how to

How and When You Should Leak Government Secrets

A guide for federal employees who need to get something off their chests.
February 8, 2017, 9:34pm

So you're a government employee, and you're thinking about leaking government secrets to the press. Congratulations! As you're no doubt aware, your boss, President Donald Trump, has a "war on the media" going on. He's said that people in the media are "among the most dishonest human beings on Earth" and once claimed that journalists are actually "the lowest form of humanity." His advisor Steve Bannon said he views the media as "the opposition party."


Except your colleagues don't seem to view journalists the same way. Though the Trump administration tried early on to clamp down on federal workers communicating with the press (or even Congress), leaks from inside government have been coming fast and furious about details big and small.

"Leaking is ubiquitous in Washington," according to Esha Bhandari, staff attorney at the ACLU's Speech, Privacy, and Technology Project. "Officials from the highest levels on down leak for a variety of reasons, whether it's self-interest, whether it's public interest motivation, whether it's to advance their political goals."

Some leaks seem to just be the work of one faction in the White House wanting to shit-talk another faction. Other juicy details don't seem to be much more than gossip, like Trump's alleged tendency to hang around the White House in a bathrobe or his rage at SNL's Sean Spicer sketch. But a few leaks are legitimately big deals, like the documents that are allegedly drafts of potential executive orders.

Leaks that expose actual government wrongdoing are constitutionally protected speech, but they're not treated that way these days according to Bhandari. "The system as it currently stands puts a lot of the onus on government employees to have to deal with legal challenges, and obviously that has a strong chilling effect," she told me. "That's a loss for the public."

So if you're thinking about leaking, but you don't know when it's OK, or how to do it anonymously without getting caught, here's everything you need to know:

1. Decide Whether You Really Need to Leak

I get occasional emails from would-be leakers—mostly in the private sector—and I can say from experience that leaked info is not always news. Sometimes, people leak as a way to screw over their workplace rivals, or for some other petty reason; you might want to ask yourself if this material you're trying to send to the press is really going to be of interest to anyone.

Also worth noting: If your organization is doing something awful, but you're in a position to voice your concerns internally, that's the best short-term course of action. The Obama administration defended itself after the Edward Snowden revelations by claiming that Snowden stayed mostly quiet about his concerns before he took them to the press—implying that he was leaking information for self-serving reasons. But an investigation by VICE News last year proved that Snowden actually pushed fairly hard for internal change before blowing the whistle.


"There are official channels for blowing the whistle to institutional audiences," said Tom Devine, the legal director of the Government Accountability Project. "You can bring that to the Federal Whistleblower Agency, the Office of Special Council, an agency inspector general, or the head of the agency where you work. But you're limited to those channels."

2. Know Your Rights

According to Bhandari, leaking is your constitutional right. "The First Amendment would require that the government can't prevent people from whistleblowing about illegality, waste, fraud, or abuse occurring the in the government, because the government has a great need to know about those things." So yes, the Constitution is on your side, but unfortunately, Bhandari added, "Current law doesn't adequately take that into account."

Instead, she said, "review of retaliatory decisions goes through an administrative process that heavily favors the government," and this process can have "a chilling effect on people in government who want to blow the whistle about illegality or abuse that they're seeing."

The Whistleblower Protection Act of 1989 was supposed to prevent retaliation against certain government employees who expose crime, gross abuse, mismanaged funds, or public safety threats, Bhandari said, but she noted that "not all federal employees are covered by that. Notably, a lot of intelligence officials are not covered by that."


So often, when you expose wrongdoing by giving sensitive information about to the press, "You're acting at your own peril," Devine told me.

3. Choose Your Recipient(s)

Only a few dozen organizations accept anonymous leaks. The easiest way to transfer your documents anonymously is with a tool called Securedrop (I'll explain how that works shortly), which keeps a directory of media organizations and NGOs who use it. My favorite is VICE Media, but I'm biased.

Leaking to multiple organizations is a good idea, Devine told me. If someone misconstrues the information you're providing, or publishes something that doesn't cover the whole scope of the problem you're trying to expose, that can have the opposite of the desired effect. "It could be an advanced warning that gives the corrupt institution advanced opportunity for a coverup, for destroying documents, and for solidifying testimony. That would be a disastrous mistake."

So while journalists like myself love exclusive news leads, you potentially have a lot to gain by also dropping your information into the SecureDrop, an activist organization like the Project on Government Oversight, the ACLU, or Greenpeace, which might already have the necessary expertise to act on your evidence. "If that happens, then society surrounds the corrupt bureaucracy instead of the corrupt bureaucracy surrounding the whistleblower," Devine said.

4. Prepare the Documents You're Leaking

You obviously need to get the relevant files safely out of your workplace, and I don't know how to help you do that. But according to Devine, you might not want to take the originals—that way you're literally not stealing anything. This is a particularly useful strategy if your leak is going to result in some law enforcement agency rummaging through all these files soon anyway.

"I have people do screenshots of the records, so they can honestly say they didn't take those documents out of the organization," he told me. A phone picture of your computer screen might also be a good idea, since the document instantly transfers to a device that is your private property. In order to direct the investigators who will eventually arrive to the smoking gun, Devine said, "Set up a folder with a misleading name. Put it in the archives, and you can direct the government where to find it."


But it's much better to have the originals, so if possible, transfer the files onto a thumb drive or something and take them home.

5. Prepare a Leak Machine

Screenshot via Wikimedia Communs User Tails project

Unless you go the 20th-century route and have your leaked documents delivered by the United States Postal Service (which arguably is a good idea, as that avoids an electronic paper trail), you're going to be doing this digitally. In that case, "leaking" means sending detailed note, or some files, or both, anonymously over the internet, and that's going to involve a lot more than just shooting a reporter a quick email.

It's critical that you not use your work laptop for any leak-related activities. Instead, choose a laptop you don't use for work-related browsing or emailing. It might be a good idea to grab an old laptop you don't use anymore, clear the hard drive, and start fresh. Even better: You may want to install the Tails operating system, which is programmed to "forget" everything you do while you're using it.

6. Make Yourself Anonymous

You could do your leaking from home, but I don't recommend it. Instead, when you have some time off, locate a source of WiFi you don't generally use—a library or a Starbucks a few towns away. Your phone is a tracking device, so keep that turned off or leave it at home. Once your leak machine is on WiFi, you're going to access the deep web. Don't be scared.

If you're running Tails, you already have a browser on there called Tor. (If not, you need to install it on your leak machine before you leave the house.) You'll immediately find that Tor sucks. It's the slowest browser in the world, but that's because it's running everything through multiple layers of encryption. In addition to encrypting your online activity, Tor is pretty much the only way to access deep web urls, which end with .onion, such as VICE's SecureDrop page: cxoqh6bd23xa6yiz.onion.


Word to the wise: Don't do anything with Tor apart from leaking your documents. If you log in into your email or social media accounts, you risk having them associated with Tor and therefore, your leaking activities. So stay focused.

7. Drip, Drip, Drip!

SecureDrop itself will guide you through the very easy process of uploading your files, and will allow you to add a note—or you can send just a note, if you prefer. Upload everything you have, and then add a detailed note that helps the recipient connect dots. It's a good idea to explain laws, policies, and other inside-baseball stuff about your workplace that the journalist on the other end might not know about. In short: Spell out the violation. Don't just drop off the documents.

After you click "Submit Documents for the First Time," you'll get a long string of random words like "gamble shark rent enough verify temporary regal," or something like that. This is a secret code you can use to log back in and check for a response a few days later. This is important: You will want to log back in, according to Devine. "Very seldom does it work where you can just drop evidence in someone's lap," he told me. "There needs to be a tutorial on its significance, and maybe a lot of explanation to help demystify the technical jargon." He doesn't think of links in terms of a "disclosure moment," but rather as "disclosure process."

Be patient. We journalists can be a lot dumber than movies make us look. In all likelihood, we'll have a lot of questions to ask you before we can go ahead with a story. We might even want more documents. Sorry.

8. Expect a Shitstorm

"Whether or not you've done it right or wrong, you should expect that if the leak has had an impact, there'll be a determined effort to find the source—sometimes an obsessive effort," Devine told me. Obviously you become a target, but this effort can impact your coworkers as well. After a leak in 2007, for instance, the FBI raided the homes of unrelated NSA employees who had raised similar issues internally, despite the fact that they "had scrupulously worked within the system," Devine told me.

If you're caught, you might be celebrated as a hero, or your life could be ruined.


Judges in the past have decided that some leaks, like the revelation of horrific war atrocities during the Vietnam War by Daniel Ellsberg, were justified, and the charges against Ellsberg were dismissed. But don't count on that. Some kinds of leaks—like the ones about White House staffers struggling to find light switches—are frowned upon, but not really punished. Other leaks can earn you a lengthy prison term like Chelsea Manning, or force you into exile like Edward Snowden.

9. Never Tell Anyone

When I say never tell anyone, I mean never tell anyone. Not your significant other, not your cat. No one. It's the only way to stay in control of your secret.

In rare cases, people who leak information stay anonymous as long as they want. Mark Felt, a.k.a. Deep Throat, who helped expose President Richard Nixon's involvement in the Watergate break-in in 1972, managed to stay anonymous for 36 years. If you expose serious wrongdoing, and cover your tracks, you can follow his example.

Follow Mike Pearl on Twitter.