Is Wikileaks Compromised?

Julian Assange, the editor-in-chief and founder of the leak website Wikileaks has been 'missing' for over a month. After releasing a particularly damaging emails from the US Democratic National Committee, former Secretary of State Hillary Clinton, and Clinton  campaign manager John Podesta, Assange, not one for subtlety and laying low, suddenly went completely quiet. While rumors swirl about his capture or assassination, repeated requests for proof-of-life have gone unaddressed by both Assange himself, who might not have access to the Internet at this time, and Wikileaks.

While a missing Assange surely gives good fodder to conspiracy theories, something else is developing that's just as concerning, if not more so: Wikileaks itself may be compromised.

Wikileaks, through their official Twitter account, continues to assert that Assange is 'fine'  but gives no reason as to how they know this or why he has chosen to go silent at such a critical time. Additionally, several posts on social media sites like Reddit, 4Chan, and 8Chan, claiming to be from actual Wikileaks staffers paint a picture of a deeply compromised organization that may be controlled by forces that are hostile to the organizations goals and Assange himself.  Outsiders have been repeatedly warned not to share whistleblower information with the organization as it should now be considered a potential trap being used by those forces to catch and persecute whistleblowers.

All of this weirdness has prompted members of the community to begin to seriously question Wikileaks and the integrity of both the site and the people running the infrastructure. Calls have gone out on Twitter and other social media sites for Wikileaks to issue a digitally signed statement using an known, old PGP key in order to show that they at least remain in control of their keys.  So far, Wikileaks has refused to do so, causing mass speculation that they may be refusing to do so because, whoever is currently in control of the organization doesn't have access to the keys or their passphrase.

In an alleged phone interview yesterday, Assange said that he wouldn't issue a personally signed statement because it doesn't prove he identity of the person who signs it. It just proves that 'who controls the keys controls the keys', which is true and Wikileaks takes a similar stance on the issue. But both Assange and Wikileaks understand, even though this is true, their refusal to do so casts increasing suspicion as to if they actually are who they claim to be. Certainly, both Assange and Wikileaks understand that, while not perfect, a digitally signed statement from each of them would go a long way in allaying the fears of many in the community. Even though it doesn't "definitely prove anything", if they know it would calm folks down,why not just do it?

Unfortunately, the most obvious answer to that question is that they don't control the keys and can't issue such a signed statement. In my mind, there is only one answer that makes sense:

The people claiming to be Julian Assange and Wikileaks are not who they claim to be and do not have access to the private keys that are required to issue such a signed statement.

Some have speculated that another reason might be that the keys were destroyed as part of their contingency plans. While it's possible that this is the case, it's highly unlikely for a number of reasons:

1. If an attacker is sophisticated enough to infiltrate Wikileaks and harm or suppress Julian Assange in the Ecuadorian embassy, they are likely sophisticated enough to have already compromised staff computers and stolen a copy of the private keys. All they need are the passwords, which could be tortured out of almost anyone.

2. Destroying the keys would make it incredibly difficult to reassert their legitimacy at a later date and to establish new keys that are considered trustworthy.

Overall, I think the only answer is that either party is not issuing signed statements because they can't. There is absolutely no compelling or valid reason for them to refuse to do so otherwise and ever day that passes without such a statement makes things more suspicious.

So what can we do? Unfortunately, not much. We need to continue to hold Wikileaks feet to the fire and demanding two fairly simple things from them:

1. A valid, signed statement that they have not been compromised that has been signed with a known good PGP key

2. An explanation as to how they know Julian Assange is 'fine'.

These two things are the bare minimum we should accept from them. Again, it's not perfect, but it's a start. Establishing the continued credibility of Wikileaks is as important (if not more important) than whether Assange is alive, dead, or captured. Wikileaks can live without Assange, but we have to be able to trust it. Right now, we just can't do that.

Will Wikileaks step up?