Robert Lemos

The fallout from the Hewlett-Packard board investigation has brought up a lot of interesting issues, not the least of which is how journalists should try and keep their sources confidential. The unauthorized accesses to journalists’ and sources’ phone-records underscored that in this day and age it is hard to keep sources anonymous.

Whistleblowers are an important societal force for democracy and represent a source of major stories for journalists. Protecting whistleblowers’ identities from organizations–whether corporate, government or criminal–that might not want light shown on their activity can have extremely positive societal effects and helps to guard against corruption.

So what can be done? After researching what happened with the HP case, I wanted to see what others thought would be an effective way to communicate anonymously (or at least, keep the source anonymous).

On my own site, here is a communications policy I drew up a while back for anonymous tips. Kim Zetter also posted an article on Wired.com about post-”pretext” privacy. (If you are wondering, why I use quotes around the word “pretext,” read my entry here.)

One thing I wanted to look at was whether TracPhones are the answer. If a reporter buys a TracPhone with cash, and the HP board investigation happened all over again:

1. Reporter calls board member from TracPhone,
2. Board member calls reporter back at TracPhone number (I include this because most interviews on sensitive topics generally happen over multiple phone calls),
3. Story breaks, chairperson exhibits Dunnian fury and investigates,
4. PI are hired and get the board members’ phone records,
5. All numbers are accounted for, except for TracPhone number,
6. Investigators call TracPhone number, and reporter picks up, but refuses to give
   name,
7. Investigators compare a recording of the reporter’s voice with the person on the TracPhone and decide it’s a match (as this isn’t a court of law, nothing more is necessary).

So, it would seem to me that they could still track the reporter down, or at least match a suspicious number to a small pool of reporters. So lets redefine the problem:

PROBLEM: Given that there is a small pool of people (”sources”) with a certain tidbit of knowledge and a known reporter who has outed that tidbit of knowledge is there a way to communicate the knowledge from the source to the reporter in a way that does not reveal the true source.

Here are the ideas that I have come up with so far:

1. Both source and reporter have to have TracPhones. When setting up the communications channel, meet face-to-face and swap TracPhone numbers.
2. If the communications is initiated by the source, then the source can buy a TracPhone and most of the issues go away.
3. Don’t use TracPhones, but instead call all the possible sources and even if you only talk about inane things, talk for a reasonable amount of time. The PIs would then find that the reporter had a 5- to 15-minute conversations with all possible sources and would not gain any appreciable information.
4. Call all possible sources, go through a fixed spiel about what you want to talk about, and at the end, say, “If you want to contact me, buy a TracPhone with cash and call me.” Like (3), a PI will only see that everyone had a 2-minute call from the reporter, and like (2), the PI will only see that the reporter got a call from an anonymous TracPhone.

I think (4) might be the best answer for voice calls. Any other options would be welcome.