The Intercept's thirst for a scoop ruins the life of a source

Reality Leigh Winner, a 25-year-old woman in the US state of Georgia, faces 10 years in federal prison over allegations she sent top secret documents to The Intercept, an online news outlet.

She was arrested Saturday, and is set to appear in court Thursday where she is reportedly set to plead not guilty. Officials announced the arrest just an hour after The Intercept published a story based on the document she allegedly leaked. They also alleged that Winner confessed.

The leak meant a big story for The Intercept — Russian intelligence tried and mostly failed to hack US election systems — but it came at a tremendous cost for their source. There is also evidence that indicates The Intercept's attempts to validate the information actually handed the government clues that let it identify and indict Winner. If investigative journalism were surgery, The Intercept's sloppiness amounts to leaving a scalpel in a patient.

This grim situation provides an important lesson to everyone in the media: No scoop is worth the freedom — or the life — of an anonymous source.

It is the responsibility of journalists to not only protect the identity of anonymous whistle blowers — and be prepared to go to jail to keep their names secret — but also know when to hold back on publishing stories when the risk to their sources is too great. If they cannot verify the document without exposing the identity of the source, they have a duty to hold off on even attempting verification. In this case, The Intercept failed.

And op-ed in The Washington Post more or less exonerates the journalists involved and blames Winner, saying she didn't take proper precautions in trying to conceal her identity. The Post calls it a "brazen and bush-league leak" of the "routine work of the national-security bureaucracy" that was "newsworthy though not Earth-shaking." All of this adds up to one thing: Don't publish the story.

Winner is only one of countless of young, idealistic people who have access to sensitive government data they believe the public should see. Some of these leaks are going to be "brazen and bush-league," but that doesn't absolve journalists from protecting these sources. If the source decides to send the information to a news outlet, then it becomes the responsibility of that news outlet to do everything it can to keep the source's identity safe, even if it means spiking the story.

The reporters involved, Matthew Cole, Richard Esposito, Sam Biddle and Ryan Grim, got their bylines, but have done serious harm to the institution of investigative journalism.

Watching what happens to Winner will discourage others from coming forward with information they feel the public should know. Carelessness like The Intercept's will set back investigative journalism more than Trump's threats to leakers and journalists ever could.

The Obama administration showed its willingness to aggressively prosecute whistle blowers, and Trump himself has proclaimed his slathering craving to convict someone — anyone — who leaks classified or secret information that casts him in a negative light.

Winner, an Air Force veteran, will be thrown into the maw of the criminal justice system.

"I don't think she's seeing a light at the end of the tunnel," her mother, Billie-Jean Davis, told CNN.

And there might not be one. Even if she avoids prosecution, Winner's name and image have spread across the merciless trollscape of social media, where some accounts call for her hanging as a traitor. Others call her a hero. What's clear is that her life will never be the same.

According to a charging document, Winner confessed to distributing restricted information. Without a criminal record, her public defender is hoping the government will release her pending trial.

"There's not much to comment on right now as far as whether there is a connection between my client and Intercept," her public defender, Titus Nichols, told NPR. "I know that there is documents circulating on the internet and everything else, but as far as concrete proof, we're just not at that stage, yet."

The Intercept released a statement Tuesday that reminded readers to be sceptical of the US government's allegations against Winner. At this point, that's about all it could do. The scalpel is in there.

"Although we have no knowledge of the identity of the person who provided us with the document, the U.S. government has told news organisations that Winner was that individual," the statement read, adding that the allegations "contain unproven assertions and speculation designed to serve the government's agenda."

So what happened? According to an affadavit written by an FBI agent recommending her arrest, Winner allegedly sent the top secret document to a news outlet by postal mail. A reporter at the outlet then reached out to another source in the intelligence community to confirm its veracity. The reporter also told the intelligence community source that it had been postmarked in Augusta, Georgia, where Winner lives.

That helped narrow down the source of the leak a great deal, to Pluribus International Corporation, a company with an NSA contract. Winner had been working there since February. On May 9, 2017, according to the charging document, she printed out the top secret document at her workplace.

How they figured that out was absurdly simple, after a reporter at The Intercept sent them photographs of the pages.

"The U.S. Government Agency examined the document shared by the News Outlet and determined the pages of the intelligence reporting appeared to be folded and/or creased, suggesting they had been printed and hand-carried out of a secured space," the affadavit reads.

In sharing images of the document with the intelligence community, The Intercept gave it vital clues to who might have sent it and how they got hold of it. It's even possible that nearly invisible marks left by the printer Winner allegedly used could have given her away.

The Intercept does provide a guide for how to contact them anonymously, but the section on submitting material by mail is remarkably sparse. It says that mailing is appropriate for sources who "don't wish to engage in back-and-forth," but it doesn't mention that the photos of the original could end up back in the hands of the intelligence agency that first guarded them.

"Was providing an apparently unredacted copy to a government employee for verification unavoidable?" cyber security expert Matthew Garrett tweeted. "When a user follows the documentation and loses anyway that's *bad*"

Ted Han, project lead for DocumentCloud, which helps journalists catalogue online documents, said that The Intercept found itself in a difficult position, weighing the need to verify the scoop and the obligation to protect the source.

"There is a challenge in how much information one can disclose versus what information must be furnished to do credible fact checking and verification. Reporters want to know whether the document is legit (verifying it). Government wants to know what document it is in order to identify it. Those things seem like nearly the same thing," Han added.

The anonymity of anonymous sources relies on there being space between those two interests. Even though The Intercept didn't know who sent the document, they should have measured whether or not there was enough room for the source to remain a mystery to the government as well. The Intercept measured wrong, and Winner will pay the price.