Distributed Denial of Secrets is picking up where WikiLeaks left off

Last summer, internal intelligence and communications from more than 200 law enforcement agencies was hacked and released to the public. The disclosures came right in the midst of the nationwide protests after the murder of George Floyd by Minneapolis police, when people all over the country were pouring into the streets to demand reform, if not outright abolition, of policing in America.

The group behind the leak was Distributed Denial of Secrets, a collective of journalists and transparency advocates. Founded in 2018 by journalist Emma Best and an anonymous partner known as The Architect, DDoSecrets has quietly been one of the most effective organizations at bringing information powerful organizations want to keep hidden into the light. Since the BlueLeaks drop last June, DDoSecrets has published more juicy contraband, including videos, photos, posts, and direct messages scraped from far-right social media sites Gab and Parler in the wake of the Jan. 6 insurrection attempt. In the last few weeks, the organization has hosted a mirror of data from Epik, an internet services company that has been utilized by far-right and white supremacist groups, and has published emails, chat logs, and member and donor lists from the Oath Keepers, a far-right militia group involved in the Jan. 6 insurrection attempt.

DDoSecrets is a tight-knit group, with a trusted network of journalists, researchers, advocates, and experts. LGBTQ+ identity is also baked in: The inclusive Pride flag appears in the DDoSecrets logo, and many of its members identify as trans or queer folk. That wasn’t intentional, Best tells Mic, but rather more of a “happy accident.” “We’ve been open about it,” Best says, “but it’s never been part of our agenda or criteria.”

Members of DDoSecrets made it a point in their interviews with Mic not to speak for anyone else in the group when discussing their identity or how it affects their work. But some did share how their own personal experiences influenced their desire to contribute to the release of information. “Queer people are attracted to transparency because we’re forced into closets and into confronting broken and abusive systems,” Best says.

“For many of us, to exist as a queer or trans person is to need to be a hacker.”

Beka Valentine, a member of DDoSecrets and the founder of the experimental art and technology workspace Queerious Labs, says there is a common thread between queer identity and hacker identity. “Our existence has been stigmatized, outlawed,” Valentine says, noting that access to the most basic and essential things, be it medical treatment or work or basic safety, is often threatened for LGBTQ+ people. “We’ve often had to figure out ways of doing stuff — whether that’s getting on hormones, having gender-affirming clothing, paying rent — outside of the socially imposed limits.”

Valentine adds that for many queer and trans folk, computers were the first tool that allowed them to connect with other members of the LGBTQ+ community and express their own identities. “Our computers were, and often still are, the means by which we exercise agency over our lives,” she tells Mic, so understanding and controlling them is paramount. To lose that control would be to lose access to safe communities, to medication, to knowledge essential for survival. “For many of us, to exist as a queer or trans person is to need to be a hacker.”

There is history here, according to Edmond Chang, an assistant professor of English at the University of Ohio and a scholar of digital spaces and queer identity. “In early digital spaces, be it dial-in bulletin board systems (BBS) or email listservs or Web 1.0, queer people found ways to recognize one another, connect, gather, collaborate, and organize,” Chang says. “Much like in the ‘real world,’ be it in a city or a small town, there have always been overt and covert ways to signal that you are part of the community, part of the ‘family.’” In real life, that may have been the use of slang or an identifier like a handkerchief in a pocket. Online, Chang says, queer people may use “textual clues or a little image” to signal their identity to others — like DDoSecrets’s logo.

It’s difficult to say whether or not the information published by DDoSecrets would have still found its way into the public if the organization didn’t exist. But it does seem like the collective has been able to create a level of trust with sources that may have been hard to establish otherwise. The hackers who claim to be behind the release of data from far-right web host Epik identify themselves with the name Hackers on Estradiol, a reference to a hormone therapy utilized by trans women. The source of the Parler data that DDoSecrets published was a hacker who went by the name donk_enby, a presumed reference to being non-binary. Another hacker who provided the dataset scraped from Gab, JaXpArO, uses they/them pronouns.

In releasing the Gab data, DDoSecrets noted that the hacker entrusted the group “with both the data and their safety.” Thus far, DDoSecrets has given sources good reason to trust them: “We see a measure of success in how, to date, none of our sources have been arrested for their work of sharing information with us,” says Lorax Horne, a DDoSecrets member who joined in 2019.

Perhaps inevitably, some who have been on the wrong side of a leak have attempted to weaponize the group’s identity to dismiss their work. Earlier this year when DDoSecrets published a trove of content from Gab, including public posts and private messages from many users of the far-right social network, the company's CEO Andrew Torba referred to the group as “mentally ill” and “demon hackers” and used a transphobic slur to describe its members.

DDoSecrets took the attack in stride; some members even added Torba’s insults to their social media profiles. But the incident was a reminder of exactly the type of people DDoSecrets is trying to expose — and how harmful they can be.

“It’s left me with the constant awareness that many of the people we publish data [about], at best, do not care about the quality of life for people like me unless it’s profitable for them in some way, and many others would gladly cheer on or commit violence against queer people like me just for existing,” Best tells Mic. “This doesn't leave me vengeful or spiteful or anything like that, but it reminds me of the stakes — both the potential for danger to myself and my family, and the danger of letting some things go unchecked.”

Horne says that those who try to drag identity or politics into the work that DDoSecrets does are offering “a lazy critique from people who did not want to interrogate the datasets and mine them for insight.” They note that in Torba’s case, he had a direct motivation to try to discredit DDoSecrets, and the fastest way to do that among his audience — a community made up of white supremacists, antisemites, transphobes, and other members of hate groups — was to attack the members’ identity. This is not a new tactic: In the 1960s, government intelligence agencies attempted to smear leakers and defectors by accusing them of being gay.

The transparency community itself has unfortunately not been free of this type of bigotry, either. Prior to working together at DDoSecrets, Best and Horne were both involved, in separate capacities, with WikiLeaks. Likewise for Birgitta Jónsdóttir, an adviser to DDoSecrets and a co-founder of the Icelandic Pirate Party, who was an early member of WikiLeaks. Over time, they found the environment within WikiLeaks to be toxic.

The crossover between these groups is perhaps to be expected. And, to a degree, so is the comparison of their work. DDoSecrets stepped into the void left by WikiLeaks when WikiLeaks largely went dark after 2018. (It started publishing again in 2021.) For the general public, WikiLeaks is the closest thing to a household name for this type of transparency publishing. The organization brought to light video of a U.S. helicopter firing on civilians in Iraq, hundreds of thousands of secret cables sent from U.S. embassies, and hacked emails from the Democratic National Committee.

Horne, who was born in Canada and raised in Ecuador, started working as a journalist in their 20s and has written for publications like Newsweek and The Guardian. They became involved with WikiLeaks as part of a cross-border research effort in 2013. They tell Mic they noted some of the cracks in the organization early on, like “their rock-star culture that lionized people like [Julian] Assange and their Western-centrism that took away from the work.”

Things came to a head in the lead-up to the 2016 U.S. presidential election. “I watched WikiLeaks volunteers trying to help the Trump campaign early on and found that disgusting,” Horne tells Mic. At the time, WikiLeaks was publishing hacked emails from the Democratic National Committee and the organization reportedly had a preference for Trump. Assange appeared to be intentionally obfuscating whom the source of the data was by leaning into conspiracy theories that suggested they came from a DNC staffer who had been murdered. Later reporting would indicate that someone at WikiLeaks appeared to be in contact with Donald Trump, Jr. during the election season. (Mic reached out to WikiLeaks for comment but did not receive a reply.)

Best, too, has history with WikiLeaks — first collaborative, then combative. Best worked with the organization for a number of years, but a rift began when WikiLeaks, in Best’s mind, started shifting away from its more idealistic origins and set aside its standards to pursue something that appeared more like a political agenda. Best has called out WikiLeaks for publishing without permission from its sources, editorializing leaks, and selectively publishing information.

“We are a newer generation of something [WikiLeaks] tried to do, and we are trying to do better.”

Best was also involved in a situation in which WikiLeaks failed to live up to its promise of protecting innocents while publishing leaked data. In 2016, a hacker gained access to a trove of emails and data collected from the Turkish government following a coup attempt. The information was intended to be combed through by local journalists, but was made public before being properly curated and culled. The leaked database ultimately contained sensitive information of Turkish citizens that was not properly redacted. Best says they took responsibility for uploading a copy of the data that contained that information and quickly agreed to take it down, but WikiLeaks chose not to take down social media links to the dataset. (Mic reached out to WikiLeaks for comment about this decision but did not receive a reply.)

The ties to WikiLeaks were evident from the start for DDoSecrets. One of the first things that Best published under the heading of their new organization was a massive trove of emails from Russian politicians and oligarchs — data that had previously been given to WikiLeaks, but that the organization had declined to publish. Best has since not been shy about calling out bad behavior they saw within WikiLeaks: They published thousands of direct messages sent to and from the WikiLeaks Twitter account, which included homophobia, transphobia, ableism, sexism, racism, and antisemitism.

“WikiLeaks is important context,” Horne says. “We are a newer generation of something they tried to do, and we are trying to do better.”

DDoSecrets’s work has driven news cycles, but the group itself doesn’t grab headlines the way WikiLeaks and other transparency organizations, like Anonymous, have in the past. Best believes that’s in part due to how the group chooses to present itself, as well as how small the organization is. “I don’t think people understand how much we do with how little resources,” Best says. They estimate that WikiLeaks’s operations cost about 3,000 times that of DDoSecrets. “That’s not to say WikiLeaks or anyone else is inefficient,” Best explains. “It’s to highlight how much we do with very little.”

And while they may have put distance between their new organization and their past, Best’s work at WikiLeaks did lay the foundation for DDoSecrets to come together. According to Horne, it wasn't just what Best was publishing there, but how they went about it that appealed to them. “They could admit when they were wrong and take responsibility for their actions,” Horne says, pointing to Best’s mea culpa with the Turkish data. “They seemed to actually care about the people most impacted by data breaches in a way that WikiLeaks seemed to pass over and neglect.” The evidence is in DDoSecrets’s work as well: The group intentionally protected innocent users of Gab by only releasing limited datasets to trusted sources, rather than offering a full public archive.

As a freelance journalist and transparency advocate, Best has made thousands of Freedom of Information Act (FOIA) requests for information from U.S. intelligence services — so frequently, in fact, that the FBI tried to ban them from filing any more. FOIAs are useful tools that often reveal previously unreported or unknown information, but the process is a slow and arduous one. Agencies can delay their responses for years, declare information too sensitive to disclose, or even seemingly ignore the requests entirely.

Now, working with DDoSecrets, Best and her crew are not subject to these limitations. The information the group publishes does not come through the slow drip of bureaucratically approved releases, but rather through a steady stream of leaked and hacked documents. DDoSecrets say they are not the hackers themselves; instead, they exist as a confidential space for whistleblowers to come forward with information, and work diligently to archive and share it.

Best, along with The Architect, formed DDoSecrets under the guidance of a Latin creed: “Veritatem cognoscere ruat caelum et pereat mundus.” Roughly translated, it means “to know the truth, even if the heavens fall and the world perishes.” Best says the motto is a little jab at intelligence agencies like the CIA and its unofficial slogan “and ye shall know the truth and the truth shall make you free.”

The heavens are still hanging, as best we can tell, but they may appear closer than they once were. It's hard to exactly measure the impact of DDoSecrets’s work. Information, once made available, tends to move well beyond its original source. Additionally, legislators and law enforcement, especially in the U.S., loathe crediting a leak as the impetus for major reform.

For members of DDoSecrets, though, their efforts are less about sparking change. Sometimes that’s just a nice side effect of the work. Instead, the primary driver is the information itself. For Best, freeing information is a step toward safety, and that is their ultimate goal. “It’s not something we can guarantee or even create,” Best says, “but it’s impossible to walk through the world and not be keenly aware of its absence.”