America the Vulnerable

AT 12:30 ON the morning of Tuesday, January 19, 2010, a slim woman in a wide-brimmed hat disembarks from Air France flight 526, and after presenting a doctored Irish passport to an emigration official of the United Arab Emirates, emerges into the marble-clad halls of Dubai International Airport. Her passport says “Gail Folliard,” and that’s what we’ll call her, because we don’t know her real name.² On the airport’s closed-circuit television we watch her emerge into the warm night of the Persian Gulf coast, hop into a taxi, and drive off. At 1:21 A.M., on another closed-circuit TV system, we watch her at the front desk of the Emirates Towers Hotel as she checks into room 1102. Ten minutes pass. A bald man who took the same Air France flight but a different taxi arrives at the same hotel and checks into room 3308. His Irish passport, also doctored, identifies him as Kevin Daveron. That’s somebody’s name, but not his. Folliard and Daveron are members of a surveillance team that is converging on Dubai from France, Switzerland, Germany, and Italy and, in the wee hours of that Tuesday morning, is checking into various Dubai hotels. Some of them will emerge in disguise. We know this because we are watching them. Their hotels all have closed-circuit video systems.³

Back at the airport people depart and arrive from all over the world, and cameras capture them all. Who is worthy of interest? We do not know yet. Later we will notice the arrival from Zurich at 2:29 A.M. of a man claiming to be Peter Elvinger. Apparently in his late forties, this man holds a doctored French passport and carries an unusual piece of luggage. Seven minutes later we watch him leave the airport—then quickly return, walk across the lobby, and exchange a word with another man before they depart in different directions. Elvinger leaves in a taxi; the other man enters the parking area. Both are caught on camera.

At 2:46 A.M., Elvinger—or whoever he is—checks into room 518 in a hotel. He remains there until 10:30 that morning, when he leaves to go shopping. At exactly the same time, three other team members arrive at the Dubai Mall, which has closed-circuit video. Ten minutes later, Folliard and Daveron—the woman and bald guy from the Air France flight—arrive at the same mall. All these people are using cell phones, or pretending to use them, but none of them is calling any of the others on this team, not once. Instead they call a number in Austria, no doubt using an encrypted line.

At 3:15 P.M., the man he had inquired about, Abdul Ra’ouf Mohammed, arrives at the Dubai airport on Emirates flight number EK912 from Damascus. The flight is packed. Usually Mr. Mohammed travels with two bodyguards, but this time he is alone. Outside customs, surveillance team members are pacing about, on camera. Five minutes later we watch Abdul Ra’ouf Mohammed pass through immigration. Actually Abdul Ra’ouf Mohammed is an alias—one of five aliases he is known to use. His real name is Mahmoud al-Mabhouh, and he is a cofounder of the Izzedine al-Qassam Brigades, the paramilitary wing of Hamas, and an active weapons buyer for Hamas in Gaza. Such a man has many enemies. The Israelis have imprisoned him several times. He is alleged to have organized the capture and murder of two Israeli soldiers during a Palestinian uprising in the 1980s. Egypt arrested him in 2003 and imprisoned him for a year, and the Jordanians are looking for him. Fatah loathes him. Already, at only age fortyeight, al-Mabhouh has survived several assassination attempts.⁴ At the moment, however, on the video screen he looks like just an ordinary arriving passenger, somewhat tired perhaps, pulling a wheeled suitcase behind him as he squeezes around a fellow in a white baseball cap and T-shirt chatting on a cell phone.⁵ The man in the baseball cap is not there by accident.

At 3:25, the man from Hamas, al-Mabhouh, arrives from the airport at the Al-Bustan Rotana, checks in, and is given two plastic key cards to room 230. He enters the elevator—followed by the two men in tennis togs who have been loitering around the hotel. They follow him out of the elevator onto the second floor and down the hallway, noting his room number and also that of the room across the hall, number 237. Al-Mabhouh does not appear to notice them. He inserts his key card and enters. His room has no balcony, and the windows are sealed—just as he likes it. He takes a shower and changes clothes.

At 3:51 P.M., from the business center of the Crowne Plaza Hotel, the man calling himself Peter Elvinger books room 237 in the Al-Bustan—the room across from al-Mabhouh. Elvinger also books a flight out of the country. Meanwhile, Folliard and Daveron—the two from Paris—arrive at Fairmont and are joined by several others. At 4:14, Daveron leaves Fairmont for the Al-Bustan, followed two minutes later by Folliard and the others. Meanwhile, a new surveillance team has taken over at the Al-Bustan.

At 4:23 P.M., al-Mabhouh leaves the Al Bustan. He is going to the mall to buy sneakers. He is followed. Ten minutes later Elvinger arrives at the Al-Bustan, which al-Mabhouh has just left. He checks into room 237, but he doesn’t go to it. Instead he gives the keys to the bewigged bald guy, Daveron, who has arrived from the Fairmont. Elvinger then departs, soon to be out of the country. Daveron hands the keys to his original traveling companion, Folliard, who goes to the room and is joined by several men. They wait.

Two hours and eleven minutes later, at 6:34 P.M., members of the assassination team arrive at the hotel. Seven minutes after that, a new surveillance team takes over. Al-Mabhouh is still out of the hotel, having dinner, but his hunters are frantically busy. At 8:00 they attempt to enter his room by reprogramming the software in the door lock but are interrupted when a hotel guest enters the corridor. Daveron, posing as a member of the hotel staff, calls them off. The software in the lock retains a record of the attempt.

Twenty-two minutes later, at 8:46 P.M., four men emerge from al-Mabhouh’s room, put a DO NOT DISTURB sign on the door, and leave. Indeed, al-Mabhouh will not be disturbed again, even by a phone call from his wife half an hour later, which he does not answer. He’s dead—shocked five times with an electric device, tranquilized with the drug succinylcholine,⁶ and suffocated. When his visitors depart they leave the door locked and chained from the inside. If the Dubai police know how they gained entry to the room, they haven’t said. Did they pick the lock on a second try? Was al-Mabhouh overpowered after answering a knock at the door? Was there a bribe? We don’t know. The Dubai police have not released all the tapes.

A FEW YEARS AGO the assassins and surveillance teams would have vanished without a trace, but not this time. This was the first political assassination in history where most of the operation—all but the actual killing—was recorded on 648 hours of video,⁷ supplemented by electronic passport, travel, and key-card entry records. Within twenty-four hours of finding the body, the efficient Dubai police had assembled and correlated closed-circuit video and other records from public and private sources and figured out what had happened and how it had happened. This supposedly covert intelligence operation unfolded in a fishbowl. Without a doubt, such a synchronized, expensive, laborintensive, and deadly operation could only be pulled off by one of the world’s most sophisticated intelligence agencies. And as far as the Dubai police and international opinion were concerned, the whole affair bore the fingerprints of Israel’s foreign intelligence service, the Mossad. Yet how could a sophisticated intelligence service fail to understand that the world had become transparent? How could Mossad—if it was Mossad—permit its agents to be photographed over and over again? By February 16, when the Dubai police went public with the story, they had splashed photographs of eleven foreign suspects all over the Internet, along with the pictures used on the passports and footage of the operation itself. They also wrapped up two local Palestinians and charged them with aiding and abetting the crime. The eleven foreigners all traveled on European passports—six British, three Irish, one French, and one German. Ten of the passports had been issued to persons with dual Israeli citizenship, but there was no suggestion that any of the people whose identities had been used were involved in the operation. On February 25, the Dubai police charged fifteen others with participating in the crime and posted their photographs too. Training an agent costs millions and takes years. Twenty-six of them were now finished forever—or, as they say in the trade, “burned.”

Was Mossad behind it? That’s the leading theory, but even good theories leave loose ends. How to explain that two of the suspects left Dubai by boat for Iran? How to explain that the two arrested Palestinians worked for a real estate company owned by Mohammed Dahlan, a senior security official in Fatah, Hamas’s rival?⁸ Fatah, as it turns out, regularly shares intelligence with Israel.⁹ Was this a joint Fatah-Israeli operation? But if so, how to explain the Dubai police chief ’s claim that a member of Hamas leaked al-Mabhouh’s travel itinerary to Mossad?¹⁰ Evidently Mr. al-Mabhouh had more enemies than he knew. In the intelligence business, a good rule of thumb is that nothing is what it seems. People play double games. The Dubai police are indeed very good, but are they that good—or were they tipped off? Many powerful players in the Middle East would have been glad to get rid of Hamas’s murdering arms dealer and embarrass Israel. One of those players could have been working with the Israelis (or Fatah, or Hamas) and with the Dubai police. Nobody’s telling the whole story.

One thing is certain, however: In an age of mass surveillance and instant electronic storage and retrieval, covert espionage operations will never be the same again. The intelligence business, like everyone else, now operates in a glass house. This isn’t a case of heavy-handed government surveillance. It’s a case of pervasive light-handed surveillance by just about everybody, producing massive amounts of information that can be correlated with a few keystrokes or mouse clicks. Transparency has come to the intelligence business.¹¹

Managing Identity in the “Participatory Panopticon”¹²

Is transparency in intelligence good or bad? Before you answer, remember that the surveillance technology that exposed the Dubai operation is the same technology that captures you scratching where it itches in public, tracks your movements as you pass through tollgates and in and out of elevators, records when you use a key card to enter and leave your office, recalls that you like your coffee with soy milk and light sugar, sends you targeted advertising from places you’ve never heard of, and records every keystroke you make at work. Surveillance can be used for good or ill, and judgments about it will vary among thoughtful people. The good/bad question surely has its place; if we are going to make any rules at all about how technology can be used, we will have to deal with it. But while passing judgments leads to moral self-satisfaction, it won’t help us understand what’s happening around us. Whether on balance we like these developments or not, relentless transparency is a fact of life.

Transparency is not an unadulterated virtue to be preferred without reflection over discretion, modesty, privacy, and tact. We cannot have unlimited amounts of both privacy and transparency. Privacy implies opacity; it throws a veil over our lives. Transparency demands: Open up! Privacy says: Here you may not go. This you may not see. That you may not hear. Transparency laughs: Get over it! The technology that gathers and culls data, compares photographs, and forgets nothing does not come with built-in discretion. It gathers and culls indiscriminately, compares faces regardless of motive, and remembers with efficient indifference to motivation, profit, or nationality. The technological threat to personal privacy and the technological challenge to the secrecy of intelligence operations are therefore essentially identical. Or as I put it earlier: Secrecy is to government what privacy is to persons. They both rise or fall—at present they’re falling—on the same technological changes and on the same cultural proclivities for modesty on the one hand or exhibitionism on the other.

One of the most basic functions of intelligence work is protecting the identities of the people who do that work. The most obvious challenge is preventing someone from knowing whether your employee is who he (or often she) says he is. If your agent is living under an alias, you’ve got to make the alias credible to prevent others from seeing through it. The Russians are—at least until recently—masters at this. They specialize in a class of agents known as illegals, and used them heavily from 1917 onward. An illegal was a Soviet intelligence officer working abroad under an alias and having neither diplomatic cover nor any apparent connection to Soviet institutions.¹³ The Russians, who still use this practice, embarrassed themselves badly when the FBI rolled up ten of their illegals in mid-2010.¹⁴ That blown operation may have been remarkable for its insignificance, but it would be a mistake to think the Russian flair for this kind of penetration is a thing of the past.

Intelligence and security services reflect the talents, tendencies, and especially the insecurities of the cultures that create them, and the Russians have been running illegals for generations. This is unlikely to change. These operations require extraordinary patience, which is a commodity in short supply in American culture. In the same way, the American lack of deep familiarity with foreign languages and cultures and our tendency to seek solutions to problems through technology are reflected in our intelligence agencies. When the United States was at war with Germany in 1917, for example, there were tens of thousands of native German speakers living in New York City, but there was only one German-speaking Allied intelligence agent in New York—and he was British.¹⁵ Nine decades later, in 2006, there were only six Arabic speakers among the one thousand employees of the U.S. embassy in Baghdad—and most of them were not fluent.¹⁶ This was disgraceful—but characteristically so. On the other hand, our prowess at technical intelligence is unmatched, though we have serious rivals in areas such as cryptography and certain types of electronic eavesdropping. Of course, Western intelligence agencies also run agents under cover, but more often than not, Western agents operate under their true names. In either case, the question of identity not only involves knowing the person’s true name but also whom that person is really working for. The man’s name may truly be Adnan Hakim al-Aziz, and he may really be an Egyptian citizen employed by the Cairo (electric) Generation Company—but if Mr. al-Aziz (whose name and circumstances I have invented) is really working for French intelligence they would not want you to know it.

Creating and protecting that kind of deep cover has become more difficult than ever, as the Dubai episode demonstrated. But the technology used by the Dubai police to unravel that caper was actually elementary compared to capabilities now available. Microsoft, for example, has created software that will find, link, tag, and correlate every electronically available image of the same thing. If you have someone’s photograph from a passport or a surveillance camera, you can find every other photo of that same person that has ever been posted online. You can also enrich that image with every bit of information that has ever been associated with any of those images—biometric data such as fingerprints, for example. Such data are increasingly embedded in passports, credit cards, driver’s licenses, and other documents. You can also pull up their credit history, bad jokes about them from a high school yearbook, photographs, social information from Facebook, and so on. When your agent tells the foreign immigration official he’s visiting the country on business for Acme Metallurgy, Inc., but he has posted a Twitter link to a photograph showing him at a football game with pals known to be from army intelligence, he’s got a problem. If you’re running a counterintelligence investigation, capabilities like this are wonderful. If you’re trying to protect cover identities, they’re a nightmare.

Pervasive social media also make it difficult to protect cover identities. While in the counterintelligence job in late 2008, I learned that the chief public diplomacy official in one of our Eastern European embassies had decided that everybody in the embassy had to be on Facebook. The local intelligence services must have been salivating with glee. If this directive had been implemented there would necessarily have been a handful of exceptions: Officials working undercover don’t do public diplomacy. But a quick comparison of the embassy’s telephone directory with Facebook would have shown who they were, and their covers would have been blown. Facebook and similar networking sites are a gold mine for intelligence officers whose business it is to spot and assess embassy workers who may be amenable to bribery (because of debt), blackmail (because of indiscretions), or simply closer cultivation as a source (greatly enhanced if you know your target’s interests, friends, and habits). Facebook is also a mother lode for phishermen and hackers.¹⁷ As I write this a Russian hacker is offering 1.5 million Facebook credentials for sale on the black market, and has reportedly already sold almost half of them.¹⁸ Public diplomacy is to the State Department what marketing is to Madison Avenue. It’s important, and this country has not been doing it well. But it must be done by people with a clear and cold-eyed view of the world they live in. I had this misguided effort at compulsory self-exposure stopped, but social media are now pervasive and their use cannot be fully controlled.

The chief objective of an intelligence service is to persuade other people to commit treason. You can sugarcoat this any way you want, but that’s the bottom line. In order to recruit others into treachery, you begin by learning as much as you can about the habits, likes, dislikes, indiscretions, and vulnerabilities of potential targets. For this work there’s no such thing as insignificant information. Is my target’s wife a serial adulterer? That’s useful if I want to stoke his resentment. Does my target fancy a certain restaurant or health club? Then if I want to meet him, that’s where I will dine or exercise. Does she repeatedly visit the same understated but elegant hotel on the Amalfi Coast? What a coincidence! That’s my favorite hotel too. We have so much to talk about. Ordinarily it takes months, even years to compile this kind of profile on a potential target. With sites like Facebook you can do it in ten minutes. Again, this is a blessing when you’re recruiting agents and a nightmare when you’re in counterintelligence. The lesson is not that people who work in embassies can’t use social networking sites. These sites are part of the world now, and they’re not going away. It does mean that diplomats and others who work in embassies need better training about how to handle them.

Tracking satellites as they orbit the earth is a favorite pastime of amateur astronomers. On a clear night you don’t even need a telescope to watch some satellites passing overhead, and with inexpensive optics you can find most of them in your latitude. All the information you need to do it is available free online: latitude, longitude, azimuth, speed, elevation, and the bird’s location right now.¹⁹ If you’re an amateur astronomer, gathering this information is fun. If you’re loading missiles onto a freighter in the harbor at Chinnampo, North Korea, in violation of a UN resolution, or trying to conceal the preparation for a missile launch from Bakhtarun in western Iran, knowing when the satellite is going to pass overhead is not about having fun. It’s vital information that tells you when you can load the cargo or transport the missile undetected. In international relations this is the equivalent of knowing where the radar traps are on the interstate—except it’s easier to move radar traps than to change satellite orbits.

Closer to the ground, an unorganized band of aviation enthusiasts known as plane spotters enjoy photographing and recording the takeoffs and landings of aircraft from civil and military airfields around the world. Getting a photo of any kind of aircraft in service anywhere is a cinch.²⁰ And if you can see the registration number on the tail, you can find out not only who owns it, but also who used to own it, and if its registration number has changed, you can learn that too.²¹ Some of this information has always been public but hard to find. Now it’s compiled in advance and easy to find.

In 2004, stories began to surface about alleged CIA flights carrying prisoners from Afghanistan and Iraq to Guantánamo Bay, Cuba, or “black sites”—secret prisons—in Europe and elsewhere. A tip here, a whisper there, and an amateur photograph of a certain twelve-seat Gulfstream jet: These details were the end of the skein; pulling on it began to unravel the whole ball of yarn. In October 2004, stories appeared in the Irish press of mysterious U.S. military flights in and out of Shannon Airport, though there seemed to be no official record of their takeoffs or landings. “The Gulfstream jet with the call-sign N379P has landed in Shannon on at least 13 occasions in the past four years,” reported the Dublin Sunday Business Post. “The privately-owned aircraft is on a permanent lease to the US military and is known to have transported al-Qaeda suspects on at least two separate occasions.”²²

Web sites were also popping up with the same kind of information. As one of them explained a month later, “Analysis of [another] plane’s flight plans, covering more than two years, shows that it always departs from Washington DC. It has flown to 49 destinations outside America, including the Guantánamo Bay prison camp in Cuba and other US military bases, as well as Egypt, Jordan, Iraq, Morocco, Afghanistan, Libya and Uzbekistan.” Changing the registration number of the aircraft no longer hid anything; it was merely further evidence of something shady.²³ According to an article in Britain’s Sunday Times, “The movements of [yet another] Gulfstream 5 leased by agents from the United States defence department and the CIA are detailed in confidential logs obtained by The Sunday Times which cover more than 300 flights.”²⁴

As official and self-appointed investigators caught the scent, their hunt for evidence of these flights—and of secret prisons—intensified, and they would not let up for several years. Witnesses began to talk. “Everything was unusual, from beginning to end,” said the woman who had managed a Polish airfield. “I was told to accept these flights even when the airport was closed.” The flights originated in Afghanistan, and the planes, mostly Gulfstream jets, were registered to American companies. Parked at the far end of the runway, the planes “would be met by government vehicles. The planes would stay no more than an hour or two before taking off. Their onward destinations were also unusual: Morocco, Uzbekistan and Guantánamo Bay, Cuba.”²⁵

The initial sleuthing was unofficial: plane spotters, human rights advocates, and journalists all got into the act. Then national and international officials hustled to catch up. The once covert operation was now the subject of investigations by the Council of Europe, the European Parliament, and the UN; by the governments of France, Germany, Portugal, Spain, Italy, the UK, Romania, and Kosovo; and by nongovernmental organizations, including Amnesty International and the World Policy Council. As the Chicago Tribune noted, although the leader of the Council of Europe’s investigation “had no subpoena powers, his team of investigators used public records, satellite imaging, news accounts and interviews with officials to lay out a strong circumstantial case for what he described as a ‘spider’s web’ of clandestine CIA flights and secret detention centers.”

About thirty times a day, somebody somewhere sends an electronic copy of a secret document to an amorphous and suddenly well-known organization called WikiLeaks, hoping the organization will post it electronically for the world to see*.²⁷ Depending on your point of view, the senders and recipients of these messages are heroes or villains, whistleblowers exposing injustice or rootless subverters of international public order—or both.²⁸ WikiLeaks’s sources scour and send every sort of document imaginable: classified intelligence reports, secret corporate memos, personal correspondence and embarrassing videos.

Of course, the leaking of official secrets predates and extends well beyond WikiLeaks. It’s a huge headache for any counterintelligence official, and I’ve taken my share of aspirin. Officials in both the executive branch and Congress do it without compunction for political advantage. Civil servants leak secrets from a real or imagined sense that an activity is illegal or from moral outrage, as with Daniel Ellsberg and the Pentagon Papers, or with the terrorist surveillance program run by the White House through the NSA. And an innocent slip of the tongue can be as damaging as an intentional disclosure. In 2009, for example, the chairman of the Senate Intelligence Committee, Senator Dianne Feinstein, mentioned at a televised hearing that the United States was launching drone aircraft from bases in Pakistan, a fact the Pakistani government had denied. Feinstein is no fool—she was apparently just exhausted—but the damage was done. The press, meanwhile, is very effective in ferreting out information. As the investigative reporter Seymour Hersh once told me, “Your job is to keep secrets; our job is to find them out.”

But Hersh was talking about retail leaking. WikiLeaks is a wholesale operation. If information is liquid, WikiLeaks has turned on the hose. After going live in 2007, WikiLeaks published the classified standard operating procedures from the prison at Guantánamo Bay, the “Climategate” e-mails of scientists at England’s University of East Anglia, and private e-mails from Sarah Palin’s Yahoo account. WikiLeaks has no office, no paid staff, no fixed address. It keeps no logs—so there are no logs to subpoena—and it uses high-grade encryption to protect its sources and other information.²⁹ Run by volunteers from more than a dozen countries,³⁰ the group hit its stride on April 5, 2010—and achieved the notoriety it craved—when it posted video footage of a U.S. military helicopter attack in Iraq that killed eleven people. The dead included two unarmed civilians as well as men carrying assault rifles and rocket-propelled grenade launchers, and it was accompanied by a sound track of the brutal language one might expect of soldiers under stress but that civilians far removed from battle find profoundly disquieting.³¹ The seventeen-minute, edited footage of the aerial attack was headlined COLLATERAL MURDER and was met with fierce criticism from the secretary of defense and media commentators, who attacked both its inflammatory title and partisan editing. It was also greeted with voluntary contributions to WikiLeaks from people around the world, and soon it led to a New Yorker profile of its founder and guiding light, Julian Assange.³²

The episode involving the helicopter footage was a mere skirmish compared to the firestorm that erupted a few months later, on July 25, 2010, when WikiLeaks released a document trove that it called, “[T]he Afghan War Diary, an extraordinary compendium of over 91,000 reports covering the war in Afghanistan from 2004 to 2010.”³³ To WikiLeaks the release was a triumph of transparency and candor over secrecy and lies, comparable to Daniel Ellsberg’s leaking of the Pentagon Papers during the Vietnam War. Anticipating criticism of unvetted documents, however, WikiLeaks broke from its past practice of releasing raw documents and instead offered them to three news organizations: the New York Times, the Guardian in London, and Der Spiegel in Hamburg. These organizations published simultaneously, but each made its own decisions about what to release, and each wrote its own analyses.³⁴ Assange claimed that about fifteen thousand documents were withheld to protect identities,³⁵ but lives were undoubtedly put in jeopardy by those that got out. Assange’s colleagues said that the decision to release them without first deleting the identities of Afghan intelligence sources was his alone.³⁶

Contributions to WikiLeaks again shot up, and so did criticism. On the day of the leak, the Times (London) stated that “in just two hours of searching the WikiLeaks archive, The Times found the names of dozens of Afghans credited with providing detailed intelligence to U.S. forces. Their villages are given for identification and also, in many cases, their fathers’ names.”³⁷ Among those named were people who had risked their lives to expose Taliban members, and shortly after the leaks a Taliban spokesman declared that the Taliban had set up a “commission” to determine who was spying for NATO.³⁸ Critics of WikiLeaks’s undifferentiated information “dump” emerged from many quarters. They ranged from Reporters Without Borders, which called the posting of identities “incredibly irresponsible,”³⁹ to General Michael Hayden, formerly the director of the NSA and the CIA, who pointed out that the released material included reams of technical information about military operations that was of keen interest to foreign military and intelligence services but of no interest to the public .⁴⁰ Releasing that kind of information doesn’t trouble Assange, however; it pleases him. In 2007 he was incensed when the press failed to notice that he’d leaked reams of pages of secret military information about the U.S. Army in Iraq and Afghanistan. “I am so angry,” he said. “This was such a fucking fantastic leak: the Army’s force structure of Afghanistan and Iraq, down to the last chair, and nothing.”⁴¹ After the more recent dump on the Afghan war, Der Spiegel quoted him as saying that he “loved crushing bastards,” which led the Wall Street Journal to “wonder if the ‘bastards’ he has in mind include the dozens of Afghan civilians named in the document dump as U.S. military informants.”⁴²

Australian by birth and an eccentric nomad by inclination, Assange is not an attractive poster boy for his cause. The Daily Beast described him this way: “With his bloodless, sallow face, his lank hair drained of all color, his langorous, very un-Australian limbs, and his aura of blinding pallor that appears to admit of no nuance, Assange looks every inch the amoral, uber-nerd villain, icily detached from the real world of moral choices in which the rest of us saps live.”⁴³ After the Afghan leaks he lived for months in fear of arrest, moving from country to country and from one supporter’s apartment to another, staying out of sight when he wasn’t giving interviews to The New Yorker. The habits and language of war and secrecy infect even those who oppose them: Assange’s former quarters in Reykjavik were rented on a subterfuge—his people called it “the Bunker”—and key members of the group are known only by their initials.⁴⁴ The Australian government made it clear that if he returned to his home country and were prosecuted in the United States, Canberra would cooperate. Iceland was also turning unfriendly. As an Australian citizen he could stay in Britain, but not indefinitely, and the British government’s view of leakers was, if anything, even dimmer than that of American officials.

Following the drumbeat of criticism about endangering lives, Assange was also having internal troubles. “We were very, very upset with that,” one of his main backers in Iceland said, speaking of disclosing Afghan identities. When another supporter and coworker challenged his judgment, Assange told him essentially to shut up or get out. “I am the heart and soul of this organization, its founder, philosopher, spokesperson, original coder, financier, and all the rest,” he said, and the group would fall apart without him. His critics, he sniffed, “were not consequential people.” Resentful of Assange’s imperious style and uneasy with his capricious judgment, about a dozen volunteers left the group. And then in August the Swedish government issued, withdrew, and then later reissued a warrant for Assange’s arrest on charges of raping two women. The cases involve consensual sex that allegedly turned forceful and nonconsensual. Assange then temporarily went into hiding somewhere in southeast England.⁴⁵ In spite of accusations that the charges were trumped up by WikiLeaks’s enemies, the publicly disclosed evidence thus far suggests otherwise.⁴⁶

Then in November 2010 the group engineered another massive document dump of secret State Department cables that laid bare conversations among diplomats, monarchs, ministers, cabinet secretaries, and spymasters. The disclosures added little to what the public knew about the policies of their governments but added a great deal, in embarrassing detail, about conversations that would not have occurred at all, or would not have been candid, if their participants had known their words would be leaked. In early December the group released a secret list of worldwide critical infrastructure, including hydroelectric plants; European pharmaceutical facilities that manufacture vaccines for smallpox, flu, and other diseases; and the locations of undersea cables through which pass all the world’s electronic communications.⁴⁷ Some pundits, who were not themselves in the business of protecting anything, blandly opined that such a list could have been compiled from unclassified sources, but the list was obviously suggestive, especially to would-be terrorists, and it showed terrorists of every caliber what locations probably were (or were not) well protected. Its publication seemed to be motivated by nothing other than malice. The leak of diplomatic cables managed to alarm and offend every nation with which the United States engages, and to most people the leak of critical infrastructure sites was appalling. Under concerted pressure, Assange seemed to be flailing. Already an enemy of the United States, now he had made enemies of governments around the globe. As all of this was unfolding, he was arrested for rape in London on a Swedish warrant and then freed on bail, and as of mid-2011 is fighting extradition. That episode is a sordid distraction from the serious public policy issues that WikiLeaks presents, but it wasn’t irrelevant to Assange’s predicament. He was now looking less like a principled if fanatical champion of free expression than merely a fanatic who couldn’t abide restrictions on his self-aggrandizing personal and social behavior. Meanwhile, PayPal froze the accounts of people who were donating to WikiLeaks. Bank of America, Visa, MasterCard, and some smaller money handlers refused to process financial transactions for the group.⁴⁸ A short while later Apple removed the WikiLeaks app from its store.⁴⁹

But Assange was not without vocal support, notably from the loosely affiliated army of politically active cyberanarchists known as Anonymous. Anonymous, or people calling themselves that, quickly launched Operation Avenge Assange “to fight the oppressive future which looms ahead . . .” Their slogan, obviously intended to intimidate their opponents, was “We are Anonymous. We do not forgive. We do not forget. Expect us.” Their weapon was the DDOS attack, and after going after PayPal, in December 2010 they succeeded in temporarily taking down the servers of MasterCard, Bank of America, a Swiss bank, and the office of the Swedish prosecutor. ⁵⁰

WIKILEAKS’S STATEMENT of purpose is high-minded. In its view, “principled leaking” changes history for the better, and “transparency in government activities leads to reduced corruption, better government and stronger democracies.” It describes itself as a “multi-jurisdictional public service designed to protect whistleblowers, journalists and activists who have sensitive materials to communicate to the public.” Since its founding, it claims that it has “worked across the globe to obtain, publish and defend such materials, and, also, to fight in the legal and political spheres for the broader principles on which our work is based: the integrity of our common historical record and the rights of all peoples to create new history.”⁵¹

“Multi-jurisdictional” means that the group is not only transnational in principle, but also beyond the ability—thus far—of a government to regulate or shut down. Governments, whether democratically elected or not, have no special status in the WikiLeaks worldview. After all, many governments exercise power beyond their own borders, so why shouldn’t people outside those borders have a say in how they operate? According to this argument, international organizations are ineffective at policing the activities of other governments, because international organizations are just cliques of the governments. That’s where WikiLeaks comes in, because somebody has to decide what information you and I “should” have, and WikiLeaks has nominated itself for this role: “[T]he time has come,” it says, “for an anonymous global avenue for disseminating documents the public should see.”

WikiLeaks relies on crowd sourcing to test the authenticity of its postings. That is, if you publish something for all to see, then the truth about it should quickly come out, regardless of whether the initial information was false, misleading, or defamatory.⁵² Besides, unlike companies that are interested in shareholders’ profits, and governments that are interested in power, WikiLeaks’s motives are ostensibly pure. It represents “the people” and—here’s hubris—functions as “the first intelligence agency of the people.”

WikiLeaks’s profession of objectivity may be doubted in light of its deeply anarchic, antimilitary, anticapitalist,⁵⁴ and anti-American biases, but its ideological leanings are not germane here. An analogous group could arise that devoted itself to leaking documents but that supported a nationalist military agenda. Far more significant is whether WikiLeaks is, as Assange claims, “an uncensorable system for untraceable mass document leaking and analysis,”⁵⁵ beyond the reach of public authorities everywhere, democratic or otherwise.

Jack Goldsmith and Tim Wu point out in their fluid, hardheaded account of the birth and shattering of “illusions of a borderless world,” that every part of the Internet is owned by someone: servers, routers, wires, transmission towers, switches—everything that makes the Internet work, everything that creates the lived illusion of cyber “space” is a physical thing subject to some government’s jurisdiction.⁵⁶ Whether it’s a question of regulating domain names, enforcing subpoenas for information, or policing crime, nation-states have hardly been powerless when it comes to the Internet. Now WikiLeaks poses a direct challenge to governmental control. Is WikiLeaks really “uncensorable”? Is it beyond the reach of any public authority anywhere? Or, as many people are asking, why don’t we just shut it down?

IN FEBRUARY 2008, a Swiss bank called Bank Julius Baer sued WikiLeaks, “an entity of unknown form,” in federal court in San Francisco, alleging that WikiLeaks had wrongfully published leaked documents falsely indicating that the bank had laundered money in the Cayman Islands to assist tax evasion by U.S. and other customers. The bank asserted a litany of claims, including defamation. About two weeks later Judge Jeffrey White prohibited WikiLeaks from posting, publishing, disseminating, or giving access to any of the challenged material through any Web site. He further ordered WikiLeaks to block publication of the offending material. The cease-and-desist order extended to “all those in active concert or participation” with WikiLeaks and to everybody else who had notice of the order. That included “DNS host service providers, ISPs, domain registrars, Web site developers, Web site operators, Web site host service providers, and administrative and technical domain contacts, and anyone else responsible or with access to modify the Web site, and that they are to cease and desist.” In a separate order the court directed WikiLeaks’s domain name registrar, Dynadot, to “lock the wikileaks.org domain name” and disable WikiLeaks’s account so that it “remains turned off.”⁵⁷

This was about as sweeping an injunction as you can get, and it was met with howls of protest from civil rights and media groups.⁵⁸ But before the month was out, the injunction was dissolved by the same court that had issued it. Once WikiLeaks had posted the documents, the cat was out of the bag. The court also realized that its power to suppress publication was seriously in doubt on First Amendment grounds. In any case, by attempting to shut down WikiLeaks entirely, as opposed to ordering the organization to purge certain files, the orders were doubtless far too broad to stand up on appeal. It was also unclear whether the court had power over the foreign parties it sought to reach. But the real problem with the injunction was that the court finally figured out—with amused assistance from the media⁵⁹—that it had no power to redress the alleged harm to the bank regardless of the jurisdictional and constitutional issues.

WikiLeaks’s principal hosting service is a Swedish firm called PRQ. Sweden is highly libertarian when it comes to freedom of expression, even by Western standards. “If it is legal in Sweden,” PRQ says, “we will host it, and will keep it up regardless of any pressure to take it down.” Founded in 2004, PRQ has a well-deserved reputation for keeping its mouth shut: A New York Times blogger called it “perhaps the world’s least lawyer-friendly hosting company and thus a perfect home for WikiLeaks.”⁶⁰ “With our discreet customer relations policy,” says PRQ’s Web site, “we don’t even have to know who you are, and if we do, we will keep that knowledge strictly confidential. We are firm believers in freedom of speech, commerce, and the right to privacy and anonymity.”⁶¹ The company takes pride in laughing off threats from lawyers and public authorities. Nevertheless, WikiLeaks doesn’t put all its eggs in PRQ’s basket.⁶² The group maintains servers all over the world, many of them with mirror images of all of its content. In late 2010 there were about two hundred such sites.⁶³

As the judge in San Francisco discovered, you can take one of WikiLeaks’s sites down only to find that the same content continues to appear through other servers. This is like playing electronic Whac-A-Mole on a global scale, and the court put an end to the game before its lack of power could be displayed any further. The bank, meanwhile, reaped far more bad publicity as a result of its lawsuit than if it had done nothing. The injunction against the domain registrar, Dyandot, stood, thus freezing a group of domain names, but as an observer put it, “That’s akin to removing a person’s name from the phone book but not disconnecting his phone.”⁶⁴ None of the documents that led to the suit has ever been removed from WikiLeaks sites.⁶⁵

AS THE BANK Julius Baer case suggests, it is unlikely that WikiLeaks could be “taken down”—at least, not for doing what it has done so far. Even leaving aside the technological features that protect it, WikiLeaks’s situation has been prefigured by groups like Amnesty International, Reuters, and the International Red Cross, all of which are transnational organizations that displease various governments from time to time. None of those organizations has ever been shut down. And Western governments would be unlikely to take down WikiLeaks as a matter of principle. Here again, history shows us why: When the New York Times published the Pentagon Papers, there were principled disagreements about whether that particular publication should be permitted, but no sensible person advocated shutting down the Times itself.

But shutting down WikiLeaks isn’t technically impossible, and it would be legally and politically possible under certain circumstances. Let’s imagine a hypothetical case involving an ordinary crime, like murder, with no political overtones. Suppose an organization like WikiLeaks, with reckless disregard for truth, published plainly defamatory information that not only created shame, loss of reputation, and bankruptcy, but also led to some third party stalking and killing the victim of its behavior. To pursue this crime, public officials could first try to break the organization’s encryption. That might be difficult, but it could almost certainly be done. Breaking the encryption, after a courtapproved warrant to enter one or more servers electronically, would illuminate a great many operational details—bank accounts, names of donors and sources, e-mail and IP addresses, and so forth. Even without such an order, much of this information is publicly available. That would establish a basis to assert jurisdiction over specific people affiliated with the organization—not merely Assange—and would be followed by subpoenas for records and witnesses that would likely be honored across international boundaries. Judicial efforts to bring murderers to justice—unlike efforts to stop the leaking of official secrets—command broad international support across the political spectrum. Bank accounts could be frozen and payments disrupted. Indeed, this has already happened to WikiLeaks without subpoenas or judicial process ; for example, Bank of America and PayPal voluntarily stopped processing the organization’s donations and other transactions. Establishing the liability of an amorphous group would be a challenge, but responsibility for the activities of unincorporated associations, not to mention the participants in criminal conspiracies, is hardly a new problem. Courts in all Western countries deal with it every day. Witnesses could refuse to talk, but they would go to jail. In other words, given an adequate basis under the law of one or more countries, WikiLeaks’s secrecy could be broken and punishment or liability imposed. At this writing, U.S. prosecutors are trying just such a strategy as they investigate whether Assange conspired with the alleged source of the recent leaks, U.S. Army private first class Bradley Manning. If he did, Assange could be charged with conspiracy to commit espionage or computer fraud, and could be extradited to the United States.⁶⁶

Regardless of what happens to Assange in Swedish or American courts, the leaked information will remain public. Assange’s claim that the group exists beyond any form of governmental control or sanction may be overblown, but WikiLeaks has thus far managed to publish vast troves of secrets once deeply held by governments, individuals, and organizations—from the U.S. Army to Swiss banks to the Church of Scientology to Kenya’s kleptocratic former president Daniel arap Moi. Few people would say that none of this information should have been leaked. WikiLeaks may even fall apart, but where it has gone, others will surely follow. Whatever you think of his motives or personality, Assange has highlighted for his followers—and for all of us—the potential for transparency that characterizes so many aspects of our electronically tethered lives. Assange also understood that “the source is no longer dependent on finding a journalist who may or may not do something good with his document.”⁶⁷ The recent episodes in which WikiLeaks funneled information through three large newspapers suggest a new, more symbiotic relationship with the media, but even in these cases WikiLeaks is leading and the media are following.

Focusing on how to suppress an organization like WikiLeaks misses the point. Even if WikiLeaks were destroyed, imitators are emerging to take its place. And once information gets into the hands of such an organization, it is for all practical purposes irretrievable. Therefore the important issue is not what comes out of one of these groups, but what goes in: How did WikiLeaks obtain all that information in the first place? That query raises questions we’ll address in the next chapter, about how we manage information.

The world of information is changing at light speed. Covert operations run by the top-notch intelligence agencies are uncovered with cameras in hotels and shopping malls. Low-budget terrorists run operations using free imagery from Google Earth. An army of amateur sleuths exposes secret rendition flights from out-of-the-way military airports on several continents. Top-secret State Department cables, once meant for the eyes of a few, are leaked en masse through a phalanx of servers around the world.⁶⁸

Managing Identity in the “Participatory Panopticon”¹²

Leaking on a Mass Scale

Managing Identity in the “Participatory Panopticon”12

Leaking on a Mass Scale

Managing Identity in the “Participatory Panopticon”¹²