"I cannot live without looking over my shoulder," a sexual abuse survivor told US lawmakers in May, describing how her personal information was publicly exposed in January, when the Department of Justice (DOJ) released hundreds of thousands of documents related to the financier Jeffrey Epstein. "I can only imagine the long-term impact this mistake will have on my life." 

Three days after the DOJ released the largest of 12 datasets on Epstein on January 30, a department lawyer told a federal court that "human or technical error" had been among the factors that led to the publishing of personally identifying information of people who had been sexually abused by Epstein and his associates. As a result, the DOJ said it would remove, review and redact flagged documents before republishing them.  

DW's investigative unit, along with its Innovation and Data teams, spent months reviewing thousands of documents released by the DOJ. In the six months since the release, DW identified dozens of files that still contained information — including names, faces and email addresses — that could be used to identify survivors, witnesses and informants, among other people.  

DOJ Epstein Library 

By mid-February, DW had scraped more than 800,000 files from the DOJ's Epstein Library — a challenging task with the archive constantly changing: New files were being added, others were taken down and modified files were popping up after days of absence.  

But it wasn't until DW obtained an earlier set of files archived by a publicly facing data preservation project on GitHub that we realized more than 500,000 files were removed between the initial days of the release and our scrape.   

To verify the contents of the original release, DW generated a unique digital fingerprint, known as a hash, for every document. Hashes confirm that a document matches the original and hasn't been altered. By comparing these fingerprints with documents scraped from the DOJ website about two weeks later, DW could determine which files matched, as well as identify documents that had been removed from the DOJ website. 

DW also found that some files had changed because the digital fingerprint was no longer the same: They had the same file name but were larger or smaller than the original. When DW reviewed this subset, we found that they represented files that had been further redacted — or information was added.  

In one instance, a survivor described how Epstein had abused her for years as a minor in her testimony to lawyers. Her name was redacted throughout the transcript until the last page, when a lawyer thanked her for her testimony and said her name, and it remains unredacted as of publication.  

Her exposed name was not an isolated case.  

Deep audio analysis 

To analyze audio files, including victim statements and tipoffs, DW's investigative unit collaborated with the Fraunhofer Institute for Digital Media Technology's Media Distribution and Security research group in Ilmenau, Germany. The MDS specializes in audio authenticity, manipulation and speech synthesis detection.  

After removing duplicated files from the publicly facing data preservation project and DW's scrape, we were left with more than 150 audio files, which the MDS's forensic audio researchers analyzed using state-of-the-art tools developed at the institute. They detected digital traces left by audio production and editing processes that are, at times, inaudible to the human ear.  

That included identifying parts of a recording that had been modified or reused, determining whether a recording was an altered version of another file, and assessing whether audio files may have been recorded using the same microphone or recording setup.  

Forensic audio researcher Milica Gerhardt observed something unique: that redaction styles varied across the files, along with inconsistencies in how redactions were executed.  

"If one observes the content of these audio files, one can see that a lot of personal information has not been redacted," Gerhardt said.   

In one case, a person called an official tipoff hotline to report information for use in an investigation into Epstein's abuse. In the redacted version, you can hear the person's name, but their phone number was bleeped out.  

The same dataset, however, also contained a different version of the audio file, in which the person's full name could be heard as well as their direct contact. Alleged witnesses or informants were apparently not included in the protections allotted to victims. 

"They could and should have done a better job on the redactions," said Patrick Aichroth, who heads the MDS group at the Fraunhofer Institute, which has consulted on audio-related evidence for judicial authorities in Germany.  

"There is a reason why such material is treated so carefully in court cases," Aichroth said. "Once sensitive or identifying information is disclosed, the damage cannot be undone." 

DOJ's redaction failures 

DW's investigative unit confronted the DOJ with its findings, including examples in which survivors' personally identifiable information remained in the official Epstein Library.  

The DOJ did not respond.  

In April, the DOJ's Office of the Inspector General, an independent watchdog tasked with investigating misconduct within the department, announced that it was "initiating an audit of DOJ's compliance with the Epstein Files Transparency Act."  

"Our preliminary objective is to evaluate the DOJ's processes for identifying, redacting and releasing records in its possession as required by the Act," the office said in a statement.  

In July, several lawmakers introduced the Epstein Files Transparency Act II, which would allow sexual abuse survivors and the governments of US states to take the DOJ to court for failing to comply with the rules laid out in the initial Transparency Act, which had guaranteed that the personally identifiable information of survivors would be protected. 

Survivors whose information was published unredacted have since shared accounts of harassment, humiliation and physical threats. With the publicly disclosed information still available on public platforms and, in some cases, still on the DOJ website, the impact continues to upend survivors' lives. 

"While the rich and powerful remain protected by redactions, my name was exposed to the world," said the sexual abuse survivor who gave her testimony to Congress in May.

"The evidence is right here," she said, "yet those in power [would] rather us die socially, emotionally and physically than admit their own complicity." 

Edited by: Mathias Bölinger, Milan Gagnon 

Technical and data analysis by: Andreas Giefer 

Data journalists: Gianna Grün, Rodrigo Menegat Schuinski 

Fact checking by: Birgitta Schülke