How Panama Papers journalists protect their data,
Early last year, German newspaper Sueddeutsche Zeitung (SZ) received an anonymous message: ‘This is john doe. Interested in data?’ What followed was the largest database leak in history, revealing the massive exploitation of tax havens by some of the worl
[ john doe]: One more thing: I’m going to need a warning or some kind of message a few weeks before all this is published.
[Sueddeutsche Zeitung]: No problem.
[ john doe]: Just before publication I may want to tell my family about it. I haven’t decided yet; it might actually increase the risk involved. And I also will be telling a few people I trust just in case something happens to me or one of them.
[SZ]: This could put those people at risk.
[ john doe]: I know. They are at risk anyway, in a sense. I will not tell them everything — just as much as they need to know, and most importantly, how to reach Sueddeutsche Zeitung in a worst-case scenario. But if something happens to me or I disappear, I want there to be at least one person who actually understands why. [SZ]: OK. [ john doe]: When is publication planned for?
[SZ]: Spring. We don’t make November, it’s all too much.
[John Doe]: Spring?!? Who knows if we’ll all still be alive by then . . . [SZ]: We will. We will. [ john doe]: Are not you afraid? You are supplying ammunition that will be used against very powerful people. Your name will be on the byline and all over the papers. Not mine. (Hopefully.)
We are asked this question increasingly by colleagues who are in on the story. Aren’t we afraid?
As long as we don’t think about it, no, we are not. But when we do think about it? Yes, somehow we are.
Maybe not fear exactly. It is more a sense of unease that we have not felt while researching previous stories. Why would you be afraid when investigating — as we have — the General German Automobile Club (ADAC), a scandal-plagued Bavarian egg producer, the Catholic Church, or even German arms companies?
This project, however, goes well beyond anything we have ever worked on by a factor of10. Or15, even. In any case, one of the reasons we like the international co-operation so much is the security it offers us. By this point, more than100 journalists have access to our data. There would not be much point in bumping us off, we of all people, because it would not do anything to stop the coverage. Quite the contrary — it would only attract even more attention to the story.
Having said that, we are the ones making the data available to the ICIJ [International Consortium of Investigative Journalists] and, through it, to dozens of media institutions across the globe. If someone wanted to make an example of journalists in an attempt to stop the growth of such collaborative projects between troublesome reporters, we would be a reasonably good place to start.
Unfortunately, we have found plenty of shady figures in the data who presumably wouldn’t lose any sleep if they sent round a gang of thugs to deliver us a message.
By now, we have discovered three companies linked to Sergei Roldugin, the cellist and [Russian President] Vladimir Putin’s friend. In addition to International Media Overseas, which we came across in the early days of our research, we have now discovered two companies called Sonnette Overseas Inc. and Raytar Ltd. All three companies are registered under the name of the man who claimed in a 2014 interview that he was not a businessman, let alone a millionaire. So we are curious to find out who owns it all.
These companies are part of a complex network of shell companies in which other figures from Putin’s circle, as well as a number of less wellknown bankers and businessmen — almost all of whom are from St. Petersburg, the city in which Putin began his ascent — are involved.
The [Panamanian law firm] Mossack Fonseca documents concerning these offshore companies expose deals involving shares in several big Russian companies. Large sums of money change hands. Unbelievably large sums.
Is Putin behind these companies? It would make sense.
Our international Russia task force, made up of a handful of reporters, is working its way contract by contract and company by company through the convoluted network of businesses linked to the cellist.
It is possible to imagine all kinds of things going on in Russia since the fall of the Soviet Union. But that a cellist such as Roldugin is running operations worth hundreds of millions of dollars? Unlikely.
There must be people behind him who are far more powerful.
This takes us back to the question of fear.
When the Russian edition of Forbes magazine first published a list of the 100 richest Russians (several of whom we find in our data) in 2004, the magazine’s chief editor was shot dead outside the Forbes offices just a few weeks later. The Russian journalist Anna Politkovskaya, who made her name reporting on Russia’s war in Chechnya, was murdered in the stairwell of her Moscow apartment building in 2006. Those who ordered the killing were never caught. But every Russian knows the date the crime was committed: Oct. 7, 2006, the date of Vladimir Putin’s 54th birthday.
There it is again, that vague sense of unease. But what about Roman Anin and Roman Shleynov, our Russian colleagues who have now been on the ICIJ team for a few weeks? Roman Anin started as a sports reporter with the Novaya Gazeta newspaper, which is well known for its critical stance towards the Russian government. Within a few years he had made a name for himself as one of Russia’s toughest investigative reporters, having probed and exposed corruption and cronyism in the military, in politics and in business. Anin published the construction contracts for the Winter Olympics in Sochi — contracts that were lucrative for many of Putin’s acolytes. He knows that he is in danger and that there are no guarantees.
At least four of his colleagues at the Novaya Gazeta have been murdered since 2000.
Our two Russian colleagues cannot access our multi-encrypted forum because you would need a smartphone, among other things, to do so. Roman Anin and Roman Shleynov do not use smartphones for security reasons — Anin has discovered spyware on his phone in the past. We only exchange research results with them via encrypted emails. Safety first.
We too force ourselves to maintain discipline regarding our data and devices. All hard drives are encrypted as a matter of course and all external hard drives are stored in a safe. Some of the hard drives are kept in the editorial office and the others in a secure location elsewhere.
We have special security measures in place in our project office. The new computer is even given its own lockable housing, which, in turn, is chained down so that you cannot simply walk off with the whole unit. We also paint all the housing screws [on the computer cases] with glitter nail polish.
That’s right: glitter nail polish. Our children would be envious, if they knew. A security expert advised us to do this because we would see it immediately if someone tampered with the housing. Single-colour nail polish can easily be painted over. But you would quickly notice if they tried that with glitter nail polish.
However, these measures can only keep the data safe. Glitter nail polish won’t be much help if someone decides to pay us a visit.
But what steps should we take? We do not feel the danger is so acute that we should be wearing bulletproof vests.
But just to reiterate: we live in Germany, a paradise for most investigative journalists. For our ICIJ colleagues in Africa, the Middle East, Eastern Europe and Latin America, the results of this research will be far more dangerous.
Some members of the ever-expanding Prometheus [code name for the Panama Papers] team will not be able to report freely — or if they do, they will face serious problems.
Khadija Ismayilova cannot even take part in the research — she is behind bars in an Azerbaijani prison. We worked with Khadija in 2013; she investigated offshore holdings owned by relatives of the Azerbaijani president Ilham Aliyev.
At the time, Khadija worked for Radio Free Europe, which has since ceased broadcasting, and the OCCRP [Organized Crime and Corruption Reporting Project], which has members from Southern Europe, the Caucasus and Central Asia. They do what local media no longer dares for fear of reprisals or economic pressure: investigate, expose and publish explosive stories.
According to Khadija’s investigation, several relatives of the Azerbai- jani president had holdings in shell companies. It appears that his two daughters, Arzu and Leyla, established three offshore companies in the British Virgin Islands in 2008. What’s more, the data revealed that the president and his wife, Mehriban — who is a member of Parliament — also set up their own offshore company in 2003: Rosamund International Ltd.
Despite being threatened several times, Khadija Ismayilova was undeterred. In 2013 she was arrested and detained briefly. When she returned from a journey to Europe in 2014 she was held for several hours by customs officials at Baku airport. The authorities demanded to see the content of her USB stick.
Since they had no legal grounds for making their demand, she refused and called the police. She later reported that the USB stick was actually empty — for Khadija it was a matter of principle.
She was arrested again in December 2014. One of the charges: inciting her ex-boyfriend to suicide. An absurd accusation, say observers, friends, colleagues. “This step is the last link in endless attempts to silence the free media in Azerbaijan — Khadija Ismayilova is one of the last independent voices in the country,” says Amnesty International.
In summer 2015 she was sentenced in Baku to prison for 71⁄ years. A few minutes after the judgment, the OCCRP posted this on its website: “Today, the Azerbaijani government sentenced Khadija Ismayilova to seven years and six months in prison. They think this will stop us from reporting. They are wrong.”
And indeed, Miranda Patrucic, who works with Khadija at the OCCRP, discovers the family of Azerbaijani president Ilham Aliyev in our data. Khadija Ismayilova’s reports were correct. Not that we ever doubted her. But the documents we now have before us show that she had only scratched the surface.