The single server theory

Jeff Id at the Air vent writes about the recent UEA/CRU announcement that the Climategate files were all left on a single server. Gathering them into one zip file and posting on a Russian FTP: “not so sophisticated”.

https://i0.wp.com/www.olino.org/wp-content/uploads/2008/articles/zuinige_server_sc5275-e.jpg?resize=153%2C193

That and Sir David King – making up stuff.

0 0 votes
Article Rating
96 Comments
Oldest
Newest Most Voted
Inline Feedbacks
View all comments
Henry chance
February 2, 2010 9:07 am

For an insider, it can be done over time. Yes it is easy.

rbateman
February 2, 2010 9:11 am

Is there anything they told us that was the truth, the whole truth, and nothing but the truth, so help them “your maker”?

Veronica
February 2, 2010 9:15 am

So… hacked from that single server by international weather spies, or leaked by a disaffected employee? What’s your vote?
I’m thinking that if the police enquiry by the Norfolk plods says “international weather spies” it would allow the leaker to get off scot free, which might be a politically astute outcome to the enquiry, assuming the leaker was judged by the Powers That Be to have done us all a favour.

Ray
February 2, 2010 9:26 am

That must be one of the shortest post ever on WUWT!
As someone said, why would a big international organization hack such a small university computer when only a small Joe with a dial-in model managed to hack the Pentagon computer system…

kadaka
February 2, 2010 9:30 am

Right after the release, it was argued it had to be an inside job because there were too many computers to access over too long of an undetected period to sort out all the info and gather it together. It had to be a leaker, not a hacker.
Now finally comes a rebuttal, everything was on one server thus it would be easy for a hacker, therefore it was a not a leaker, everything was still stolen.
Now awaiting the next stage of rebuttal, the access info was accidental/y left unprotected in a publicly-available file somewhere, and like with a lost set of house keys, permission to enter and take stuff was not granted therefore it was still theft, and there absolutely was no leaker, just a hacker.
Does it seem to anyone else that certain people are desperately trying to set up a legal defense where certain evidence should be thrown out of court on the grounds that it absolutely, positively, no-doubt-whatsoever was stolen therefore it should not be admitted?

Leon Brozyna
February 2, 2010 9:39 am

What?!!
No vast right-wing conspiracy?
No Big Coal/Big Oil conspiracy?
No Russian intelligence agency conspiracy?
So it all comes down to either a deliberate leak or sloppy ‘housekeeping’ or a combination of both. Considering the way we keep getting treated to a gate du jour, this is very believeable.

Thomas Hobbes
February 2, 2010 9:44 am

Hard to believe the common story that it might have been a Russian intelligence agency. Had it been a Russian hack, there is little chance that they’d post the files on a server in Russia. They would have posted the files to a server in the US, UK, or some other country.

Veronica
February 2, 2010 9:48 am

A point of law. Is stolen data automatically inadmissable as evidence? I don’t know. A stolen gun used in a drive-by shooting would, presumably, be admissible as a murder weapon.

Robert of Ottawa
February 2, 2010 10:05 am

My personal suspicion is that it is not a student, but someone in the CRU. I also suspect the authorities know who, and are going to cover it up because of the embarassment, Why? all the mis-direction about evil foreigners and weather spies.

Jim Berkise
February 2, 2010 10:09 am

I routinely work with dumps of email servers that have been turned over in the
discovery phase of legal proceedings, and it’s my professional opinion that it would have required an outsider weeks of work to separate out what was posted from a raw dump of emails.

Chilled Out
February 2, 2010 10:20 am


No “stolen” evidence can be admissible. The UK and German tax authorities have recently demonstrated this through their handling of ‘leaked’ (or was it stolen) bank account data from Lichtenstein. An employee sold large quantities of bank account data to the tax authorities of these two contries allegedly for a 6+ figure sum.
As the tax authorities in both countries have used this data to threaten account holders with legal action for tax avoidance it would appear that senior govenment/prosecution lawyers in both counties have decided that it is entirely legal to use stolen information in a prosecution.

Ray
February 2, 2010 10:21 am

Maybe it was one of those server that ends up as recycle in Africa. THey did not erase the hard drive and some African found the file on the hard drive and decide to transfer it to a Russian server… Secret CIA files have been found that way… hey, it’s a possibility!

George E. Smith
February 2, 2010 10:22 am

Well whoop-de-doo; so it was all on a single server.
So just how many hours of hacking time would it take, to round up these presumably randomly disposed files; which so far as I can tell, would require a complete reading of all of the files that are on that server; well unless someone had some a priori knowledge of what all was there.
My damp finger says that would be most expeditiously accomplished by an insider; simply too exposed for an outside hacker to be holding up the bank for that long; without getting caught.

Al Gore's Brother
February 2, 2010 10:23 am

The ironic part is that they used Al Gore’s invention of the Internet to transmit the files. Seriously, you can’t make this stuff up!

steven mosher
February 2, 2010 10:24 am

Jim Berkise:
1. The zip folder is more than emails.
2. Some of the files have had creation dates bleached.
3. I can write the filter to go through a million mails and pull out
those that are of interest to the CA community in about 30 seconds.
4. There are housekeeping mails that anybody who read the files thourougjly would delete.
5. Some of the files in the documents folder were previously left on an open FTP ( see charles third theory)

old44
February 2, 2010 10:27 am

Why would an evil Russian criminal/International Oil Cartel/American anti-warming conspiritist hack into the CRU server and then give the files to the BBC Weatherman 4 weeks before making it public?

Al Gore's Brother
February 2, 2010 10:28 am

In all seriousness, it appears to me (from an IT perspective) that these files were already assembled and waiting release in light of an FOIA request. Or they were put together just in case the CRU was forced to adhere to an FOIA request and someone stumbled across them. Someone that knew what was going on and was just sick of the lies and decided to take action.
It is highly unlikely that someone went through that many years of emails and documents (which were probably attachments at some point) and put them all together and released them…

David Schnare
February 2, 2010 10:31 am

It was a leak. I’m just wondering how the leaker covered his tracks as access to servers is usually something easy to find out.

TerryS
February 2, 2010 10:38 am

It would not surprise me if the “backup server” in question had directories that could remotely mounted by anybody within CRU to transfer files to for backup purposes. It also wouldn’t surprise me if either they could be mounted without a username/password or with a username/password that everybody in the CRU knew.

Tom
February 2, 2010 10:38 am

My two-cent view is that PJ deleted his files as he said… then when the FOI order was required he asked that the file be prepared. When the person or his request was entered; surprise! It was still on the Administration server. PJ spends time seeing what is revealed in the assembled file. Freaks. Adds stuff to confuse the issue(Briffa et al). Makes a tough call and pulles the pin on the grenade. He has six seconds to leave the building. Which he does when he leaves early on Friday the 13th, to mail the CD’s… Good story anyway:)

JonesII
February 2, 2010 10:40 am

From one single tree to one single server to warm up a complete planet!: That server served the purpose or its users, who in turn served their patrons, in a typical attitude of servitude.

JonesII
February 2, 2010 10:43 am

David Schnare (10:31:19) :With a gadget called USB memory stick. No trace at all.

TerryS
February 2, 2010 10:47 am

Re: Jim Berkise (10:09:13) :

I routinely work with dumps of email servers that have been turned over in the
discovery phase of legal proceedings, and it’s my professional opinion that it would have required an outsider weeks of work to separate out what was posted from a raw dump of emails.

The emails aren’t raw dumps. If they were then they would have all the headers and some would be multipart/mixed encoded. As it is none of the emails have all headers intact and none of them are multipart/mixed encoded.

Charlie A
February 2, 2010 10:52 am

Whether or not “stolen” e-mails can be used as evidence is a trial is a moot point.
A common legal rule, which I assume applies in the UK, is that the best or original or most trustworthy version of evidence is required to be used. For examples, if the originals of a document are available, they are to be used rather than photocopies.
In this case there are files on the servers at UEA that are better (i.e. closer to original and with better known history) than the stolen e-mails.

Jason F
February 2, 2010 10:53 am

Didn’t the police say the file had been compiled by someone at cru for their own personal use, so if it were hackers who got the file that must have been one fluke of a hack job.
All of the sophistication of the information contained in the file was not because anyone went in to specifically get that data in a targeted manner as king suggests, because the archive already existed.
That either means the file was left on a public area like an FTP server or someone knew of it’s existence and how to get it.
Or
the KGB working for exxon scoured every file on every server and pc in cru in an elaborate hack on the off chance a file like this existed, I think not.

Ray
February 2, 2010 10:54 am

Here is another what-if:
What if the whistleblower prepared the file and in order to hide his tracks then accessed it from outside (for that would be seen as an outside hack job) via a Russian server… it’s quick, clean and has his back covered since he would know very well that his wellbeing is at risk.

Charlie A
February 2, 2010 10:59 am

Independent of whether the files were just on a a single server or scattered across many servers, the data and e-mails that were posted had been selected and filtered to leave very little extraneous material.
Why would a random hacker go through the trouble of selecting data and e-mails?
I still haven’t seen a reasonable hypothesis as to why there would be a file of data and e-mails of just the types that were leaked, other than perhaps that they were the product of a search in regards to an FOIA request. But even that doesn’t really account for the big spread in dates and subject matter.
An inside leaker that purposefully searched and selected for incriminating material does fit the observed facts.

Andrew P
February 2, 2010 11:01 am

OT – I’m told that Channel 4 News (UK) tonight will have a discussion with Prof Watson of UEA and Lord Lawson. So UK viewers may wish to tune in, the programme starts in about 5 minutes. The News editor asked me to submit a question for Prof Watson – so I gave them a couple and said take your pick. See http://www.channel4.com/news/articles/science_technology/climate+email+row+scientists+speak+out/3524137 which will presumably be updated after the programme.

February 2, 2010 11:11 am

Phil Jones is apparently ‘worried’ in a defence of the latest allegation in The Guardian:
http://www.guardian.co.uk/environment/2010/feb/02/phil-jones-climate-scientist-hacked-email?showallcomments=true#end-of-comments
Monbiot says more people should be sacked:
http://www.guardian.co.uk/environment/georgemonbiot/2010/feb/02/climate-change-hacked-emails
The Guardian really has got it’s teeth showing now. The penny has at last dropped. So tonight it’s official: AGW has died – now we can look forward the the wake.
Time for a beer.

Tom
February 2, 2010 11:12 am

TerryS, Is there an Admin. command to remove the headers etc.? Someone?

Jeef
February 2, 2010 11:13 am

Talk of weather spies and foreign hackers is diversion, and helps smear the climate moderates / AGW opponents effectively at the same time. Simple, really. I’ve no IT knowledge whatsoever, but it seems to me that, using the principle of occam’s razor, that the simplest and most obvious way for the CRUtape letters (copyright Mosher?) to see the light of day would be for them to have been leaked, not hacked.

Stephen Brown
February 2, 2010 11:40 am

A re-post from ‘Tips & Notes To WUWT’
Sir David King, who for seven years was Tony B’liar’s science Panjandrum manages to blame Russian spies for ‘hacking’ the CRU e-mails and data and, somewhat startlingly, states “… the American lobby system was a “very likely source of finance” for the hack and that “the finger must point to them.”
http://www.telegraph.co.uk/earth/environment/climatechange/7126586/Climategate-emails-stolen-by-foreign-spies.html
Amazing!!

TerryS
February 2, 2010 11:41 am

Re: Tom (11:12:24) :

TerryS, Is there an Admin. command to remove the headers etc.? Someone?
You could probably find something to do it or write a script to do it. The point is though, if it was a hacker why would (s)he strip the headers (and other things) from the emails? By doing something like that (s)he is decreasing the provenance of the emails. It is work that only decreases the value of the emails.

Veronica (England)
February 2, 2010 11:43 am

Interesting. A famous case in UK Law going back to 1861 appears to be Regina versus Leatham:
‘”It matters not how you get it; if you steal it even, it would be admissible in evidence” (per Justice Crompton in R v Leatham [1861]) Discuss
This is a much debated and analysed quote. Does it mean that the police and the Crown Prosecution Service in England and Wales can source information by any means necessary and in spite of the method it will be admissible in a court of law? Or does it mean that a message is being sent to criminals, that if they commit a crime they must not assume that all methods of obtaining evidence to prosecute them are limited? Does it condone the theft of evidence for the purpose of using it to convict a defendant? If it does surely this is at odds with criminal law and in particular s.1 of the Theft Act of 1968, s.7 of which prescribes a maximum of seven years prison on conviction on indictment. Regardless of the specific reason or meaning (which in any case presumably there are many), the impact of this statement by Justice Crompton is far reaching. The Criminal Justice Act of 2003 even extends the range of evidence that is admissible, so defendants definitely have little to hide behind.’
More recent cases involving the tax authorities are different in jurisdiction but the principle seems similar:
http://www.lynamtax.co.uk/news/bbc-panorama-and-the-liechtenstein-bank-accounts/2009/02/18/
Anyway, the Climategate files weren’t “stolen”. CRU still has them and enjoys the use of them. They were simply copied and made public!

Jean Parisot
February 2, 2010 11:45 am

The file is exactly what a FOIA (FOI) request generates. A set of filters are run against various document stores and email servers. The file is then reviewed by a committee and any material that must be withheld or isn’t relevant is removed. This is either the unredacted or partially redacted results of a suppressed FOIA response. Somebody wanted it out – and it made it’s way out.
After collection and during the editing, the file could certainly have been compressed and stored on a single machine. That isn’t a surprise. What surprises me is that 10y record of emails — it is hard to piece together the fragments left from email server upgrades and system changes without an enormous amount of long-term institutional IT discipline.
The fact that it was “stolen” does not make it inadmissible – but it challenges the provenance of the evidence. EAU has verified the contents of the file – so this may be less of a problem.

MartinGAtkins
February 2, 2010 11:47 am

As reported at the Air Vent.
university of East Anglia to release this little tidbit of information.
In fact, as UEA confirmed today, all the files and emails were archived on a single backup server on the Norwich campus.

I don’t believe this explanation at all. The last email was dated 12 Nov 2009 and the earliest goes back to 1996. Since the last emails were not of much importance then archiving on a separate server at that rate would have resulted in a lot of more trivial mail.
It must have been deliberately collected together or Phil Jones may have thought he deleted them but only moved them into the trash.
I’ll bet someone had direct access to his computer.

February 2, 2010 11:47 am

Still a mystery. A miracle, as the CA post from RC said. What impresses me is the sense of quiet orderliness, even courtesy, about the whole operation. As if the miracle_worker knew all the writers well and picked out what was relevant and included nothing that was not relevant; not only that, but they chose the best blogs where the best science is done and the sense of human balance and courtesy is best upheld: Warren Meyer, the Air Vent, CA and here.
I don’t just believe in miracles. I have seen miracles. And researched them. They can happen.

RoyJ
February 2, 2010 11:49 am

Andrew P (11:01:01) :
OT – I’m told that Channel 4 News (UK) tonight will have a discussion with Prof Watson of UEA and Lord Lawson. So UK viewers may wish to tune in, the programme starts in about 5 minutes.
They ran it as the lead item. A long interview with Peter Liss and Lord Lawson. The Channel 4 website also has a piece on Peter Liss’s defence of Phil Jones.
http://www.channel4.com/news/articles/science_technology/climate+email+row+scientists+speak+out/3524137

Tom
February 2, 2010 12:08 pm

TerryS, Thanks for the info. My view is PJ is just a nice guy. As he read the emails he erased the headers or whatever seemed private and just x’d. When he was done reading he was freaked out at how he was framed by his own words. So he added bits and pieces to distract from a now much wider picture. He knew it was going down so he just blew the thing up hoping to keep his job in the long run. I am pretty sure that in all the emails in the FOIA files it is only the Nov. Friday 13th 2009, that PJ says anything like he is leaving the office early…? Time will tell.

Frederick
February 2, 2010 12:09 pm

Sir David King has form for alarmist science. Several years ago, he and his buddy Prof. Roy Anderson convinced Tony Blair to engage in a massive contiguous cull of cattle following the outbreak of foot and mouth disease in the UK. Based on Anderson’s computer models for disease transmission many millions of cattle were killed needlessly.
Later it transpired that the inputs to the models were flawed since they did not take into account that the disease had been in the cattle for longer than it was thought. They also played politics – adjusting the output of the model to suit Tony Blair’s election schedule.
David King was closely involved in all this as a main proponent of the contiguous cull. His judgement is flawed.
For a full expose of the matter check out this link
http://www.warmwell.com/footmoutheye.html

UK John
February 2, 2010 12:09 pm

it is interesting that Phil Jones and the CRU are self evidently not very good when it comes to understanding how to work with computers.
However the IPCC rely totally on the computer derived research of these people.

John Peter
February 2, 2010 12:14 pm

Well, the BBC has come to the aid of Professor Phil Jones by allowing him to defend himself here http://news.bbc.co.uk/1/hi/england/norfolk/8494497.stm
Extract: “Professor Phil Jones, former director of the Climatic Research Unit at the University of East Anglia (UEA), said his results “stand up to scrutiny”.”

Zeke the Sneak
February 2, 2010 12:16 pm

What if the noble Source of the leaks has more files?
Well, on that note, I just want to wish everyone at CRU and Penn State luck on their internal investigations, and wish them very sweet dreams.

Richard Wakefield
February 2, 2010 12:21 pm

Not according to Desmog
http://www.desmogblog.com/cru-hack-was-highly-sophisticated-spy-job-prominent-british-scientist-says
“Sir David King, the UK’s former chief scientist, strongly believes that the theft of hundreds of emails from the Climatic Research Unit in East Anglia was carried out by highly-paid professionals, perhaps a foreign intelligence agency, and was deliberately designed to destabilize the Copenhagen climate talks last December.
The highly sophisticated hacking operation involved stealing more than 1,000 emails and some 2,000 documents from a backup server at the University which would have been difficult to access remotely.
According to The Independent newspaper, King believes the hack “was carried out by a team of skilled professionals, either on behalf of a foreign government or at the behest of anti-climate change lobbyists in the United States.” “

John Galt
February 2, 2010 12:22 pm

I’d like to hear less theory and conjecture and more facts. Follow the evidence.
Hmmm… I think that applies to lots of things, doesn’t it?

Harold Vance
February 2, 2010 12:33 pm

The odds of finding the hacker/leaker have greatly diminished with this revelation. I give it a 5% chance tops.

Tenuc
February 2, 2010 12:40 pm

From the context of the stuff in the Climategate zip file, it had to be someone with a wide inside knowledge who pulled it together.
My guess would be an inside job, careless placement of the file on an open UEA server, or as an outside bet, GCHQ. If it was the least likely option is true, the the CRU is toast!

Veronica (England)
February 2, 2010 12:44 pm

A notoriously left wing MSM, the Guardian, and their most alarmist writer, Fred Pearce, author of the stunningly apocalyptic book “The Last Generation” are starting to get indignant about CRU, and talking about doubts over the hockey stick curve. We are beyond being right-wing oil-funded deniers now.
http://www.guardian.co.uk/environment/2010/feb/02/hockey-stick-graph-climate-change
They will turn really vindictive against the AGW academics when the full cover-up story comes out at the Select Committee in March.

Spector
February 2, 2010 12:45 pm

I seem to recall a precedent seemingly cited in the film “The Rainmaker,” staring Matt Damon and Danny DeVito, stating that stolen work-papers were admissible as evidence as long as the plaintiffs were not responsible for the stealing them.
I still think there would be a great reluctance to prosecute men whom many still consider to be heroes of the Green Earth movement.

Veronica (England)
February 2, 2010 12:49 pm

OMG, and the writer formerly known as Moonbat, too, although he adds a caveat as usual to the end of his article. Welcome to reality, George.
http://www.guardian.co.uk/environment/georgemonbiot/2010/feb/02/climate-change-hacked-emails
I’m just going to check the BBC website for signs of a miracle.

Power Grab
February 2, 2010 12:52 pm

I still say that PJ (or someone with equal pull) told everyone in the shop to delete whatever incriminating messages/documents they could find…so the users themselves deleted the most valuable items…thereby marking them for easy collection.
Then someone with true IT savvy and insider access gathered them all together using backup software and put them on the single server.

Ralph
February 2, 2010 12:56 pm

>>So it all comes down to either a deliberate leak or
>>sloppy ‘housekeeping’ or a combination of both.
Deliberate prank, more like.
This is a Uni – a bit of a giggle to liven up Rag Week??
.

richard
February 2, 2010 12:59 pm

My understanding of UK law is that stolen material is perfectly admissable in court. The concept of the “fruit of the rotten tree” is a purely US concept relating to one of the amendments (i forget which one, the one that says that evidence has to be collected correctly).
A judge can accept any evidence collected by the police even if it was, for instance, found during the raid of the wrong property due to a typo on the search warrant.

Bob Kutz
February 2, 2010 1:04 pm

1) I would ask to see the server. There’s no server that I’m aware of that would’ve housed the collection of emails going back some 15 years. Is that all users for 15 years? How is it that the email server (or backup or whatever) also contained so many data files? Were they really keeping their general documents, their data and their emails all on one server for 15 years? Fire the IT guy too.
2) This stolen data could be used for prosecution, as all of it, or a large share of it should have been available under FOI. The culprits cannot use their unlawful refusal to share this information as a defense against it’s use in their prosecution. The stolen gun issue is somewhat different, as the stealing of the gun was a crime, and the drive by shooting was a crime. In this case somebody ‘stole’ what is essentially public domain material. It would be like disallowing the use of a newspaper story as evidence because the police found out about the crime in a newspaper that was stolen from somebody’s front porch.
None of that withstanding, these people’s academic career’s should be over. There’s clear evidence that these people were not engaging in science here. The ‘Rules of the Game’ pdf file should be evidence enough of that, let alone the email exchanges. Science doesn’t ‘hide the decline’, it openly discussed the decline, or any other equivocating evidence, or any unexpected outcomes or data. That is science. Fun to watch these guys concoct their tale though, plausible deniability and so forth.

February 2, 2010 1:04 pm

RoyJ
Watson was lying through his teeth. Are all these “climate scientists” at UEA trained in the art of lying?

February 2, 2010 1:11 pm

It was an inside job.
My money is on someone who had always had doubts about the hockey stick and blew hot and cold (pun not intended) over the reconstructions. He was never totally trusted and came in for a lot of criticism, being the ever-present side-kick. His illness and problems with Yamal gave him lots of time to think about his work and he decided he couldn’t take any more of the defending the indefensible and the hassle on his return to work. Ably assisted by his younger and more sassy “loose cannon” colleague, he was able to assemble the FOIA file and release it to the world.
Now who could that be?

RichieP
February 2, 2010 1:18 pm

I have been greatly amused to read Monbiot’s mental and moral gymnastics in blaming “deniers” for the appointment of Pachauri to the IPCC (and thereby enabling Monbiot to declare him anathema and spawn of the Evil Ones:
http://www.guardian.co.uk/environment/georgemonbiot/2010/feb/02/climate-change-hacked-emails
“The US government immediately complied. Once it had extracted Watson, it accepted Pachauri as his replacement. The very qualities which made him acceptable to the climate change deniers in the White House – he wasn’t a climate scientist, he had friendly relations with business – are now being used by climate change deniers as a stick with which to beat him.”
Stunning cunning, bizarre spin eh? It reminds me of the kind of logic you find in medieval witchfinding manuals.

CodeTech
February 2, 2010 1:25 pm

Veronica (England) (11:43:27) :
Anyway, the Climategate files weren’t “stolen”. CRU still has them and enjoys the use of them. They were simply copied and made public!

Now, just as point of interest and in no way intended to argue with you, but… from their perspective this is the same as someone gaining access to your naked pics on your computer. You still have them, they weren’t stolen, just copied and made public.
However, to continue the analogy: in this case the released pictures showed that the gold medal olympic women’s weightlifter was, in fact, a man. So does that negate the manner in which the pictures were obtained?

Veronica (England)
February 2, 2010 1:34 pm

@Code Tech
Sorry to disappoint you but there are no naked pics. Except on the Heathrow security scanner, of course.
OK, I was being mischievious with that point. But I resent the comparison with a weightlifter of either gender.

wayne
February 2, 2010 1:34 pm

Re: “Gathering them into one zip file and posting on a Russian FTP: “not so sophisticated”.”
Yeah, right. You expect a reasonable person to believe that, the ‘not so sophisticated’ part, not the ‘it was on one server’ part.
Whoever had the complete deep knowledge of the subjects and people involved must have been internal or tightly bound. That is the only way to allow the accumulation of the correct files, all of the correct files, and only the correct files.
Come on King, you look a gullible fool!

KTWO
February 2, 2010 1:39 pm

Has anyone considered that copies of files were made over a longer period and the zip file itself was then built outside CRU?
Maybe someone at CRU just left work with a DVD in her purse each week.
Is this likely? Why or why not?

Tom
February 2, 2010 1:52 pm

Don’t forget, these folks were sending money to personal bank accounts in Russia for daily amounts of less than 10k. Briffa was also out in the sticks of Siberia. It’s possibe that they understood the regional server situation was open and took advantage of it…

richard
February 2, 2010 2:05 pm

It seems far more likely to me that it was an outside job but with inside help. Someone inside probably gave network systems access to someone else who had sufficient technical skill to zip up a big folder of stuff that seemed like it might be important and/or damaging but lacking a scientific background.
This is evidenced by the fact that over 95% of the emails are purely housekeeping and of no use to anyone but do serve to prove the validity of the truly damaging mails (hide the decline, trick, etc.).

Konrad
February 2, 2010 2:08 pm

As I see it the Norfolk Police are caught in a difficult political situation. The UK government and media have spent some effort in keeping the “Hacker” story alive. The idea of a “Leak” is unacceptable to the UK government as it would imply an individual who felt the whistle needed to be blown on gross malfeasance. The hacker story can be spun to look like a fishing trip by evil skeptics who are taking small particles of dirt out of context. The Norfolk Police may now be under pressure to return an inconclusive finding. If they conclude that this was a hacking incident this may provoke the whistle blower to subsequently reveal themselves. A whistle blower publicly revealing themselves after the authorities have released an official hacking claim would be even more politically damaging than an admission that this was a leak. The tactic of delaying the investigation and hoping people forget will no doubt be tried, despite this being the age of Little Brother. Some delaying techniques we may expect could include;
A – Changing the personnel in charge of the investigation
B – Losing files in the floods of 2010
C – Opening endless “new lines of inquiry”
D – Involving extra departments or agencies
E – Interrupting global popcorn supplies

February 2, 2010 2:15 pm

Tom (11:12:24) :
“TerryS, Is there an Admin. command to remove the headers etc.? Someone?”
Depends on how the files were received. If they were intercepted over the network, then you could use tcpreplay to send only the bits you were interested in (send network framing + bits 1024 to 5000 of the data portion of the packet, assuming the headers are in bits 0-1023 of the data portion of the packet for example). This would assume there were tcpdump type files (network capture files) which were not in the archive. So, capturing/sniffing at the network level may not have been the route used. Given the time span involved, likely these were flat files somewhere.
If the files were not intercepted at the network level, and were flat files somewhere, copy and paste the body would get the contents without the headers. This would be easy for an admin to do by pulling a user’s mailbox and opening the sent items folder. Copying the non-email files would also be trivial for an admin.
Copying and pasting into a new document would also take care of the file date mystery, as the new document would use the system time for the file creation stamp.
Wonder if Jones’ arrogance bit him here? I expect he would be the type to treat the admins poorly.

CodeTech
February 2, 2010 2:16 pm

Veronica (England)… I wasn’t comparing YOU to a weightlifter… lol
You know, I’ve been predicting the wheels falling off this thing for years now, the whole house of cards has been increasingly unstable… but I never, ever guessed that emails and other files would be released.
I guess, being an IT guy myself, I “assumed” that someplace with a bigger budget would have top-notch IT people. And now I’ve been reminded what happens when I assume.

L Bowser
February 2, 2010 2:20 pm

@Chilled Out
Typically the distinction on whether stolen evidence can be admitted in court is who acted in bad faith. In the Lichtenstein case, the government was “buying” evidence of fraud instead of obtaining the information legally.
When the information is obtained “illegally” by a non-government organization for a purpose other than prosecution with no expected remuneration, case law in most countries tends to lean towards admissible. In the CRU case, there was no unreasonable search and siezure by authorities violating the rights of the accused. Where you would run into trouble is if you can establish that someone in an official government capacity encouraged the theft. Either way, the point is moot because the CRU folks in question are ineligible for prosecution under the UK foi laws.

Tom
February 2, 2010 2:29 pm

Not A Carbon Cow, Thank you for the information. In my minds eye I see PJ with a double scotch as he reads his email; again. To keep track of what he has read he x’s the stuff he thinks should be kept private. He does not want the public emailing everybody who is on his list. If he then adds the Briffa stuff and files and grant money, PR pieces etc. it adds nothing really. The heart beat seems like PJ’s… & his fellows. Time will tell.

February 2, 2010 2:29 pm

“It is interesting that Phil Jones and the CRU are self evidently not very good when it comes to understanding how to work with computers.
However the IPCC rely totally on the computer derived research of these people.”
BINGO, on the MARK, right on. Recently I was discussing with a friend the 787 passing the “weight test”. That’s where they weight the wings with sandbags until they BREAK to get the “max load”.
My friend, who works for a company supplying high speed data gathering equipment to CERN said, “WHAT? ! ? They still do a physical test?” I noted (from my civilian aviation experience, and keeping up with the industry over the years, “Yes, the FAA is rather ‘anal retentive’ about getting that sort of testing done.”
My friend and I then both noted: Computer models are great (I’ve been doing Finite Element work for 25 years!) but there is NOTHING like a real PHYSICAL test to verify YOUR COMPUTER MODELING WAS CORRECT.
Hum, possible with a 787. Not so possible with Earth 1.0
Max

Dave N
February 2, 2010 2:56 pm

@Chilled Out, and L Bowser
Head over to John O’Sullivan’s ClimateGate site:
http://www.climategate.com/climategate-professor-phil-jones-could-face-ten-years-on-fraud-charges
There was another article that pointed out while the emails may have been “stolen”, they weren’t obtained illegally by prosecutors, and that’s what counts. I can’t seem to find that article at the moment.

February 2, 2010 3:00 pm

The E-mails and documents could have been leaked as there where offered to the BBC three weeks before they ended up on russian web site.
Some of the zipped documents where copied at 4.30 am, on new years day has anyone picked up on this?
Just had letter from Joan Ruddock, MP Minster of State at the Department of Energy & Climate Change. After all that is on the web and in the papers about climategate to get this letter is like reading a Monty Python sketch.
“the data hacking incident”
“the government does not provide funding for the CRU”
“temperature analysis is confirmed by two entirely independent analyses. Carried out the the USA by the NASA and the NOAA”
“We can also take confidence that the UEA temperature analysis has been peer reviewed in numerous scientific papers over the last twenty years and been assessed by the Intergovernmental Panel on Climate Change (IPCC) in its last three reports. the IPCC has issued a statment which supports this in detail.” Joan Ruddock MP
REPLY: No the BCC emails thing with Paul Hudson is wrong, he only confirmed that emails in the FOIA2009.zip file contained communications to/from him from weeks before, leading to his concluding the whole file package to be authentic. He described it in such a way that many people got the wrong meaning.

February 2, 2010 3:11 pm

KONRAD
I have some more for your list
F National Security
G not in the puplic interest.
H No man power to carry out the work
I lack of funds

Tom
February 2, 2010 3:15 pm

Ian, The time stamp of my 64,936,854 bytes, FOAI Zip file was loaded on Friday, Nov. 20th, 2009.

Richard Saumarez
February 2, 2010 3:55 pm

Re Sir David King.
I am reminded of a famous quote attributed to Bacon:
“He doth like the ape; the higher he climbeth, the more doth he show his arse”

Richard Saumarez
February 2, 2010 3:58 pm

I’m sorry, I’ve just had another thought. If the original data of temperature records have been “lost”, how the hell did these e-mails survive?

February 2, 2010 4:17 pm

Konrad (14:08:34) : ” If they [Norfolk Police] conclude that this was a hacking incident this may provoke the whistle blower to subsequently reveal themselves. A whistle blower publicly revealing themselves after the authorities have released an official hacking claim would be even more politically damaging than an admission that this was a leak. ”
&
“The tactic of delaying the investigation and hoping people forget will no doubt be tried, despite this being the age of Little Brother. ”
Konrad: This blog is amazing, your points are well articulated. I would like henceforth to use the expression “Little Brother is Watching” as a rallying cry against the “Big Brother is Watching”. Who do I attribute the Little Brother idea? You?
John

MrLynn
February 2, 2010 4:22 pm

Bob Kutz (13:04:58) :
1) I would ask to see the server. There’s no server that I’m aware of that would’ve housed the collection of emails going back some 15 years. Is that all users for 15 years? How is it that the email server (or backup or whatever) also contained so many data files? Were they really keeping their general documents, their data and their emails all on one server for 15 years? Fire the IT guy too. . .

Not so hard to believe. In our much smaller business operation in the past 5 years we’ve had our one data array and our one server replaced, but in the first case we copied over all the data to the new array, and in the second just attached the existing array to the new server. The data hasn’t disappeared. With HD space cheap and ample, there’s no need to wipe old data files off, especially if you want to access them from time to time.
/Mr Lynn

Syl_2010
February 2, 2010 4:28 pm

Well I sure hope they don`t teach Information Technology and Computer Security at East Anglia!

MrLynn
February 2, 2010 4:50 pm

Richard Lawson (11:11:35) :
. . . The Guardian really has got it’s teeth showing now. The penny has at last dropped. So tonight it’s official: AGW has died – now we can look forward the the wake.
Time for a beer.

Not here in the good ol’ USA. The major papers and broadcast networks are still firmly in the Obambi administration camp, and still following the party line on AGW. This administration has three years to go, and it is full of extreme enviro-ideologues, namely Holder, Chu, and Jackson. They and their allies in the Congress have had the AGW bit in their teeth for years, and they’re not going to release it without a fight.
Maybe the midterm elections next fall will keep them in the stable, unable to race to a Cap-and-Trade and CO2-restriction finish line, which they so fervently desire.
But I need a beer, so I’ll have one anyway.
/Mr Lynn

wxmidwest
February 2, 2010 5:21 pm

IT seems more logical that the info would come from within then some Kiddie “Pub-Scanned” Open Russian FTP

Konrad
February 2, 2010 5:37 pm

John Whitman (16:17:17) :
I don’t think I could claim to be the first to use the phrase, although I use it a fair bit.. The internet has some reference to getting kids to be informers or companies as opposed to governments using CCTV. I use the term to refer to the public, especially on the internet watching government and main stream media. My more common usage would be “Little Brother is watching and recording…” which I feel serves to remind those in government and old media that they are no longer the gate keepers of opinion and they cannot rewrite history. WUWT, CA and the climate debate seem to be becoming a cornerstone of the New Media. In this debate we are seeing Old Media dancing to New Media’s tune and thousands spent on government propaganda failing to fool the public. I’m sure these interesting times will be the subject of study for Media and Political Science students for years to come.

February 2, 2010 6:17 pm

Hey ‘Konrad @(17:37:56)’,
Regarding our Little Brother discussions on this thread, I will try to use Little Brother in the context of independent individuals monitoring the established organizations (gov’t, MSM, IPCC, UEA, PSU, GISS, etc). This is like a modern internet era equivalent to the old David vs Goliath theme (without the religious slant). So, if there is a Big Brother watching us then now there is a multitude of independent Little Brothers watching them.
John

Roger Knights
February 2, 2010 8:13 pm

Anyway, the Climategate files weren’t “stolen”. CRU still has them and enjoys the use of them. They were simply copied and made public!

IOW, they were copied, not moved.

February 2, 2010 8:13 pm

Richard Saumarez (15:58:13) :
“I’m sorry, I’ve just had another thought. If the original data of temperature records have been “lost”, how the hell did these e-mails survive?”
I wonder that too. I expect either the records were selectively deleted, or the records and emails are on two different computer systems (unix and Windows) with two different retention policies.
Can anyone validate the computing environment that is (or is likely) in place at the CRU or a typical British University?
Obviously, the Fortran programs execute on a unix mainframe. But how about personal computer usage?

February 2, 2010 8:18 pm

My crazy theory that Jones accidentally created FOIA.zip using a faulty eraser program is looking better all the time.
http://appliedimpossibilies.blogspot.com/2009/12/own-goal-at-cru-hockey-team.html
Imagine how many people will have a fit if I’m right. Aaaaaaaaaagh the shreders bugged.

Roger Knights
February 2, 2010 8:27 pm

“Sir David King, the UK’s former chief scientist, strongly believes that the theft … was deliberately designed to destabilize the Copenhagen climate talks last December.

But that’s not what actually happened:

Jimmy Haigh (09:37:59) :

Snowed in in the UK (04:12:22) :
The Independant is still battling on in denial. Look at the story about ‘Climate Change in 2009′ at the bottom of the page. In it they say:

“…The situation was not helped by the selective leaking of private emails from a few climate change scientists.
This action, clearly calculated to cause maximum political damage before the Copenhagen summit, gave further impetus to the campaign of a few of the so-called “sceptics”, who seek every means available to discredit what is now very clear mainstream climate science. I suspect that history will regard this little flurry as comparable to the Battle of the Bulge – a last high impact but doomed counter-attack on what is ultimately an irresistible weight of evidence that underlines the gravest threat to human wellbeing. In any event it had almost no impact on the talks.”

Further, King evidently hasn’t been following my posts here as attentively as he should. I pointed out months ago that the e-mails should have been released six weeks earlier, at least, if the leak was meant to affect Copenhagen. We can see how only after that delay did the alarmist consensus start to unravel. Climategate only opened a chink in the armor. It’s taken six weeks for insiders like Kaser to speak out, for the press to have the nerve to exploit that opening, etc.

Roger Knights
February 2, 2010 8:34 pm

Power Grab (12:52:07) :
I still say that PJ (or someone with equal pull) told everyone in the shop to delete whatever incriminating messages/documents they could find…so the users themselves deleted the most valuable items…thereby marking them for easy collection.
Then someone with true IT savvy and insider access gathered them all together using backup software and put them on the single server.

(IOW, the leaker trolled through the “deleted” bucket.)
Poetic justice! I hope it’s true.

February 2, 2010 10:34 pm

Power Grab (12:52:07) : …so the users themselves deleted the most valuable items…thereby marking them for easy collection.
Roger Knights (20:34:02) : (IOW, the leaker trolled through the “deleted” bucket.)
Poetic justice! I hope it’s true.
I cannot see any immediate holes in your theory. UEA however and the Norwich police unfortunately have all the evidence. Will they reveal all their evidence? I am cautiously optimistic.
John

richard
February 3, 2010 12:08 am

There’s a curious attraction to these emails, pictures and data coming from the ‘deleted items’ bucket on the main server.
We know that there was a strong desire to evade FOI despite the blatantly obvious risks to reputation and position. Maybe someone was also stupid enough to think that deleted is the same as gone forever.

p.g.sharrow "PG"
February 3, 2010 12:24 am

“Little brother is watching” an old saying as well as “little pitchers have big ears”. Actually if I remember correctly little sister had the big mouth! and at the worst time 🙁
Oh well it appears to me P J gathered the files and moved them to the server.
Most people that use modern computers, just know how to use them. They do not know how the hardware and software work. He thought he hid them from prying eyes by stashing them on a separate server, not knowing that anyone with access to that server could view and copy them.
The total number of files that would have to be sifted through and the number and different kinds gathered togather would make an outside hack very difficult to yield the zipfile.

Dodgy Geezer
February 3, 2010 3:36 am

I think that this comment, copied from the Independent’s comment pages, should be given a wider circulation.
This parodies a well-known advert for insurance in the UK:
……………………………………………………………………………
alexjc38 wrote:
Monday, 1 February 2010 at 07:04 pm (UTC)
Greetings! It is I, Aleksandr Meerkat (ex-KGB) who give you lowdown on latest dramatic climate story!
Absolutely Sir David King is right, and this must be truth behind recent ClimateGate scandal – far from being leakage of incriminating e-mails and files showing gross misconduct of Phil Jones and cronies at Climatic Research Unit, in reality this is exciting and mysterious Cold War spy novel! International conspiracy of denialistic American Big Oil, in league with shadowy Russian petrodollar plutocrats to discredit heroic IPCC and destroy planet itself. Da, is true! SMERSH and Illuminati involved too, perhaps, who knows!??
Forget dull details of ClimateGate, with blatant corruption of peer review process and climate scientist cabal behaving like tiny Supreme Soviet, quashing all dissent and hiding decline! Forget revelation that latest IPCC report based on motley collection of magazine articles, eco-propaganda pieces and student essays. Forget complicated and boring financial connections between Government, TERI-Europe, WWF and Greenpeace. Forget tedious analysis of NASA GISS and CRU computer code, revealing unholy tangled meerkat’s nest of errors and fudges. Forget fact that northern hemisphere now whiter than ever on top, like decadent Western Christmas pud with brandy sauce! Pay no attention, is not interesting or significant, truly!
Sir David King is absolutely man who knows what he’s talking about! Da, is true – this is person who say entire human race must move to Antarctica when Global Warming catastrophe annihilates civilisation next Tuesday, so is obviously sensible and knowledgeable of these matters. Simples!

Michael Ozanne
February 3, 2010 4:03 am

British Rules of Evidence are much more “Pragmatic” than the US rules derived from the 4th amendment, that might be in the mind of American readers. Pretty much the material in question would have to be privileged (e.g client counsel communication) , Forged or tampered with (e.g anything from special branch or the ATU), or blatantly handled outside PACE (Police and Criminal Evidence Act). Even then a Judge may still want to aid the search for justice (e.g “firearms residue” in the Barry George case was admitted even though the jacket in which it was found was not properly secured and protected, the chain of evidence was not preserved, it was taken to a non-laboratory setting and photographed by non-forensic staff in a room where contamination by “Firearms residue” was very probable. You might state that where the judicial thumb is applied to the scales of justice it is usually the crown that benefits, I couldn’t possible comment….:-)

Pascvaks
February 3, 2010 5:22 am

MI-5 thanks you, the FBI thanks you, as well as every other investigative agency in the world. Through your colective deductions you have just helped them determine that the person who “leaked” the Climategate data was a 12 year old girl visiting her father and being told to play with that computer over there while Papa did his very important work. It was a Bank Holiday and Papa had come in to prepare a special report. Oh well. The cat’s out of the bag. The poor kid will probably be “accidently” snuffed tonight, along with her whole family. Best to let little things be sometimes.

Veronica
February 3, 2010 8:59 am

John Whitman
The first time I heard the “Little Brother” thing was in the context of last year’s G20 summit in London, where a guy died after receiving the focused attention of some police officers. While the police take photos of demonstrators these days, acting as “Big Brother”, the evidence for the assualt by police officers was obtained by other demonsrtators taking photos of the incident with their mobile phones. Little Brother therefore was watching Big Brother.

Veronica
February 3, 2010 9:01 am

Alex the Meerkat
We’ll get Dan Brown to write this one up as a best selling novel.

Roger Knights
February 3, 2010 4:00 pm

There’s a novel out called Little Brother, by one of the guys behind the Boing Boing site.