,
13 tweets,
2 min read
Read on Twitter
It's about 10PM, my partner's in Tokyo, I've been to Ikea and hung a pair of curtains on my own. Of course I have thoughts on The Intercept.
First: It is clear that in this case the leaker was going to get caught if the story was published, no matter how careful the journalists.
But there are legitimate questions. The printer dot thing isn't new. Could steps have been taken to avoid that?
Was providing an apparently unredacted copy to a government employee for verification unavoidable?
But, more importantly: theintercept.com/leak/ is almost silent on covering most of your tracks.
It's a document that goes into detail on how to anonymously communicate, but doesn't cover basics like "Is this material access controlled?"
Documents that are heavy on detail in one respect and light in another give readers the impression that that stuff doesn't matter
Other than having emailed The Intercept on an apparently separate matter, Reality Winner seems to have done everything listed on that page
Now yes *we* know that there are many other things to worry about, but when a user follows the documentation and loses anyway that's *bad*
If you have a page that encourages people to break the law, you owe it to them to provide enough information to help them assess the risks
Information on who you'll show it to to verify it. Information on whether you'll make a best effort attempt to redact metadata or not.
When you're documenting a process that could land someone in jail for the rest of their life (or worse), your documentation should be *good*
(Yes this has all been a long parable about the state of the tech industry)
