#PanamaPapers: The Biggest Leak In History

When Daniel Ellsberg photocopied and leaked the Pentagon Papers to the New York Times in 1971, those 7,000 pages of top-secret Vietnam War documents represented what was then the biggest whistleblower leak in history, a couple dozen megabytes if it were contained in a modern text file. 

Almost four decades later, WikiLeaks in 2010 published Cablegate, a world-shaking, 1.73 gigabyte collection of classified State Department communications that was almost a hundred times bigger.

If there’s some Moore’s Law of Leaks, however, it seems to be exponential. Just five years have passed since WikiLeaks’ Cablegate coup, and now the world is grappling with a whistleblower mega-leak on a scale never seen before: 2.6 terabytes, well over a thousand-fold larger.

Recently, more than a hundred media outlets around the world, coordinated by the Washington, DC-based International Consortium of Investigative Journalists, released stories on the Panama Papers, a gargantuan collection of leaked documents exposing a widespread system of global tax evasion. 

The leak includes more than 4.8 million emails, 3 million database files, and 2.1 million PDFs from the Panamanian law firm Mossack Fonseca that, according to analysis of the leaked documents, appears to specialize in creating shell companies that its clients have used to hide their assets.

“This is pretty much every document from this firm over a 40-year period,” ICIJ director Gerard Ryle told WIRED in a phone call, arguing that at “about 2,000 times larger than the WikiLeaks state department cables,” it’s indeed the biggest leak in history.

Neither the ICIJ nor any of the reporters it’s worked with have made the leaked data public. But the scandal resulting from their reporting has already touched celebrities, athletes, business executives and world leaders. 

The documents trace $2 billion of hidden money tied to Vladimir Putin through accounts held in the names of family members and his celebrated musician friend Sergei Roldugin. Icelandic Prime Minister Sigmundur Gunnlaugsson is facing demands from the previous Icelandic prime minister that he resign after the Mossack Fonseca documents showed that Gunnlaugsson may have failed to disclose ownership of a stake in certain Icelandic banks under the government’s rules for officials. And the leaks drag FIFA officials back into the news, showing that even an ethics lawyer for the world soccer body had financial ties to another FIFA official already accused of corruption.

But beyond those revelations—and there will likely be more as the reporting around the Panama Papers continues—the leak represents an unprecedented story in itself: How an anonymous whistleblower was able to spirit out and surreptitiously send journalists a gargantuan collection of files, which were then analyzed by more than 400 reporters in secret over more than a year before a coordinated effort to go public.

The Panama Papers leak began, according to ICIJ director Ryle, in late 2014, when an unknown source reached out to the German newspaper Suddeutsche Zeitung, which had reported previously on a smaller leak of Mossack Fonseca files to German government regulators. A Suddeutsche Zeitung reporter named Bastian Obermayer says that the source contacted him via encrypted chat, offering some sort of data intended “to make these crimes public.” But the source warned that his or her “life is in danger,” was only willing to communicate via encrypted channels, and refused to meet in person.

“How much data are we talking about?” Obermayer asked. “More than you have ever seen,” the source responded, according to Obermayer.

Obermayer tells WIRED he communicated with his source over a series of encrypted channels that they frequently changed, each time deleting all history from their prior exchange. He alludes to crypto apps like Signal and Threema, as well as PGP-encrypted email but declines to say specifically which methods they used. Each time the reporter and source re-established a connection, they would use a known question and answer to reauthenticate each other. “I’d say ‘is it sunny?’ You’d say ‘the moon is raining’ or whatever nonsense, and then both of us can verify it’s still the other person on the device,” Obermayer says.

After seeing a portion of the documents, Suddeutsche Zeitung contacted the ICIJ, which had helped to coordinate previous tax haven mega-leaks including a 2013 analysis of leaked offshore tax haven data and another leak-enabled investigation last year that focused on assets protected by the Swiss bank HSBC. ICIJ staff flew to Munich to coordinate with Suddeutsche Zeitung reporters.

Meanwhile, the shipments of leaked data continued piecemeal. “Over time we got more and more until we had all 11.5 million documents,” Ryle says. Obermayer declined to explain how their leaker sent Suddeutsche Zeitung hundreds of gigabytes or even terabytes of information at a time. That’s far too much to send over email, of course, though that quantity of data could easily be sent anonymously in the form of shipped encrypted hard drives. “I learned a lot about making the safe transfer of big files,” Obermayer says elliptically.

The ICIJ’s developers then built a two-factor-authentication-protected search engine for the leaked documents, the URL for which they shared via encrypted email with scores of news outlets including the BBC, The Guardian, Fusion, and dozens of foreign-language media outlets. The site even featured a real-time chat system, so that reporters could exchange tips and find translation for documents in languages they couldn’t read. “If you wanted to look into the Brazilian documents, you could find a Brazilian reporter,” says Ryle. “You could see who was awake and working and communicate openly. We encouraged everyone to tell everyone what they were doing.” The different media outlets eventually held their own in-person meetings, too, in Washington, Munich, London, Johannesburg and Lillehammer, Ryle says.

Remarkably, despite all that broad access and openness, the full leaked database has yet to leak to the public—perhaps in part because it’s so large and unwieldy. Obermayer admits that rumors of the massive leak spread, but says that the data itself remained contained. “Last fall I was really nervous, thinking ‘a lot of people know,'” he says. “Word leaked out at places. But it never got further.”

Ryle says that the media organizations have no plans to release the full dataset, WikiLeaks-style, which he argues would expose the sensitive information of innocent private individuals along with the public figures on which the group’s reporting has focused. “We’re not WikiLeaks. We’re trying to show that journalism can be done responsibly,” Ryle says. He says he advised the reporters from all the participating media outlets to “go crazy, but tell us what’s in the public interest for your country.”
Weeks before contacting the subjects of the investigation, including Mossack Fonseca, Obermayer took one final precaution: he destroyed the phone and the hard drive of the laptop he’d used for his conversations with the source. “This may have seemed a little overachieving,” he notes, “But better safe than sorry.”

He notes that even now, he doesn’t know who the source actually is. “I don’t know the name of the person or the identity of the person,” Obermayer says. “But I would say I know the person. For certain periods I talked to [this person] more than to my wife.”

A New Era of Mega-leaks

The leaks are bound to cause ripples around the world—not least of all for Mossack Fonseca itself. The firm didn’t respond to a request for comment from WIRED, but it wrote to the Guardian that “many of the circumstances you cite are not and have never been clients of Mossack Fonseca” and that “we have always complied with international protocols … to assure as is reasonably possible, that the companies we incorporate are not being used for tax evasion, money laundering, terrorist finance or other illicit purposes.” 

Wired:

 

 

 

« CYBERCOM Elevated To Full Combatant Command Status
Smart UAE Police Cars For Expo 2020 »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Echelon

Echelon

Echelon Company is a provider of information security services specializing in certification of security software and hardware products in Russia.

ShmooCon

ShmooCon

ShmooCon is an annual east coast hacker convention offering three days of demonstrations and discussions of critical infosec issues.

Cybersecurity Philippines CERT (CSP-CERT)

Cybersecurity Philippines CERT (CSP-CERT)

Cybersecurity Philippines CERT is the national Computer Emergency Response Team for the Philippines.

Open Systems International (OSI)

Open Systems International (OSI)

Our innovative Operations Technology (OT) solutions are highly scalable and can be deployed by various utility companies to monitor, control and optimize their real-time operations.

Caretower

Caretower

Caretower is one of Europe’s leading value added managed service provider in cyber security.

Hacken

Hacken

Hacken provide a range of cybersecurity services including security assessments, blockchain security audits, and secure software development.

Onsist

Onsist

Onsist brand protection services provide proactive defense against fraudulent use of your brand online.

Portshift

Portshift

Portshift leverages the power of Kubernetes and Service-Mesh to deliver a single source of truth for containers and cloud-native applications security.

Zephyr Project

Zephyr Project

The Zephyr Project strives to deliver the best-in-class RTOS for connected resource-constrained devices, built to be secure and safe.

DAtAnchor

DAtAnchor

Anchor is simply a better way to protect and control sensitive data. Zero-trust, data-centric security. Simplified.

Strike Security

Strike Security

Strike Security offers a continuous penetration testing platform that combines automation with ethical hackers.

Mayer Brown

Mayer Brown

Mayer Brown is a global law firm. We have deep experience in high-stakes litigation and complex transactions across industry sectors including the global financial services industry.

Curatrix Technologies

Curatrix Technologies

Curatrix Technologies is a Managed IT Service provider based in Hampshire, UK, providing high quality and reliable Managed IT Services since 2015.

Total Secure Technology

Total Secure Technology

Total Secure Technology provides trusted Managed IT Security and Managed IT Services for organizations looking to increase their cybersecurity defensive posture.

Yarix

Yarix

Yarix is the leading company in Var Group’s Digital Security division and one of the most recognised, innovative and authoritative Italian companies in the IT security sector.

Northern Computer

Northern Computer

Northern Computer provides comprehensive IT solutions that streamline your operations and help you achieve your business goals.