The Rise of Digital Whistleblowing Platforms — and How They Work

Whistleblowers have been central to some of the most important news stories of the last decade. The contributions of WikiLeaks whistleblower Chelsea Manning, former National Security Agency contractor Edward Snowden, or the still-anonymous “John Doe” behind the Panama Papers investigation, show how leaks-powered investigative reporting is capable of making a difference when it comes to exposing major cases of abuse of power, violations of civil rights, or tax evasion. 

Whistleblowing was not invented in the last ten years. Investigative journalists have historically relied upon key information from whistleblowers for decades, especially in the Western context. 

But digital technologies have changed the practice of whistleblowing, with a growth in new tactics and strategies based on the use of encryption-based communication tools. In particular, investigative journalists may now find encryption technology can be some of their best allies when it comes to cooperating with whistleblowers and fulfilling their duties in regards to source protection in the digital age. 

What I call “digital whistleblowing platforms” are among the most interesting phenomena to have emerged at the crossroads between journalism and hacking in recent times. These software solutions enable news organizations or individual journalists to provide potential sources with safer, anonymous communication channels online.

By using strong encryption standards — including the Tor Network — as a core part of the infrastructure, digital whistleblowing platforms enable confidential communication, as well as secure file and document sharing. In principle, newsrooms and journalists adopting this practice can offer an online dropbox of sorts where whistleblowers can deliver story tips or leaks anonymously, all while being protected by higher security standards than those provided by commercial and day-to-day digital communication tools.

The history of digital whistleblowing platforms in their current shape starts with WikiLeaks, which pioneered this approach with its own encrypted submission system that granted the organization access to some of the most important leaks of the last decade. Manning provided files to WikiLeaks that exposed secret details about US actions in the conflicts in Iraq and Afghanistan, and troves of diplomatic correspondence.

Today, the digital whistleblowing platform ecosystem is diverse and populated by different organizations with differing aims and editorial strategies, from independent groups of journalists to the most prominent news brands of the world.

I’ve conducted an academic study into these platforms internationally, and the results have been published in a peer-reviewed book, “Digital Whistleblowing Platforms in Journalism. Encrypting Leaks.” 

For my research, I examined 21 digital whistleblowing platforms in 15 countries, aiming to understand how differing approaches to whistleblowing have spread. I also looked at how platforms operate and conceptualize their work in the context of the sometimes-blurred boundaries between journalism, hacking, and activism. 

From a technological perspective, two open-source software solutions have become standard for whistleblowing platforms: SecureDrop, developed by the San Francisco-based Freedom of the Press Foundation, and GlobaLeaks, from the Italian Hermes Center for Transparency and Digital Human Rights, another organization dedicated to press freedom and information security training. Although there are technical differences, these groups follow a similar concept and offer different solutions. Both organizations also offer mentorship and technical assistance in setting up platforms, and crucially, they operate as technology providers that take care of anything technical, guaranteeing the testing and updating of the functionality and security of the software. In doing so, these organizations fill a technical skills gap for many news outlets. 

Organizations that use these two sites tend to operate using different editorial approaches. My research proposes a taxonomy of whistleblowing platforms, which can be divided into at least four groups, according to how platforms manage all the steps involved in a whistleblowing-type leak and the release of content. The taxonomy includes:

1. “Publishing” platforms that use the leaks they receive to produce their own content or to make documents available over the internet; 
2. “Collaborative” platforms, which tend to publish content based on the leaks they receive with selected media partners; 
3. “Multi-stakeholder” platforms that operate as facilitators of leaks, offering whistleblowers the opportunity of selecting recipient news organizations during the process; and
4. “Media” platforms, which are similar to “publishing” platforms, but are operated by established news organizations, newspapers, or major media conglomerates. These platforms differ from “publishing” platforms in that “publishing” platforms tend to be managed by smaller organizations, collectives, or activist groups. 

In journalism today, whistleblowing platforms are spreading and comprise independent investigative journalism collectives, such as the Investigative Reporting Project Italy  or the African Network of Centers for Investigative Reporting, free speech organizations such as Free Press Unlimited, and large news organizations, which can range from large public broadcasters in Europe to The New York Times. Outlets like the UK-based Guardian are now offering technological solutions to solicit leaks and support whistleblowers. 

While technology and digital whistleblowing platforms can be a huge help to journalists who want to work with whistleblowers, no technical solution is capable of offering 100% security. The technology behind these platforms is certainly capable of granting the highest and safest standards of security available today, but technology itself can’t be a cure-all, and threat models may change depending on the context. 

A group of investigative journalists analyzed and identified the key elements of contemporary whistleblowing-led journalism. The Perugia Principles enumerate technology’s role in source protection in the digital/surveillance age. Yet, safety for journalists and whistleblowers is only possible when journalistic standards, legal safeguards, and safe technology together create a safe environment for all those involved. 

Whistleblowers take enormous risks — including retaliation, arrest, or worse — when they decide to speak out against wrongdoing, and it is the duty of journalists to protect them as best we can. Whistleblowing platforms are fundamental in facilitating this process. With leaks increasingly becoming more vital to shaping stories, news organizations need to be ready to cope with whistleblowing, its advantages, its grey zones, and its perils. 

Additional Reading

• Working with Whistleblowers
• Covering Whistleblowers: 6 Tips for Journalists
• The Perugia Principles: 12 Ways Journalists Should Protect Their Sources

Philip Di Salvo is a lecturer and post-doctoral researcher at the Università della Svizzera Italiana’s Institute of Media and Journalism. He writes for Wired, Motherboard/Vice, Esquire, and has written two books on leaks and whistleblowing.