Blockbuster NYTimes Story Accidentally Leaked Phone Numbers of Russian Soldiers Criticizing War

I noticed when Margaret Sullivan was Public Editor — the equivalent of ombudsman — of the NY Times, that neither editors nor reporters would admit they erred. Rarely there would be a single grudging admission, but mostly any criticism was brushed aside, even when the criticism pointed out a flagrant error.

And the Times maintains that attitude. Joseph Cox reports in Motherboard:

A blockbuster investigation from the New York Times in September, 2022, inadvertently exposed the apparent phone numbers of Russian soldiers as well as the apparent civilian family members they were speaking to, Motherboard has learned. Some of these people were providing a frank assessment of the ongoing Ukraine war, and blunt criticisms of their superiors including President Putin himself. The exposure potentially put the people at risk of reprisal from their own government and other third parties.

The news highlights not only the risks phones pose in wartime, but also the security hazards that can be posed by journalists handling leaked information. Last week, for example, dozens of Russian soldiers were killed in an attack by Ukrainian forces; the Kremlin said they were targeted based on cell phone data. “For Russian troops, cellphone use is a persistent, lethal danger,” the Times wrote.

When contacted by Motherboard, the Times initially said that it took steps to delete the metadata but failed to scrub several audio files. It said that the metadata was up for only a “few hours.” 

“Before publication, we worked to remove identifying information from the story. We later learned that some buried metadata was live on the site for a few hours, and took prompt steps to remove it,” Charlie Stadtlander, director, external communications, newsroom, at the New York Times initially told Motherboard in a statement.

Motherboard then found that additional phone numbers and internal notes for fact checkers—which in some cases seemingly included not only the number of the apparent soldier but also the person they were speaking to, as well as their supposed relation—remained online in the article’s source code as of Wednesday afternoon, months after publication. When contacted again by Motherboard, the Times edited the piece to remove that metadata from the source code, and replace it with “null.”

In response to the second request for comment about the further exposure in the source code, Stadtlander provided a nearly identical statement that only removed the “few hours” section..

“Before publication, we worked to remove identifying information from the story. We later learned that some buried metadata was live on the site and took prompt steps to remove it,” Stadtlander wrote.

Motherboard found what appears to be multiple phone numbers in the source code.

Security experts told Motherboard the exposure is dangerous.

“This metadata error is a regrettable and entirely avoidable cockup on the part of the New York Times,” Thomas Rid, professor of strategic studies at Johns Hopkins University/SAIS, told Motherboard in an online chat. “The Times says it spent almost two months on translating the recordings—well, it should have spent another 20 minutes on scrubbing the metadata.”

In its investigation, the Times says it . . .

Continue reading.