The anonymous leaker of the Panama Papers most probably collected the 2.6 terabytes of highly sensitive information over a period of time so as not to raise suspicion, QUT internet security expert Dr Ernest Foo says.
“Given the secrets that have been made public the leaker, most likely a person within Mossack Fonseca, will be on the most wanted list of many people and could be identified by the date the files were downloaded, even though they are encrypted,” Dr Foo said.
“The leaker probably downloaded the material slowly so as to not leave a trace.
“To ascertain the identity of the leaker forensic cybersecurity experts could look at the dates the documents were downloaded to narrow down who was employed at the time, if they had not already been changed by the leaker.
“They could then look at who had access privileges during those times.”
Dr Foo said large organisations had different setups for access to files.
“Access privileges are normally distributed throughout an organisation,” he said.
“The leaker could have been a systems administrator with access to all the files who could have downloaded them over a period of time, but equally it could be an analyst or law clerk who had legitimate access to those files.
“If, however, the full set of leaked information is split up and not stored in one place it would be harder for a cyber investigator to access it to get those dates.
“The material has been distributed to dozens of media outlets which have not made it public, so as long as the entire set of leaked data isn’t stored in one place it would be difficult to piece together the dates of downloading.”
Dr Foo said journalists would have learnt their lessons from Wikileaks and Edward Snowdon on how to protect their sources by not leaving a digital trail.
“The International Consortium of Investigative Journalists will not make the material public which is an extra safeguard for the leaker.”
He said 2.6 terabytes was history-making in terms of leaks but it wasn’t much.
“These days you could fit it all on a three-terabyte hard drive from any electronics store that you could hold in the palm of your hand.”
Media contact: Niki Widdowson, QUT Media, 07 3138 2999 or n.widdowson@qut.edu.au
After hours: Rose Trapnell, 0407 585 901 or media@qut.edu.au
