panam papers leaks

26 words

The security guard handed over a key with a small yellow label. The Guardian’s secure room had housed the team that in 2013 worked through data leaked byEdward Snowden to expose unchecked surveillance by British and American spy agencies.

Now it was to be home to a small group of journalists gathered from all corners of the newsroom to work on a project code-named Prometheus. Our investigation into the murky world of tax havens, underpinned by the biggest leak in history, would eventually surface eight months later with the publication of the Panama Papers.

The story began back in February 2015, with an article in Süddeutsche Zeitung that revealed the German newspaper had a slug of secret files about offshore companies on the books of the Panamanian law firm Mossack Fonseca. Some 80 gigabytes of data about the firm’s customers had been received by the paper’s investigative reporters, Bastian Obermayer and Frederik Obermaier.

A source would go on to leak 2.6 terabytes of information, sending the pair as an opening message: “Hello, this is John Doe. Interested in data?” The source demanded absolute anonymity. To this day, his or her identity remains unknown to the Panama Papers reporters. “My life is in danger, we will only chat over encrypted files. No meeting ever.”

The Guardian’s involvement formally began in September 2015, when Katharine Viner, the paper’s editor-in-chief, and Paul Johnson, deputy editor, flew to Munich to secure participation in the consortium of journalists around the world collaborating on the story.

Back in London, the team began poring over the archives of Mossack Fonseca. These were being gradually uploaded to servers managed by the International Consortium of Investigative Journalists (ICIJ) in Washington. The database would eventually include 11.5m emails, passport scans, contracts, share registers and even sound recordings.

As a business reporter tasked with unpicking the tax-sheltering schemes used by California technology groups and London property developers, I have followed many trails leading to offshore dead ends. The Panama Papers meant that for the first time I was able to take a good, long look at what lay beyond the wall of secrecy.

It quickly became apparent that offshore agents such as Mossack Fonseca often have no special knowledge about their customers. Tax havens’ lack of transparency may allow the keeping of secrets, but these secrets are often kept elsewhere.

As a result, the database needed to be approached from multiple angles, whacked with many sticks, until it could be cracked.

The Guardian brought together its specialists. Luke Harding, the paper’s foremost Russia expert, took on the huge task of investigating Mossack Fonseca’s many Russian and Ukrainian customers. Simon Bowers, a tax and fraud specialist from the City desk, picked apart the undeclared offshore holdings of Iceland’s prime minister.

Holly Watt, who had previously exposed the MPs’ expenses scandal for the Daily Telegraph, tracked down the files relating to members of parliament, peers andpolitical donors. The Guardian’s chief sports writer, Owen Gibson, delved into the world of sport, while reporters in the paper’s New York and Sydney offices hunted for stories of local interest.

David Pegg, with whom I had worked on the HSBC files, exposing tax evasion at the Swiss branch of Britain’s biggest bank, matched land registry records with lists of Mossack Fonseca companies. He soon realised that the firm was acting for roughly 10% of all offshore companies with land holdings in Britain.

Helena Bengtsson, editor of the data projects team at the Guardian, compiled lists of the names of everyone from members of parliament to those wanted by Interpol or on European or US sanctions orders. She then cross-matched these with the Panama Papers data, checking tens of thousands of names at a time and leaving her computer running all night so she could comb through the results in the morning.

We worked hard to keep the information safe. With investigative reporters looking into a $2bn Russian money-laundering scheme linked to Vladimir Putin, the threat of a hack by the FSB, Russia’s security agency, was very real.

More than 140 high-ranking politicians and heads of state were uncovered in the data, leaving partners in less democratic countries at risk of government retaliation. Since the Panama Papers were published Ecuador’s president, Rafael Correa, has used Twitter to name and admonish local journalists for not handing over all the data. In Venezuela, the journalist Ahiana Figueroa has been fired from her news organisation for being part of the Panama Papers team. In Tunisia, the website Inkyfada has come under suspected cyber attack after naming a former presidential adviser.

The five reporters in the core team spent long days over the winter interrogating the data, plugged into headphones and staring at screens.

As we worked, more information was being leaked. New data was uploaded at regular intervals, with the last set dating from December 2015. In February, we began to approach those we intended to name, and our research began to collide with events in the outside world. In places far away from Britain, the impact of the Panama Papers was beginning to be felt in local and apparently isolated political scandals.

In late January, two Mossack Fonseca representatives in Brazil were arrested, and later released, by authorities investigating the Petrobras affair. Two others fled the country. A prosecutor in the case described the firm as a “money-washing machine”.

On 4 March, the law firm received a letter from the ICIJ and Süddeutsche Zeitung stating that they had seen information concerning thousands of its companies.

On 11 March, TV crews from the consortium descended on Panama City to film the firm’s offices and ask for interviews. Later that day, founding partner Ramón Fonseca resigned from his position as an official adviser to the Panamanian president, Juan Carlos Varela. In a parting shot, he tweeted: “The pen is a powerful tool. It’s sad when used for evil.”

On the same day, the Icelandic prime minister, Sigmundur Davíð Gunnlaugsson, walked out of a television interview with two Panama Papers reporters, the independent documentary maker Jóhannes Kristjánsson and Sven Bergman from Swedish TV. They had, on camera, named Wintris, the undeclared offshore company he had once owned with his wife, and which his wife still owned.

The film would not be released until 7pm GMT on Sunday 3 April, the date that all 110 news outlets brought together by the ICIJ had agreed to release their stories simultaneously.

But by the Monday before publication, the Kremlin was beginning to spin. Putin’s spokesman held a press conference to warn that a number of journalists were planning an “information attack” on the Russian president, led by the ICIJ. Key names, including those of the banker Yuri Kovalchuk and the cellist Sergei Roldugin, were released.

The atmosphere inside the secure room at the Guardian was tense. We had by now been joined by the paper’s investigations head, Nick Hopkins, picture researchers and a crack team of subeditors who moulded a mass of 33 articles into publishable form.

Would the story hold? Should we bring the publication date forward? Requests for information began to flood into the ICIJ. Like a general holding back his troops before the charge, the consortium’s director, Gerard Ryle, hit the phones, talking editors into holding their nerve.

By the Friday, two days before we published, there were calls for a vote of no confidence in the Icelandic parliament. But the key data relating to Gunnlaugsson’s offshore adventure remained unpublished, and so the embargo agreed months beforehand stayed in place.

After months working on our own, on Sunday 3 April, the Panama Papers reporting team emerged from the locked office to gather around a desk in the centre of the newsroom. There were 11 items ready to be published. Viner and Johnson stood ready to give the signal.

At 6.48pm, Edward Snowden sent a Twitter message to his 2 million followers: “The biggest leak in the history of data journalism just went live, and it’s about corruption.” His tweet linked to a Süddeutsche Zeitung article headlined A Storm is Coming.

Within minutes, the Panama Papers whirlwind had struck. In 70 countries around the world, the reverberations are still being felt.

WHEN DANIEL ELLSBERG photocopied and leaked the Pentagon Papers to the New York Times in 1971, those 7,000 pages of top secret Vietnam War documents represented what was then the biggest whistleblower leak in history—a couple dozen megabytes if it were contained in a modern text file. Almost four decades later, WikiLeaks in 2010 published Cablegate, a world-shaking, 1.73 gigabyte collection of classified State Department communications that was almost a hundred times bigger.

If there’s some Moore’s Law of Leaks, however, it seems to be exponential. Just five years have passed since WikiLeaks’ Cablegate coup, and now the world is grappling with a whistleblower megaleak on a scale never seen before: 2.6 terabytes, well over a thousandfold larger.

On Sunday, more than a hundred media outlets around the world, coordinated by the Washington, DC-based International Consortium of Investigative Journalists, released stories on the Panama Papers, a gargantuan collection of leaked documents exposing a widespread system of global tax evasion. The leak includes more than 4.8 million emails, 3 million database files, and 2.1 million PDFs from the Panamanian law firm Mossack Fonseca that, according to analysis of the leaked documents, appears to specialize in creating shell companies that its clients have used to hide their assets.

“This is pretty much every document from this firm over a 40-year period,” ICIJ director Gerard Ryle told WIRED in a phone call, arguing that at “about 2,000 times larger than the WikiLeaks state department cables,” it’s indeed the biggest leak in history.

Neither the ICIJ nor any of the reporters it’s worked with have made the leaked data public. But the scandal resulting from their reporting has already touched celebrities, athletes, business executives and world leaders. The documents trace $2 billion of hidden money tied to Vladimir Putin through accounts held in the names of family members and his celebrated musician friend Sergei Roldugin. Icelandic Prime Minister Sigmundur Gunnlaugsson is facing demands from the previous Icelandic prime minister that he resign after the Mossack Fonseca documents showed that Gunnlaugsson may have failed to disclose ownership of a stake in certain Icelandic banks under the government’s rules for officials. And the leaks drag FIFA officials back into the news, showing that even an ethics lawyer for the world soccer body hadfinancial ties to another FIFA official already accused of corruption.

But beyond those revelations—and there will likely be more as the reporting around the Panama Papers continues—the leak represents an unprecedented story in itself: How an anonymous whistleblower was able to spirit out and surreptitiously send journalists a gargantuan collection of files, which were then analyzed by more than 400 reporters in secret over more than a year before a coordinated effort to go public.

How You Coordinate History’s Biggest Leak

The Panama Papers leak began, according to ICIJ director Ryle, in late 2014, when an unknown source reached out to the German newspaper Suddeutsche Zeitung, which had reported previously on a smaller leak of Mossack Fonseca files to German government regulators. A Suddeutsche Zeitung reporter named Bastian Obermayer says that the sourcecontacted him via encrypted chat, offering some sort of data intended “to make these crimes public.” But the source warned that his or her “life is in danger,” was only willing to communicate via encrypted channels, and refused to meet in person.

“How much data are we talking about?” Obermayer asked.

“More than you have ever seen,” the source responded, according to Obermayer.

Obermayer tells WIRED he communicated with his source over a series of encrypted channels that they frequently changed, each time deleting all history from their prior exchange. He alludes to crypto apps like Signal and Threema, as well as PGP-encrypted email but declines to say specifically which methods they used. Each time the reporter and source re-established a connection, they would use a known question and answer to reauthenticate each other. “I’d say ‘is it sunny?’ You’d say ‘the moon is raining’ or whatever nonsense, and then both of us can verify it’s still the other person on the device,” Obermayer says.

After seeing a portion of the documents, Suddeutsche Zeitung contacted the ICIJ, which had helped to coordinate previous tax haven megaleaks including a 2013 analysis of leaked offshore tax haven data and another leak-enabled investigation last year that focused on assets protected by the Swiss bank HSBC. ICIJ staff flew to Munich to coordinate with Suddeutsche Zeitung reporters.

Meanwhile, the shipments of leaked data continued piecemeal. “Over time we got more and more until we had all 11.5 million documents,” Ryle says. Obermayer declined to explain how their leaker sent Suddeutsche Zeitung hundreds of gigabytes or even terabytes of information at a time. That’s far too much to send over email, of course, though that quantity of data could easily be sent anonymously in the form of shipped encrypted hard drives. “I learned a lot about making the safe transfer of big files,” Obermayer says elliptically.

The ICIJ’s developers then built a two-factor-authentication-protected search engine for the leaked documents, the URL for which they shared via encrypted email with scores of news outlets including the BBC, The Guardian, Fusion, and dozens of foreign-language media outlets. The site even featured a real-time chat system, so that reporters could exchange tips and find translation for documents in languages they couldn’t read. “If you wanted to look into the Brazilian documents, you could find a Brazilian reporter,” says Ryle. “You could see who was awake and working and communicate openly. We encouraged everyone to tell everyone what they were doing.” The different media outlets eventually held their own in-person meetings, too, in Washington, Munich, London, Johannesburg and Lillehammer, Ryle says.1

Remarkably, despite all that broad access and openness, the full leaked database has yet to leak to the public—perhaps in part because it’s so large and unwieldy. Obermayer admits that rumors of the massive leak spread, but says that the data itself remained contained. “Last fall I was really nervous, thinking ‘a lot of people know,'” he says. “Word leaked out at places. But it never got further.”

Ryle says that the media organizations have no plans to release the full dataset, WikiLeaks-style, which he argues would expose the sensitive information of innocent private individuals along with the public figures on which the group’s reporting has focused. “We’re not WikiLeaks. We’re trying to show that journalism can be done responsibly,” Ryle says. He says he advised the reporters from all the participating media outlets to “go crazy, but tell us what’s in the public interest for your country.”

Weeks before contacting the subjects of the investigation, including Mossack Fonseca, Obermayer took one final precaution: he destroyed the phone and the hard drive of the laptop he’d used for his conversations with the source. “This may have seemed a little overachieving,” he notes, “But better safe than sorry.”