How to responsibly leak information to the press

Well, the messaging app Signal has been in the news recently, thanks to a snafu in which prominent federal defense officials mistakenly added The Atlantic's editor-in-chief, Jeffrey Goldberg, to a group chat in which they discussed military strikes in Yemen. This whole situation reminds us of another conversation we've been having as a team about how to responsibly leak information to the press, and if there is such a thing as a "secure line." To answer this question, we reached out to our WBUR colleague, investigative and data reporter Todd Wallack. If you have a story you would like to share with us in a secure way, you can reach us on Signal (yes, Signal) at 646-456-9095 or email us at [email protected]

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Speaker 00

  Support for WBUR comes from the Quiet Tension Podcast. When Joe Missoula got the Celtics job, Steve Paliuka sat up until 1:00 in the morning typing him 25 things about leadership. Dr. Sharon Turbin asks what came first on the list. Listen closely wherever you get your podcasts.

• 0:19Speaker 01

  Support for Endless Thread comes from MathWorks, creator of MATLAB and Simulink software to design and develop engineered systems, accelerating the pace of discovery in engineering and science. Learn more at mathworks.com.

• 0:35Speaker 02

  Life is all about making decisions. Sometimes you make questionable ones, like buying a new TV that's too big for the wall because the electronics store employee was a little too good at their job. Then sometimes you make great ones, like protecting your home and auto with Progressive. You get customized coverage options so you can be sure you have the right coverage. Get your quote today at progressive.com. Progressive Casualty Insurance Company affiliates and other insurers. Not available in all states.

• 1:05Amory Sivertson?

  Okay, before we get to today's episode, just want to remind you that we are looking for your stories about how AI is playing a role in your relationships today. So these could be romantic relationships, but we're not really looking for like, I have an AI significant other. It's more like-

• 1:23Ben Brock Johnson?

  Did I get a foot rub from an AI?

• 1:26Amory Sivertson?

  You didn't.

• 1:27Ben Brock Johnson?

  Did me and the AI play checkers? Did we... Sorry.

• 1:32Amory Sivertson?

  Yeah, no, but you're, yes, you're picking up what I'm putting down here, Ben, which is we're looking for how is AI playing a role in your work relationships, in your family relationships? What role is AI taking on? What is it putting on your plate, taking off your plate? Tell us about all of your interesting AI relationship stories. How do they do that, Ben?

• 1:56Ben Brock Johnson?

  You can email us at [email protected].

• 1:59Amory Sivertson?

  Yeah, and we'd love it if you sent us a voice memo in particular because we want your voices. Not in a creepy way, actually, but you can also, of course, send a written message if that's more your jam. [email protected]. Okay, here's the rest of the show.

• 2:23Amory Sivertson?

  WBUR Podcasts, Boston.

• 2:33Ben Brock Johnson?

  So Emory, we were gonna put a whole different episode in the feed this week. And then we decided to switch it out with something else we've been working on. Because the messaging app Signal has been kind of big in the news this week. I don't know if you heard, papers read all about it.

• 2:52Amory Sivertson?

  You know, I happened to hear, in fact, that Jeffrey Goldberg, an investigative reporter and the editor in chief at The Atlantic, has been in a tête-à-tête with top Defense Cabinet members, who added him to the chat when discussing US military strikes on Yemen because of Houthi fighters who have been disrupting shipping there.

• 3:12Ben Brock Johnson?

  I feel like there was an Endless Threat episode that kind of mentioned some of this a couple of weeks ago.

• 3:17Amory Sivertson?

  You know, that's ringing a bell. You probably have heard plenty about that. So we're not going to go too deep into that right now. But we did decide to drop this episode in your feed this week because, you know, Signal chats are a thing right now.

• 3:33Ben Brock Johnson?

  For us, Signal chats and their relative security were the topic of a whole other conversation that we have been having over the past weeks and months about how to responsibly and carefully leak information to the press.

• 3:48Amory Sivertson?

  I'll tell you one way not to do that. Add JG to your fellow Trump administration Signal chatters without checking on who JG is. It's accomplished journalist Jeffrey Goldberg. In fact, this week's big story is a masterclass in how not to do it, which starts with knowing who you're talking to.

• 4:09Ben Brock Johnson?

  Yeah, seriously, Signal has long been a communications tool used by journalists precisely because of its security and the ability to protect sources and sensitive information. And as we've been watching the endless litany of stories about what Doge and Elon Musk are doing inside the federal government, to say nothing of this week's story about military officials using Signal, as we've seen some of those stories leak into the world via things like the Fed News subreddit, for instance, and other places, and we've been having this conversation on our own subreddit about how or whether to cover this kind of news.

• 4:49Amory Sivertson?

  We had this question. What is the best way for a source to get in touch with a journalist and let them know about something that really Americans need to be aware of? What in the year of our Lord 2025 is a secure line?

• 5:06Ben Brock Johnson?

  Well, we've kind of got an answer for that now. You can email us at [email protected]. That is Proton Mail, the secure email service. You can also text or call us on Signal, and the number for that is 646-456-9095. So again, that is [email protected]. Or you can text or call us on Signal, 646-456-9095.

• 5:38Amory Sivertson?

  But it's not quite that simple. We wanted to learn and to share some other best practices with our listeners.

• 5:45Ben Brock Johnson?

  And for that info, we reached out to a guy a few cubicles over from us, Todd Waller.

• 5:54Amory Sivertson?

  For the good people, Todd, tell us what you do at WBUR.

• 5:58Speaker 05

  Sure. I'm an investigative and data reporter for WBUR.

• 6:02Amory Sivertson?

  OK, but before WBUR, you worked at the Boston Globe?

• 6:05Speaker 05

  Yes. I worked for the Boston Globe for 14 years, most of that time on the Boston Globe Spotlight Team.

• 6:15Speaker 05

  The Boston Globe Spotlight Team might be the oldest investigative team of any newspaper across the country, and it was made famous by Spotlight the Movie, which recorded the well-known investigation that the Spotlight Team did of the Catholic Church and sex abuse.

• 6:36Amory Sivertson?

  And am I correct that for a while, you were the person in charge of the Spotlight tip line?

• 6:43Speaker 05

  I did manage that for a while. So I saw all sorts of different emails and phone calls coming in, had to spend a lot of time listening to voicemails.

• 6:54Ben Brock Johnson?

  What kind of tips does a tip line minder like you enjoy getting?

• 7:01Ben Brock Johnson?

  And what kind of tips does a tip minder not enjoy getting when they're when they're manning the spotlight tip line?

• 7:09Speaker 05

  Yeah, well, first of all, I should say that tips are really important for journalists. I think that the public might imagine that if they don't see a story that the media is just not interested, or they're covering it up, but often we don't know about it. Or we don't have the information needed to actually report it and tell the public. So tips are really crucial in alerting us to issues that we might not know are going on, or providing us with names and documents and information that we actually can use to tell that story. So the tips that are most helpful are very specific and very concrete.

• 7:49Speaker 05

  It might be, hey, this public official lied about their resume. And here's how you can prove it, or here's evidence. They might include documents or pictures that prove what they're saying, or they might have names and contact information of people who can back it up, or other specific details. It's harder when people say, hey, there's something going on with the Biden or Trump administration, you should dig harder. You should check that out.

• 8:20Speaker 05

  Or this guy must be corrupt. You should look into that. It's like, ow.

• 8:24Ben Brock Johnson?

  My buddy's friend's girlfriend says there are aliens. You should get on that.

• 8:30Speaker 05

  Another one, we get a lot of conspiracy theories.

• 8:35Speaker 05

  It's really hard. It's, I'm really skeptical when I get tips that say, hey, there's this huge cover up involving the FBI, my, my wife, her defense lawyer, the judges, this media station.

• 8:55Speaker 05

  I know conspiracies do happen, but usually people are busy with their own work and their own problems and don't have time to join up with six other organizations and people all to make some random person's life miserable.

• 9:11Amory Sivertson?

  That's totally true, and yet it does feel like we're living in a slightly different time right now with regards to the lack of transparency around really consequential things that the federal government is doing, you know, like whereas we might have been more inclined in the past to say, that's just a conspiracy theory. Something about this moment does feel like, oh, we might actually need to look into that.

• 9:38Speaker 05

  Well, I definitely think we're at it. We're in an environment where if somebody says something happened and it sounds a little crazy, it still might have happened. We all probably saw the news that the Associated Press, one of the most respected journalism organizations, was barred from covering White House events because the AP style guide that many people rely on refused to change their style to stop using Gulf of Mexico and didn't change it to Gulf of America. And I would have guessed that was something out of The Onion.

• 10:12Amory Sivertson?

  Yeah.

• 10:13Ben Brock Johnson?

  Yeah, The Onion's got tough competition with reality these days, feels like at times. You spoke a little bit to this, but just to underscore it again, what's the value of a whistleblower?

• 10:28Speaker 05

  Well, of course, there are different meanings by whistleblowers. There's some people who blow the whistle within their own agency or company and report problems up the chain. And sometimes it's somebody embezzling money. Sometimes it's not following the law in some other way. And it's really important that organizations know when there's a rogue person who's flouting all the rules and doing something wrong. Otherwise, they can't take action. There are also lots of cases where people can't trust the organization they work for, and they go to the press, they go to reporters, and they try to find

• 11:07Speaker 05

  somebody to expose a problem that they think is really serious and can't trust their organization to take care of it on their own.

• 11:16Ben Brock Johnson?

  Can you talk about how, you know, you were just talking a minute ago about the tip line?

• 11:24Ben Brock Johnson?

  Can you talk about what a secure drop is? And, and why someone might want to use that kind of thing when they're communicating with journalists?

• 11:33Speaker 05

  Sure. So obviously, many whistleblowers who go to the media are worried about being fired, being publicly embarrassed, getting in trouble in some other way if they're publicly known. So want to find some way to confidentially give journalists information. In some organizations, like the Washington Post and New York Times and ProPublica have set up essentially a big safety box that people can drop off documents electronically without giving up their name or identity.

• 12:16Speaker 05

  So a secure place to upload files.

• 12:19Amory Sivertson?

  And can you say more about what a secure place is? Like, how do you upload something or email something or leave a voicemail for something without maybe revealing your location, what device you're on, what, any, any trace of your identity, if that's possible?

• 12:38Speaker 05

  There are lots of ways that people can communicate with journalists and keep their identity secret. I mean, the most, the most famous was probably Deep Throat, the tipster involved in the Watergate scandals. And Deep Throat kept his identity secret by meeting with Bob Woodward, Washington Post reporter, in person, in this-

• 13:02Ben Brock Johnson?

  In a dimly lit parking garage.

• 13:05Speaker 05

  Exactly, a dimly lit parking garage. We now know that, it turns out, Deep Throat knew a little bit about security. He was- Deputy Chief of the FBI at the time. So he had a lot of inside knowledge about how to protect himself. But there are lots of other ways that people can do it. I mean, clearly, talking to somebody in person is really secure because you're not leaving a paper trail and you're not leaving an electronic trail. For most people, you know, just using their personal phone or their personal email is fine if you're not dealing with national security secrets. If you work for a company or you work for even, you know, many government agencies and

• 13:49Speaker 05

  you're not dealing in security, as long as you're not using your work email and your work phone, your bosses aren't going to be able to trace who talked to a reporter. For people who work, who do handle national security secrets or handle really sensitive stuff like IRS files, they have to take a lot more precautions. There's also Proton Mail, which is an email service that encrypts email. So I know that's used by a lot of people to send sensitive messages. Another way that people can hand off files is they can do it in person, handing off a CD or a hard drive, and they can send it to the mail.

• 14:30Speaker 05

  Believe it or not, the good old US Mail system is one of the more secure ways that people can send information, just dropping off mail at a mailbox. And there's usually no trace of who sent it. And in fact, US Mail is the way that a leaker leaked Donald Trump's tax returns to New York Times and the way the same person leaked tax returns or tax data on many wealthy Americans to ProPublico. And interestingly, neither publication knew who sent them the data.

• 15:10Speaker 05

  So the hardest part for them was, once they got the information, was verifying that it was real.

• 15:19Ben Brock Johnson?

  More from Todd in a minute.

• 15:36Speaker 00

  Support for WBUR comes from the Quiet Tension Podcast. There's a part of high performance that drives you, shapes you, and pulls at you, too. Rarely spoken, almost never examined, that's the quiet tension. Coming up, psychologist and executive coach Dr. Sharon Churbin with Steve Paliuka on what separates the leaders people follow from the ones they don't. Stay with us for a preview. Listen closely wherever you get your podcasts. Support for WBUR comes from Heading Home. Homelessness isn't always visible. Many families continue working, sending their children to school, and participating in their communities while quietly experiencing housing instability.

• 16:19Speaker 00

  Heading Home, the largest family shelter provider in Massachusetts, has been working to prevent and end homelessness for more than 50 years. Join their mission and see how you can help at headinghomeinc.org.

• 16:35Amory Sivertson?

  We're talking with Todd Wallach, our colleague at WBUR, about how to communicate with journalists while protecting your identity as a source. Things like using the good old fashioned snail mail, or protecting your device using something called a Faraday cage.

• 16:51Speaker 05

  It's a way to block electrical signals from computers.

• 16:57Amory Sivertson?

  Hmm.

• 16:58Speaker 05

  Yeah. Once, when I worked at the Boston Globe, we had some classified materials that we needed to keep secure, and we kept them on a computer that was air-gapped, meaning there was air between that computer and any other computer network. Because one big risk that people are concerned about is that if you have materials on a computer that are sensitive, and they're connected to other computers, and then in turn connected to the internet, they might be vulnerable. I also personally worry that if somebody handed me a bunch of files and I just inserted

• 17:40Speaker 05

  them on my computer, could it contain malware that infects our own computer? Could it be a Trojan horse, in other words? So journalists also have to protect themselves and make sure that they're not inadvertently uploading viruses or some other nefarious software to their entire network when they get sensitive files from people.

• 18:05Ben Brock Johnson?

  You and I talked recently about about some of these technology challenges and talked about how Signal, the messaging service, can sometimes be a simpler way to go when journalists and whistleblowers or anonymous sources are trying to talk to each other.

• 18:23Speaker 05

  Yeah, absolutely. And a lot of people that I know who worry about security tend to like Signal because it's not only encrypted in the entire way, but Signal, the organization, also doesn't keep copies of the messages. They might have a record of who contacted who and when, but they don't have a record of actual messages. Whereas there are some other messaging services where people worry that the operator does have copies of the actual records. And so a government agency or a company might be able to subpoena those companies and get copies of those records.

• 19:02Amory Sivertson?

  That is exactly what I was going to ask, because I think for a while now, and we used to make this show in partnership with Reddit, for a while Reddit has been seen as like the anonymous place to go to share your stories, your tips, your leaks, your whatever. Not the only place, but a place where you can be anonymous. And yet, recently, I've been thinking about, but what if Reddit, like we've seen with Meta, where we've seen Mark Zuckerberg acquiesce to the Trump administration in a way that maybe surprised some people, what if that happens with Reddit? And suddenly, yes, your username is anonymous, but your email address is not.

• 19:45Amory Sivertson?

  Reddit has all of that information. And so if we're talking about Signal, though, which does seem like it's secure in a different way, on a different level, are there things that a source should be keeping in mind when reaching out to a journalist on a platform like Signal?

• 20:01Speaker 05

  Yeah, so one thing, again, is it's important not to use your work phone, because if it's your work phone, the works IT department can probably tell that you've installed Signal. And maybe they would wonder why. The another thing is that it is, while it is true that using Signal and some other systems means that the messages are encrypted on route, they're scrambled, so it's harder to intercept the messages, they're probably original copies of the messages stored on both the sender and the recipient's phone. So if somebody got arrested and they grabbed

• 20:42Speaker 05

  their phone, that phone would have copies of all the messages, unless they set it to auto delete or they manually deleted it.

• 20:50Ben Brock Johnson?

  I think a lot of people think about this in a pretty altruistic way. I mean, certainly I do because I'm a journalist and, you know, I view part of my job as part of the fourth estate, sort of being skeptical of of things and, you know, helping people speak truth to power and and all sorts of things. But any kind of leak or whistleblowing act is a risky act, both for the journalist sometimes, but really more importantly and more largely for the for the source.

• 21:30Speaker 05

  Absolutely. And granted, most people who are going to leak, aren't going to leak national security details, so the risk is is a bit lower. But there are certainly people who have shared important secrets because they thought it was important and have gotten into serious jeopardy. One name that comes to mind is Reality Winner, and that is a real name. She was a government employee who was concerned in hearing reports that Russia had interfered in the US elections, and there were a lot of people publicly denying

• 22:12Speaker 05

  that. And she had access to military intelligence showing that the milit-

• 22:18Speaker 05

  Military intelligence officials did indeed have evidence of Russia interference. So she wanted to share that story. She printed out some pages of that report, mailed it off to The Intercept. The Intercept didn't know who she was. But in trying to verify that information, The Intercept shared it with the government. And they also, I think, posted the document later online. And the government was able to notice that there was a fold in the paper indicating it was printed. And because it was printed out at a secure national security facility, they keep elaborate

• 23:01Speaker 05

  records on who printed out what at each time. And there were also embedded marks that wouldn't be visible to the naked eye easily that had additional information about when and where it was printed out. And they were able to use that to track her down. And she wound up going to prison for five years. Charles Littlejohn, the person who shared the confidential tax returns for billionaires and Donald Trump. Again, the media didn't know who he was, but because the IRS very carefully tracks the distribution of tax information and tax data, they were eventually able to figure out who did it.

• 23:46Speaker 05

  And he was also sentenced, I believe, to five years in prison, which was far above the recommended maximum term.

• 23:54Amory Sivertson?

  You were talking about Deep Throat and Watergate and the specifics of how that information was leaked. But if we zoom out and we think about real world changes that have come, that have happened as a result of some of these whistleblowers and anonymous sources and leaks, what would you say are those kind of bigger real world impacts?

• 24:24Speaker 05

  Blowing the whistle is really important in exposing corruption or problems, systematic failures, all sorts of issues that otherwise we wouldn't know about. In the case of Watergate, it brought down a presidency and it inspired the creation of a whole flurry of laws, including the Freedom of Information Act, including laws eventually to protect whistleblowers. So in many cases, there are legal ways that people can notify their own company or now or their own agency about problems, or they can go to government watchdog organizations

• 25:06Speaker 05

  and report problems with some security because there are laws protecting people against retaliation. I think there's greater awareness with movies about Watergate, about the importance of alerting the press to problems. And again, in 99% of the cases, people who blow the whistle are not in jeopardy of violating the law. It is not illegal to tell a journalist that their government agency is laying off tons of people. That is probably important news. People should be aware of it, but it is not one of those national security secrets where

• 25:49Speaker 05

  people face legal jeopardy from informing the public about. And it is really important that people contact either their government agency or journalists to alert the public when there is a real problem that isn't getting fixed.

• 26:06Ben Brock Johnson?

  Seems like a good place to end. Todd Wallach, thank you very much.

• 26:10Speaker 05

  It's great having the conversation with you.

• 26:20Ben Brock Johnson?

  A reminder to our listeners that yes, you can reach us securely via email at [email protected]. That's our email. Or you can text and call us on signal at 646-456-9095.

• 26:38Amory Sivertson?

  And we should say WBUR is an NPR member station, and the CEO of NPR, Catherine Marr, chairs the board of the Signal Foundation, the nonprofit that supports the messaging app.

• 26:50Ben Brock Johnson?

  And again, if there's anything you need to tell us about, we are all ears.

• 26:54Amory Sivertson?

  Secure ears.

• 26:56Ben Brock Johnson?

  This episode was produced by Caitlin Harrop and Franny Monahan. It was co-hosted by me, Ben Brock Johnson.

• 27:01Amory Sivertson?

  And me, Amory Sivertson. It was edited by Meg Kramer. Mix and sound design by our production manager, Paul Vikes.

• 27:08Ben Brock Johnson?

  The rest of our team is Dean Russell, Emily Jankowski, Grace Tatter, and our managing producer, Sumit Joshi. See you next week.

• 27:30Speaker 00

  Support for WBUR comes from the Quiet Tension Podcast with Dr. Sharon Churbin, psychologist, executive coach, and a close listener to what lives beneath high performance. Here she is with Steve Paliuka, who built Bang Capital and helped bring a championship back to Boston on the thing the best leaders do that most don't.

• 27:51Speaker 06

  The best leaders kind of give credit and take blame. When something goes wrong, they're the first ones to take responsibility for it. And they see the good in the other people on the team. They don't immediately try to deflect whatever problem there was, what went wrong. You miss the sales target on the salesperson, they reflect on themselves and what they could do better. Same thing, you know, what Joe Mazzulla does in basketball. If you see his press conferences and the Celtics don't play well, the first thing he says is, you know, I need to coach better. I made a mistake here. I made a mistake there. Not many coaches do that. But that's why the players love Joe, and that's why, another reason he's a great coach. So there are things like that that you learn. There are many, many more things like that I learned from people like Red

• 28:36Speaker 06

  Auerbach and my classmates from business school and sports and all the rest. And really, what an array of leaders, because leadership

• 28:45Speaker 00

  Is both the same and different depending on the environment that you're in.

• 28:51Speaker 00

  Listen for more of the Quiet Tension wherever you get your podcasts.

• 28:57Speaker 02

  Progressive's Accident Response can contact emergency services if you're in a major accident. The only thing worse than someone you love being in an accident is not being able to help them. So Progressive is here to help when you can't. So get peace of mind knowing your loved ones are protected with Progressive's Accident Response. Learn more at progressive.com. Progressive Casualty Insurance Company and Affiliates. Limited availability in California. Driver is responsible for emergency and towing charges not covered by the policy. Coverage subject to policy, terms, and conditions. As wish lists grow, you know where to go. Head to Ulta Beauty. We have gifts they'll love from brands like Tato One and Rare Beauty by Selena Gomez. Shop beauty faves to give or keep from Shark Beauty, Sol de Janeiro, and more. Not sure what they want?

• 29:41Speaker 02

  You can't go wrong with Balmain, Clinique, or Redken. And don't forget to put yourself on the list. Book a salon moment or add a little more sparkle to your season. Shop holiday in store or at Ulta.com. Ulta Beauty.