appearing online, 鈥渢here was not an authorised version of the cables that the public could rely on鈥�.

Authorised version

What does he mean by an 鈥渁uthorised鈥� version of cables, when they were US government property?

鈥淏y 鈥榓uthorised鈥� I mean a version that is known to be true 鈥� it doesn鈥檛 have another agenda. The unauthorised versions that were being tweeted everywhere 鈥� although as far as we can determine they were accurate, the public and journalists couldn鈥檛 know they were accurate.鈥�

He points to stories published in Tajikistan and Pakistan that have been based on fake cables. 鈥淲ikiLeaks is a way for journalists and the public to check whether a claimed story based on a cable is actually true. They can come to our site to check. We have a 100 per cent accuracy record.鈥�