Support for this podcast comes from Is Business Broken? A podcast from BU's Mehrotra Institute that explores questions like, why are executives paid so much? Do they deserve it? Listen wherever you get your podcasts. you Okay, before we get to today's episode, just want to remind you that we are looking for your stories about how AI is playing a role in your relationships today. So these could be romantic relationships, but we're not really looking for like...
I have an AI significant other. It's more like... Did I get a foot rub from an AI? You didn't. Did me and the AI play checkers? Did we... Sorry. Yeah. No, but you're yes. You're picking up what I'm putting down here, Ben, which is we're looking for how is AI playing a role in your work relationships, in your family relationships? What role is.
AI taking on? What is it putting on your plate, taking off your plate? Tell us about all of your interesting AI relationship stories. How do they do that, Ben? You can email us at endlessthreat at wbur.org. Yeah, and we'd love it if you sent us a voice memo in particular because we want your voices. Not in a creepy way, actually. But you can also, of course, send a written message if that's more your jam. EndlessThread at WBUR. Okay, here's the rest of the show.
So, Anne-Marie, we were going to put a whole different episode in the feed this week. And then we decided to switch it out with something else we've been working on. Because the messaging app Signal...
has been kind of big in the news this week. I don't know if you heard. Papers read all about it. You know, I happened to hear, in fact, that Jeffrey Goldberg, an investigative reporter and the editor-in-chief at The Atlantic, has been in a... a tête-à-tête with top defense cabinet members, who added him to the chat when discussing U.S. military strikes on Yemen because of Houthi fighters who have been disrupting shipping there.
I feel like there was an endless threat episode that kind of mentioned some of this a couple of weeks ago. You know, that's ringing a bell. You probably have heard plenty about that. So we're not going to go too deep into that right now. But we did decide to drop this episode in your feed this week because, you know, signal chats are a thing.
right now. For us, Signal Chats and their relative security were the topic of a whole other conversation that we have been having over the past weeks and months about how to responsibly and carefully leak information to the press. I'll tell you one way not to do that. Add JG to your fellow Trump administration signal chatters without checking on who JG is. It's accomplished journalist Jeffrey Goldberg.
In fact, this week's big story is a masterclass in how not to do it, which starts with knowing who you're talking to.
Yeah, seriously, Signal has long been a communications tool used by journalists precisely because of its security and the ability to protect sources and sensitive information. And as we've been watching the endless litany of stories... what doge and elon musk are doing inside the federal government to say nothing of this week's story about military officials using signal as we've seen some of those stories leak into the world via things like the fed news
subreddit for instance and other places and we've been having this conversation on our own subreddit about how or whether to cover this kind of news we had this question What is the best way for a source to get in touch with a journalist and let them know about something that really Americans need to be aware of? What in the year of our Lord 2025 is... A secure line. Well, we've kind of got an answer for that now. You can email us at WBUR Secure Tips.
at proton.me. That is ProtonMail, the secure email service. You can also text or call us on Signal. And the number for that is 646-456-9095. So again, And that is WBURSecureTips at Proton.me. Or you can text or call us on Signal 646-456-9095. But it's not quite that simple. We wanted to learn and to share some other best practices with our listeners. And for that info, we reached out to a guy a few cubicles over from us, Todd Wallach.
For the good people, Todd, tell us what you do at WBUR. Sure. I'm an investigative and data reporter for WBUR. Okay, but before WBUR, you worked at the Boston Globe. Yes, I worked for the Boston Globe for 14 years, most of that time on the Boston Globe Spotlight team. The Boston Globe Spotlight team might be the oldest. investigative team of any newspaper across the country. And it was made famous by Spotlight the movie, which recorded...
the well-known investigation that the Spotlight team did of the Catholic Church and sex abuse. And am I correct that for a while you were the person in charge of the Spotlight tip line? I did manage that for a while. So I saw all sorts of different emails and phone calls coming in, had to spend a lot of time listening to voicemails. What kind of tips does a tip line minder like you?
uh enjoy getting and and what kind of tips does a tip minder not enjoy getting when they're when they're manning the spotlight tip line yeah well first of all i should say that tips are really important for journalists I think that the public might imagine that if they don't see a story that the media is just not interested or they're covering it up, but often we don't know about it. Or...
We don't have the information needed to actually report it and tell the public. So tips are really crucial in alerting us to issues that we might not know are going on or providing us with names and... documents and information that we actually can use to tell that story so the tips that are most helpful are very specific and very concrete it might be hey this public official lied about their resume, and here's how you can prove it, or here's evidence.
They might include documents or pictures that prove what they're saying, or they might have names and contact information of people who can back it up or other specific details. It's harder when people say, hey, There's something going on with the Biden or Trump administration. You should dig harder. You should check that out. Or this guy must be corrupt. You should look into that. It's like, ow.
My buddy's friend's girlfriend says there are aliens. You should get on that. Another one. We get a lot of conspiracy theories. It's really hard. I'm really skeptical when I get tips that say, hey, there's this huge cover-up involving the FBI, my... My wife, her defense lawyer, the judges, this media station. I know conspiracies do happen, but usually people are busy with their own work and their own problems and don't have time to join up with six other organizations and people all to make.
some random person's life miserable. That's totally true. And yet... It does feel like we're living in a slightly different time right now with regards to the lack of transparency around really consequential things that the federal government is doing. You know, like, whereas we might have been more inclined in the past to say, that's just a conspiracy theory. Something about this moment does feel like, oh, we might actually need to look into that. Well, I definitely think we're at it.
we're in an environment where if somebody says something happened and it sounds a little crazy, it still might have happened. We all probably saw the news that the Associated Press one of the most respected journalism organizations was barred from covering white house events because the ap style guide that many people rely on, refused to change their style to stop using Gulf of Mexico and didn't change it to Gulf of America. And I would have guessed that was something out of the onion. Yeah.
Yeah, The Onion's got tough competition with reality these days, it feels like at times. You spoke a little bit to this, but just to underscore it again, what's the value of a whistleblower? Well, of course, there are different meanings by whistleblowers. There's some people who blow the whistle within their own agency or company. and report problems up the chain. And sometimes it's somebody embezzling money. Sometimes it's not following the law in some other way.
And it's really important that organizations know when there's a rogue person who's flouting all the rules and doing something wrong. Otherwise, they can't take action. There are also lots of cases where people can't trust the organization they work for, and they go to the press, they go to reporters, and they try to find somebody to expose a problem that they think is really serious.
and can't trust their organization to take care of it on their own. Can you talk about how, you know, you were just talking a minute ago about the tip line. Can you talk about what a secure drop is and why someone might want to use that kind of thing when they're communicating with journalists? Sure. So obviously many whistleblowers.
who go to the media are worried about being fired being publicly embarrassed uh getting in trouble in some other way if they're publicly known so want to find some way to confidentially give journalists information. And some organizations like the Washington Post and New York Times and ProPublica have set up essentially A big safety box that people can drop off documents electronically without giving up their name or identity. So a secure place to upload files.
And can you say more about what a secure place is? Like, how do you upload something or email something or leave a voicemail for something without... Maybe revealing your location, what device you're on, any trace of your identity, if that's possible. There are lots of ways that people can communicate.
with journalists and keep their identity secret. I mean, the most famous was probably Deep Throat, the tipster involved in the Watergate scandals. And Deep Throat... kept his identity secret by meeting with bob woodward washington post reporter in person uh in this
Dimly lit parking garage. Exactly. A dimly lit parking garage. We now know that it turns out Deep Throat knew a little bit about security. He was... deputy chief of the fbi at the time so he had a lot of inside knowledge about how to protect himself but there are lots of other ways that people can do it i mean clearly talking to somebody in person is really secure because you're not leaving a paper trail and you're not leaving an electronic trail for most people you know just using
Their personal phone or their personal email is fine if you're not dealing with national security secrets. If you work for a company or you work for even, you know, many government agencies and you're not dealing and. As long as you're not using your work email and your work phone, your bosses aren't going to be able to trace who talked to a reporter. For people who work, who do handle national security secrets.
or handle really sensitive stuff like IRS files, they have to take a lot more precautions. There's also ProtonMail, which is an email service that encrypts email. So I know that's used by a lot of people to send. sensitive messages. Another way that people can hand off files is they can do it in person, handing off a CD or a hard drive, and they can send it to the mail. Believe it or not,
The good old U.S. mail system is one of the more secure ways that people can send information, just dropping off mail at a mailbox. And there's usually... No trace of who sent it. And in fact, US mail is the way that a leaker leaked Donald Trump's tax returns to the New York Times and the way the same person leaked.
tax returns or tax data on many wealthy Americans to ProPublico. And interestingly, neither publication knew who sent them the data. So the hardest part for them was once they got the information was... verifying that it was real. More from Todd in a minute. This episode of Endless Thread is brought to you by another podcast called Tools and Weapons, hosted by Microsoft's vice chair and president, Rad Smith. Tools and Weapons is a show exploring technology's impact on our changing world.
Across three exclusive conversations celebrating the company's 50th anniversary, Microsoft's CEOs Bill Gates, Steve Ballmer, and Satya Nadella Share the untold stories, big dreams, and relentless drive that has fueled a digital revolution. Hear why each of these transformative leaders thinks that revolution may be at its most exciting point yet.
You can find the CEO series and other impactful conversations with government, business and cultural leaders by searching for tools and weapons wherever you get your podcasts. We're talking with Todd Wallach, our colleague at WBUR, about how to communicate with journalists while protecting your identity as a source. Things like... using the good old-fashioned snail mail, or protecting your device using something called a Faraday cage. It's a way to block electrical signals from computers. Yeah.
Once when I worked at the Boston Globe, we had some classified materials that we needed to keep secure, and we kept them on a computer that was air-gapped, meaning... There was air between that computer and any other computer network. Because one big risk that people are concerned about is that if you have materials on a computer that are sensitive...
and they're connected to other computers and then in turn connected to the internet, they might be vulnerable. I also personally worry that if somebody handed me a bunch of files and I just inserted them on the computer, Could it contain malware that infects our own computer? Could it be a Trojan horse, in other words? So journalists also have to protect themselves and make sure that they're not inadvertently...
uploading viruses or some other nefarious software to their entire network when they get sensitive files from people. You and I talked recently about... about some of these technology challenges and talked about how Signal, the messaging service... can sometimes be a simpler way to go when journalists and whistleblowers or anonymous sources are trying to talk to each other. Yeah, absolutely. And a lot of people that I know who worry about security tend to like Signal.
Because it's not only encrypted in the entire way, but Signal, the organization, also doesn't keep copies of the messages. They might have a record. of who contacted who and when, but they don't have a record of actual messages. Whereas there are some other messaging services where people worry. that the operator does have copies of the actual records. And so a government agency or a company might be able to subpoena those companies and get copies of those records.
That is exactly what I was going to ask, because I think... for a while now, and we used to make this show in partnership with Reddit. For a while, Reddit has been seen as like the anonymous place to go to share your stories, your tips, your leaks, your whatever. Not the only place, but a place where you can. And yet, recently, I've been thinking about, but what if Reddit, like we've seen...
with Meta, where we've seen Mark Zuckerberg acquiesce to the Trump administration in a way that maybe surprised some people. What if that happens with Reddit? And suddenly, yes, your username is anonymous, but your email... address is not. Reddit has all of that information. And so... If we're talking about Signal, though, which does seem like it's secure in a different way, on a different level, are there things that a source should be keeping in mind when reaching out to a journalist?
On a platform like Signal? Yeah. So one thing, again, is it's important not to use your work phone because if it's your work phone, the work's IT department can probably tell that you've installed Signal. And maybe they would wonder why. Another thing is that while it is true that using Signal and some other systems means that the messages...
are encrypted en route. They're scrambled, so it's harder to intercept the messages. They're probably original copies of the messages stored on both the sender and the recipient's phone. So if... Somebody got arrested and they grabbed their phone. That phone would have copies of all the messages unless they set it to auto delete or they manually deleted it. I think a lot of people think.
about this in a pretty altruistic way. I mean, certainly I do because I'm a journalist and, you know, I view part of my job as part of the fourth estate sort of. being skeptical of of things and you know helping people speak truth to power and and all sorts of things but any kind of uh leak or whistleblowing act is a risky act, both for the journalist sometimes, but really more importantly and more largely for the source. Absolutely. And granted, most people...
who are going to leak, aren't going to leak national security details. So the risk is a bit lower. But there are certainly people who have shared... important secrets because they thought it was important and have gotten into serious jeopardy. One name that comes to mind is Reality Winner, and that is a real name. A government employee who was concerned in hearing reports that Russia had interfered in the...
and there were a lot of people publicly denying that. And she had access to military intelligence, showing that the military intelligence officials did indeed have evidence of Russia interference.
So she wanted to share that story. She printed out some pages of that report, mailed it off to The Intercept. The Intercept didn't know who she was. But in trying to verify that information, The Intercept shared it with the government, and they also, I think, posted the document later online, and the government was able to notice that there was a fold in the paper indicating it was...
And because it was printed out at a secure national security facility, they keep elaborate records on who printed out what at each time. And there were also... embedded marks that wouldn't be visible to the naked eye easily that had additional information about when and where it was printed out and they were able to use that to track her down.
and she wound up going to prison for five years. Charles Littlejohn, the person who shared the confidential tax returns for billionaires and Donald Trump, again, the media didn't know who he was, but... because the irs very carefully tracks uh the distribution of Tax information and tax data. They were eventually able to figure out who did it And he was also sentenced I believe to five years in prison Which was far above the recommended maximum term
You were talking about Deep Throat and Watergate and the specifics of how that information was leaked. But if we zoom out and we think about... Real world changes that have come, that have happened as a result of some of these whistleblowers and anonymous sources and leaks. What would you say are those kind of bigger... real-world impacts? Blowing the whistle is really important in exposing corruption or problems, systematic failures.
all sorts of issues that otherwise we wouldn't know about in the case of watergate it brought down the presidency and it inspired the creation of a whole flurry of laws including the Freedom of Information Act, including laws eventually to protect whistleblowers. So in many cases, there are legal ways that people can. notify their own company right now or their own agency about problems, or they can go to government watchdog organizations and report problems with some security.
because there are laws protecting people against retaliation. I think there's greater awareness with movies about Watergate. about the importance of alerting the press to problems. And again, in 99% of the cases, people who blow the whistle are not in jeopardy of violating the law. It is not illegal. to tell a journalist that their government agency is laying off tons of people. That is probably important news. People should be aware of it, but it is not one of those national security secrets.
where people face legal jeopardy from informing the public about. And it is really important that people contact either their government agency or journalists. to alert the public when there is a real problem that isn't getting fixed. Seems like a good place to end. Todd Wallach, thank you very much. It was great having the conversation with you.
A reminder to our listeners that, yes, you can reach us securely via email at wbursecuretipsatproton.me. That's our email. Or you can text and call us on Signal. at 646-456-9095. And we should say WBUR is an NPR member station. And the CEO of NPR, Catherine Marr, chairs the board of the Signal Foundation, the nonprofit that supports the messaging app. And again, if there's anything you need to tell us about, we are all ears.
Secure ears. This episode was produced by Caitlin Harrop and Frannie Monahan. It was co-hosted by me, Ben Brock Johnson. And me, Anne-Marie Sievertson. It was edited by Meg Kramer. Mix and sound design by our production manager, Paul Vykus. The rest of our team. See you next week!