UK Police Spying Expert Heading Probe into Snowden Leak Journalists

Back in July, London's Metropolitan Police admitted that it was still conducting a criminal investigation it launched two years ago into journalists who have reported on Edward Snowden's leaked documents.

Since then, I have been trying to find out more details about the investigation through the Freedom of Information Act. The Met is refusing to disclose virtually anything about the probe, but recently it did provide me with one new detail:

Specialist Operations under the direction of AC Mark Rowley is the MPS [Metropolitan Police Service] unit involved in the investigation related to the Snowden documents.

Rowley (pictured below) has taken over the Snowden investigation from Cressida Dick, the Met's former head of Specialist Operations, who quit the force in December last year to take up a secret new job at the Foreign Office. The Met confirmed this in an emailed letter it sent me late last month (I'd have written about it sooner but have been a bit swamped with other projects).

Rowley is an expert in covert surveillance methods and pioneered the development of new police spying techniques across the UK while working as a detective superintendent in the 1990s with the National Criminal Intelligence Service. Notably, he recently made clear he has no qualms about monitoring journalists' communications if he deems it necessary to “chase down criminals." He has also boasted about the London police being at the “cutting edge” of covert surveillance through the use of “specialist hardware and software.” (These specialist tools include powerful portable spying devices the Met uses to monitor mobile phone communications across targeted areas of London, as I reported back in 2011.)

The Met first announced it had launched an investigation related to the Snowden documents in August 2013, saying the criminal probe was being headed by its Counter Terrorism Command, which is a division of the Specialist Operations department. In December 2013, Rowley's predecessor Cressida Dick acknowledged during a parliamentary hearing that the investigation was looking at whether reporters at The Guardian had committed criminal offenses for their role in revealing secret surveillance operations exposed in the Snowden documents.

For almost seven months earlier this year, the Met refused to confirm or deny whether the investigation remained ongoing, repeatedly claiming doing so would be “detrimental to national security.” But the force performed a sudden volte-face on its position in late July following an intervention from the Information Commissioner’s Office, the public body that enforces the UK’s freedom of information laws.

I'm currently seeking more information about the investigation, such as details about how much money it has cost the taxpayer to date and the names of outside agencies or contractors that have assisted. The Met has so far refused to release this information — again spuriously claiming that doing so could somehow jeopardise national security — but I have lodged an appeal in an effort to have this decision reversed. Will post updates as and when I have them.

Questions About The Sunday Times Snowden Story

The Sunday Times has a front page story out today claiming that the Chinese and Russian governments have somehow managed to obtain National Security Agency whistleblower Edward Snowden's trove of documents. The story is sourced from anonymous UK government officials who make a series of significant allegations, unfortunately backed up with zero evidence. It's worth going through some of the key points of the story to cast some critical scrutiny on the central claims and to raise a few questions about them:

1) "RUSSIA and China have cracked the top-secret cache of files stolen by the fugitive US whistleblower Edward Snowden...according to senior officials in Downing Street, the Home Office and the security services."

Is the claim here that a full archive of encrypted files was "cracked" by some sort of brute-force decryption attack? If so, how did these "senior officials" establish that? How did the Russians and Chinese allegedly obtain the encrypted material in the first place?

2) "forcing MI6 to pull agents out of live operations in hostile countries."

This was a surprise to me because I've reviewed the Snowden documents and I've never seen anything in there naming active MI6 agents. Were the agents pulled out as a precautionary measure? Keeping in mind that the UK government does not actually know exactly what Snowden leaked, how do these officials know there were documents in there that implicated MI6 operatives and live operations in the first place?

3) "Moscow gained access to more than 1m classified files held by the former American security contractor"

Snowden has said repeatedly that he did not carry any files with him when he left Hong Kong for Moscow. Is this article alleging that he is lying? If so, where's the evidence to support that? Moreover, I've seen nothing in the region of 1m documents in the Snowden archive, so I don't know where that number has come from. Oh, wait:

4) "Snowden, a former contractor at the CIA and National Security Agency (NSA), downloaded 1.7m secret documents"

This 1.7m figure was invented by US officials and since then it has been regurgitated repeatedly and unquestioningly by various media outlets. I've seen the trove of documents; the claim or insinuation that he leaked 1.7m is not true.

5) "A senior Downing Street source said: 'It is the case that Russians and Chinese have information'."

Of course they do: the same information that the rest of the world has access to in public news reports and documents published as part of those. If the claim here is that the Russians and Chinese have access to every single document in the entire archive (i.e. all the unpublished material), where is the evidence to support that? How do the officials know? Are they speculating? These are serious claims — and serious claims demand serious evidence. Which is unfortunately not provided here.

6) “Why do you think Snowden ended up in Russia?” said a senior Home Office source. “Putin didn’t give him asylum for nothing."

I thought this one had long since been debunked by now, but apparently not. The reality is that Snowden never intended to stay in Russia. He was trying to get to Latin America and only ended up in Russia because his passport was revoked by the US government while he was transiting through.

7) Senior Home Office source: "His documents were encrypted but they weren’t completely secure and we have now seen our agents and assets being targeted.”

So the UK Home Office is alleging Snowden lied about taking documents to Moscow? How has it established that? And the "targeted" assets — how does the source know this has happened as a direct consequence of the Snowden leaks? There are many other factors at play here, and correlation does not imply causation. Especially with regard to Russia, given that anonymous UK "security sources" claimed months ago — again in the Sunday Times — that they are engaged in a "new Cold War" against Kremlin spies due to the broader issue of Vladimir Putin's heightened military posturing.

8) "A British intelligence source said: 'We know Russia and China have access to Snowden’s material'."

As I noted above: the Russians and Chinese have access to documents published with public news reports, sure, that's obvious and true. But is the claim here that they have access to material beyond that? If so, where's the evidence? How does this source "know" and what does he "know," exactly? Why the vague statement? Let's hear what it is the source knows and how so we can properly assess and scrutinise the merit of the allegation.

9) "It is not clear whether Russia and China stole Snowden’s data, or whether he voluntarily handed over his secret documents in order to remain at liberty in Hong Kong and Moscow."

If it's not clear then why does the top line of the story say the Chinese and Russians "cracked" the documents? If Snowden just handed them over, why would they need to "crack" them? And if the Russians and Chinese somehow stole the documents in encrypted form, how did they a) manage to obtain them in the first place (especially given Snowden says he didn't carry the files with him into Russia), and then b) break the encryption?

10) "David Miranda, the boyfriend of the Guardian journalist Glenn Greenwald, was seized at Heathrow in 2013 in possession of 58,000 'highly classified' intelligence documents after visiting Snowden in Moscow."

This is wrong. Miranda was detained at Heathrow after visiting Laura Poitras in Berlin. He wasn't visiting Snowden in Moscow and I think this is the first time I've ever seen this asserted. It's false.

*****

All in all, for me the Sunday Times story raises more questions than it answers, and more importantly it contains some pretty dubious claims, contradictions, and inaccuracies. The most astonishing thing about it is the total lack of scepticism it shows for these grand government assertions, made behind a veil of anonymity. This sort of credulous regurgitation of government statements is antithetical to good journalism.

The government has an obvious vested interest in portraying Snowden as a terrible person who's helped "the enemy" — it has been badly stung by his surveillance revelations and the political fallout that has ensued as a result of them. For that reason alone its claims should be treated with caution and not repeated unchallenged. Evidence should be necessary for allegations of this magnitude, which have such big ramifications. The Sunday Times has a long and commendable history of holding the government to account with great investigative journalism. But in this case, sadly, it has allowed itself to be used by faceless officials as a mouthpiece.

UPDATE, 14 June 2015, 19:30 BST: My colleague Glenn Greenwald has a post up at The Intercept dissecting the Sunday Times report, which he blasts as "pure stenography of the worst kind." Greenwald writes that "the exact kinds of accusations laundered in the Sunday Times today are made — and then disproven — in every case where someone leaks unflattering information about government officials." He says the story is "as shoddy and unreliable as it gets. Worse, its key accusations depend on retraction-level lies."

The Guardian has a good piece from Ewen MacAskill with five pertinent questions for the British government about the claims. "Anonymous sources are an unavoidable part of reporting, but neither Downing Street nor the Home Office should be allowed to hide behind anonymity in this case," writes MacAskill, who travelled with Greenwald and Laura Poitras to meet Snowden in Hong Kong back in 2013. "Where is the evidence?" he asks.

In another interesting development, the Sunday Times quietly deleted the false assertion I noted above (see #10) about David Miranda having documents on his possession "after visiting Snowden in Moscow." This has been removed from the online version of the story with no correction or note, but it can still be found in the paper version, which I got a copy of. The inaccuracy was significant as it underpinned the central dubious narrative of the story — that the documents were "held" by Snowden in Moscow, the insinuation being that this was how the Kremlin was supposed to have gotten hold of them, a claim presented in the story as unquestionable fact because nameless officials "confirmed" it (without offering any evidence).

UPDATE II, 15 June 2015, 19:00 BST: The lead reporter on the Sunday Times article, Tom Harper, has given an interview with CNN that has to be seen to be believed. In it, Harper is quizzed by host George Howell about the piece — and his answers highlight the many problems with the story's central allegations and how they were sourced. Here's a transcript of the important bits; I'll dissect some key points below.

Howell: How do senior officials at 10 Downing Street know that these files were breached?

Harper: Well, uhh, I don't know the answer to that George. All we know is that this is effectively the official position of the British government ... we picked up on it a while ago and we've been working on it and trying to stand it up through multiple sources, and when we approached the government late last week with our evidence, they confirmed effectively what you read today in the Sunday Times, so it's obviously allegations at the moment from our point of view and it's really for the British government to defend it.

How do they know what was in them [the files], if they were encrypted? Has the British government also gotten into these files?

Well, the files came from America and the UK, so they may already have known for some time what Snowden took — uhh, again, that's not something we're clear on ... we don't go into that level of detail in the story we just publish what we believe to be the position of the British government at the moment.

Your article asserts that it is not clear if the files were hacked or if he just gave these files over when he was in Hong Kong or Russia, so which is it?

Well again sorry to just repeat myself George, but we don't know so we haven't written that in the paper. It could be either, it could be another scenario ... when you're dealing with the world of intelligence there are so many unknowns and possibilities it's difficult to state anything with certainty and so we've been very careful to just stick to what we are able to substantiate.

The article mentions these MI6 agents ... were they directly under threat as a result of the information leaked or was this a precautionary measure?

Uhh, again, I'm afraid to disappoint you, we don't know ... there was a suggestion some of them may have been under threat but the statement from senior Downing Street sources suggests that no one has come to any harm, which is obviously a positive thing from the point of view of the West.

So essentially you are reporting what the government is saying, but as far as the evidence to substantiate it, you're not really able to comment or explain that at this point?

No. We picked up on the story a while back from an extremely well placed source in the Home Office. and picked up on trying to substantiate through various sources in various agencies throughout Britain, and finally presented the story to the government, and they effectively confirmed what you read in today's Sunday Times. But obviously when you're dealing with intelligence it's the toughest nut to crack and unless you have leaked documents like Snowden had, it's difficult to say anything with certainty.

So, in summary: How were the files breached? "I don't know." Were the files hacked or did Snowden hand them over? "We don't know." Were MI6 agents directly under threat? "We don't know." How did the government know what was in the files? "That's not something we're clear on." Can you substantiate the claims? "No."

The interview is quite extraordinary because it makes absolutely clear that not only was this entire dubious story based solely on claims made anonymously by government officials, the reporters who regurgitated the claims did not even seek to question the veracity of the information. They just credulously accepted the allegations and then printed them unquestioningly. That really is the definition of stenography journalism — it's shameful.

It's also worth noting that in Harper's interview he admits he has no idea how the Chinese and Russian governments supposedly obtained the files, yet the whole story was based on a bombshell claim that the trove of files was somehow "cracked" by Chinese and Russian government operatives (i.e. that the encryption on them was broken). As I noted above in point #9, if Snowden just handed over the files, why would these governments then need to "crack" them, unless the claim is that he handed over a set of encrypted documents? Either way, Harper says he has no idea how the files were obtained, so how does he know they were "cracked"? This central allegation seems to have been invented completely out of thin air, at worst a fabrication by technologically inept reporters who don't understand what terminology like "cracked" means, at best derived from evidence-free conjecture from spineless government officials too afraid to put their names to the claims.

It is also very telling to note that Harper cites "an extremely well placed source in the Home Office" as the initial person who tipped him off about the story. That's presumably the same "senior Home Office source" quoted in the story insinuating that Snowden chose to go to Russia and hand over documents in return for asylum. That absurd allegation, as I noted in point #6 above, contradicts the fact that Snowden only ended up in Moscow because the US government foolishly revoked his passport and stranded him there while he was passing through on route to Latin America; moreover, Snowden has said repeatedly that he didn't take any documents to Russia. Any reporter familiar with the story knows this. An assertion from an official claiming Snowden went there to hand over documents should surely have set off alarm bells about the credibility of his claims, and should have at least prompted a demand for evidence to back them up, given their magnitude.

But no alarm bells were triggered in our boy Harper's head. Sounding more like a government press officer than a journalist, he told CNN: "we just publish what we believe to be the position of the British government at the moment."

And that brings me to my final point on this. Harper claimed in his CNN interview that his story was "effectively the official position of the British government." If that's the case, then why will no one in the government come out and say so publicly? As the well-sourced BBC security correspondent Gordon Corera noted in a measured analysis on Sunday: "No one in government today is confirming that they are sure that the Russians and Chinese have got full access — that remains in the realm of 'no comment'."

Google's Role in the Government Surveillance of Fox News Reporter James Rosen

In recent weeks, there have been a series of controversies in the United States over the Justice Department snooping on journalists as part of aggressive investigations into leaks of classified information.

The most egregious case involves Fox News reporter James Rosen, whose private emails were secretly obtained, his phone records grabbed, and his movements to and from a government building electronically tracked. Rosen sparked a leak investigation after he authored a story in 2009, based on US intelligence passed to him by an anonymous source, concerning possible nuclear tests in North Korea in response to United Nations sanctions.

The case has attracted widespread coverage, and the extent of the monitoring of Rosen — and the FBI's accusation that he was "an aider, abettor and/or co-conspirator” who committed a crime for merely reporting news — has outraged media organisations. Some high-profile figures, including the lawyer James Goodale, have called for attorney general Eric Holder to resign for authorizing the surveillance.

But one element of the Rosen case has been largely overlooked: that is, the role of Google in handing over Rosen's emails. That is a point made by WikiLeaks founder Julian Assange in an opinion piece for the New York Times published Sunday. "There has been little analysis of Google’s role in complying with the Rosen subpoena," Assange noted.

I have been looking into this very issue in the past week, and so it seems like a good time to lay out what I've learned.

In 2010, it emerged last month, Google was ordered to hand over Rosen's emails and other data as part of a search warrant signed off by magistrate judge Alan Kay. Here is a list of what Google was told to give the FBI from Rosen's Gmail account, according to court documents:

• An "exact duplicate" of all communications between Rosen's Gmail account and three named email accounts deemed of investigative interest, two of which were @yahoo.com and one @gmail.com. Specifically: all emails sent or received by Rosen to and from any of the three accounts, whether marked "cc," "bcc," "fwd," or "sent"; any deleted messages; messages maintained in the trash folder or other folders (i.e. drafts); and copies of attachments sent between Rosen and the three named accounts including videos, documents, and photographs.


• ALL communications sent to and from Rosen's Gmail account on 10-11 June 2009, from or to ANY address (i.e. not just the three named accounts). Specifically, as above, the FBI sought: messages marked "cc," "bcc," "fwd," or "sent"; any deleted messages; messages maintained in the trash folder or other folders (i.e. drafts); and attachments including videos, documents, and photographs.


• Screen names associated with Rosen's accounts, account numbers, status of accounts, dates of service, methods of any payment, telephone numbers, addresses, detailed billing records, histories and profiles.


• Log files from Rosen's account showing dates, times, methods of connecting, ports, dial-ups, IP addresses, and/or location from which he connected.

Google was told that it must keep the warrant secret and should not "notify any other person... of the existence of the warrant." The question is: could Google have challenged the lawfulness of this contentious warrant and fought in the courts in an attempt to notify the journalist?

I asked Google, but the company said its policy was not to comment on specific cases. What I was able to establish, however, is that when Google receives an order to turn over user data as part of a search warrant, in most cases it does not see the full affidavit from the FBI investigator that details the specifics of the case — and the FBI has no legal obligation to inform Google of the specifics because a judge has already reviewed and signed off on it.

But crucially, what Google does sometimes see, a well-placed source told me on condition of anonymity, is an "attachment" that occasionally accompanies a warrant ordering it to disclose certain information. The attachment is an important document because it details the specific types of data investigators expect Google (or any other given company) to turn over. It also sometimes contains a note for the authorities detailing what they should look for in the data once it is disclosed.

In the Rosen case, there was a six-page attachment that detailed all of this. You can read it here. It breaks down the data Google was ordered to turn over, and it also has instructions for the investigators. If Google received this document before turning over Rosen's emails, in my view the company could fairly easily have established that this was a warrant to obtain private data on a journalist and his source.

How? The Rosen attachment, though it does not explicitly name Rosen or Fox News, outlines that the FBI is looking to find evidence concerning violations of the Espionage Act (18 USC § 793), a law that has been used at least seven times by the Obama administration to prosecute people for disclosing classified information. The attachment explains that the FBI is seeking to obtain communications between a man named Stephen Kim (the alleged source of the Fox News story) and the "author of [an] article that is the subject matter of the FBI investigation that is the basis for this warrant." The attachment also refers to "classified and/or intelligence information" and mentions that the FBI is seeking to find evidence in the emails that Stephen Kim and/or "the author" had knowledge of government rules or procedures regarding communicating with "members of the media." It adds that it is seeking to find evidence of the "author's communication with any other source or potential source of the information disclosed in the article," making it clear that it is a journalist's email being targeted.

Google would not tell me whether or not it had seen this attachment, again saying that its policy is not to "discuss the specifics of any particular case." But if the company did see it and did not seek to level any legal challenge, there is a legitimate and serious question to be asked concerning the extent of its complicity in the government's surveillance of a journalist in order to expose a confidential source. Hanni Fakhoury, a staff attorney at the Electronic Frontier Foundation, told me that while it is unusual and difficult for a company to challenge a search warrant because a judge has already reviewed and signed off on it, it is still possible to challenge. "Theoretically a challenge to the search warrant would go back to the judge who signed it, who I imagine would be reluctant to change their mind (though you never know)," Fakhoury said in an email.

This also raises questions for me about how closely Google scrutinizes individual warrants and court orders before turning over users' private data. Google has a fairly solid track record of standing up to government snooping that it deems disproportionate, and it has commendably pioneered the publication of transparency reports showing government requests to censor Internet content and obtain users' data. But if it turns out Google's legal team were sent the attachment in the Rosen case and did not even attempt to challenge the lawfulness of the warrant, as seems possible, the company's reputation for standing up for users' rights will take a hit — and deservedly so — not least because the spying on Rosen stands out as such a flagrant example of government overreach and excessive surveillance.

Lady Liberty's Watching You: The Full Correspondence

Below is the full bizarre correspondence between myself and two companies, Cognitec and Total Recall Corporation, which was the subject of a recent article I wrote for Slate magazine called "Lady Liberty's Watching You."

As you will see, it started out with me following up a tip about new face recognition technology being piloted at the Statue of Liberty, and ended with me getting sent legal threats warning me not to write about it. A number of outlets followed up the story, including BoingBoing, the Village Voice, and Techdirt.

The correspondence — which consists of both phone interviews and emails listed in chronological order — has not been edited apart from a couple of typo fixes and the removal of email introductions and signatures ("hi there," "best regards," etc.) to avoid unnecessary repetition. I am publishing the correspondence in full not only because doing so is in the interest of transparency, but because I feel that it can serve as an educational example — helping inform about the sort of crass, outrageous intimidation attempts journalists occasionally face when attempting to go about their work. Receiving crude threats is unfortunately sometimes part of the job, but never should we back down.

*****
PHONE CALL
Ryan Gallagher
Elke Oberg [Cognitec]
19 March 2013 13:36pm
Contemporaneous note

I ask for more information about pilot of Cognitec face recognition at Statue of Liberty.

Oberg says: "We were doing this through an integrator [Total Recall Corporation]. So what usually happens is our software, we give it to a company that actually integrates it into a real-world application. I am not really the best person to tell you about what's happening with this project, because that's really more [for] the company that is doing the actual project. I mean, yes, they are going to try out our technology there. But as to the status, and how it's going, I am not the best person to answer those questions for you."

She adds: "I knew this project was going on but hadn't really checked up on it."

She describes what the technology can be used for: "facial analysis to determine how many people have gone through the checkpoints, how many are male, how many are female... we do have ethnicity detection as well but obviously not that accurate for person of mixed ethnicity. But you can also use it for people flow if you see a certain entrance or certain choke point there are too many people gathering you can open another entrance put more staff on etc. It can give a rough estimate of age... age ranges within five years of actual birth date, it is quite accurate.

She says the demographics capability was relevant to the Statue of Liberty pilot: "I'm certain that they are interested in that part."

*****

From: Ryan Gallagher
To: [Total Recall Corp. secretary] Viktoriya
19 March 2013 15:31

I spoke to you on the phone a moment ago. I am a journalist with Slate.com.

I'm doing a story on facial recognition technology in New York and was hoping you could give me an update on the status of a pilot I understand Total Recall is running at the Statue of Liberty with software made by a company called Cognitec.

Is the pilot still going ahead once the Statue of Liberty reopens? How long is the pilot expected to last?

If you could send me some information on this asap it'd be greatly appreciated.

*****

From: Ryan Gallagher
To: [Total Recall Corp. secretary] Viktoriya
20 March 2013 13:18

Hi Viktoriya, just wondering if you have managed to get me answers to my questions?

Thanks

*****

From: [Total Recall Corp. director of business development] Peter Millius
To: Ryan Gallagher
20 March 2013 14:06

Ryan,

Where did you get this information?

Please call me to discuss

*****

From: Ryan Gallagher
To: Peter Millius
20 March 2013 14:10

Hi Peter, calling now.

*****

PHONE CALL
Ryan Gallagher
Peter Millius
20 March 2013 14:19
Contemporaneous note

Millius asks where I heard about the pilot. I explain that I received a tip, had read about it in a police magazine, and that I had also spoken with Cognitec about it.

He says: "At this time there is not going to be a pilot project of the facial recognition at the Statue of Liberty although if it was it would be with Cognitec. We do work with Cognitec but right now because of what happened with [Hurricane] Sandy it put a lot of different pilots that we are doing on hold.

"There are no plans put something in right now. There are a lot of other things that need to get fixed. And they said that once we get all that stuff up we can start talking about that again. But nothing to talk about right now.

"Total recall is doing a security program at the Statue of Liberty. However, if you'd like to do a story about it I could talk to you about it more in detail when we want to do a full press release and so on and so forth.

"It's still months away and the facial recognition right now is not going to be part of this phase.

"We're in the middle of trying to work out what's going to get installed and what's not going to get installed.

"The timing is just premature."

[Millius then puts me on hold. He returns a minute or two later and puts me on speakerphone. One of his colleagues joins the call but does not introduce himself.]

Millius now says that the company had "discussed the possibility of it [a face recognition pilot] and it's been completely vetoed."

I ask, vetoed by who? He says the "Park Police."

I ask why it was vetoed and he says I should contact the Park Police. He declines to answer specific further questions and adds that I am "not authorized" to write about any use of face recognition at the statue.

*****

From: Ryan Gallagher
To: Elke Oberg [Cognitec]
20 March 2013 15:20

I have a couple more questions for you regarding the Statue of Liberty project. Do you think you could put me in touch with the person at Cognetic who knows most about this contract? Thanks.

*****

From: Elke Oberg
To: Ryan Gallagher
20 March 2013 15:23

LETTER ATTACHED.

Please consider this a written confirmation that you are to refrain from publishing any information about the use of face recognition at the Statue of Liberty. As you learned from Total Recall, the project was cancelled and you have false information.

If you decide to publish the information, we will need to take legal action to demand an official correction statement.

We appreciate your professionalism and integrity.

*****

From: Ryan Gallagher
To: Elke Oberg
20 March 2013 15:28

This is quite confusing. You told me yesterday that they were going to be trying out the Cognitec software at the statue. When and why was the project cancelled?

*****

From: Elke Oberg
To: Ryan Gallagher
20 March 2013 15:33

I asked you that I did not have any current information and that you need to talk to Total Recall about the status of this project. They told you and confirmed to me that the project is not happening. The City of New York has not approved it.

*****

From: Ryan Gallagher
To: Elke Oberg
20 March 2013 15:35

So the software is not going to be used because the City of New York has not given it approval?

You said yesterday, and I quote: "Yes, they are going to try out our technology there."

*****

From: Elke Oberg
To: Ryan Gallagher
20 March 2013 15:40

Again, I do not have any exact information about this. I thought you spoke to Total Recall about it?

*****

From: Ryan Gallagher
To: Elke Oberg
20 March 2013 15:42

I have spoken with Total Recall, yes, but I am trying to verify what they are saying. It is all very confusing and I have been provided contradictory information from different sources.

*****

From: Elke Oberg
To: Ryan Gallagher
20 March 2013 15:51

There seems enough confusion to leave the subject out of your article.

*****

From: Elke Oberg
To: Ryan Gallagher
20 March 2013 15:51

Quite the contrary, the confusion and people threatening me with legal action only encourages me to keep digging and establish the facts.

*****

From: Ryan Gallagher
To: Peter Millius
20 March 2013 16:52

Hi Peter,

A follow-up question for you. I have been back in touch with Cognitec and they are now saying that the facial recognition pilot project at the Statue of Liberty was "cancelled" because "the City of New York has not approved it."

Is that correct?

*****

From: Peter Millius
To: Ryan Gallagher
20 March 2013 17:04

LETTER ATTACHED.

Please consider this a written confirmation that you are to refrain from publishing any information about Total Recall and the Statue of Liberty or the use of face recognition at the Statue of Liberty. As you learned from Total Recall, the project was cancelled and you have false information.

If you decide to publish the information, we will need to take legal action to demand an official correction statement.

*****

From: Ryan Gallagher
To: Peter Millius
20 March 2013 17:10

Thanks for the interesting note, Peter. Who was the project cancelled by? You mentioned in our phone call that it had been "vetoed" by the Park Police, and Cognitec told me that "the City of New York has not approved it." Which of these statements is correct? If you could help clarify it'd be much appreciated.

*****

From: Peter Millius
To: Ryan Gallagher
CC: Attorney from Greenberg Traurig law firm.
20 March 2013 18:01

As I have previously told you- I have no comment and please be advised that we will take legal action against you personally and your company if you continue to harass me or chose to publish anything

*****

From: Ryan Gallagher
To: Peter Millius
20 March 2013 18:09

I am merely asking questions, Peter, legitimate questions. That is my job. I am a journalist. But If you have no further comment then I shall send no more inquiries. Thanks for your time.

*****

PHONE CALL
Ryan Gallagher
Elke Oberg [Cognitec]
22 March 2013 2:26pm
Contemporaneous note; summary of call

RG: I'm just trying to establish some of the details around why the project was cancelled, as you're saying.

Oberg: "I have no idea, Ryan, I really don't know. All I know is it's cancelled and that's the end of it... I have no information on it."

You did say the other day that they were 'going to try out our technology there.' So I'm just trying to establish what changed and why.

"Yes, not on that particular project, though, that particular project I don't know anything about. They informed us it was cancelled and I don't know any more than that."

You said you were aware it was going ahead at the statue.

"No, I did not say that. I don't know if it was scheduled."

Why did you tell me then, 'yes they're going to try out our technology there'?

"I don't think I said that."

Yes, you did.

"Then I must have made a mistake. I don't know anything about this project."

So you've never had any knowledge of this being tested at the Statue of Liberty, is that true?

"No, I don't. As I said, you need to ask the contractor."

*****

From: Ryan Gallagher
To: Peter Millius
28 March 2013 18:03

Mr. Millius,

I'm hoping you might have had a chance to reflect since our correspondence last week. I thought I would give you a final opportunity to talk with me — on record or off — about the reasons for the cancellation of the face recognition project at the Statue of Liberty. I am going to be writing about it based on information from a variety of sources. As things stand, your attempt to prevent me from reporting on the project will be a central focus of the story. But, of course, it doesn't have to be that way, and if you would like to discuss the project and the reasons for its cancellation then I would be happy to make time at your convenience for a phone call.

*****

Millius never responded to my final attempt to clarify details around the claimed cancellation of the Statue of Liberty face recognition project. The full article based on the above correspondence can be found at Slate.

The WikiLeaks Grand Jury

As Alexa O'Brien reported Tuesday, the US Department of Justice has provided the latest confirmation that the grand jury investigation into WikiLeaks remains currently ongoing. That means it has been actively investigating the whistleblower website now for at least about 26 months (the Guardian first reported back in January 2011 that a subpoena seeking data on WikiLeaks had "appear[ed] to confirm for the first time the existence of a secret grand jury" empanelled to investigate individuals associated with the organisation. Prior to that, in late November 2010, the White House confirmed that there was an "active, ongoing criminal investigation" into WikiLeaks. And in July 2010, the Department of Defence stated that it had requested that the FBI help with an investigation related to WikiLeaks disclosures and that it "go wherever it needs to go").

I've been doing a bit of reading on grand juries, and the time-frame is significant because they do not have an indefinite lifespan. US law states that:

The grand jury shall serve for a term of eighteen months unless an order for its discharge is entered earlier by the court upon a determination of the grand jury by majority vote that its business has been completed. If, at the end of such term or any extension thereof, the district court determines the business of the grand jury has not been completed, the court may enter an order extending such term for an additional period of six months. No special grand jury term so extended shall exceed thirty-six months, except as provided in subsection (e) of section 3333 of this chapter.

From subsection (e) section 3333:

A special grand jury term may be extended by the district court beyond thirty-six months in order that such additional testimony may be taken or the provisions of subsection (b) of this section may be met.

And this from the American Bar Association's riveting Handbook on Antitrust Grand Jury Investigations:

The district court may extend the term of the special grand jury to a total of 36 months... The special grand jury may continue even beyond 36 months if it issues a report, and if the district judge determines that additional testimony is necessary, or that the report needs to be rewritten to comply with the governing statute.

So this means that the WikiLeaks grand jury seems to have been granted at least one six month extension thus far, as it has definitely exceeded the 18 month period already. It also suggests that some time between July this year and January 2014 — about four to ten months from now — the grand jury will either have already wrapped up or it will be close to wrapping up as it reaches the somewhat flexible 36-month cut-off point (see an update on this below). Grand juries, for those unfamiliar with them, do not decide the guilt of a person or persons. What they do is take evidence and make a judgement on whether or not criminal charges can be brought (in the form of an indictment) — in this case against Julian Assange and others affiliated with WikiLeaks.

All things considered, I would expect that within the next year or so it will be crunch time for this long-drawn-out saga. It still seems as if it could swing either way at this point, but it is worth weighing up the influence the broader political climate may have. There is an atmosphere in the United States at the minute that seems to represent a growing fatigue with the punitive national security culture that became pervasive post 9/11. Recent court judgments have gone against the government on issues related to secret surveillance and covert drone strikes, and this makes me wonder whether the tides are changing — albeit only incrementally and to a small degree.

Choosing to prosecute Assange for his role as an editor in publishing classified documents, as if it needs to be said, would be an outrageous decision that would cause an almighty outcry from a cross-partisan range of organisations and in the process damage the standing of the United States globally. Even at the height of the Bush administration's jingoistic reign it would have been an extremely controversial call to make. So for Obama's Justice Department to pursue a prosecution in the months ahead, in an atmosphere that may be tangibly shifting against draconian policies, would be a doubly contentious act that could turn out to be politically kamikaze for Obama personally in terms of his lasting legacy. All of these things will surely factor into any final decision regarding a prosecution, which will no doubt be discussed at the very highest echelons of the administration. But first, of course, we will have to wait to see whether or not the grand jury determines that there are charges to pursue in the first place....

*****

UPDATE, 1 April 2013: Wired.com news editor Kevin Poulsen, who was himself once the subject of a grand jury investigation for hacking into computer systems, tells me: "When a grand jury is up, prosecutors can just roll the case into a new grand jury." Significantly, this means that the 36-month cut-off point is far more flexible than the law I cited above implies, because when the first grand jury runs out of time, a new, second grand jury can effectively take up the investigation and continue its work with a fresh timetable. Poulsen said this occurred in his own case ("I had two GJs in series. Prosecution had a law enforcement witness summarize all previous testimony for the incoming panel"). And the book Grand Jury Practice by Howard W. Goldstein suggests it is not an unusual occurrence. Goldstein notes that "given the increasing complexity of federal investigations, many are not finished before the grand jury's term expires," adding: "information developed in one grand jury may be relevant to another grand jury."

An additional point worth mentioning here is that, according to an analysis of grand jury statistics circulated by WikiLeaks:

it is extremely rare for a grand jury not to indict. In the year 2009, federal grand juries in the United States saw cases involving 69,245 suspects and voted to indict all but 20 of them. (This is denoted by "no true bill returned" in the document.) That is a approximately one in every three thousand five hundred suspects. These statistics are repeated year after year. Given that it is known that he is the target of a grand jury investigation, Julian Assange has in and around a 99.97% chance of being indicted.

Interestingly, the same statistics show that US attorneys declined to prosecute 29,780 suspects in 2009 for reasons such as "stale case," "weak evidence," "minimal federal interest," and "Department of Justice policy." These all sound like strong grounds to halt any future attempt to prosecute WikiLeaks staff for their publishing work — if and when an indictment eventually materialises.

Spy Trojan Seller on Ethics, Authoritarians, & 'Bad Guys' vs. 'Good Guys'

Headquartered out of a modern industrial estate in Andover, England, Gamma Group sells controversial advanced surveillance technologies to intelligence and law enforcement agencies in countries across the world. The company has been the source of widespread news coverage over the last couple of years due to its spy trojan tools — designed to secretly infiltrate computers, monitor communications and siphon data from hard drives — which security researchers say they believe are being used by authorities in a host of countries with poor human rights records, including: Bahrain, Brunei, Ethiopia, Indonesia, Mongolia, Singapore, Turkmenistan, and the United Arab Emirates.

Recently, I had an interesting and at times revealing back-and-forth email exchange with Gamma's Germany-based spokesman, Martin J. Muench. It is significant enough that I feel it is worth reproducing here, mainly because it offers an unusual level of insight into Muench's — and ultimately Gamma's — thinking.

The exchange began when I sent Muench a query regarding a prospective story I was working on — a follow-up to a Netzpolitik article detailing documents showing German federal police's plans to use Gamma's "Finfisher" (a.k.a "FinSpy") computer surveillance software. I also wanted to ask Muench about a "code of conduct" his company is apparently looking to implement in response to concerns about complicity in human rights violations.

However, the exchange, all on the record, eventually became a broader discussion about selling surveillance technologies, with Muench telling me that "we don’t necessarily agree with each other as far as the definition of what is ethical" and adding that he thought journalists had kicked up a "fuss" about Finfisher because they themselves were "guilty of the most appalling breaches."

It makes for quite a thought-provoking read, I think, especially toward the end. The content of the correspondence has not been edited, though I have removed email signatures and greetings ("Hi Ryan," "best regards," etc.) to cut out unnecessary repetition.

*****

From: Ryan Gallagher
To: Martin J. Muench
22 January 2013 12:52

I was reading this report on netzpolitik.org about the German Bundeskriminalamt acquiring Finspy: https://netzpolitik.org/2013/secret-government-document-reveals-german-federal-police-plans-to-use-gamma-finfisher-spyware/

I wanted to confirm with you:

1. is this an accurate report? Have the Bundeskriminalamt purchased Finspy or are they just testing it?

2. I note that the Netzpolitik report says you are in talks with NGOs with regards introducing a code of conduct for companies like yours. Which organizations are involved in the discussions? Can you share any information about what the code of conduct might include? And are any other companies involved?

*****

From: Martin J. Muench
To: Ryan Gallagher
22 January 2013 13:15

1. is this an accurate report? Have the Bundeskriminalamt purchased Finspy or are they just testing it?

As you can imagine this article and others relating to it have stimulated a great deal of interest...

However, I am afraid I have to tell you that Gamma simply does not discuss its client base, its exports, or any of the operations which its clients may or may not be undertaking. This is because there is usually a contractual term of confidentiality, and because naming a client can prejudice criminal or counter terror investigations and compromise the security of the members of the police or security services involved. Neither will Gamma name any countries which have not purchased its products thereby enabling customer countries to be identified by a process of elimination.

2. I note that the Netzpolitik report says you are in talks with NGOs with regards introducing a code of conduct for companies like yours. Which organizations are involved in the discussions? Can you share any information about what the code of conduct might include? And are any other companies involved?

We are currently having discussions with several groups. I don’t wish to elaborate further at the moment as some of these groups are our most vociferous public critics but who are quite prepared to discuss our ideas with us in private. In fact we have drafted a proposed Code of Conduct for the industry which goes far beyond the current ECAs.

*****

From: Ryan Gallagher
To: Martin J. Muench
22 January 2013 14:04

Regarding the code of conduct: is there any way you can send me a copy of the draft so I can get an idea of what it includes? Will it be made available publicly?

I note that Privacy International were previously reported to have turned down an invitation to discuss the code of conduct: http://www.guardian.co.uk/technology/2012/dec/26/british-company-gamma-international

Why did Privacy International refuse to engage? Do you think the code will have credibility if groups like Privacy International say they won't meet you to discuss it?

*****

From: Martin J. Muench
To: Ryan Gallagher
22 January 2013 14:16

I would honestly appreciate not putting too much focus on it at this point as I firstly would like to finish it and most of all also implement everything that has been and will be defined in there before promoting it publicly. Once it's done and we began the implementation we will definately make it public.

PI was offered numerous times a visit to our offices, a full product demonstration and open discussions about various topics. They mentioned that they're discussing internally a few month ago but did not respond to any follow-up emails. No reasons were given on why the offer was ignored.

I can only guess or better wonder why Eric King of PI does not want a personal meeting and also see the other side of the stories especially as he is spending so much time and energy on them without having the full picture; but I don't think that one organisation like PI not being interested in also giving constructive criticism will affect the credibility of such a code on a global level.

*****

From: Ryan Gallagher
To: Martin J. Muench
22 January 2013 15:05

If you have not yet implemented the code of conduct, doesn't that mean you are acknowledging that thus far you have not been adhering to appropriate ethical standards? What exactly is it that you need to implement? It would be great if you could show me a draft of the code, even on a background basis, to help me understand the context of the thing.

*****

From: Martin J. Muench
To: Ryan Gallagher
22 January 2013 21:56

Firstly, let me correct you. I am not acknowledging that Gamma has not adhered to ethical standards at all. One problem with ethical standards is that we all have them and we don’t necessarily agree with each other as far as the definition of what is ethical. Who decides? You have your views, I have mine and others have theirs’. That’s not to say we all disagree on everything. It simply means that we don’t all have the same views and for very different reasons.

Our position is this; we believe in the right to privacy but we don’t believe it takes precedence over or supersedes the right to life. We believe that nation states have the right to defend themselves against terrorists and we believe in the right to fight organised crime. We sell FinFisher to governments and law enforcement agencies to do this. We don’t sell a mass-monitoring tool. We sell a highly sophisticated piece of target specific software capable of providing evidential quality reports.

Another problem, of course, is that today’s ‘good guy’ may be tomorrow’s ‘bad guy’ and vice versa. If we imposed a moral code based on our intuition as to who might become a bad guy in the future we could end up spending a lot of time thinking about it and doing very little else. So, until we can get a code of conduct up and running that will actually work, rather than pay lip service to ‘ethics’, we have decided to let the export controls authorities act as our ‘moral compass’, for want of a better expression. After all, they are best placed to know who the ‘bad guys’ are and who the likely future ‘bad guys’ will be. We follow their lead and comply with the law.

Of course one of the reasons that some of the media have picked up on FinFisher products and make such a fuss is that some of them have become the subject of law enforcement inquiries themselves by electronic means and have been shown in the past to be by their own admission guilty of the most appalling breaches. The Leveson Inquiry shows a good example of this.

*****

From: Ryan Gallagher
To: Martin J. Muench
23 January 2013 03:30

Your last email raises many questions for me.

One problem with ethical standards is that we all have them and we don’t necessarily agree with each other as far as the definition of what is ethical.

Ethical standards can sometimes be highly subjective but they are often also relative to basic standards of right and wrong. Would it be ethical for me to sell a gun to a man I knew had a history of violence and might subsequently use it to murder an innocent person? I think the answer to that question is obvious. And I think the same kind of hypotheticals can be used in the realm of surveillance technologies. Would it be ethical for me to sell a sophisticated spy technology to a notoriously brutal state security agency operating in a country ruled by a despot with a well documented record of cracking down on, beating and jailing people engaging in legitimate democratic activities?

So, until we can get a code of conduct up and running that will actually work, rather than pay lip service to ‘ethics’, we have decided to let the export controls authorities act as our ‘moral compass’, for want of a better expression.

By this I assume you mean European export controls? Or are you also including United Nations and United States sanctions?

I should point out that just because a company is not on an export control list doesn't mean it is a place where human rights violations are not rife. For instance, countries such as Turkmenistan, Kazakhstan, Uzbekistan, Morocco and Thailand are ruled by authoritarian regimes with little (if any) limitations on the use of sophisticated spy technologies to monitor innocent individuals participating in legitimate democratic activities (journalism, activism, etc.). It is a given that these countries also have serious criminals whom they wish to monitor. But they may also have a disposition towards abusing surveillance technology to stifle dissent, track dissidents, target journalists, etc.

Have you never considered conducting an analysis of each country's respective social and polititical conditions before you do business with it? This is in line with the "know your customer" program recommended by the United States and the UN Guiding Principles on Business and Human Rights, which outlines how companies should "act with due diligence to avoid infringing on human rights and address adverse impacts."

It doesn't strike me as due diligence for you to say that you will sell to any country so long as they are not on a sanctions list.

Of course one of the reasons that some of the media have picked up on FinFisher products and make such a fuss is that some of them have become the subject of law enforcement inquiries themselves by electronic means have been shown in the past to be by their own admission guilty of the most appalling breaches. The Leveson Inquiry shows a good example of this.

I find this to be a bit of an inaccurate comparison. The "phone hacking" scandal involved (unethical) tabloid journalists listening to the voicemails of individuals by entering a default PIN code into their mailbox to gain access. I don't think that it is comparable to providing authoritarian regimes with a sophisticated spy trojan that can be used to secretly take over targeted computers, intercept communications and steal data from hard disks. The scale is different, the technology is different, and, perhaps most crucially, the potential harms are different.

*****

From: Martin J. Muench
To: Ryan Gallagher
23 January 2013 08:51

Thanks for your email. It’s a fascinating debate and one in which we could engage for some time. I see you have strong views and clearly have made your own judgments but I am afraid that I am going to have to end it here.

Would it be ethical for me to sell a sophisticated spy technology to a notoriously brutal state security agency operating in a country ruled by a despot with a well documented record of cracking down on, beating and jailing people engaging in legitimate democratic activities?

This may well be a view held by some of; the UK (Northern Ireland), the USA (Guantanamo Bay) or Germany – and we are a little sensitive of our past. However, many people in the West might not view those counties that way…..

Debate aside and let’s be clear, we co-operate with the export controls agencies of Germany, the UK and the USA. Gamma simply does not discuss its client base, its exports, or any of the operations which its clients may or may not be undertaking. This is because there is usually a contractual term of confidentiality, and because naming a client can prejudice criminal or counter terror investigations and compromise the security of the members of the police or security services involved. Neither will Gamma name any countries which have not purchased its products thereby enabling customer countries to be identified by a process of elimination.

Lastly, may I suggest you have a closer look at the Leveson Inquiry — you may find it illuminating — at least in the definition of a tabloid (David Leigh of The Guardian admits to hacking an arms dealer?)

*****

From: Ryan Gallagher
To: Martin J. Muench
23 January 2013 13:33

Yes, it's an interesting discussion. I was particularly keen to hear your response to my question about due diligence and the UN Guiding Principles on Business and Human Rights, which I note that you did not answer directly.

we are a little sensitive of our past. However, many people in the West might not view those counties that way…..

What do you mean?

may I suggest you have a closer look at the Leveson Inquiry – you may find it illuminating — at least in the definition of a tabloid (David Leigh of The Guardian admits to hacking an arms dealer?)

Yes, that's right. There were a few cases included in the Leveson inquiry that focused on journalists outside the tabloids, though it was certainly a tabloid-orientated inquiry. The Leigh case is interesting because it reveals the extent to which investigative journalists will sometimes break the law in order to expose corruption — which can be deemed permissible under UK law if there is a substantial "public interest" defence. In 2006, well before Leveson, Leigh admitted to listening to voicemails of an arms dealer in order to help reveal corrupt payments. If you followed the case you would know that the UK's Crown Prosecution Service looked into Leigh's activities and advised that he not be prosecuted because on balance it was decided his actions were in the public interest: http://www.guardian.co.uk/media/2012/jun/14/police-guardian-journalist-phone-hacking

I understand why you raise the example. But ultimately it is unrelated to what we are discussing — that is, export controls and surveillance technologies. It's false equivalence for you to bring up Leveson in the context of selling spy trojans to authoritarian regimes. As I wrote in my previous message, the scale is different, the technology is different, and, perhaps most crucially, the potential harms are different.

*****

From: Martin J. Muench
To: Ryan Gallagher
23 January 2013 14:37

Thank you for your email. I do not wish to add anything at this point. You have my answers.

Give Light

After writing a short note here yesterday about weak and deferential journalism in the United States, I was reading today about a fearless American newsman from a different age.

In the 1920s, Carl C. Magee kicked up a shitstorm when his Albuquerque newspaper published revelations about what was called the Teapot Dome scandal. This was, according to the History News Network:

...the most famous of several scandals that ruined the reputation of President Warren G. Harding, who served from March 1921 to August 1923 and is often described as the worst president our country has ever had. At its bare bones, Teapot Dome is a simple case of bribery. Secretary of the Interior Albert Fall, a former senator from New Mexico and a friend of Harding's, was convicted of taking bribes from oil executives.

Magee's newspaper, the Albuquerque Morning Journal, had apparently infuriated President Harding by revealing details about this corruption. He was later called to testify in Washington and his testimony helped convict Fall, who was sentenced to one year in prison and fined $100,000.

There was a backlash against Magee during these years. He received death threats, was physically assaulted, and one district judge at the time was implicated (pdf) in efforts to discredit, or possibly imprison him. Eventually he was forced to sell off the Journal after being driven close to bankruptcy by financial institutions which, under political pressure, refused to renew his loans.

But Magee couldn't be stopped for long — emerging just two months later with another newspaper, named Magee's Independent. On the front page, printed beneath the sketch of a rising sun, there was a motto: Give Light And The People Will Find Their Own Way.

The firebrand continued to call out corrupt officials and reveal wrongdoing in a regular column titled "Turning on the Light." He was unfazed by the threats and intimidation.

"They did as they pleased without criticism," Magee was quoted as saying. "State institutions were run negligently. Public money was deposited in the banks, and state officials took the interest and put it in their own pockets."

Magee died in 1946 aged 73. A brilliant character whose tenacious muckraking embodied the pure spirit of good journalism.

Saudi Drone Base Blackout

Yesterday it was widely reported that the United States has been operating "secret" drone base in Saudi Arabia since 2011. Not only that, but some American news organisations had known about the base for more than a year and chose not to disclose its existence because of a blackout agreement made with the government.

Here's a snippet from the Washington Post's report:

The Washington Post had refrained from disclosing the location at the request of the administration, which cited concern that exposing the facility would undermine operations against an al-Qaeda affiliate regarded as the network’s most potent threat to the United States, as well as potentially damage counterterrorism collaboration with Saudi Arabia.

The Post learned Tuesday night that another news organization was planning to reveal the location of the base, effectively ending an informal arrangement among several news organizations that had been aware of the location for more than a year.

But the logic here doesn't stack up. Why? Because on 26 July 2011 a story was published by the London Times titled "Secret drone bases mark latest shift in US attacks on al-Qaeda." This report revealed the existance of a CIA drone base in Saudi Arabia, and even went as far as to speculatively pinpoint its exact location:

The CIA has set up a network of secret drone bases in Arab states in a major escalation of its campaign against al-Qaeda militants in Yemen.

Sources in the Gulf say the agency is now massed along Yemen’s borders, launching daily missions with unmanned Predator aircraft from bases in Saudi Arabia, Oman, Djibouti and the United Arab Emirates. [...]

“Oman, Saudi and the UAE are being used as bases for drones. The operation against al-Qaeda has been stepped up in Yemen and in Somalia,” said a Gulf defence source. [...]

A senior Gulf intelligence source believes the most likely base in Saudi Arabia is at Khamis Mushayt in the southwest. The site has been used by Saudi forces for airstrikes against Houthi rebels in northern Yemen. A possible alternative is Sharurah in the kingdom’s Empty Quarter, close to the Yemeni border but considered less secure.

What this means is that the information the United States government was pressuring American reporters to keep secret was already in the public domain — it had already been "outed," as it were, and it hadn't damaged counter-terrorism operations or the relationship with Saudi Arabia. Anyone with an Internet connection — and yes, that includes members of al-Qaeda — could find out that the CIA had a "secret" drone base in Saudi Arabia simply by doing a quick Google search. (Even though the Times story is behind a paywall, the first few paragraphs, which include the Saudi detail, can still be viewed for free.)

Defending the decision not to publish this information after some criticism, Washington Post reporter Greg Miller posted a tweet today saying: "For the record, WaPo has reported CIA drone base on Arabian peninsula since 2011, w/out disclosing it was in Saudi." I asked him why not disclose the specific country when it had already been published elsewhere, and he responded: "Short answer: US govt concerned more about US press than British, and saying on Arabian peninsula puts readers pretty close."

I think this shows poor judgement. It seems flawed to make a distinction between the British and American press here, especially in the age of the Internet. All news stories published online are distributed instantly to an international audience. By disclosing the existence of an "Arabian peninsula" base while suppressing the exact country in question — even though it is already in the public domain — not only are you serving no substantive purpose but you are doing your readers a disservice.

In national security journalism, difficult decisions often have to be made under incredible pressures. Sometimes, there can be a legitimate need to keep a certain military operation undisclosed if, for example, lives are at stake. But in this case I think the American press got it wrong. Unfortunately, it comes off looking like another example of deference to power that will ultimately taint the reputations of the newspapers involved.

Leveson Report

I wrote this for openDemocracy.net -- a short reaction to the publication of the Leveson report into press standards in the UK:

It is looking right now like the crux of the Leveson report is going to be ignored. I can't see a situation where, if a draft bill is introduced into the House of Commons, statutory underpinning of a new regulator will gain majority support (though it could be a close call). Personally I am quite relieved the government is showing reluctance to bring in new legislation, as I am anxious about any direct government involvement in regulating the profession, even if that involvement would be at a distance. I share the concern expressed by legendary Watergate reporter Carl Bernstein, who told Channel 4 News during an interview last night that he thought any drastic new measures would "come back and bite British democracy in the ass."

Throughout the phone hacking scandal and the many moving witness testimonies during the Leveson inquiry, what struck me repeatedly was how in so many cases the actions of (mostly tabloid) reporters constituted violations of criminal or civil laws already in place. It is not clear to me how bringing in new legislation would address that problem, which was ultimately fuelled by a toxic, morally bankrupt web of corruption involving not only journalists but the police. Definitely there needs to be much stronger regulation and accountability of the press, but that regulation must be fully independent just as existing law needs to be vigorously enforced to prosecute those who cross the line.

I would also say that I don't think there has been enough focus or discussion on the importance of journalism training in all of this. I studied journalism, and the first proper writing course I ever went on was at the age of 18 (about nine years ago). I will never forget one of my tutors, a tabloid freelancer based on Scotland's east coast. He was a vile man, who would spend his classes spluttering drivel about how we should always carry a camera in order to capture secretive snapshots of celebrities in vulnerable situations and such like. His blasé attitude and complete failure to grasp the concept of dignity had a profound impact on me at that impressionable age: it put me off pursuing journalism as a career for a couple of years.

It took me a while to learn for myself that the tutor in question was a bad egg, and that there is a place, a much needed place, for decency and conscience in journalism. That is why I think if the Leveson report can achieve anything it will be to make tabloid practices like those espoused by my former tutor so taboo and shameful that young journalists coming into the profession today will be taught to shun them as a matter of basic instinct. We do need a culture shift in journalism, the slate needs to be wiped clean, and education is a good place to start. I don't expect that any great sea change will happen organically like magic; action will be needed. My hope is that universities, schools, colleges and organisations like the National Council for the Training of Journalists will be ready to take up the challenge.

The Rise of Public Relations and The Great Wall of Obfuscation

It's a well established fact that the growing public relations industry is having a profound impact on journalism today. Last month I was reading about how global PR revenues are amounting to $10bn a year, and in the United States it is estimated that the ratio of American PR professionals to journalists grew from 1.2-1 in 1980 to 4-1 in 2010.

What this means in reality is not only that journalists are ceaselessly bombarded by a near-constant flow of emailed press releases. It has also contributed towards something far more damaging to the profession. That is, how public relations representatives and press officers increasingly function as a barrier or buffer between the journalist and the information he (or she) wants to obtain. They often seem trained to engage in evasiveness, less interested in helping reporters reveal information than they are in protecting the reputation of the organisation which pays their salary.

I'll cite a few routine examples just to illustrate the sort of thing I'm talking about.

1. I have been chasing a well-known US technology company for more than two months about an important story I have been working on concerning surveillance, and so far I have been passed between two separate public relations teams. Both have evaded answering my direct questions and declined to put me in direct contact with the people at the company I need to speak to. Why? "It's complicated," I have been repeatedly told.

2. Government organisations are just as bad. Only last week I discovered that the European Commission, the EU's executive body, has a rule in place that bars its officials from talking directly to any journalists. Any contact, one official told me, has to be approved by the press office, which functions as a sort of overlord, sanctioning any comments before they are released.

3. While pursuing a story last year about Bradley Manning, the US soldier accused of leaking US government documents to WikiLeaks, I contacted a police detective in Wales who I understood had some involvement in the Manning case. Manning is a joint UK-US citizen because his mother is Welsh and lives in Wales, and I wanted to find out more information about claims the Welsh force had assisted the FBI to search his mother's house. The detective refused point blank to speak with me when I called her on the phone; she sounded offended that I had even attempted to ask her a question directly and hung up on me seconds after I introduced myself. The press officer for the force swiftly emailed me a reprimand: "In future if you have a media query please observe the correct protocol and contact the press office and do not approach individual officers directly." I fired back: "Not every public body – police force, council, government office etc. – has a set in stone 'protocol' that must be blindly adhered to and never breached. May I remind you that it is not a against any law for a journalist to approach a police officer to ask for background comment."

The cold and arbitrary bureaucracy of it can be extremely frustrating. On some occasions, press officers can be helpful: assisting you by pointing out relevant information, or by arranging interviews with officials. But in other (most) cases there is no doubt that they function as corporate-style risk managers ready to erect a Great Wall of Obfuscation the moment they get a whiff of a controversial headline.

This also has a bearing on the UK's Freedom of Information Act, which is used to obtain information from public bodies. Specifically, take how London's Metropolitan Police has admitted handling Freedom of Information requests. FOI requests, according to the UK's Information Commissioner, are supposed to be "applicant and motive blind" because "it is about disclosure to the public, and public interests. It is not about specified individuals or private interests." The Met's policy, revealed during a government consultation on FOI law in February, contravenes the commissioner's principle because journalists' requests are treated differently and have to be pre-approved for release by the press office.

One thing I am glad to see is that the UK's Society of Editors appears to have recognised the impact all of this is having. On Monday in Belfast the Society hosted a discussion on the topic, described as follows:

Members of the public have a right to know, but journalists are finding it increasingly difficult to get answers to the simplest of questions on their behalf. A creeping control culture means that face-to-face contact, and even telephone calls being replaced by carefully managed email exchanges. De-humanised, sterile, and obstructive, this trend poses a serious threat to journalism and genuine transparency – at all levels.

It is definitley a threat – but I'm not sure how journalists collectively can respond. As the public relations industry grows, in stark contrast, journalism is struggling to survive. There are less and less publications out there able to invest in time-consuming, laborious investigative reporting, which is hugely detrimental to society and to the health of democracy.

One solution might be for the government to create a kind of investigative journalism fund to help reporters and media outlets finance important investigative projects. This has been supported by a House of Lords committee – but is probably unlikely to come to fruition at least in the near future due to the wider economic crisis. Yet it's not as if public funding for investigative reporting isn't financially viable, even in the grip of a recession. Recently, the government wasted an estimated £40 million on a botched rail contract. Yes, £40 million. Even a fraction of that amount could have funded valuable muckraking projects and helped to push back against the polluting culture of public relations.