Careful – WSJ and Al-Jazeera Lure Whistleblowers with False Promises of Anonymity

WSJ and Al-Jazeera Lure Whistleblowers With False Promises of Anonymity
Legal Analysis by Hanni Fakhoury – EFF
June 7th, 2011

The success of Wikileaks in obtaining and releasing information has inspired mainstream media outlets to develop proprietary copycat sites. Al-Jazeera got into the act first, launching the Al-Jazeera Transparency Unit (AJTU), an initiative meant to “allow Al-Jazeera’s supporters to shine light on notable and noteworthy government and corporate activities which might otherwise go unreported.” AJTU assures users that “files will be uploaded and stored on our secure servers” and that materials “are encrypted while they are transmitted to us, and they remain encrypted on our servers.”

On May 5, the Wall Street Journal (WSJ), a subsidiary of Dow Jones & Co., Inc., launched its own site, SafeHouse. That same day, the Atlantic published a story describing SafeHouse as a “secure uploading system” with “separate servers,” two layers of encryption, and a policy of discarding information about uploaders “as quickly as possible.” You can “keep yourself anonymous or confidential, as needed,” the SafeHouse site promises, as you “securely share documents with the Wall Street Journal.”

Immediately after its launch, however, online security experts ripped SafeHouse apart. The Atlantic published its story online at noon on May 5 and by 5 p.m., the page was updated with a link directing readers to the Twitter feed of Jacob Appelbaum, a security researcher and Wikileaks volunteer, who had already exposed an embarrassing number of security problems with SafeHouse.

EFF’s review of the legal side of these websites doesn’t fare any better. While some of the more egregious technical problems with SafeHouse have been fixed since its launch, its terms of use haven’t changed. We read through the Terms of Service for both SafeHouse and AJTU (pdf). Don’t fall for the false promises of anonymity offered by these sites. Here’s what you should know.

They Reserve the Right to Sell You Out

Despite promising anonymity, security and confidentiality, AJTU can “share personally identifiable information in response to a law enforcement agency’s request, or where we believe it is necessary.” SafeHouse’s terms of service reserve the right “to disclose any information about you to law enforcement authorities” without notice, then goes even further, reserving the right to disclose information to any “requesting third party,” not only to comply with the law but also to “protect the property or rights of Dow Jones or any affiliated companies” or to “safeguard the interests of others.” As one commentator put it bluntly, this is “insanely broad.” Neither SafeHouse or AJTU bother telling users how they determine when they’ll disclose information, or who’s in charge of the decision. …more