>>! In T39992#424332, @Jdforrester-WMF wrote:
> If we create a server-side private drafts facility, we invite malefactors to (ab)use the facility to store and (using accounts with a shared password) distribute:
> 
> * Terrorism-related materials;
> * Child pornography (even if the Drafts are 'just' text, e.g. base64 encoding of images);
> * Foreign intelligence service / espionage channels (let's please not make the Wikileaks comparisons true);
> * Other criminal information; and
> * Civil illicit information (e.g. breaking NDAs, corporate espionage, …)
>
>All this kind of stuff is potentially uploaded to the public fora of Wikimedia's wikis (talk pages, etc.), but (because people are aware that it's public) it is much less frequently put there, and so is at a level where it can generally be dealt with by the existing community processes. A private cache of drafts that isn't visible to any other user means that the community couldn't police it, or flag for suppression/other admin action.
> 
> Because of this, *even if no terrorist/pædophile/spy/criminal/mole ever did this*, WMF would get many, many subpœnæ, warrants, clandestine requests (National Security Letters, etc.) and other legal instruments which would have the effect of hugely increasing the cost to comply with these matters. I appreciate that lots of the other top-10 websites have server-side drafts facilities, but they have lots more money to throw away like this, and (allegedly) direct NSA/FBI/… access to their servers anyway, reducing the legal compliance cost (but something to which we would never agree, of course). People running less-visible services run into this problem from time to time, and in some cases end up shutting down their services; we can't take the risk that we'd need to do this at Wikimedia.

This is the classic argument from infocalypse [1] which is bad form in general, but makes even less sense in Wikimedia's case given that storing arbitrary private data is already possible via the options API [2]. In fact, any user with some Javascript skills could implement the Drafts extension right now as a user script. Even if arbitrary-key, arbitrary-length options got disabled, there would be ways to make Wikipedia store private information (e.g. split it into 255-byte chunks and store it as signatures over a set of autogenerated user accounts).

Not that there is any need of that, given that Wikipedia can be edited by anyone and edits are practically never deleted, so a terrorist/pedophile/etc. who is particularly set on using Wikipedia to distribute illegal content could easily do that with some industry-grade cryptography tool and a bot that hides secret messages in vandalism. Or encode messages via steganography in penis selfies, etc.

Not that there is any need of *that*, given that other WMF-operated services give you easier ways of sharing secret messages, such as etherpad which is essentially private if you choose a pad name that's hard enough to guess.

Not that there is any need of that either, of course, since the net is full of services which, unlike Wikipedia, can be used easily and conveniently using pre-existing software to share information in secret. Dropbox, Google Drive etc, and we didn't even get to tools which were designed explicitly for that purpose like Freenet. So I find the notion that anyone would choose to use Wikipedia's draft feature as their underground distribution channel somewhat absurd.

I appreciate the argument that such activities don't actually need to happen for law enforcement to decide that they need to police them, but as I said, they are already possible, so Drafts would not change the status quo at all.


[1] https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Infocalypse
[2] https://www.mediawiki.org/wiki/API:Options