DDoSecrets is the New WikiLeaks

Wednesday 18 August 2021

How the transparency collective DDoSecrets eclipsed Julian Assange.

As Freddy Martinez tracked the latest impeachment proceedings against Donald Trump on Twitter, he saw a screencap of a CNN broadcast that struck him as odd. Right there in his feed was a clip from some shaky phone footage shot by one of the Capitol rioters. CNN credited the video to someone whose work Martinez had just encountered: donk_enby,* a relatively unknown hacktivist who had scraped the data from the right-wing social network Parler. They then gave the data to Distributed Denial of Secrets, a transparency collective Martinez advises, which published a 32-terabyte archive of posts and and videos from the riot as a shareable archive, making it available to practically anyone—including news networks and congressional investigators, who played some of the videos during the impeachment hearings.

For Martinez, watching the investigators play the videos for millions of Americans was “surreal”—“a cyberpunk moment,” Martinez heard someone call it. Distributed Denial of Secrets, or DDoSecrets, had been a thorn in the side of secretive governments, corrupt corporations, and powerful law firms since its founding in late 2018. In June 2020, in a release known as BlueLeaks, the group published 269 gigabytes of law enforcement data, which exposed police malfeasance and surveillance overreach across the United States.

DDoSecrets also published incriminating records from overseas tax shelters, from the social media site Gab, and from a Christian crowdfunding site often used by the far right. The group has affected autocrats as well, exposing the Russian government’s plans in Ukraine and mapping out the Myanmar junta’s business dealings. These revelations have spawned numerous news stories in the public interest, making DDoSecrets a valuable source for journalists, but also rendering it a target: In July 2020, German authorities seized one of the organization’s servers. August of last year brought ominous news of a Department of Homeland Security bulletin labeling DDoSecrets a “criminal hacker group.” And yet by February, Congress was discussing the Parler videos on the Senate floor.

Such are the contradictions that come of being in the vanguard of the journalistic transparency movement in the post-WikiLeaks era. One part of the U.S. government uses group members’ work; another describes them as criminals.

Of all the transparency organizations, hackers, whistleblowers, and leakers that have emerged in recent years, DDoSecrets stands apart, not just for its collaborative discipline, technical sophistication, and a wide network of sources, but also for its lack of ego and aggressive commitment to transparency.* That alchemical combination doesn’t mean the group is without internal disagreements or public criticism—indeed, its growing prominence and willingness to push the envelope of what it publishes seem to earn the organization enemies wherever it goes: In February, Gab CEO Andrew Torba said that “mentally ill tranny demon hackers” were attacking his company—an absurd description that DDoSecrets members, many of whom are trans or queer, have reappropriated. (Emma Best, perhaps the collective’s most prominent representative, briefly added the phrase “Demon Hacker” to their display name on Twitter.)

In the murky world of hacked and leaked materials, which often contain personal or sensitive information, DDoSecrets has had to grapple with thorny questions: What should be published? Who can the group trust? And how can transparency work survive when tech companies are ready to cooperate with government investigators in preserving official secrecy and criminalizing investigative journalism? Distributed Denial of Secrets is still figuring that out.

Avowedly nonpartisan, DDoSecrets nonetheless exhibits an ethos that seems to fuse anarchist politics, a hacker’s curiosity about forbidden knowledge, and a general sympathy for the oppressed. Its barbed Latin slogan, Veritatem cognoscere ruat caelum et pereat mundus, roughly translates to, “To know the truth, even if the heavens fall and the world perishes.” Call it a bolder, more transformative version of “information wants to be free.”

Best, a prolific filer of Freedom of Information Act requests who covered national security as a freelance journalist, launched DDoSecrets in December 2018 with someone known only by the pseudonym “The Architect.” Together, they set out to distinguish their group from WikiLeaks, which they felt had morphed into a vehicle for Julian Assange’s ego.

In July 2018, Best published more than 11,000 internal messages from WikiLeaks.

The messages showed how the group operated, along with a great deal of homophobia, transphobia, and other crude behavior. Best has since critiqued WikiLeaks for its lack of transparency, for supporting conspiracy theories, and for a tendency to editorialize around major releases. Best described it to me over the encrypted messaging app Signal as “deception about their sources and even their data.”

Whereas WikiLeaks cultivated an anti-imperialist mystique centered on the cultish figure of Assange, DDoSecrets professes something more modest: an unvarnished commitment to providing information useful to journalists and concerned citizens. As the DDoSecrets website puts it, data must fulfill two criteria: “Is it in the public interest?” and “Can a prima facie case be made for the veracity of its contents?” If it passes that test—and the group, which now has approximately 10 members along with an advisory board and volunteer contributors, decides collectively that they can protect their sources—then they publish the archive, sometimes as an easily downloadable torrent, other times through its slightly more difficult to reach onion site, which requires using the Tor browser. While many archives are published for a wide audience, others are withheld and only offered to journalists upon request; and in some cases, the organization will write about data it receives without publishing its contents.

At its best, the work of DDoSecrets reveals the limits of official transparency, of authorized government leaks and incrementalist beat reporting and FOIA requests that yield pages of useless redactions. Nowhere is this more visible than with BlueLeaks. “Reading the unredacted, hacked documents gives a very different picture than the selections you get from an open records officer,” said Brendan McQuade, author of Pacifying the Homeland, a book about the modern surveillance state. Based on BlueLeaks information, he wrote articles that exposed police malfeasance and brought attention to a federal whistleblower suit against the Maine Information and Analysis Center, or MIAC. Maine’s state house later voted to close the site (although the bill never cleared the Senate). To McQuade, and to the members of DDoSecrets, hacked data provides what official channels cannot: truth and the potential for accountability.

DDoSecrets attracted criticism a few years ago for publishing—and then withdrawing—an archive hacked from the infidelity dating site Ashley Madison, an experience the group said it learned from. The BlueLeaks archive also included personal information, such as emails and home addresses, for roughly 700,000 law enforcement officers (though nothing has apparently come of that data dump). DDoSecrets is adamant that it doesn’t break the law or solicit hacked material. But its members are mingling with the hacktivist underground, which includes people engaging in potentially criminal behavior. Like many journalistic outfits, it does publish hacked and stolen material, but that remains a long-standing, legally protected practice of a free press. And these days, journalists often have to act much like spies to escape prosecution of whistleblowers and leakers. If the work of DDoSecrets has the whiff of the illicit, it’s because official secrecy, mass surveillance, threats of prosecution, and big tech’s cooperation with censorious authorities have impeded the ability of journalists and publishers of leaked data alike to operate.

Freddy Martinez wondered if somehow the broken systems of democratic accountability that gave rise to DDoSecrets could be repaired. “Maybe we’ll become irrelevant, which might be nice,” he said. For now, the group has become a 501(c)(3) and collects small donations. It has also formed a partnership with Harvard’s Institute for Quantitative Social Science and established a legal defense fund for Best, a journalist who is believed to be the main target in the federal investigation. (For three months this year, the FBI prevented them from filing FOIA requests, before lifting its ban in June.)

“Truth has an impact, regardless of the respectability politics some people choose to engage in when it comes to the alleged sources,” Best wrote after Swiss law enforcement, at the request of U.S. authorities, arrested Tillie Kottmann, a hacker who alerted journalists to security vulnerabilities in a vast commercial network of surveillance cameras. “The world can no longer be rid of hacktivists or leaktivists. Not as long as people are willing.”

* This article originally misstated that Martinez met donk_enby through the internet. It also mischaracterized the publishing activities of WikiLeaks since 2018.

— Jacob Silverman is a contributing editor at The New Republic.