Feeds

All WikiLeaks' secret US cables are on BitTorrent in full

The Guardian published crypto password

Seven Steps to Software Security

Wikileaks has accused a Guardian journalist of negligently publishing the passphrase for a database of unredacted secret US diplomatic cables in a book. The encrypted database is available on BitTorrent.

The book by David Leigh, Inside Julian Assange's War on Secrecy, contains an excerpt explaining how he persuaded Julian Assange to give him the PGP passphrase, named as ACollectionOfDiplomaticHistory_Since_1966_ToThe_PresentDay#.

Armed with the passphrase, interested parties possessing the relevant encrypted database can see copies of the controversial documents. The material includes raw copies of more than 100,000 classified US diplomatic cables.

WikiLeaks published carefully redacted and selected samples of the US diplomatic cables starting last November. Details pointing to the identity of informants or naming agents contained in the raw Cablegate archive were removed. After months in hiatus the whistleblowing site began publishing further cables at a greatly increased rate last week.

The passphrase disclosure problem must have been known about for months but only became public after German magazines highlighted the issue recently.

WikiLeaks, which has remained silent on the issue in order to avoid drawing attention to the presence of the passphrase in The Guardian book, said that it has "spoken to the State Department and commenced pre-litigation action" against The Guardian. It accused the paper of an "act of gross negligence or malice".

In a story about the availability of the unredacted cables, The Guardian said it was told it was supplied with a "temporary password which would expire and be deleted in a matter of hours."

The paper goes on to say:

The embassy cables were shared with the Guardian through a secure server for a period of hours, after which the server was taken offline and all files removed, as was previously agreed by both parties. This is considered a basic security precaution when handling sensitive files. But unknown to anyone at the Guardian, the same file with the same password was republished later on BitTorrent, a network typically used to distribute films and music. This file's contents were never publicised, nor was it linked online to WikiLeaks in any way.

The Guardian adds that WikiLeaks has not previously objected to Leigh's book, which was published back in February. "No concerns were expressed when the book was published and if anyone at WikiLeaks had thought this compromised security they have had seven months to remove the files," stated the paper.1

Once one of five trusted international media partners, the Guardian and Assange had fallen out spectacularly even before the publication of Leigh's book, mainly over early Guardian stories on the sex allegations against Assange in Sweden that remain the subject of ongoing extradition proceedings.

Last year a former WikiLeaks volunteer gave access to the database to a freelance reporter, Heather Brooke, without the permission of Assange. So this latest incident is not the first time WikiLeaks has lost control of its unredacted Cablegate database. The difference this time around is that anyone - potentially intelligence agencies within oppressive regimes that are hostile to the US, and not just a few hacks - will be able to obtain raw copies of the sensitive diplomatic diplomatic cables. ®

Bootnote

1Removing or changing the location of the cables file on the Wikileaks site would have had no effect once the database was on the torrents.

Mobile application security vulnerability report

More from The Register

next story
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Black Hat anti-Tor talk smashed by lawyers' wrecking ball
Unmasking hidden users is too hot for Carnegie-Mellon
Attackers raid SWISS BANKS with DNS and malware bombs
'Retefe' trojan uses clever spin on old attacks to grant total control of bank accounts
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.