The Ethics of Leaks

When longtime investigative journalist David Cay Johnston received two pages of President Donald Trump’s 2005 tax return in the mailbox of his home in Rochester, New York in March, there were plenty of ways to trace who leaked it to him. Johnston had the envelope, with a postmark and a stamp, and far scanter evidence has been used to find people who have sent things through the mail.

But hunting down the source of this long-sought clue to Trump’s financial history might have discouraged future leakers. So Johnston didn’t do it—not even for his own edification or to gauge the trustworthiness of the leak. In fact, he thought about burning those original documents.

It’s one of the unprecedented quandaries faced by journalists in this new era of covering the government substantially through leaks and at a time of conspiracy theories, misdirection, power plays, deflection, allegations of fake news, and fears of pervasive government surveillance. Should journalists seek a source’s identity and motivations? Share these with readers or viewers? Publish or broadcast information that hasn’t been confirmed? Questions like these arise when WikiLeaks releases more information about a presidential candidate than journalists can effectively fact-check or when BuzzFeed posts a sketchy Russian dossier in spite of skepticism that any of the scandalous information in it is true.

At this divisive time in particular, it’s important to question a leaker’s motivation for leaking. But while authenticating documents and scrutinizing why someone might have leaked them are longstanding parts of investigative journalism, that process has been newly complicated by the speed of the news cycle and the steady supply of disclosures. More people are being encouraged to leak, including by news organizations themselves.

Some current reporting on leaks appears to violate long-held ethics rules, most notably the cardinal one that no news be reported whose accuracy is not confirmed. It’s a practice with dangerously high stakes for journalists. Amid threats from Trump and some in Congress to prosecute leakers, there is also the risk of sources being compromised by official eavesdropping, much of it also exposed by leaks. The pace at which leakers and whistleblowers have been prosecuted picked up significantly under President Barack Obama, and under Trump at least one leaker has been arrested: 25-year-old federal government contractor Reality Leigh Winner, who allegedly gave classified information to the news site The Intercept.

There’s also still no federal shield law, meaning journalists themselves could go to jail in some cases if they know their sources but refuse to name them in a legal proceeding. In the memos in which he kept notes of his conversations with Trump, former FBI Director James Comey (who testified that he himself arranged for the contents of the memos to be leaked, through a friend) said Trump told him to consider putting reporters in prison for publishing classified information. Comey also testified, before the Senate Judiciary Committee before he was fired by Trump that, “If I find out that people were leaking information about our investigations, whether to reporters or to private parties, there’ll be severe consequences.”

In this climate, once Johnston had authenticated the document by checking the math and that accounting practices on the tax returns met contemporaneous requirements, “Why in the world would I want to go find out where it came from?” Johnston asks. “Why would I want to put the person who did this in jeopardy, or put myself in jeopardy? I don’t see any upside. Plus, I’ve just said to anybody who might ever send me a document, ‘Hey, I’m going to investigate you.’ And I want people to send me documents.”

Johnston needn’t worry too much. There’s been a strong and steady flow of leaks that shows no sign of slowing.

They include the WikiLeaks release, on the eve of the Democratic National Convention, of emails from inside the Democratic National Committee, some embarrassing enough to force the resignation of DNC chair Debbie Wasserman Schultz.

Then there was the leak of Trump’s 1995 tax returns to The New York Times, showing that Trump had posted a loss big enough to potentially avoid paying income taxes for as long as 18 years.

Next was a Russian dossier with purportedly compromising information about Trump supposedly recorded during a trip he made to Moscow.

After Trump took office, there were leaks that connected national security advisor Michael Flynn and others close to Trump to Russia; Flynn resigned.

There were leaks about who shared information with Republican House Intelligence chairman Devin Nunes suggesting that intelligence officials in the waning days of the Obama administration had “unmasked” Trump associates. When that information was revealed as having come from a pair of White House staffers, Nunes stepped aside from his committee’s probe of Russian influence in the election.

There were leaks about the reasons for and the process that preceded the firing of Comey. By then, the culture of leaking had so deeply penetrated the administration, Trump felt compelled to warn in a tweet that Comey should hope there were no recordings of his conversations with the president “before he starts leaking to the press!” (Trump subsequently admitted there are no tapes.)

There were the leaks, attributed to two U.S. officials, about how Trump himself, during a meeting in the Oval Office, shared highly classified information with Russian Foreign Minister Sergey Lavrov and Russian Ambassador Sergey Kislyak about an operation planned by the Islamic State, purportedly making it possible for the Russians to discern the source of the intelligence.

And in late June CNN was forced to retract a story saying the Senate Intelligence Committee was investigating the nature of a meeting between a Trump transition team official and an executive of a Russian investment fund. The network said the story hadn’t gone through the required checks, and it apologized; the writer, an editor, and the head of the investigative unit resigned. Breitbart News was first to challenge the report. Critics of leaks, including Trump, vented on Twitter.

Leaks aren’t new, of course, but they are no longer limited to big stories. They have gradually become a major element of journalism, especially the political kind. “It’s become an increasing feature of Washington reporting in particular that people won’t speak for the record, even in official briefings, making anonymity a big part of how reporting is done in Washington,” says New York Times deputy managing editor and investigative journalist Matthew Purdy. “And that has spread throughout officialdom and the corporate world and everywhere else. That’s a problem for the media.”

It’s also one in which they’ve had a role. “It does take two to tango,” Purdy says. “You don’t have to print anything that you get without someone’s name attached to it. It just would make reporting some of the most important stories tough to do.”

The heavy reliance on anonymous sources has intensified the debate over—and public mistrust of—them. Contrary to appearances, journalists say, they are trying to push back. Citing what she calls the irony of the fact that Trump administration officials, who often complain about the use of unnamed sources, ask for anonymity themselves—including official federal agency spokespeople—Washington Post senior national affairs correspondent Juliet Eilperin says she and her colleagues usually won’t let them: “That’s a violation of the very idea” of what a spokesperson is paid by the taxpayers to do. “That’s their jobs. By cutting down on that, it reduces the numbers of times you have to” cite unnamed sources in stories.

In general, however, she and others say, it’s hard to stop the practice, even though they acknowledge it hurts their credibility with readers. Times readers say the use of anonymous sources is among the things that bother them the most in stories, the newspaper told its staff last year in a memo, one in a series of memos over the years about the practice.

“You have to be as judicious as you can in using these anonymous sources so your stories aren’t riddled with them to the extent that people do lose faith,” says Eilperin. “I understand reader skepticism, but the flip side of that is I am incredibly conscious of the fact that [sources] are operating in an environment where they are very intimidated and feel they may be retaliated against” if their names are attached to the information they disclose.

Eilperin herself co-authored a story, during the Obama administration, that cited “officials who spoke on the condition of anonymity” saying Russian hackers had penetrated the electric grid through computers at a Vermont utility company. Follow-ups reported that there was no indication this had occurred—that a code associated with Russian hackers had been detected in a computer not connected to the grid. Eilperin says the original headline and the assertion in the text that hackers had penetrated the electric grid were both quickly corrected. “We thought at the time, and still think today, that it is in the public’s interest to report on whether and where that code was detected,” she says. “And after getting preliminary information about this, we also worked to gather additional context so our readers were fully informed.”

Successive presidential administrations have also fought against leaks, of course, none in recent times as hard as Obama’s, whose “insider threat program” began after Chelsea (then Bradley) Manning’s 2010 leak of military and diplomatic secrets. The government charged eight leakers and whistleblowers during the Obama presidency under the Espionage Act of 1917, more than under all previous presidents combined. Six were convicted or pleaded guilty, one was convicted of the misdemeanor charge of unauthorized use of a computer, and one, Edward Snowden, remains a fugitive in Russia. The Obama administration also took such steps as scanning federal employees’ communications for suspicious logins, downloads, or printer use, and monitoring their travel.

That has had a further chilling effect on the availability of information through conventional channels, as had already begun happening under previous presidents of both parties. More than half of political reporters said in a Society of Professional Journalists survey during Obama’s time in office that their interviews with government officials had to be approved in advance, and 85 percent that the public was not getting the information it needed. Three-quarters said that the controls kept getting tighter.

“If employees are being told, ‘Do not talk to the press,’ we’re going to have to depend more on these leaks to get information we used to pick up the phone and call somebody about,” says Lynn Walsh, an investigative television journalist and president of Society of Professional Journalists (SPJ).

Many media outlets have made it easier for anyone to send them tips, suggesting the use of software that encrypts texts and emails. And lots of people have, including government employees at all levels. “It has really risen to heretofore unseen levels,” says Mike Cavender, executive director of the Radio Television Digital News Association (RTDNA).

The Associated Press, for instance, got a leaked 11-page memo suggesting the National Guard might be used to round up undocumented immigrants, and the AP and The Washington Post were leaked information about heated calls between Trump and the leaders of Mexico and Australia. Even a State Department memo about how to reduce leaks was leaked, in February, to the Post.

Like the appetite for leaks, the risks have also grown, and now have to be weighed at a faster pace than ever. Where leaks were once a first step in the long, deliberative process of investigative journalism, they’re now part of a hyperactive daily news cycle. “We’re trying to make these judgments in hours or days rather than weeks or months,” says University of Kansas media law professor Jonathan Peters.

The 35-page dossier alleging that the Russian government had intimate compromising information about Trump, which had been making the rounds in Washington for weeks before BuzzFeed decided to go public with it, is a case in point. News of the Russian dossier overshadowed some extraordinary qualifications in the story, and in BuzzFeed’s subsequent defense of it. “The allegations are unverified, and the report contains errors,” read the subhead; those included the misspelling throughout the document of a company name. “Unverified,” echoed the first line. “Unverified, and potentially unverifiable,” the second paragraph said. BuzzFeed reporters had been investigating claims in the dossier, “but have not verified or falsified them.”

It was a huge departure from journalistic practice of never reporting anything, ever, that is unconfirmed. That seems the most basic of all rules. It’s the first tenet of the SPJ’s code of ethics: “Journalists should take responsibility for the accuracy of their work [and] verify information before releasing it.” Not doing so feeds into the media’s adversaries’ attacks on “fake news.”

But a surprising divide has evolved. In the Internet age, readers can often see primary source materials anyway. Trump himself threw fuel on the BuzzFeed story, lashing out in three tweets, putting other media in the awkward position of seeming to ignore something the president was megaphoning to his followers.

Under this school of thought, reporting such things, with the caveat that they are unconfirmed, fulfills the journalistic obligation to put the news into context. That was BuzzFeed’s stated rationale, at least—publish now, verify later, if at all.

In an op-ed in The New York Times, BuzzFeed editor in chief Ben Smith said BuzzFeed had provided “appropriate context and caveats” for a document that was already in wide circulation in Washington. Yet the rest of the country wasn’t able to see those original source documents. Smith said readers expect transparency. “You trust us to give you the full story; we trust you to reckon with a messy, sometimes uncertain reality,” he wrote. It’s the rationale for not doing this, Smith wrote, that must be overwhelming. “Our audience inhabits a complex, polluted information environment; our role is to help them navigate it—not to pretend it doesn’t exist.” (BuzzFeed did not respond to requests for comment from Nieman Reports.)

Nonsense, says Leonard Downie, Jr., former executive editor of The Washington Post, who now teaches at the Walter Cronkite School of Journalism and Mass Communication at Arizona State University. “That’s not journalism. Implicit in the definition of journalism is that a professional journalist is collecting information, synthesizing it, verifying it, and delivering it to the public.”

Cop-out, agrees The New York Times’s Purdy: “We’re responsible for what we print. We’re not responsible for whatever everybody else prints or puts online.”

Adds Cameron Barr, managing editor at The Washington Post: “We’re in the business of publishing things that are true, or where we get as close as possible to the truth.”

One way of doing that is to get, and link to, the original documents that detail the information, which journalists say—in most cases—have more credibility with readers. Another? Institutional experience, says Eilperin, who has been covering national politics since 1993. “I have a better sense of whether the documents and information I’m getting are reliable because I have been working with these people for years,” she says. The Post also has a two-source requirement, “so when someone who you’re unfamiliar with provides you with verbal information or a document, the key test is that you have to have corroboration. And that second source is how you get confidence that what you have is accurate.”

But many of the people now in national power are new to it, and to the reporters on the beat, which Eilperin acknowledges complicates the process. “What you have to gauge is how well versed some of these folks are in the subject matter,” she says. “It’s not just a matter of, Are they being straightforward with you? It’s also a question of, Are they steeped enough in the issues that when you’re having a conversation with them about the issues, you’re talking off the same page?”

In general, however, journalists are following the same process that they always have, says Mark Memmott, supervising senior editor for standards and practices at NPR. The same questions are asked, he says: Where is the information coming from? How does this person know this thing? Does he or she have direct knowledge? Is there a document the reporter can be shown or read from? Is there a second source? “It’s the same old basic steps and procedures, perhaps accelerated a little bit because we’re getting information out faster,” Memmott says.

Some things have changed, however. “It takes a significant degree of effort to make sure you’ve pinned things down,” Eilperin says—a process not helped by the fact that the White House often won’t respond to questions. While the Obama White House was also tough to cover, because it fixated on control of information, she says, “They still often would be willing to hear you out or send a response. That’s not always guaranteed now.”

While BuzzFeed’s may have been the most extreme example, it’s not the only news organization that has aired or published information it could not confirm. So did National Public Radio, in reports about the WikiLeaks dump of Clinton campaign emails (“NPR has not been able to confirm their authenticity”) and CNN and The New York Times when they reported that the president was briefed about the Russia dossier (“The New York Times has not been able to confirm the claims”; “CNN is not reporting on details of the memos, as it has not independently corroborated the specific allegations.”)

The Washington Post doesn’t do that, “as a general matter,” says Barr, though he adds it’s fair to bring attention to something a respected competitor with credible sources is reporting. Purdy, at the Times, says it also avoids doing this “to the extent possible in real time.”

The Russian dossier may have been a turning point. Most news organizations started to acknowledge it only when it became the subject of intelligence briefings in the Oval Office. “Once that dossier was reported and out there, we made references to the portions that were out there,” Purdy says of how the Times handled it. “We have to report the news. But we didn’t put the whole thing up.”

He says blaming the fact that the original documents were being circulated in D.C. circles, as BuzzFeed did, does not absolve news organizations of responsibility for what they print. But newspapers do have to report the news—and the briefings in the White House raised it to that level. (In May, Mother Jones announced that it would launch a new project to more intensively investigate connections between Trump and Russia, including the dossier, and quickly raised $100,000 to do that, plus $15,000 in renewable monthly contributions.)

The speed of the news cycle only ratchets up the pressure to report things before they can be verified. So does competition among cable news shows trying to score exclusives. “Sometimes—and some of this can be blamed on the 24/7 news cycle we now live in—it’s very easy to bang out a line that, ‘We have not independently confirmed this,’ and then go with it,” RTDNA’s Cavender says.

But the fundamentals of journalism demand greater effort, according to SPJ president Walsh. She says that while it’s okay and transparent for journalists to tell the public what they don’t know, they should not abandon ethics codes and the obligation to verify.

Some media critics, largely on the right, say many of the leaked stories have been false, something that can be surprisingly hard to determine after the fact. These reports often cite denials from the White House or its appointees. The Federalist senior editor Mollie Hemingway, for example, pointed out in The Federalist that a Washington Post story saying Deputy Attorney General Rod Rosenstein threatened to resign when the White House said it was his idea to fire Comey (something Trump contradicted later in an interview) was refuted by Rosenstein himself. “Don’t trust anonymous sources,” she wrote, quoting from On The Media’s  “Breaking News Consumer’s Handbook.” (Hemingway did not respond to a request to discuss this topic.)

Even WikiLeaks criticized the dossier. “No credibility,” it tweeted. But the organization known for publishing leaks has presented other challenges to journalists.

One is that its data dumps are so massive they can defy even journalists’ best efforts to confirm what’s in them; the DNC leak alone consisted of 44,053 emails and 17,761 attachments. To compound that problem, WikiLeaks released some of its DNC and Clinton leaks at such decisive moments as the eve of the Democratic National Convention. And it made the documents not only freely available to anyone who Googles them, but indexed and searchable, meaning people could go right to them without the intervention of a journalist. More, not fewer, such massive leaks are likely to occur, taxing journalists’ ability to verify the information.

One organization attempting to bring journalistic standards to document dumps is the International Consortium of Investigative Journalists (ICIJ). As part of the ICIJ’s Panama Papers publication in 2016, an army of reporters worldwide from 107 media institutions vetted 11.5 million documents detailing financial information about public officials and others, including instances of tax evasion. The ICIJ is still producing stories—and soliciting leaks.

Organizations like his should collaborate with journalists from the outset, says ICIJ director Gerard Ryle. “I was always taught that the first obligation of journalists is to get the facts right,” he says. “And we’re in danger of forgetting that that is our primary responsibility.”

Moving slowly risks falling behind the news. Indictments of FIFA officials started taking place while ICIJ journalists were still reading through (but not yet reporting on) the Panama Papers, for example, which included revelations about the soccer federation’s officers. The documents included information on two major candidates in an election that was under way in Argentina. But the journalists continued to methodically review the documents and put them into context before releasing stories about them.

“Your instinct as a journalist is to rush into print, but we continued to try to take our time,” Ryle says. “If you want to fool the media into reporting something, you put time pressure on them.”

WikiLeaks also has worked with major media organizations. But its release of information about the Hillary Clinton campaign was raw. Mainstream media outlets responded with equivocation. One NPR story alone characterized the materials as “allegedly linked to Hillary Clinton campaign chairman John Podesta,” referred to them as “what WikiLeaks says are Podesta’s emails,” noted that “NPR has not been able to confirm their authenticity,” and said that, “If the emails are authentic, they provide insight into the private conversations happening at the highest levels of the Clinton campaign.” Then it proceeded to report what was in them.

That’s just being honest with the audience, says NPR’s Memmott. “We don’t want to lead people to think that NPR has seen these documents or knows for a fact that these emails were written by Mr. Podesta if we can’t say that,” Memmott says. “We want to tell people, ‘Here’s what we do know and here’s what we don’t know about this story that you’re hearing about everywhere right now,’ which we think is more valuable than—not to criticize some of our colleagues at other news outlets—to constantly talk about the news as if they’ve got it all and here’s the whole story.”

The SPJ’s Walsh agrees that journalists are running information like this because the public has access to it anyway, “and I think journalists are feeling the pressure to report it. If we don’t talk about it, our users are going to go somewhere else to get it.”

It’s hard to determine reliably whether people are going online to see original WikiLeaks documents. WikiLeaks anonymizes user data and does not release traffic figures. Users who go there are most likely to have visited Google and Reddit immediately beforehand, and appear to be people who follow politics and right-wing media, according to Amazon subsidiary Alexa, which tracks Web traffic.

The Clinton campaign largely sidestepped the substance of the WikiLeaks disclosures and instead attacked WikiLeaks itself for being what it called a “propaganda arm” of Russia and the Russian hackers who, according to U.S. intelligence officials, filched the documents. It also accused the media of being dupes. “Media needs to stop treating WikiLeaks like it is same as FOIA,” spokesman Brian Fallon tweeted, in a reference to the federal Freedom of Information Act. The leaks, he said, came from “an illegal hack” by Russian cyber experts “colluding” with Russia to the benefit of Trump.

Later leaks from intelligence agencies backed him up on that point, and most media outlets did report this prominently in coverage of the WikiLeaks material. The leaks were, after all, part of a story about national security and foreign influence in an American election, says Indira Lakshmanan, a Washington columnist for The Boston Globe and Craig Newmark Chair for Journalism Ethics at the Poynter Institute: “Part of it is a competitive culture and part of it is what people see as an overwhelming public interest in threats to our democracy.”

Fallon was right about something else the WikiLeaks example shows: It’s essential that a reader or a viewer know, in general and whenever possible, who is behind a leak and with what motives.

That’s also another thing about the use of leaks that’s gotten tougher.

Identifying where leaks—as opposed to leaked documents—come from is often required by policy. The Washington Post’s standards and ethics rules mandate that as much information as possible be provided to readers “about why our unnamed sources deserve our confidence.” SPJ’s ethics code says: “Identify sources clearly. The public is entitled to as much information as possible to judge the reliability and motivations of sources.” Anonymity, The Times reminded its staff last year, should be the last resort, and senior editors have to approve its use in every case.

Yet not allowing anonymous sources on some occasions, the Times’s Purdy says, would in the new reality of Washington reporting make some of the most important stories tough to do–situations in which, as the policy states, “the Times could not otherwise publish information it considers newsworthy and reliable.” When unnamed sources are used, it also helps to get as many as you can, editors say; one Washington Post story about the Obama administration’s response to Russian interference in the election mentions more than three dozen sources, almost all anonymous.

It isn’t just the advent of the likes of WikiLeaks, which does not identify its sources, that makes anonymous sourcing and the reporting of unconfirmed material more common. It’s the wider net the media itself has cast for leaks. Where once a leak might have come from a source known to a beat reporter, now a lot of other people have begun to offer information, people the beat reporter doesn’t know.

And there’s another danger in reporting information journalists haven’t yet determined to be true. “It’s only a matter of time before someone decides to bring a claim for defamation or potentially invasion of privacy over a false and libelous statement that an organization can’t confirm or deny,” says David Bodney, a media lawyer and the head of the Media and Entertainment Law Group at the firm Ballard Spahr. “There is absolutely a danger of placing a higher priority on speed than accuracy, or timeliness over truth.”

Two other leaks show what reporters do when they don’t know who their sources are: the successive releases of parts of Trump’s 1995 and 2005 tax returns, to The New York Times and Johnston.

In the case of Trump’s 2005 tax return, David Cay Johnston used his long career of scrutinizing tax documents to verify that the return looked real. That conclusion was reinforced when, hours before he was to talk about the leak with Rachel Maddow, live on TV, the White House issued a statement confirming the substance of the tax documents.

That’s the simple bottom line, say he and others—and the best defense against the barbs of critics: Reporters should keep digging, until they can judge whether what they’ve been leaked is true. “The information, if you can vouch for its authenticity, is the most important thing,” says the Globe’s Lakshmanan. “If there’s a good reason for protecting the identity of the source, and the information is in the public interest and the harm does not outweigh the good, I don’t know that the identity of the source is necessarily that important.”

Some media organizations have been going to great lengths to demonstrate the reliability of their sourcing. In its story disclosing that Michael Flynn had discussed sanctions with the Russian ambassador, The Washington Post cited what it said were no fewer than nine current and former officials in senior positions at several government agencies. When The New York Times reported on a leaked draft memo proposing that CIA “black site” prisons be reactivated, it said that no fewer than three administration officials had confirmed it.

And in September 2016, when an envelope landed in the office mailbox of New York Times reporter Susanne Craig, with “The Trump Organization” as its return address and photocopied pages from what appeared to be three of Trump’s 1995 tax returns inside (from New York State, New Jersey, and Connecticut), the paper poured resources into evaluating whether they were real.

Yes, says Purdy, the Times would have liked to have known the source, not only to understand what motivation he or she had for dropping this explosive leak in the middle of the presidential race, but to see if there were more documents where those had come from. The important thing, he says, was that the paper was able to make “some significant judgments through reporting” about whether they were real.

Trump, of course, had not released his tax returns, and there were also suspicious inconsistencies in the documents, including numbers typed in different fonts. Reporters combed through public records to cross-check such things as Trump’s Social Security number. They hired tax experts to review the forms. Then they found the accountant who had prepared them, flew to South Florida to meet with him, and got him to confirm that the returns were genuine—and that part of some numbers had been typed manually in a different font because the tax software used at the time didn’t allow for as many digits as the $916 million loss Trump had declared.

“I resist a little bit the term leaks as a useful category for this kind of information,” the Post’s Barr says. “My blanket description for all of this is reporting, which is the most important thing we do as journalists, especially when we’re trying to hold the government to account.”