4 months ago
33
The New York Times this week published the harrowing account of a man who thought he was applying for a translator job at an e-commerce company in Thailand, but was instead abducted and sold to a Chinese gang who forced him to work for a scam operation in Myanmar.
The Times, which withheld Neo Lu’s real name at his request for safety reasons, revealed identifying information about Lu to the public — and potentially the Chinese gangsters who took him hostage — by publishing what appears to be his passport number.
“Mr. Lu, who goes by the nickname Neo for the character in the Matrix movies, spoke to The New York Times on the condition that his full name not be used, for fear of retribution from the criminals,” reporter Isabelle Qian wrote in the Times story.
According to the account in the newspaper, Lu had provided the Times with photos of his time at the scam work camp, as well as copies of his travel documents to verify the authenticity of his situation. While the Times published several of photos of the camp, the paper also published a photo of a visa page that appears to be from Lu’s passport, publicly revealing his passport number.
Though the photo revealed what appeared to be Lu’s passport number alongside travel visa information, it did not display the story subject’s full name.
The photo did not appear in the online version of the article, but it was publicly accessible on the Times website through its specific web address.
After The Intercept contacted the paper, on the same day that the story was published, the Times removed the photo from its public website.
In response to a request for comment, Nicole Taylor, a spokesperson for the New York Times, said, “Mr. Lu supplied a range of photos and documents to The Times, which we used with his permission. We removed this photo out of an abundance of caution and within 24 hours of publication.”
Taylor added that “the source is aware and has not raised concerns.”
Other images that appeared to not be intended for public consumption were also subsequently removed from the Times’s website after The Intercept informed the Times of their presence. Among them was a graphic photo Lu apparently snapped of himself showing scars on his body, as well as a snippet of a text message conversation appearing to show a discussion between the gang and Lu’s parents regarding the ransom the gang had demanded for Lu.
Once the photos were removed, the old image URLs began displaying the message, “We’re sorry, we seem to have lost this page, but we don’t want to lose you,” the standard error message the Times displays when accessing an unavailable webpage.
The revelation of Lu’s passport number could potentially identify Lu to the gang that held him at the labor camp. According to the article, “The gangs often take away the abductees’ passports and let their visas expire” — meaning the gang could have access to Lu’s passport information.
The Times story feature art — at the top of the article — is a mosaic composed of various images apparently supplied by Lu, including interior and exterior shots of the work camp. The mosaic is composed of 10 images. In the original article, the images’ URLs had irregular numbering, jumping from four to 20. Though only 10 of those 20 images were utilized in the opening mosaic by the Times, it was possible to view any of the 20 images by changing the image number in the file name listed in the image’s URL.
The unused assets being publicly available is not new; the practice is particularly common with video game developers, with gamers routinely finding unused game assets in the file systems of video game releases. The issue has arisen with nongovernmental organizations as well.
This is not the first time the Times has unintentionally revealed personally identifiable information about story subjects. Last year, the Times revealed phone numbers of Russian soldiers and their family members who were being critical of Vladimir Putin and the war effort. The Times later went so far as to remove the news story from the website archival service the Wayback Machine; the paper has been actively antagonistic to having its site archived.
Software developers have automated tools to help them scan their source code to prevent inadvertently publicly revealing sensitive information. As a best practice in journalism, however, there is no substitute for human discretion when handling sensitive materials entrusted to a newsroom by an at-risk source.
The post New York Times Doxxes Source Trafficked by Chinese Gang appeared first on The Intercept.
