November 29 2010
Andy Greenberg
In a rare interview, Assange tells Forbes that the release of Pentagon and State Department documents are just the beginning. His next target: big business.
Early next year, Julian Assange says, a major American bank will suddenly find itself turned inside out. Tens of thousands of its internal documents will be exposed on Wikileaks.org with no polite requests for executives’ response or other forewarnings. The data dump will lay bare the finance firm’s secrets on the Web for every customer, every competitor, every regulator to examine and pass judgment on.
(For the full transcript of Forbes’ interview with Assange click here.)
When? Which bank? What documents? Cagey as always, Assange won’t say, so his claim is impossible to verify. But he has always followed through on his threats. Sitting for a rare interview in a London garden flat on a rainy November day, he compares what he is ready to unleash to the damning e-mails that poured out of the Enron trial: a comprehensive vivisection of corporate bad behavior. “You could call it the ecosystem of corruption,” he says, refusing to characterize the coming release in more detail. “But it’s also all the regular decision making that turns a blind eye to and supports unethical practices: the oversight that’s not done, the priorities of executives, how they think they’re fulfilling their own self-interest.”
This is Assange: a moral ideologue, a champion of openness, a control freak. He pauses to think—a process that occasionally puts our conversation on hold for awkwardly long interludes. The slim 39-year-old Wiki Leaks founder wears a navy suit over his 6-foot-2 frame, and his once shaggy white hair, recently dyed brown, has been cropped to a sandy patchwork of blonde and tan. He says he colors it when he’s “being tracked.”
“These big-package releases. There should be a cute name for them,” he says, then pauses again.
“Megaleaks?” I suggest, trying to move things along.
“Yes, that’s good—megaleaks.” His voice is a hoarse, Aussie-tinged baritone. As a teenage hacker in Melbourne its pitch helped him impersonate IT staff to trick companies’ employees into revealing their passwords over the phone, and today it’s deeper still after a recent bout of flu. “These megaleaks . . . they’re an important phenomenon. And they’re only going to increase.”
He’ll see to that. By the time you’re reading this another giant dump of classified U.S. documents may well be public. Assange refused to discuss the leak at the time FORBES went to press, but he claims it is part of a series that will have the greatest impact of any WikiLeaks release yet. Assange calls the shots: choosing the media outlets that splash his exposés, holding them to a strict embargo, running the leaks simultaneously on his site. Past megaleaks from his information insurgency over the last year have included 76,000 secret Afghan war documents and another trove of 392,000 files from the Iraq war. Those data explosions, the largest classified military security breaches in history, have roused antiwar activists and enraged the Pentagon.
Admire Assange or revile him, he is the prophet of a coming age of involuntary transparency. Having exposed military misconduct on a grand scale, he is now gunning for corporate America. Does Assange have unpublished, damaging documents on pharmaceutical companies? Yes, he says. Finance? Yes, many more than the single bank scandal we’ve been discussing. Energy? Plenty, on everything from BP to an Albanian oil firm that he says attempted to sabotage its competitors’ wells. Like informational IEDs, these damaging revelations can be detonated at will.
Long gone are the days when Daniel Ellsberg had to photocopy thousands of Vietnam War documents to leak the Pentagon Papers. Modern whistleblowers, or employees with a grudge, can zip up their troves of incriminating documents on a laptop, USB stick or portable hard drive, spirit them out through personal e-mail accounts or online drop sites—or simply submit them directly to WikiLeaks.
What do large companies think of the threat? If they’re terrified, they’re not saying. None would talk to us. Nor would the U.S. Chamber of Commerce. WikiLeaks “is high profile, legally insulated and transnational,” says former Commerce Department official James Lewis, who follows cybersecurity for the Center for Strategic & International Studies. “That adds up to a reputational risk that companies didn’t have to think about a year ago.”
Already U.S. laws wrapped into financial reform this year expand whistleblower incentives to offer six- and seven-digit rewards to staffers in any industry who report malfeasance. Wiki Leaks adds another, new form of corporate data breach: It offers the conscience-stricken and vindictive alike a chance to publish documents largely unfiltered, without censors or personal repercussions, thanks to privacy and encryption technologies that make anonymity easier than ever before. Wiki Leaks’ technical and ideological example has inspired copycats from Africa to China and rallied transparency advocates to push for a new, legal promised land in the unlikely haven of Iceland. It’s also fueling a race in the cyber security industry and in Washington to find technology that can plug information leaks once for all.
Today Assange looks tired, his eyes narrowed and the skin beneath them puffy, as if he’s unused to even England’s gloomy daylight. He has no permanent home. “We’re like a traveling production company; everyone moves somewhere, and we put on a production,” he sighs. “We haven’t had any rest since April.” In Sweden, where many of the group’s servers are based, a warrant has now been issued for his arrest on rape charges. He’s denied the accusations, arguing they amount to smear tactics. He’s also afraid to set foot in several other countries, including the U.S., fearing that officials will find reasons to detain him. No question that Wiki Leaks would be in trouble if he were jailed: A spokeswoman says it has a “contingency plan,” but without Assange there is no public face. Meanwhile, his resources have been drained by defections from his organization; some old friends and associates have taken issue with his autocratic style.
None of which has stopped him from picking new fights. The promised release of bank documents would be the largest assault by WikiLeaks on the corporate sector, and Assange says the business community should expect plenty of sequels. In early October the site shut down its document-submission system; Assange says it was receiving more information than it could find resources to publish, thousands of additions a day at some points. The total is more gigabytes of data than he can count. “Our pipeline of leaks has been increasing exponentially as our profile rises,” he says, drawing a curve upward in the air with one hand.
If even a fraction of his claims are borne out, he’s already sitting on a crypt of data any three-letter spy agency would kill for. The world’s most vocal transparency advocate is now one of the world’s biggest keepers of secrets. And about half of those revelations, says Assange, relate to the private sector.
Over the last four years he has been so busy embarrassing various governments, from Washington to the corrupt Kenyan regime of Daniel arap Moi, that many forget the corporate scandals already on WikiLeaks’ trophy wall. In January 2008 the site posted documents alleging that the Swiss bank Julius Baer hid clients’ profits from even the Swiss government, concealing them in what seemed to be shell companies in the Cayman Islands. The bank filed a lawsuit against WikiLeaks for publishing data stolen from its clients. Baer later dropped the suit—but managed to stir up embarrassing publicity for itself. The next year WikiLeaks published documents from a pharma trade group implying that its lobbyists were receiving confidential documents from and exerting influence over a World Health Organization project to fund drug research in the developing world. The resulting attention helped crater the WHO project.
In September 2009 commodities giant Trafigura filed an injunction that prevented British media from mentioning a damaging internal report. The memo showed the company had dumped tons of toxic waste in the Ivory Coast, chemicals that allegedly sickened 100,000 locals. But it couldn’t stop WikiLeaks from publishing the information. Trafigura eventually paid more than $200 million in settlements.
How can an American corporation respond to a Wiki attack? Lawsuits won’t work: WikiLeaks is legally shielded in the U.S. by its role as a mere conduit for documents. Even if a company somehow won a judgment against WikiLeaks, that wouldn’t shut it down. Assange spreads the site’s assets over many countries. “There’s no single target to drop a bomb on,” says Eric Goldman, a law professor at Santa Clara University.
The best protection? With a dash of irony Icelandic Wiki Leaks staffer Kristinn Hrafnsson suggests that companies change their ways to avoid targeting. “They should resist the temptation to enter into corruption,” he says. Don Tapscott, coauthor of The Naked Corporation (Free Press, 2003), agrees. His simplistic conclusion: “Open your own kimono. You’re going to be naked. So you have to dig deep, look at your whole operation, make sure that integrity is part of your bones.”
Most corporations, instead, are turning to cybersecurity to shield their private parts. Despite dozens of calls to companies in tech, energy and finance, none wanted to talk about antileaking strategies. But a Forrester Research study found that about a quarter of companies in the U.S., the U.K., France, Germany and Canada were implementing leak- focused security software in 2010, and another third are considering that option. A study last year by the Ponemon Institute, a privacy-research consultancy in Traverse City, Mich., found that 60% of employees admit to taking sensitive data before they leave a company.
***
SOME OF THE MORE INTRIGUING ANTILEAK work is being done by Uncle Sam. In an unmarked government building on the edge of a residential Arlington, Va. neighborhood, a cybersecurity researcher named Peiter Zatko shows just how easily leaks can occur. He lays out a blow-by-blow history of one insider data theft: The suspect searched broadly over the network to find anything related to critical infrastructure, then returned to manually probe a few interesting files. “Then he walked away with enough information to shut down big chunks of the telephone systems in the United States,” Zatko says matter-of-factly.
Who was that shadowy data smuggler? “That was me,” says the 39-year-old researcher, giggling bashfully.
Zatko is not your typical Department of Defense employee. Even in his new Beltway digs, he prefers to be called “Mudge,” the hacker handle he used during decades of exploring the dark corners of the Internet. Frank Heidt, a former security staffer at MCI and several military contractors, says that when he first read Zatko’s exploit research in mid-1990s hacker zines, he thought that Mudge must be the pseudonym of a group. “He was so prolific that I thought he couldn’t be one person,” Heidt says. In 1998, as part of the L0pht hacker think tank, Zatko testified in a congressional hearing that he and his friends could shut down the Internet in 30 minutes.
Since March Zatko has also been a lead cybersecurity researcher at the Defense Advanced Research Projects Agency, the mad-scientist wing of the Pentagon devoted to projects that occasionally result in breakthroughs like the Internet and GPS. Zatko’s new pet project may be equally ambitious: He aims to rid the world of digital leaks.
The telephone system theft case that Zatko dissected in a Darpa conference room was a test, demonstrating that anyone with access to a network could steal data without detection, despite the system’s expensive security software. Now his challenge is to fix the problem. Since August he has led a project known as the Cyber Insider Threat, or Cinder. Like most Darpa initiatives it’s an X-Prize-style open invitation for ideas; recipients typically get tens of millions of dollars in government funding. Thirty-five entrants, mostly tiny companies, have already publicly signed up, many more in secret. “We’re looking to everyone from academia to startups to large government contractors,” says Zatko. “We’re not looking for evolutionary improvement. We want to pull the rug out from the problem altogether.”
It’s a well-worn carpet. Since late 2007 every major security software vendor, from McAfee to Symantec to Trend Micro, has spent hundreds of millions of dollars to acquire companies in the so-called Data-Leak Prevention (DLP) industry—software designed to locate and tag sensitive information, and then guard against its escape at the edges of a firm’s network.
The problem: DLP doesn’t work. Data is simply created too quickly, and moved around too often, for a mere filter to catch it, says Richard Stiennon, an analyst for security consultancy IT-Harvest, in Birmingham, Mich. “For DLP to function, all the stars have to align,” he says. “This is a huge problem that can’t be stopped with a single layer of infrastructure.”
More fashionable now is network forensics: the process of constantly collecting every fingerprint on a company’s servers to trace an intruder or leaker after the fact—and, perhaps, deter the next one. That’s a bit like fighting the next war according to the last one. Still, revenue at NetWitness, a prominent Herndon, Va. startup in that budding field, has leaped from $250,000 to $40 million since 2006. While the software generally gathers data and makes it easily available to queries, it doesn’t pinpoint culprits. “There’s nothing in current technology that can do this in an automated fashion,” says Shawn Carpenter, principal forensics analyst at Net Witness. “You need a Columbo.”
Or, better yet, a robo-Columbo. Darpa’s Zatko has been working on a system of automatically identifying what he calls “malicious missions”: insider activity aimed at stealing data from inside a company’s firewall, whether it’s a Dell PC remotely hijacked by a Chinese cyberspy or Bradley Mannings, the U.S. soldier accused of leaking classified documents about combat in Afghanistan to WikiLeaks. Zatko’s system would monitor networks in real-time for just the sort of data-stealing behavior he would perform himself: steps like scouring large areas of the network for a certain file, dumping piles of data to external storage hardware or sending encrypted files out over the Internet. No single episode would signal a leak; instead, the software would link acts in a probabilistic chain, triggering an alert only if a string of events points to purposeful data theft.
Some of that leaky behavior isn’t what a casual observer might expect. Consider the cyber footprints left by Robert Hanssen, a former FBI agent serving a life sentence in a Colorado supermax prison for selling intelligence to the Soviets over two decades. Every few days Hanssen would stop his normal activities and make a single query to a server across the network, a pattern he repeated for years. That server, Zatko says, held the counterintelligence database. Hanssen was searching for himself, a routine check to see if he’d finally been found out.
“You put all these things together into the different components of the mission,” says Zatko. “I’m looking for these new rhythms, new tells, new interrelations and requirements.”
Cinder wasn’t created to combat WikiLeaks—in fact, it predates WikiLeaks’ biggest military scandals. But Zatko has nonetheless found himself squarely in opposition to Assange’s mission—a strange face-off, given that the two men once traveled in the same hacker circles, during the years when Assange went by the hacker handle Mendax (a Latin reference to the “splendidly deceptive” in the poet Horace’s Odes) and reveled in accessing corporate and government systems without authorization. Neither will reveal much about their past encounters, but Assange says that they “were in the same milieu.” Asked about Assange, Zatko says only, “I have very pleasant memories of those old days.”
WikiLeaks’ founder, in fact, seems to have trouble accepting that Mudge is working for the other side. “He’s a clever guy, and he’s also highly ethical,” says Assange. “I suspect he would have concerns about creating a system to conceal genuine abuses.” He dismisses Cinder as just another system of digital censorship. And those systems, he says, will always fail, just as China’s Great Firewall can’t stop well-informed and determined dissident Internet users. “Censorship might work for the average person but not for highly motivated people,” Assange says. “And our people are highly motivated.”
***
SHUTTING DOWN WIKILEAKS WOULDN’T STOP the growing movement of transparency agitators. They now have a nation-size ally: Iceland. Since WikiLeaks scored a major scoop unearthing the corrupt loans that helped destroy that country’s largest bank, the volcanic island is fast on its way to becoming the conduit for a global flood of leaks.
It began when Kaupthing Bank collapsed in October 2008—a calamitous chain reaction that has strapped Iceland with $128 billion in debts, around $400,000 per capita. Ten months later Bogi Agustsson, a Walter Cronkite-ish anchor for Icelandic national broadcaster RUV, appeared on the evening news and explained that a legal injunction had prevented the station from airing a prepared exposé on Kaupthing. Viewers who wanted to see the material, he suggested, should visit a site called Wikileaks.org.
Those who took Agustsson’s advice found a summary of Kaupthing’s loan book posted on the site, detailing more than $6 billion funneled from Kaupthing’s coffers to its own proprietors and companies they owned, often with little or no collateral; $900 million went to Olafur Olafsson, a major investor in Kaupthing who, on his birthday, flew in Elton John from England, along with a grand piano, for a one-hour concert. “The banks had been eaten from the inside out,” says Kristinn Hrafnsson, a former investigative reporter in Reykjavik who now works with WikiLeaks.
A government investigation is still going on; no criminal charges have been filed. But WikiLeaks became a household name in Iceland. In December 2009 Assange and Daniel Domscheit-Berg, a German who then worked with Wiki Leaks, were invited to keynote a free-speech conference in Reykjavik. Their talk echoed an idea from American cyber libertarian John Perry Barlow, calling for a “Switzerland of bits.” Iceland, with its independent spirit and recent taste of explosive whistle-blowing, they suggested, could become the digital doppelgänger of a tax haven: a safe harbor for transparency, where it’s open season on government and business secrets—and leakers are protected by law.
The idea might have gone nowhere if not for Birgitta Jonsdottir. Assange’s message captivated the 43-year-old poet and self-styled “realist-anarchist.” She wasn’t just another idealistic protester with a goth wardrobe and hipster haircut. In the chaotic political environment that followed the national financial crisis, Jonsdottir had been elected to Iceland’s parliament, the Althingi, in April 2009.
Working with the country’s transparency activists, she pulled together the Icelandic Modern Media Initiative, or Immi. The initiative would bring to Iceland all the source-protection, freedom of information and transparency laws from around the world and even set up a Nobel-style international award for work in the field of free expression. Jonsdottir pushed through a unanimous resolution to create a series of bills to implement Immi. They would also make Iceland the most friendly legal base for whistleblowers on Earth.
Velkomin, as Icelanders would say, to Leakistan.
“The more that companies resist, the more information will get out about them,” says Jonsdottir when we meet in Reykjavik’s Hressingarskalinn café, around the corner from the parliament building. “They can’t hide anymore. The war is over. They lost.” In Jonsdottir’s vision Iceland will attract both mainstream media and Wiki Leaks-like organizations to move their data to Iceland, enjoying legal protection, just as another firm might incorporate in a tax-sheltering island in the Caribbean.
She may be getting a bit ahead of herself. Immi has yet to become law, though it has backing from powerful figures, including both Iceland’s minister of justice and the head of its progressive party. Even if it does, Immi likely wouldn’t offer much legal protection to organizations whose assets and staff aren’t physically in the country; they could still be sued anywhere else in the world, given that their digital and print publications could appear globally. Immi could also face resistance from the U.S. and the EU—particularly when it comes to military matters. As Marc Thiessen, a conservative pundit, wrote on the blog of the American Enterprise Institute in August, “Immi calls into question Iceland’s seriousness as a NATO ally, and Iceland needs to realize there will be consequences for its actions.” There could be a backlash for exposing corporate secrets, too. Alastair Mullis, a professor of law at East Anglia University in Britain, says, “It’s possible that Iceland will become the defamation capital of the world.”
Jonsdottir and fellow Immi creator Smari McCarthy are pushing ahead anyway. Immi, they say, doesn’t fashion new laws; it cherry-picks existing statutes from around the world (source shields from Sweden, libel protection from New York State, protected communications with journalists from Belgium, among them). “We’re basing our legislation on laws that have already withstood attacks,” says Jonsdottir. Defamation and other concerns like child pornography and copyright violations, she argues, would still be illegal in Iceland and wouldn’t be sheltered.
Nor is the idea to protect WikiLeaks itself, Jonsdottir points out. The site doesn’t need help: Its data and submissions process are carefully encrypted, and its infrastructure is spread over enough countries—including some servers in a bombproof, underground bunker in Sweden—that taking it offline is already nearly impossible.
Instead Immi would foster a new wave of media organizations and whistleblower outlets that don’t rely on Wiki Leaks’ technical savvy or resources. Already a handful of smaller, leak-focused conduits—regional sites like Africa-focused SaharaReporters or Thaileaks.info—have published damning data. Immi’s McCarthy says he’s been approached by media organizations from Rwanda to Chechnya. German WikiLeaks staffer Daniel Domscheit-Berg, disgruntled with Assange’s laser focus on infrequent megaleaks, has left the organization along with several others to create his own spinoff. “In the end there must be a thousand WikiLeaks,” he told Der Spiegel in September.
Iceland certainly has the infrastructure for a lot of informational mischief. Half an hour outside Reykjavik, on a landscape that resembles Mars covered in snow, the Thor Data Center is preparing for an influx of bytes. By 2011 it hopes to have thousands of servers in its aluminum-plant-turned-server-farm, powered by ultracheap geothermal energy and cooled by free arctic air. Iceland’s biggest Web host, ironically named 1984 Web Hosting, is excited about the boost Immi could give its business. “I created this company to prevent thought control,” says Mordur Ingolfsson, its chief executive. “In my humble opinion, Immi is the most important thing to happen to this godforsaken island since the Sagas were written.” (That’s 600-plus years.)
Jonsdottir agrees: “WikiLeaks was an important icebreaker. It was the tip. Immi is the rest of the wedge, and it will open up everything.” (She is less thrilled to learn that Assange speaks of Immi as his personal creation.)I ask Assange how he expects companies to cope with a world where hundreds of WikiLeak-alikes may soon exist. His three-part prescription is earnest—if a bit patronizing: “Do things to encourage leaks from dishonest competitors. Be as open and honest as possible. Treat your employees well.”
He also wants to clear up a misunderstanding. Despite his revolutionary reputation, he’s not antibusiness. He bristles at the media’s focus on his teenage years as a computer hacker who broke into dozens of systems, from the Department of Defense to Nortel, and was eventually convicted on 25 charges of computer fraud and fined thousands of dollars.
Instead, he prefers to think of himself as an entrepreneur. He tells the story of a free-speech-focused Internet service provider he cofounded in 1993, known as Suburbia. It was, to hear him tell it, the blueprint for WikiLeaks—in one instance, when the Church of Scientology demanded to know who had posted antichurch information on one site, he refused to help. (“He has titanium balls,” says David Gerard, that site’s creator.) “I saw it early on, without realizing it: potentiating people to reveal their information, creating a conduit,” Assange says. “Without having any other robust publisher in the market, people came to us.”
Leaks merely lubricate the free market, he says, settling into the couch and clearly enjoying giving me a lecture on economics. (Later, as a 45-minute interview pushes into two hours, he ignores his handler, who keeps urging him to leave for his next appointment.) He cites the example of the Chinese Sanlu Group, whose milk powder contained toxic melamine in 2008. While poisoning its customers, Sanlu also gained an advantage over competitors and might have forced more of them to taint their products, too, or go bankrupt—if Sanlu hadn’t been exposed in the Chinese press. “In the struggle between open and honest companies and dishonest and closed companies, we’re creating a tremendous reputational tax on the unethical companies,” he says.
Of course, Assange’s tax isn’t as equitable as it sounds. He alone decides where to apply the penalty, choosing the targets and when to expose them with a touch of theatrical grandstanding—and with zero accountability. For better—and worse—WikiLeaks has become the Julian Assange Show. As a photographer begins shooting, Assange wonders aloud if the coat he’s wearing might have been produced by a labor-exploiting company. A few minutes later he jokes about his “messiah complex.”
Like any true believer, Assange sees his work in simple terms. Markets, he reminds me, can’t exist without information. Business will come to appreciate what he offers. And if that requires a few painful scandals in the process?
Assange doesn’t miss a beat. “Pain for the guilty.”
