When You Say, "Confidential", What Exactly Do You Mean?

How you feel about the legal protections now offered to whistle-blowers depends on your background. Americans tend to think they're good, encouraging people to bring illegal or unethical things to light that might otherwise stay hidden. Europeans, with recent memories of secret police and neighborhood informers, are less enthused.

But no matter how you feel about them, I hope you'll agree that if you promise protection to a whistle-blower, you should mean that you'll protect them.

Journalists, in particular, claim to be willing to do almost anything -- even go to jail themselves -- to protect their confidential sources.

For example, a month ago, the New York Times reported that one of its reporters, James Risen, had been subpoenaed by federal prosecutors to require him "to testify at a criminal trial about who leaked information to him about the [Central Intelligence] agency's effort to sabotage the Iranian nuclear program at the end of the Clinton administration." (Full story by Charlie Savage, here)

Mr. Risen's response was, "I am going to fight this subpoena. I will always protect my sources, and I think this is a fight about the First Amendment and the freedom of the press."

I agree with him.... up to a point.

My very first job after college was as a newspaper reporter-photographer for a small-city daily, so I have a soft spot for "print people". But that doesn't mean that I'm blind to everything that goes on.

Journalism may be a "calling", but it's also a business, and big scoops mean more than just bragging rights.

Early this month, the Electronic Frontier Foundation (EFF) reported that "the success of Wikileaks in obtaining and releasing information has inspired mainstream media outlets to develop copycat sites." (Full story by Hanni Fakhoury and Leafan Rosen, here)

The EFF reported specifically on efforts by Al-Jazeera (called "the Al-Jazeera Transparency Unit"; website here) and the Wall Street Journal (called "SafeHouse"; website here). Both appeal to readers for help in the important work of investigative journalism. The WSJ, speaking of its SafeHouse site, says:

Documents and databases: They're key to modern journalism. But they're almost always hidden behind locked doors, especially when they detail wrongdoing such as fraud, abuse, pollution, insider trading, and other harms. That's why we need your help.

If you have newsworthy contracts, correspondence, emails, financial records or databases from companies, government agencies or non-profits, you can send them to us using the SafeHouse service.

This sounds a lot like a fishing expedition, doesn't it?

I'm uncomfortable with that, too. Is this really what journalism is about?

Both Al-Jazeera and the WSJ promise to go to "great lengths" (Al-Jazeera's phrase) to protect sources. But what's that promise worth? According to the EFF, not much. Less than a day after the "SafeHouse" program was launched, online security experts were exposing a number of security problems.

Gawker's Adrian Chen pointed out what he called "a doozy of a caveat":

Except when we have a separately negotiated confidentiality agreement… we reserve the right to disclose any information about you to law enforcement authorities or to a requesting third party, without notice, in order to comply with any applicable laws and/or requests under legal process, to operate our systems properly, to protect the property or rights of Dow Jones or any affiliated companies, and to safeguard the interests of others.

As Chen wrote (full piece here), "So, go ahead and upload your explosive documents to SafeHouse. But if they publish a scoop based on your material and someone gets mad, they can sell you out to anyone for any reason, including the insanely broad one of safeguarding 'the interests of others.'"

EFF also pointed out that the Al-Jazeera site asks, among other things, that you "represent that you 'have full legal right, power and authority' to give them ownership of the material". But isn't that just what leaked documents aren't about?

My issue isn't really with how well or badly these sites protect the sources from whom they hope to obtain material. My point, as usual, is about transparency and trust.

If you can't guarantee me confidentiality, tell me so. Tell me what the risks are. Tell me why you think it's important that I ignore those risks and go ahead and share the material that you want. Tell me why I should trust you with this material.

In other words, journalism sites shouldn't keep their security secrets from whistle-blowers.