Wikileaks

I have written about the WikiLeaks farrago before, but recent developments have made the story much more serious, and have cast serious questions on the behaviour of the protagonists.

Last year WikiLeaks got hold of 250,000 US Diplomatic cables that had been sent between US Embassies and the State Department. Several newspapers (the Guardian in Britain and the NYT in the US amongst others) did a deal with Assange and WikiLeaks to publish the data. They also said that they would redact any data that would prove dangerous to individuals before publication. Since then we have had a trickle of information coming out from these newspapers.

Much of this information has been fairly uninteresting. However a great deal of it involves third world or dictatorial regimes, and the redaction was necessary to protect people mentioned in the cables.

However, because of a series of stupid actions, the full unredacted cables are out in the public domain. Now anybody can read the full detail of the cables. And that can only be a really bad thing.

(A note: below I am using the term 'password' when it should really be 'encryption key' or 'passphrase'. I have done this to make it more readable to the layman).

As far as I can tell from various good sources, the following occurred:

1. Assange and the newspapers came to a deal to publish the cables.
2. The papers wanted to publish the data in redacted form; Assange reportedly did not like this.
3. Assange encrypted the data and placed it onto an obscure ('hidden') area of a server. As it happens, this was not very hidden.
4. He met with the Guardian journalists. He handed them most of the password on a piece of paper and told them the rest of it verbally.
5. The Guardian journalists decrypted the data, redacted pieces and started publishing.
6. The original file was not removed from the WikiLeaks server.
7. Meanwhile, a split occurred in the WikiLeaks organisation. Someone took a copy of all the WikiLeaks data - including the 'hidden' file - and published it on servers belonging to their new rival organisation. People downloaded all the data, including the hidden file.
8. Two Guardian journalists published a book that included the 'real' password of the file. They claim that they had been assured that WikiLeaks would remove the file once they had downloaded it. 
9. The Guardian and Assange had a falling-out after they investigated the claims of rape against him.
10. It takes a few months, but someone eventually realised that the password given in the book is the *real* password and managed to find and decrypt the file.

The password was, apparently, based on the following: 'ACollectionOfHistorySince_1966_ToThe_PresentDay#'. Assange also verbally instructed the journalists to add the word 'Diplomatic' before the word 'History', the idea being (wrongly) that the information on the piece of paper would be worthless without the verbally-given modifier word.

It was an atrocious password to be used in something of such importance (although not as bad as Rebekah Wade's hilariously poor password for her News International email account). True, Assange's password is long, but length does not equate to security. It is a spectacularly poor choice given Assange's paranoia about security - I would hope that his 'insurance' file has a better-conceived and executed password.


Ordinarily I would not have published the password in this posting myself, but given that it is available in a printed book and is on many other websites, I see little harm.

Even if the Guardian journalists had changed the password, the other information given in the book would give someone attempting to crack Assange's passwords an idea about how he generated them. For instance, it is clear that he thinks security is added by writing down a partial password then having a word that can be added to complete it - indeed, a word that makes sense in the context of the whole password. Such knowledge can help people work out what any particular password might be, and it was exceptionally stupid - nay, gormless - to put any such information in the public domain.

There is so much fail in this:

• WikiLeaks should not have relied on 'hiding' the data on a server.
• WikiLeaks should have kept the data much more secure. Once the Guardian had a copy of the data, it should have been removed from the hidden location.
• WikiLeaks should have used a more secure password (there are plenty of programs to pseudo-randomly generate passwords.
• The Guardian journalists should never, ever have published the real password in any public form.
• The Guardian journalists should have checked that the data had been removed.
• The Guardian and/or WikiLeaks should have realised that the password was publicly available and made attempts to mitigate the problem.

Strangely, the Guardian's take on this is that it is all WikiLeaks' and Assange's fault. I would agree with this, except for the mind-numbingly stupid behaviour of their journalists in publishing the actual password. Why was this necessary? Why not just say that Assange gave them a printed password and told them verbally how to alter it? Is the actual password of much interest to the reader? (of course, in the end it was as the file was still extant).

Assange seems to think of himself as a professional, but he has shown himself (and WikiLeaks) to be rank amateurs who evidently know little about security or the underlying technology. The Guardian journalists are meant to be professional, but have shown themselves to be dangerous amateurs.

WikiLeaks have now released the full unredacted form of the cables, which, it is suggested, Assange wanted to do in the first place. They can do this without being *blamed* for the data being made public, as they are blaming the Guardian for that. And the Guardian can blame WikiLeaks. Rather convenient, really...

People may well suffer or die because of this. There should be a special circle of hell reserved for people capable of such negligence.

WikiLeaks

Rumours are coming out that WikiLeaks is going to publish yet more documents in the near future - allegedly they comprise of two million diplomatic wire messages between US embassies and the State Department.

The Government is putting a DA-notice on the data, meaning that British publications will not be able to publish details of the leak. It will be difficult to see how they think this will work as the WikiLeaks data will be available throughout the world. As the Spycatcher debacle showed, DA-notices are increasingly inapplicable in the modern world, where servers can be placed anywhere.

This presents many problems. Governments will have an obvious wish to keep embarrassing data secret, and whistle blowers have an obvious role in getting the truth out - the MP's expenses being a classic case to point. However, such data is also often complex to understand, and is often open to misinterpretation by non-experts.

But WikiLeaks is going far too far. Their previous large releases - 'Collateral murder', 'Iraq War Logs' and 'Afghan War Diary' are widely believed to have included information that put both soldiers and civilians in danger. WikiLeaks claim to have redacted all such data from the release, but that is widely disbelieved. Many think that their parsing was done in chunks - they put similar documents together, inspected a few, and if they saw things they did not want releasing, then they did not release the entire batch. Otherwise, the documents were released. The problems with this are obvious.

Why batch the data. From Wikipedia:

According to statements by Assange in 2010, submitted documents are vetted by a group of five reviewers, with expertise in different fields such as language or programming, who also investigate the background of the leaker if his or her identity is known. In that group, Assange has the final decision about the assessment of a document.

The 'Iraq War Logs' comprised 400,000 documents. It would take years for just five people to go through this data. Say you can parse one document a minute: that means, with a ten-hour day, the five reviewers can do 3,000 documents a day. Given these very liberal constraints, it would have taken them over100 days to check and redact all the documents. In reality, it would have been much more.


Therefore WikiLeaks rely on what they call 'volunteer journalists'. Note the word 'volunteer': the more people you have, the more you require rules, procedures, checks and balances to ensure that all the volunteers are working to the same standard. It also begs the question about whether the volunteers are qualified to make such judgements. The release of names of soldiers along with Iraqi and Afghan collaborators led Amnesty and others to make official complaints to WikiLeaks.


The amount of data is massive. The Telegraph studied the MP expenses data and analysed it, looking for the juicy stories and the best way of releasing the information to keep the story going (and their circulation up). They parsed the data and published the things that were, in their opinion, in the public interest. These made and shaped the story, and they did not do too bad a job of it.

Secondly, this data is all about the US. WikiLeaks has published interesting data from other countries (for instance Peruvian oil and Scientology), but this year they have been concentrating on the US. It would be nice if they published similar data from (say) North Korea, Russia, China, Burma, etc. It is increasingly looking like an organisation that is solely concentrating on the US state.

These new documents allegedly number 2,000,000 documents. There is no way that they have adequately parsed these to check that it is wise or moral for them to be released. And that is exceptionally worrying.

Of course, the US has an obvious problem with keeping their data secret, but that does not excuse WikiLeaks' behaviour. Even one WikiLeaks' founders is deeply critical of the organisation.

WikiLeaks could be a force for good in the world. Instead, I fear it is becoming a force of evil.

In praise of the lesser-known sportspeople

For some time I have been following the career of Chrissie Wellington.

Heard of her? No? That is a shame, for she is probably one of the foremost sportsmen or women out there at the moment. She had broken a host of records in an exceptionally hard sport - ironman triathlon (a 2.4 mile swim, followed by a 112-mile bike ride and then a marathon run) - after having only started in the sport in her late twenties. She had never even ridden a bike until she was 27.

Since then she has set a world record for the ironman distance of 8 hours, 31 minutes and 59 seconds; won her first three ironman world championships (the first less than a year after having turned professional); and remains undefeated at the ironman distance. She deserves much more attention (see James Cracknell's piece in the Daily Telegraph).

Just think about that for a moment; I would find it hard to swim 30 lengths, yet alone 2.4 miles. After that, it is a 112-mile bike ride (the most I have ever done is London to Cambridge at about 55 miles - it took me all day). Then, finally, a marathon. Anyone who completes an ironman triathlon deserves congratulation; it is an amazing feat. Yet Chrissie Wellington won her first one!

Quite frankly, she is an inspiration. Yet I have never seen her mentioned on BBC News; the only TV coverage I have seen of her has been on the sports programmes that are on Channel 4 on Sunday mornings. Her name deserves to be as well-known as most Premiership footballers.

It is terrible the way the media focus on certain sports - for instance football, rugby, snooker, athletics - at the expense of other events. I even include my beloved Formula One in this. The mainstream media focuses far too much on a narrow range of sports. True; these sports tend to have the biggest viewership, but it becomes a chicken-and-egg situation; if it is on TV, then it is more likely to have a higher profile than if it is not!

Some sports lend themselves to TV broadcast more readily than others - a football match is usually 90 minutes long, sometimes 120 (with extra time), and only in rare conditions longer. This means that a nice 2-hour TV slot can be allocated. The same thing occurs in Formula 1 - the race is limited to a maximum of two hours (a limit that was reached in the rain-sodden 2009 Malaysian GP last year).

An Ironman Triathlon, however, would be over eight hours long - far too long to maintain a viewer's interest. For this reason, webcasting may be the best way forward for such sports. However, this does excuse the broadcasters for not mentioning these sports in their summary broadcasts. Chrissie Wellington in particular deserves much greater praise and attention than she currently gets.

An interesting exception to this is Trans-World sport, which is broadcast on Sunday mornings on Channel 4 in the UK. The owners, IMG, also broadcast a similar program worldwide. This gives short snippets of all the sports news of the previous week - a typical episode will detail everything from golf, motorsport and skiing to extreme sports. It also interviews up-and-coming sportsmen, and has segments on rare or unusual sports, such as Turkish Oil Wrestling. It is an excellent programme, as it gives an overview into sports without going overly into them. Even Sencan seems to enjoy it. Unfortunately it has recently been changed from a one-hour to a thirty-minute timespan, and many of the interviews and unusual sports have been removed.

Sometimes people do break through into the mass media's attention for some reason - Mark Beaumont's record-breaking cycle ride around the world (and his recently-broadcast trip down America), or cancer-sufferer Jane Tomlinson. Both did amazing things and managed to get mainstream publicity. Lance Armstrong's seven victories at the Tour de France was made even more remarkable after his recovery from testicular cancer.

But these people are the exception. Mark Beaumont is an interesting case - he was not particularly a hardcore cyclist before he decided to go and smash the world record for cycling around the globe, yet he had the mental perseverance to go for it. Hundreds of thousands - or perhaps millions - of people in the UK could have done it physically with a little training. The difference is he had the mental willpower and bravery to actually do it.

So what I would like is to see the broadcasters (and especially the BBC) giving publicity to more obscure sports, especially where there is a great human-interest story behind it. The vast majority of people in this country could do amazing things in sports and activities; mostly it just requires the sheer mental determination to do it. In this way, Chrissie Wellington is an excellent role model.

The black screen of death and media reporting

There is a brilliant article on zdnet that goes into the alleged Microsoft 'black screen of death' fears with Windows 7 that plagued Microsoft last week.

The article is a fascinating dissection of the way that an ill-judged and inaccurate article by a security firm spread like wildfire over the Internet, media and newspapers. Over a couple of days Microsoft suffered a great deal of bad publicity, only for the firm that released the statement to admit that the problem was not Microsoft's fault, but was caused by malware on the affected systems.

It smells like a well-planned, deliberate attack on Microsoft. The original article was released on the Friday, and IDG picked it up and released it on their tech websites just in time for the Monday morning after-holiday rush in the US. What was worded in the original article as 'Black Screen woes could affect millions on Windows 7, Vista and XP' became, on many websites: 'does affect'.

As the article says, IDG (who published the article on Monday morning) was not following the story, but leading it. This happens all the time in the media, and it is simply not good enough.

Microsoft had scorn poured over it throughout the media, for something that was fundamentally not its fault, whilst IDG got many hits to its website (many articles referred to it as the originating website, not the security firm). The security firm has increased its public visibility, but has suffered a major embarrassment. IDG wins, and Microsoft loses.

This reactive, inaccurate reporting is happening all the time at the moment. Any reputable media organisation should be morally obliged to check on original sources and weigh them up when writing articles. Instead, they repeat rumour and (in this case) ill-founded 'research' as fact. Worse, instead of copy and pasting the story, words get altered in the process (e.g. 'could' to 'does'), and the original source lost.

At a time when science is being wounded by the 'Climategate' scandal, the media needs to take a step back and take a firm look at the way it reports the news.