But while the “wiki” elements have been abandoned, a structure to enable anonymous submissions of leaked documents remains at the heart of the WikiLeaks idea. British encryption expert Ben Laurie was another who assisted. Laurie, a former mathematician who lives in west London and among other things rents out bomb-proof bunkers to house commercial internet servers, says when Assange first proposed his scheme for “an open-source, democratic intelligence agency”, he thought it was “all hot air”. But soon he was persuaded, became enthusiastic and advised on encryption. “This is an interesting technical problem: how do you reveal things about powerful people without getting your arse kicked?”
As it now stands, WikiLeaks claims to be uncensorable and untraceable. Documents can be leaked on a massive scale in a way which “combines the protection and anonymity of cutting-edge cryptographic technologies”. Assange and co have said they use OpenSSL (an open source secure site connection system, like that used by online retailers such as Amazon), FreeNet (a peer-to-peer method of storing files among hundreds or thousands of computers without revealing where they originated or who owns them), and PGP (the open source cryptographic system abbreviated from the jocular name “Pretty Good Privacy”).
But their main anonymity protection device is known as Tor. WikiLeaks advertises that “We keep no records as to where you uploaded from, your time zone, browser or even as to when your submission was made.” That’s a classic anonymisation via Tor.
US intelligence agencies see Tor as important to their covert spying work and have not been pleased to see it used to leak their own secrets. Tor means that submissions can be hidden, and internal discussions can take place out of sight of would-be monitors. Tor was a US Naval Research Laboratory project, developed in 1995, which has been taken up by hackers around the world. It uses a network of about 2,000 volunteer global computer servers, through which any message can be routed, anonymously and untraceably, via other Tor computers, and eventually to a receiver outside the network. The key concept is that an outsider is never able to link the sender and receiver by examining “packets” of data.
That’s not usually the case with data sent online, where every message is split into “packets” containing information about its source, destination and other organising data (such as where the packet fits in the message). At the destination, the packets are reassembled. Anyone monitoring the sender or receiver’s internet connection will see the receiver and source information, even if the content itself is encrypted. And for whistleblowers, that can be disastrous.
Tor introduces an uncrackable level of obfuscation. Say Appelbaum in Seattle wants to send a message to Domscheit-Berg in Berlin. Both men need to run the Tor program on their machines. Appelbaum might take the precaution of encrypting it first using the free-of-charge PGP system. Then he sends it via Tor. The software creates a further encrypted channel routed through the Tor servers, using a few “nodes” among the worldwide network. The encryption is layered: as the message passes through the network, each node peels off a layer of encryption, which tells it which node to send the payload to next. Successive passes strip more encryption off until the message reaches the edge of the network, where it exits with as much encryption as the original – in this case, PGP-encrypted.
An external observer at any point in the network tapping the traffic that is flowing through it cannot decode what is being sent, and can only see one hop back and one hop forward. So monitoring the sender or receiver connections will only show a transmission going into or coming out of a Tor node – but nothing more. This “onion” style encryption, with layer after layer, gave rise to the original name, “The Onion Router” – shortened to Tor.
Tor also allows users to set up “hidden services”, such as instant messaging, that can’t be seen by tapping traffic at the servers. They’re accessed, appropriately, via pseudo-top-level domains ending in “.onion”. That provides another measure of security, so that someone who has sent a physical version of an electronic record, say on a thumb drive, can encrypt it and send it on, and only later reveal the encryption key. The Jabber encrypted chat service is popular with WikiLeakers.
“Tor’s importance to WikiLeaks cannot be overstated,” Assange told Rolling Stone, when they profiled Appelbaum, his west coast US hacker associate. But Tor has an interesting weakness. If a message isn’t specially encrypted from the outset, then its actual contents can sometimes be read by other people. This may sound like an obscure technical point. But there is evidence that it explains the true reason for the launch of WikiLeaks at the end of 2006 – not as a traditional journalistic enterprise, but as a piece of opportunistic underground computer hacking. In other words: eavesdropping.
On the verge of his debut WikiLeaks publication, at the beginning of 2007, Assange excitedly messaged the veteran curator of the Cryptome leaking site, John Young, to explain where his trove of material was coming from:
“Hackers monitor chinese and other intel as they burrow into their targets, when they pull, so do we. Inexhaustible supply of material. Near 100,000 documents/emails a day. We’re going to crack the world open and let it flower into something new …We have all of pre 2005 afghanistan. Almost all of india fed. Half a dozen foreign ministries. Dozens of political parties and consulates, worldbank, opec, UN sections, trade groups, tibet and falun dafa associations and … russian phishing mafia who pull data everywhere. We’re drowning. We don’t even know a tenth of what we have or who it belongs to. We stopped storing it at 1Tb [one terabyte, or 1,000 gigabytes].”
A few weeks later, in August 2007, a Swedish Tor expert, Dan Egerstad, told Wired magazine that he had confirmed it was possible to harvest documents, email contents, user names and passwords for various diplomats and organisations by operating a volunteer Tor “exit” node. This was the final server at the edge of the Tor system through which documents without end-to-end encryption were bounced before emerging. The magazine reported that Egerstad “found accounts belonging to the foreign ministry of Iran, the UK’s visa office in Nepal and the Defence Research and Development Organisation in India’s Ministry of Defence. In addition, Egerstad was able to read correspondence belonging to the Indian ambassador to China, various politicians in Hong Kong, workers in the Dalai Lama’s liaison office and several human rights groups in Hong Kong. “It kind of shocked me,” he said. “I am absolutely positive that I am not the only one to figure this out.”
The speculation was largely confirmed in 2010, when Assange gave Raffi Khatchadourian access to write a profile. The New Yorker staffer wrote: “One of the WikiLeaks activists owned a server that was being used as a node for the Tor network. Millions of secret transmissions passed through it. The activist noticed that hackers from China were using the network to gather foreign governments’ information, and began to record this traffic. Only a small fraction has ever been posted on WikiLeaks, but the initial tranche served as the site’s foundation, and Assange was able to say, ‘We have received over one million documents from 13 countries.’ In December, 2006, WikiLeaks posted its first document: a ‘secret decision’, signed by Sheikh Hassan Dahir Aweys, a Somali rebel leader for the Islamic Courts Union, that had been culled from traffic passing through the Tor network to China.”
The geeky hacker underground was only one part of the soil out of which WikiLeaks grew. Another was the anti-capitalist radicals – the community of environmental activists, human rights campaigners and political revolutionaries who make up what used to be known in the 1960s as the “counter-culture”. As Assange went public for the first time about WikiLeaks, he travelled to Nairobi in Kenya to set out their stall at the World Social Forum in January 2007. This was a radical parody of the World Economic Forum at Davos, Switzerland, where rich and influential people gather to talk about money. The WSF, which originated in Brazil, was intended, by contrast, to be where poor and powerless people would gather to talk about justice.