In November, Reuters published a special investigative feature headlined, “How an Indian startup hacked the world.” The story alleged that a hacking-for-hire firm called Appin had stolen secrets from executives, politicians, military officials, and wealthy elites around the globe. (Appin has denied this.) A few weeks later, however, the story was taken down and replaced by an editor’s note saying that it had been “temporarily removed” following an order issued by a district court in New Delhi. The order, Reuters said, was issued amid a court case that was originally brought against the news agency a year earlier. Reuters said that its hacking-for-hire story was based on thousands of documents and interviews with hundreds of people, including cybersecurity firms, adding that it stood by its reporting and planned to appeal. (Reuters did not respond to a request for comment.)
According to the Daily Beast and other outlets, the initial lawsuit against Reuters is part of a wider legal battle launched by Rajat Khare, a co-founder of Appin, and law firms including Clare Locke LLP, which boasts on its website about its track record of “killing stories” about its clients. The Daily Beast reported that references to Khare have been removed from a collaborative investigation between London’s Sunday Times and the nonprofit Bureau of Investigative Journalism; a news story published in Luxembourg; and a report from the Swiss national broadcaster. Semafor reported, meanwhile, that Clare Locke sent legal threats to The New Yorker about a story on India’s hack-for-hire industry. (The New Yorker’s story is still online; Khare’s lawyer told Semafor that Khare “does not comment on actual or alleged legal proceedings,” but does “defend himself judicially in all relevant jurisdictions against any attacks that target him and illegitimately damage his reputation.”) Lawfare also edited an article that it had published to remove details taken from the Reuters report. And the Internet Archive, which had hosted a backup copy of the Reuters story, has taken it down. (The story has been replaced with the message: “this URL has been excluded from the Wayback Machine.”)
For Emma Best, the co-founder of a leak-hosting site called Distributed Denial of Secrets, or DDoSecrets, seeing Reuters remove its story reinforced her desire to launch what would become the Greenhouse Project—a special section of the DDoSecrets site devoted to publishing and distributing news stories that have been censored. DDoSecrets—which in the past had a server seized in Germany and was once erroneously labeled a “criminal hacker group” by the US Department of Homeland Security—sees the Greenhouse Project as part of its broader mission to ensure the free transmission of data in the public interest by making itself a “publisher of last resort.” It chose the name because it hopes to create a “warming effect to reverse the chilling effects of censorship.”
The Reuters story (along with supporting documents) is the first entry in the project, which launched last week, but Best said that it is just the tip of the iceberg. (On the Appin front alone, she provided me with a list of almost a dozen stories in various outlets that have either been edited to remove facts about Appin or unpublished completely.) Recently, I spoke with Best about the aims of DDoSecrets, the launch of the Greenhouse Project, and why she hopes it becomes redundant. What follows is a transcript of our discussion, which was conducted via the messaging app Signal and has been edited for length and clarity.
MI: So the removal of the Reuters story sparked your interest in hosting this material at DDoSecrets?
EB: The Reuters story had caught my eye before it was taken down; it’s part of a series of reports that I thought were important to begin with. It was upsetting to see it just removed like that (though I don’t blame Reuters for doing what they had to do). Seeing Reuters’s piece get taken down—and especially all the secondary reporting that was censored, too—really demonstrated that something like this was needed.
Can you give us a little background on DDoSecrets, what it does, and how it came to be?
DDoSecrets is a little over five years old, launched in December 2018. We’ve published over a hundred million leaked files provided by our sources, and we have a lot more that we’re still working on. We use a mixed distribution model, publishing information both to the general public and restricting some information to journalists and researchers when there’s a lot of sensitive information. Some of these cases contain ten million files, so adequately reviewing and redacting that just isn’t possible. Along with individual media outlets, we’ve collaborated with organizations like the Platform to Protect Whistleblowers in Africa, the International Consortium of Investigative Journalists, and the Organized Crime and Corruption Reporting Project. In 2020, we were recognized as a 501c3 [charitable organization]. A few of our more notable publications are listed on the site.
Can I assume that, much like WikiLeaks, this kind of thing hasn’t made you very popular with governments and other entities?
We’re banned by Indonesia and Russia, as well as by Twitter and Reddit. You still can’t post our URL on Twitter at all, and any post on Reddit with it is shadowbanned [downranked so it is difficult to find and can’t be shared]. I’m not sure why exactly; I found out about it last year when The Intercept reported it. A subreddit dedicated to BlueLeaks [a DDoS project in 2020 that published almost three hundred gigabytes of internal US law enforcement documents] was banned; I wouldn’t be surprised if [the shadowbanning] happened then, but I don’t have any “receipts” [proof]. Last year, the Department of Defense asked us to remove the Pentagon leaks but we basically just ignored them.
How is DDoSecrets funded?
The first year or two, it was mostly out of pocket. We took some Bitcoin donations; I think one big one that helped for a while, but things were minimal enough for the first year or so that it wasn’t too bad. Now it’s all donations. We have DonorBox and OpenCollective, we get a little bit through Substack, but I think we’re going to move away from that entirely [because of the platform’s decision to host Nazi and white supremacist content]. We have a few crypto options, but we don’t exactly appeal to the NFT and crypto crowd.
In 2021, we got a grant from [the Calyx Institute, a nonprofit focused on digital security], but we’re pretty chronically broke. I think we have maybe ten thousand dollars on hand, give or take. Right now only two of us are paid, everyone else is a volunteer. We both work on this full-time, but our salary is less than the equivalent of minimum wage. I make four hundred dollars per week before taxes. We’re trying to get funding from outside groups, but so far that hasn’t been successful. One foundation said they’d reimburse us for some conferences and travel; that was the only reason we did it, but we were never reimbursed. Probably our biggest source of funding was the Calyx grant. Unfortunately, there’s not a lot of money (or recognition) in publishing, and a lot of big funders aren’t attracted by the idea of people who have leaked (or could leak) the secrets of their friends.
What are your plans if DDoSecrets gets sued by Khare or someone else over the censored stories it publishes?
We’re not going to pre-litigate anything, but it’s worth noting that we have no people or physical presence in India. And the files and the article have both been made into a torrent [a file that can be easily shared] that can’t really be censored. Even if it’s somehow removed from our servers, we couldn’t take it back if we wanted to. As I recall, the Los Angeles Police Department filed a lawsuit [in which it tried to retract some documents that were released through the Freedom of Information Act, which DDoSecrets published] but never even bothered to include DDoSecrets or go after us in any way. As for where it’s hosted, our domain is registered through a company in Iceland. The wiki [the site runs on software similar to Wikipedia] is kept separate from everything else for security reasons.
Will DDoSecrets be adding other censored reporting to the Greenhouse Project?
I’d like this project to not have to be expanded. If it’s never needed again, that would be best for everyone. We say internally a lot that we’d love for DDoSecrets to be made obsolete by some change in the world—either some increase in transparency, or some other organization improving on the model in some way. But as long as the need is there….
Other notable stories:
- Yesterday, a hundred days into his tenure as CEO of CNN, Mark Thompson revealed more about his plans for the network in a memo to staff. Thompson called on staffers to recapture “some of the swagger and innovation” of CNN’s early years as it adapts to sharp challenges and changing consumption patterns in the TV business, and also confirmed that Alex MacCallum—a media executive with deep experience in digital transformation, including working alongside Thompson at the New York Times—will return to CNN, where she formerly worked, following a brief spell at the Washington Post. Beyond that, Thompson’s memo offered “little granular detail,” Oliver Darcy, CNN’s media reporter, noted. (In other news, CNN formally canceled a GOP debate ahead of the New Hampshire primary after Donald Trump and Nikki Haley declined to take part.)
- Also yesterday, Condé Nast announced that Pitchfork, the spiky music site, will be folded into the men’s magazine GQ; as part of the transition, an unspecified number of staffers will be laid off, including Puja Patel, Pitchfork’s editor in chief. Anna Wintour, Condé Nast’s chief content officer, cast the merger as a step toward consolidating the company’s music coverage, but many media-watchers were puzzled by—if not openly scathing of—the move given the two publications’ starkly different sensibilities and brands; Amanda Petrusich, who covers music for The New Yorker and noted that she “wouldn’t have a career” without Pitchfork, wrote that the news “feels like a death knell for the record review as a form.” Pitchfork’s union also condemned the merger.
- Meanwhile, the union representing staffers at the LA Times warned overnight that “another major round of layoffs” could be imminent at the paper, which already cut dozens of positions last year. The news follows the abrupt recent resignation of Kevin Merida, the executive editor, amid reported tensions with Patrick Soon-Shiong, the paper’s owner, including over business matters. In the wake of his departure, Merida has widely been praised within the media industry, including among LA Times staffers—but The Objective’s Brandon Pho reports that some staffers did not perceive his tenure so positively, including in his handling of last year’s cuts and other employment matters.
- Earlier this week, a clutch of reporters and commentators condemned the Biden administration’s response to a story, by HuffPost’s Akbar Shahid Ahmed, reporting on internal divisions over a potential plan for the reconstruction of Gaza; the White House initially declined to comment, but after the story gained traction, a spokesperson for the National Security Council called it untrue and suggested that Ahmed had fabricated quotes. At a briefing yesterday, John Kirby, the NSC’s chief spokesperson, partly walked back that statement, saying that the NSC hadn’t intended to question Ahmed’s ethics.
- And for CJR, Umar Farooq remembers Bilal Jadallah, a “father figure” for many journalists in Gaza who was killed in an Israeli attack in November. A decade earlier, Jadallah founded Press House, a media center and “kind of sanctuary” for domestic and foreign reporters, Farooq writes. Jadallah believed “that with an independent space to train and foster journalists he could build up a proper, professional media landscape in Gaza”—one that would “help improve Palestinian society overall.”
