Distributed Denial of Secrets, abbreviated DDoSecrets, is a nonprofitwhistleblower site founded in 2018 for news leaks.[4][5][6][7][8] The site is a frequent source for other news outlets and has worked on investigations including Cyprus Confidential[9][10] with other media organizations.[8][11] In December 2023, the organization said it had published over 100 million files from 59 countries.[12][13][14]
Distributed Denial of Secrets was founded by Emma Best, an American national security reporter known for filing prolific freedom of information requests, and Thomas White, an administrator of the Silk Road 2.0.[8][2][1] At its public launch in December 2018, the site held more than a terabyte of data from many of the highest-profile leaks. The site originally considered making all of the data public, but after feedback made some of it available only to journalists and researchers.[26]
Best has served as a public face of the group, which lists its members.[27] In February 2019, they told Columbia Journalism Review that fewer than 20 people worked on the project. According to Best, several early members of the project were driven to radical transparency work by their past background with the state, which they compared to Chelsea Manning and other whistleblowers. Best said, "Those associations all ended well prior to DDoSecrets coming together and were internally disclosed early on."[8] In April 2021, the website listed 10 members and advisors.[27]
In December 2020, the group announced its affiliation with Harvard University's Institute for Quantitative Social Science.[29]
In January 2024, DDoSecrets launched the Greenhouse Project to preserve censored information and create a "warming effect to reverse the chilling effects of censorship" as part of its broader mission to ensure the free transmission of data in the public interest by making itself a "publisher of last resort".[14] In June 2024, DDoSecrets' revamped their website[30] and in July, DDoSecrets launched two new projects, the Library of Leaks and Disclosure Without Borders. The Library of Leaks focuses on preserving existing data and coordinating with outside groups and Disclosure Without Borders focuses on new publications and source protections.[30]
In 2019, the Congressional Research Service recognized Distributed Denial of Secrets as a transparency collective.[33] In December 2019, politicians in Sweden and the UK, including anti-corruption chief John Penrose said that leaks published by Distributed Denial of Secrets showed the need for reforms on company creation and registration.[45][46] That month, Belgian tax authorities initiated an investigation based on data published by DDoSecrets the prior month.[47]
In 2020, the U.S. counterintelligence strategy described leaktivists and public disclosure organizations like Distributed Denial of Secrets as "significant threats," alongside five countries, three terrorist groups, and "transnational criminal organizations."[17][48] A June 2020 bulletin created by the Department of Homeland Security's Office of Intelligence and Analysis erroneously[14] described them as a "criminal hacker group".[49] Elements of the report were challenged as inaccurate by DDoSecrets and media such as The Verge.[49][50] On July 3, German authorities seized a public server used by Distributed Denial of Secrets[51][52] at the request of the US government.[53][11][49] The same month, the Internal Revenue Service (IRS) recognized the group as a 501(c)(3) non-profit.[4]
In 2021, legislators in Maine introduced a bill to close the state's fusion center in response to BlueLeaks and whistleblower reports.[54]
In 2022, law enforcement agencies in New York, New Jersey, Washington and Oregon launched investigations into officers who appeared in the leaked Oath Keepers records published by DDoSecrets.[55]
In June 2020, the organization was banned from Twitter[60][61] in response to BlueLeaks, citing a breach of their policies against "distribution of hacked material"[62] in a move that was criticized as setting a "dangerous precedent."[63] In September 2023, The Intercept reported that access to the organization's website was blocked by Indonesia and Russia and censored by Twitter and Reddit.[64][14] In 2024, they refused a take down letter from Brainstack over data from their spyware company, mSpy.[65] A Telegram channel operated by the group was closed without notice after publishing data from Israel's Ministry of Justice.[65][66]
As of April 2022[update], the site hosts dozens of terabytes of data from over 200 organizations.[67][68] In December 2023, the organization said it had published over 100 million files from 59 countries.[12][13][14] The group has said it uses "a mixed distribution model, publishing information both to the general public and restricting some information to journalists and researchers when there's a lot of sensitive information."[14]
2018
In December 2018, DDoSecrets listed a leak from Russia's Ministry of Internal Affairs,[69] portions of which detailed the deployment of Russian troops to Ukraine at a time when the Kremlin was denying a military presence there. About half of the material from that leak was published in 2014; the other half emerged in 2016.[70]WikiLeaks reportedly rejected a request to host the full cache of files in 2016,[70] at a time when founder Julian Assange was focused on exposing Democratic Party documents passed to WikiLeaks by Kremlin hackers.[71]
2019
In January 2019, DDoSecrets published hundreds of gigabytes of hacked Russian documents and emails from pro-Kremlin journalists, oligarchs, and militias.[71]
In November 2019, DDoSecrets published over 2 terabytes of data from the Cayman National Bank and Trust. The files were provided by the hacktivist known as Phineas Fisher, and included lists of the bank's politically exposed clients. The leak was used by researchers to study how elites use offshore banking.[72][73][74]
In December 2019, DDoSecrets published "#29 Leaks" in partnership with the Organized Crime and Corruption Reporting Project and more than 20 outlets in 18 countries.[75] The 450 gigabytes of data came from Formations House (now The London Office), a "company mill" which registered and operated companies for clients included organized crime groups, state-owned oil companies, and fraudulent banks.[72][76][77] The release was compared to both the Panama Papers and the Paradise Papers.[72][76][77]Belgian tax authorities initiated an investigation based on the Cayman bank and Formations House leaks.[47]
In December 2019, DDoSecrets published "PacoLeaks" and "MilicoLeaks": data from Chilean military police and military. PacoLeaks revealed police personnel data, extensive police files on activist groups and leaders, and evidence that the police had infiltrated activist groups[78] MilicoLeaks included details on Chilean army intelligence, including operations, finance and international relations.[79][80]
In 2020, DDoSecrets published a copy of the Bahamas corporate registry. DDoSecrets partnered with European Investigative Collaborations and the German Henri-Nannen-Schule journalism school to create the Tax Evader Radar, a project to review the dataset of almost one million documents.[81] The project exposed the offshore holdings of prominent Germans,[82] the tax activities of ExxonMobil,[83] as well as offshore business entities belonging to the DeVos and Prince families.[84]
In March 2020, DDoSecrets published 156 gigabytes of data hacked from the Myanmar Investment Commission.[85] The leak also revealed how millions of dollars allegedly flowed from Mytel subscribers to Myanmar military generals,[86] and exposed business dealings of family members of prominent military leaders.[87]
In April 2020, DDoSecrets published almost 10million messages from more than 100 Discord servers used by neo-Nazi and QAnon conspiracy theorist groups.[88] The leaked chats showed threats of violence and attempts to influence the 2018 United States midterm elections.[89]
On June 19, 2020, DDoSecrets released BlueLeaks, which consisted of 269 gigabytes of internal U.S. law enforcement data obtained from fusion centers by the hacker collective Anonymous. DDoSecrets called it the "largest published hack of American law enforcement agencies."[90]Betsy Reed described BlueLeaks as the U.S. law enforcement equivalent to the Pentagon Papers.[91]
In July 2020, DDoSecrets released documents relating to the United States' case against WikiLeaks founder Julian Assange. The release also included chat logs and letters between Assange and various sources.[92]
On February 28, DDoSecrets revealed "GabLeaks", a collection of more than 70 gigabytes of data from Gab, including more than 40 million posts, passwords, private messages, and other leaked information. The group said that they would not release the data publicly because it contained a large amount of private and sensitive information, and instead shared the data with select journalists, social scientists, and researchers.[97]
In April 2021, Distributed Denial of Secrets made donor information from the Christian crowdfunding site GiveSendGo available to journalists and researchers. The information identified previously anonymous high-dollar donors to far-right actors including members of the Proud Boys, many of whose fundraising efforts were directly related to the 2021 United States Capitol attack.[98]
Also in April 2021, DDoSecrets published a cache of emails from Chicago City Hall.[99][100] The emails revealed that the city's handling of fatal shootings by police officers violates state law and a federal consent decree.[101] The emails also exposed the Mayor's secret lobbying for qualified immunity,[102] a secret drone program funded with off-the-books cash,[103] and the city's problems with police chases and the George Floyd protests.[104][105]
In May 2021, DDoSecrets republished the leak of Washington D.C.'s Metropolitan Police Department, including over 90,000 emails. Among other things, the files revealed details of surveillance of right-wing extremists and the response to the 2021 United States Capitol attack.[106][107]
In September 2021, DDoSecrets publicly released emails and chat logs from the American far-right Oath Keepers organization to the public. They also provided member and donor data to the press. This exposed hundreds of members in law enforcement, over a hundred members with ties to the military and dozens in political office.[108][109][110]
In February 2022, after many anonymous donors supported the 2022 Freedom Convoy, DDoSecrets began providing journalists and researchers with a hacked list of donors' personal information from GiveSendGo. Later that month, GiveSendGo was hacked again, exposing donors for every campaign in the site's history, which DDoSecrets gave to journalists and researchers.[113]
In May 2022, DDoSecrets published 128,700 emails allegedly associated with a Hunter Biden laptop that were being circulated by allies of and former staff of President Donald Trump. DDoSecrets said it published the emails "to counteract possible deceptions by persons with an agenda who are currently distributing the dataset without the relevant context or warnings," because there were "considerable issues with this dataset including signs of tampering" and "more than one altered or implanted emails".[114] DDoSecrets also made a copy of the alleged laptop available to journalists and researchers.[25]
During the Russo-Ukrainian War, DDoSecrets published more than 40 datasets of Russian leaks, totaling at least 5.8 terabytes.[68][115][116] Emma Best estimated that the group had published over six million Russian documents in under two months after the war began.[116]NBC News reported that the site "might be the single best public repository of all the Russian files purportedly leaked since the start of the invasion",[117] and The Intercept wrote that it had become the "de facto home" for Russian leaks.[116]
In September, they published Fuerzas Represivas, a collection of military documents from Latin America and Mexico totaling more than 13 terabytes, which Emma Best called "the largest leak in history". The leak included the Chilean Joint Chiefs of Staff, the Mexican Ministry of National Defense and the Joint Command of the Armed Forces of Peru.[118]
In August 2023, DDoSecrets published over 500,000 documents and other files from the National Police of Paraguay.[129] In October, they published intelligence documents about investigations involving former president of Paraguay Horacio Cartes.[130] They also published emails and documents from Ethiopia's Financial Intelligence Service.[131][132]
In November 2023, the Organized Crime and Corruption Reporting Project joined with more than 40 media partners including Cerosetenta / 070,[133]Vorágine,[134] the Centro Latinoamericano de Investigación Periodística (CLIP)[135] and Distributed Denial of Secrets and journalists in 23 countries and territories for the largest investigative project on organized crime to originate in Latin America, producing the 'NarcoFiles' report. The investigation was based on more than seven million emails from the Colombian prosecutor's office which had been hacked by Guacamaya, including correspondence with embassies and authorities around the world. The files dated from 2001-2022 and included audio clips, PDFs, spreadsheets, and calendars.[136][137] The investigation revealed new details about the global drug trade and over 44 tons of "controlled deliveries" carried out to infiltrate the drug trade[138][139] and how criminals corrupt politicians, bankers, accountants, lawyers, law enforcement agents, hackers, logistics experts, and journalists in order to use logistical, financial, and digital infrastructures.[140]
Also in November 2023, the International Consortium of Investigative Journalists, Paper Trail Media [de] and 69 media partners including Distributed Denial of Secrets and the OCCRP and more than 270 journalists in 55 countries and territories[9][10] produced the 'Cyprus Confidential' report on the financial network which supports the regime of Vladimir Putin, mostly with connections to Cyprus, and showed Cyprus to have strong links with high-up figures in the Kremlin, some of whom have been sanctioned.[141][142] Government officials including Cyprus president Nikos Christodoulides[57] and European lawmakers[57] began responding to the investigation's findings in less than 24 hours,[56] calling for reforms[57] and launching probes.[58][56][59]
2024
In 2024, DDoSecrets launched the "Greenhouse Project" to preserve censored information and create a "warming effect to reverse the chilling effects of censorship" as part of its broader mission to ensure the free transmission of data in the public interest by making itself a "publisher of last resort". The first entry in the project was a November 16, 2023 Reuters story that alleged that a hacking-for-hire firm called Appin had stolen secrets from executives, politicians, military officials, and wealthy elites around the globe and supporting documents. The story was removed by Reuters following an order from a district court in New Delhi, India.[14]
At the Hackers On Planet Earth (HOPE) conference in June, DDoSecrets announced that the next entry in the Greenhouse Project was mirroring all of WikiLeaks' data after datasets became unavailable to download from the site and Julian Assange's plea deal required the organization to remove information. Emma Best said that the goal was making the WikiLeaks data more accessible and resilient against additional censorship and future website failures. Some of the data were things that DDoSecrets said they "would have handled that data differently than WikiLeaks did, the data is out there and we shouldn't act as censors for it".[30]
^
Andy Greenberg (June 22, 2020). "Hack Brief: Anonymous Stole and Leaked a Megatrove of Police Documents". Wired magazine. Archived from the original on June 23, 2020. Retrieved July 20, 2020. 'It's the largest published hack of American law enforcement agencies,' Emma Best, cofounder of DDOSecrets, wrote in a series of text messages. 'It provides the closest inside look at the state, local, and federal agencies tasked with protecting the public, including [the] government response to COVID and the BLM protests.'
^Silverman, Jacob; Haas, Lidija; Haas, Lidija; Smith, Jordan Michael; Smith, Jordan Michael; Segall, Pam; Segall, Pam; Al-Agba, Niran; Al-Agba, Niran (August 18, 2021). "The New WikiLeaks". The New Republic. ISSN0028-6583. Archived from the original on September 13, 2023. Retrieved March 6, 2022.