Feeds

All WikiLeaks' secret US cables are on BitTorrent in full

The Guardian published crypto password

Internet Security Threat Report 2014

Wikileaks has accused a Guardian journalist of negligently publishing the passphrase for a database of unredacted secret US diplomatic cables in a book. The encrypted database is available on BitTorrent.

The book by David Leigh, Inside Julian Assange's War on Secrecy, contains an excerpt explaining how he persuaded Julian Assange to give him the PGP passphrase, named as ACollectionOfDiplomaticHistory_Since_1966_ToThe_PresentDay#.

Armed with the passphrase, interested parties possessing the relevant encrypted database can see copies of the controversial documents. The material includes raw copies of more than 100,000 classified US diplomatic cables.

WikiLeaks published carefully redacted and selected samples of the US diplomatic cables starting last November. Details pointing to the identity of informants or naming agents contained in the raw Cablegate archive were removed. After months in hiatus the whistleblowing site began publishing further cables at a greatly increased rate last week.

The passphrase disclosure problem must have been known about for months but only became public after German magazines highlighted the issue recently.

WikiLeaks, which has remained silent on the issue in order to avoid drawing attention to the presence of the passphrase in The Guardian book, said that it has "spoken to the State Department and commenced pre-litigation action" against The Guardian. It accused the paper of an "act of gross negligence or malice".

In a story about the availability of the unredacted cables, The Guardian said it was told it was supplied with a "temporary password which would expire and be deleted in a matter of hours."

The paper goes on to say:

The embassy cables were shared with the Guardian through a secure server for a period of hours, after which the server was taken offline and all files removed, as was previously agreed by both parties. This is considered a basic security precaution when handling sensitive files. But unknown to anyone at the Guardian, the same file with the same password was republished later on BitTorrent, a network typically used to distribute films and music. This file's contents were never publicised, nor was it linked online to WikiLeaks in any way.

The Guardian adds that WikiLeaks has not previously objected to Leigh's book, which was published back in February. "No concerns were expressed when the book was published and if anyone at WikiLeaks had thought this compromised security they have had seven months to remove the files," stated the paper.1

Once one of five trusted international media partners, the Guardian and Assange had fallen out spectacularly even before the publication of Leigh's book, mainly over early Guardian stories on the sex allegations against Assange in Sweden that remain the subject of ongoing extradition proceedings.

Last year a former WikiLeaks volunteer gave access to the database to a freelance reporter, Heather Brooke, without the permission of Assange. So this latest incident is not the first time WikiLeaks has lost control of its unredacted Cablegate database. The difference this time around is that anyone - potentially intelligence agencies within oppressive regimes that are hostile to the US, and not just a few hacks - will be able to obtain raw copies of the sensitive diplomatic diplomatic cables. ®

Bootnote

1Removing or changing the location of the cables file on the Wikileaks site would have had no effect once the database was on the torrents.

Secure remote control for conventional and virtual desktops

More from The Register

next story
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
BlackEnergy crimeware coursing through US control systems
US CERT says three flavours of control kit are under attack
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
New hybrid storage solutions
Tackling data challenges through emerging hybrid storage solutions that enable optimum database performance whilst managing costs and increasingly large data stores.
Getting ahead of the compliance curve
Learn about new services that make it easy to discover and manage certificates across the enterprise and how to get ahead of the compliance curve.