Wednesday, June 25, 2008

The spy who didn't shag my wifi 10: the software records posts not log-ins

We have been considering the allegation that CHRC investigator Dean Stacey (who registered at several sites using the handle "jadewarr") visited Stormfront, a white supremacist site, by hacking the wifi of Nellie Hechme, an Ottawa woman. The allegation, as we have seen, is dubious.

It has already been amply demonstrated (e.g., by BCL) that the alleged hacking is technically unlikely: the wifi in question was password protected; it was too far from the CHRC offices for the signal to be reachable, with buildings blocking the line-of-site; CHRC computers are not wifi-enabled; Steacy is legally blind.

What do we know?

We know from court testimony that this IP 70.48.181.203 was assigned to Hechme for 27 hours on Dec. 7-8 (here, p. 5646): that is what a Bell technician testified. The technician did not say, however, that this IP was used to visit Stormfront.

We also know that Jadewarr logged into Stormfront on Dec. 8. The question is what IP did Jadewarr use on that day? The short answer is that we don't know and probably never will.

We know, however, that on Sept. 15, 2006 Jadewar made his one and only post to Stormfront (here) he had the same IP as Hechme had on Dec. 8.

The whole allegation, then, is the result of a simple mistake: 70.48.181.203 was an IP that had been asssigned to jadewarr, but on the wrong date.

That this is indeed what happened is furthered confirmed if we consider this from the software side: Stormfront runs on vBulletin, a commercial software for running Internet forums. How does one check the IP of any user? Here is a screen cap of vBulletin's user manual for checking IP addresses (here), with my highlighting of the important sections:

According to the manual, when you ask for the IPs that users have used, vBulletin gives you "what IPs a user has posted with".

Performing this function on the Jadewarr account will have produced the IP that jadewarr used to make his only post on the Stormfront board, which was on September 15 (here).

In short, then, all available evidence suggests that jadewarr had this Bell IP on one day in September, and Hechme had it on another in December. Any suggestion that jadewarr had it again in December enters tin-foil hat territory.

Other posts relevant to this controversy: