The Reuters story (https://www.reuters.com/investigates/special-report/usa-spie...) made this more explicit: there was a password field on the site, poorly disguised as a search feature, that would open a chat box when the right password was entered, into which the source could enter messages. On many of these sites, the password is validated by a bit of obfuscated JavaScript, which then loads a Java applet implementing the actual chat window.