Something strange is happening with WikiLeaks’ website, something which seems to have begun just before Julian Assange stepped down as Editor-In-Chief and Kristinn Hrafnsson was appointed to the post. In the last week, content has disappeared and links have broken, while the modification dates on files have mysteriously changed. These changes, though typically minor, are often difficult to explain and raise questions about the website, its management, and what happened during the transfer of power within WikiLeaks to cause content to disappear and links to break.
The issue was first brought to my attention regarding a Freedom of Information document referring to a woman in the United States Air Force who had become “infatuated with Assange” (rumored to be the now deleted @M_Cetera). According to Archive.org’s Wayback Machine, the page was intact and linked to the document on September 21st, 2018. By October 2nd, the page’s text remained intact but the link was gone. As of this writing, it has not been restored.
In another instance, the page for the transcript of WikiLeaks’ press conference on Snowden’s exit from Hong Kong has broken. Since the page’s creation and until at least July of this year, the page linked to the correct address for the PDF. By October 2nd, part of the URL in the link had disappeared – breaking access to the file. As of this writing, the link has not been restored.
A third instance involves the transcript of Assange’s secret meeting with Eric Schmidt of Google. As of September 26 of this year, the page was intact and all of the content present. By October 2nd, all content had been removed from the page except for the word “PLACEHOLDER” in all caps. WikiLeaks quietly corrected the issue within hours of my tweeting about it. Strangely, a different page on WikiLeaks’ website also hosted the press release for the transcript – though the actual transcript was missing, and the page’s press release cut off mid-word. It also showed the page’s date as January 1, 1970 – the beginning of Unix time, fairly universally used by servers. As of this writing, the page has not been restored. The transcript remains available at the correct URL.
Even the ‘What is WikiLeaks’ page, which is linked to from virtually every page of the WikiLeaks website, links and text that have been mysteriously mangled. In this instance, the HTML code and URLs for two different links have been strangely combined into one. As of this writing, the page has not been restored to its previous state.
WikiLeaks’ file repository also seems to have undergone some unexplained changes during this time. As of this writing, the repository shows the directory of Hillary Clinton emails (obtained through a Freedom of Information Act request that WikiLeaks played no part in) as having been last modified on September 25, 2018.(Several days after this, the State Department released new Clinton emails.) This date also applies to most of the subdirectories. The files themselves appear to display the original dates. This could be caused by permissions for the directories being changed or restored from a backup. Due to some of the content being mangled and missing, the latter may be most likely. Also possible is a migration to a new server, though WikiLeaks’ public IP addresses are not new, as of October 3rd.
Though the meaning of the website’s problems and the date changes remains unknown, the timing is difficult to dismiss – it began on September 25th, with the Clinton emails directory, with other pages having last been intact on the 26th, and Hrafnsson being publicly named as Editor-In-Chief on the 27th. On the 28th, WikiLeaks released its first document in nearly a year, to little public attention. Many of the errors in WikiLeaks’ webpages persist, with the only known correction having come shortly after I publicly brought attention to the matter. While what, if anything, the changes signify remains up for the debate, there is no question that something happened to WikiLeaks’ server(s) and that it appears to have immediately preceded the official transfer of authority within the organization.
Update: Two days later, the What Is WikiLeaks page remains broken, but the Clinton email folders have been timestomped back to January 1 1970. WikiLeaks has released a now-deleted statement in response (this is really what they wrote):
lizard
people… or maybe changing CMS is not an easy task with a site of that scale.
While we also have to improve on security and reliability.
but, probably lizard people.
I’ve written a brief response to their “lizard people” statement in this thread, also embedded below.
1/ #WikiLeaks has released a statement in response:
“lizard
people… or maybe changing CMS is not an easy task with a site of that scale.
While we also have to improve on security and reliability.
but, probably lizard people.” https://t.co/Zkxcq7L4O6 https://t.co/ersTMjk9Fx
— Emma Best (ᴜ//ғᴏᴜᴏ) (@NatSecGeek) October 6, 2018
3/
C. WikiLeaks is arguing that they’re doing things beyond their immediately capabilities and that they didn’t bother testing and checking things, not even even on https://t.co/cTSY9TNfFz as they have in the past. See point A above.— Emma Best (ᴜ//ғᴏᴜᴏ) (@NatSecGeek) October 6, 2018
5/5
My post never suggested a conclusion, it simply noted an unusual series of events in close proximity to each other. There’s nothing unreasonable in noting server changes coinciding with a change of power and authority and new wave of activities in a secretive organization
— Emma Best (ᴜ//ғᴏᴜᴏ) (@NatSecGeek) October 6, 2018
#WikiLeaks‘ “research” wiki has been doing this for a week now. I wonder if this is also part of upgrading their CMS and improving security. pic.twitter.com/Nm5s0oXXvD
— Emma Best (ᴜ//ғᴏᴜᴏ) (@NatSecGeek) October 7, 2018
Update: An earlier version of this post listed an incorrect date for the change to one of the pages. While the text was mistaken, the citation and links were correct, and included the correct date. The error does not change the overall timeline of events, and has been corrected.
Update, December 11, 2018:Additional portions of WikiLeaks’ website have been found to have broken at the same time. WikiLeaks’ mirror of Cryptome stopped updating during the same time period, and months later has yet to be restored. This portion of the WikiLeaks website does not share a Content Management System, upgrades to which they blamed the broken website. The search interface for the Cryptome mirror continues to superficially work, however it points to files that are not on WikiLeaks’ server due to the broken mirror.
Further update: After this post was updated and tweets pointed out the additional errors with WikiLeaks’ website, the organization repaired the Cryptome page. No explanation was offered.
