Bouquets of Gray

Wednesday, June 11, 2008

The spy who didn't shag my wifi 4: theoretical possibilities

In our last post, we saw that there are at least two versions out there about when Steacy/jadewarr had the IP 70.48.181.203 and what he did with it. The versions differ from one another in two key ways: they report different actions on the part of jadewarr, and they report different dates for those actions.

Here are the two versions in tabular form:

	Black (via Lemire)	OdinPatrick
Action	visit Stormfront	post to Stormfront
Date	Dec. 8, 2006	Sept. 15, 2006
IP	70.48.181.203	70.48.181.203
IP owner	Hechme*	(unknown)
	*From the Bell technician's testimony

If Black and OdinPatrick were both telling the truth, one of these four scenarios would have to be true:

Hecme had the same IP for the entire period and Steacy hacked her wifi twice (once to post to Stormfront and once to visit there).
Steacy had the IP for the whole time and he used it twice (once to post to Stormfront and once to visit there).
The IP belonged to Steacy personally in September, but Hechme in December, and the wifi that he hacked in December by coincidence had the same IP as the one he had used in September.
The IP belonged to some unknown person in September, and to Hechme in December, and Steacy hacked both wifis, which coincidentally happened to have the same IP.

In fact, however, none of these can be true. Scenarios #3 and #4 may be theoretically possible, but the chances of either of these happening are infinitismal: they can be rejected out of hand. And #1 and #2 contradict the testimony of the Bell Technician, who testified that Hechme had this IP from 18:36, Dec. 7, until 21:35, Dec. 8 (T1073/5405, vol. 26, p. 5646, lines 9-10): thus Hechme could not have had the IP in September (ruling out no. 1) and Steacy could not have had this IP in December (ruling out no. 2)

Clearly one of Black and OdinPatrick must be wrong.

To be continued…

Other posts relevant to this controversy:

Tuesday, June 10, 2008

The spy who didn't shag my wifi 3: when exactly did Steacy/jadewarr have 70.48.181.203?

We have examining the allegation that Dean Steacy of the Canadian Human Rights Commission had hacked an Ottawa woman's wifi and used her IP to visit Stormfront in December 2006.

Stacey, as you'll recall, had used a pseudonym named "jadewarr" in his investigations.

In Part One we saw two things. First, Marc Lemire produced evidence from Stormfront founder, Don Black, that during jadewarr's visit to Stormfront on December 8, 2006, he used IP 70.48.181.203. Second, that a Bell technician has testified that on that date 70.48.181.203 belonged to Ottawa resident Nelly Hechme.

Part two also showed that another Stormfront moderator, OdinPatrick, reported that Jadewarr had used 70.48.181.203 to post to Stormfront. Second, that jadewarr's only post to Stormfront was made on September 15, 2006.

In tabular form the two versions are:

	Black (via Lemire)	OdinPatrick
Action	visit Stormfront	post to Stormfront
Date	Dec. 8, 2006	Sept. 15, 2006
IP	70.48.181.203	70.48.181.203
IP owner	Hechme*	(unknown)
	*From the Bell technician's testimony

So, when exactly did jadewarr/Steacy use this IP?

To be continued…

Other posts relevant to this controversy:

Monday, June 09, 2008

The spy who didn't shag my wifi 2: someone else notices Jadewarr

In my first post in this series, we reviewed the background to a recent allegation that Dean Steacy, an investigator with the Canadian Human Rights Commission, had hacked the wifi of an Ottawa woman and used her IP to visit Stormfront, a white supremacist website.

The allegation depended on a chain of evidence:

on the testimony of Bell technician that the IP 70.48.181.203 belonged to Nelly Hechme on December 6, 2006;
on Don Black, founder and webmaster of Stormfront, who informed Marc Lemire that 70.48.181.203 was the IP of Steacy's pseudonym "jadewarr";
on a reporter who contacted Hechme and reported that she had not been involved;
and on internet pundits, who concluded that the details could only be explained if Steacy had hacked the wifi.

But in all the discussion about this allegation, people have overlooked an important piece of evidence: that another Stormfront administrator had already noticed the link between Steacy and Jadewarr.

We have already seen jadewarr's member profile from Stormfront, the relevant part of which is reposted to the right. It shows that jadewarr only posted once at that site, and that post is worth visiting.

On September 3, 2006, Marc Lemire had started a new thread denouncing the unfairness of the Canadian Human Rights Commission, which had recently rejected his complaints against the hate crimes unit of the Edmonton RCMP. (You can find the thread in Google-cache here, or click through from there to the Stormfront site.) Several other Stormfront members responded, all agreeing with Lemire.

The fifth post to that thread, made Sept. 15, was contributed by Jadewarr. You can read it yourself here:

Following this post, the thread went quiet, and no-one added to it for a long time.

A year-and-a-half later, however -- long after jadewarr's post and the jadewarr-Steacy connection had been made public -- a moderator of Stormfront's Canadian section by the name of "OdinPatrick" noticed jadewarr's solitary post and responded to it.

As you can see, OdinPatrick had unkind words for jadewarr, and more abuse followed that doesn't need to be repeated here. Towards the end of his post, OdinPatrick added this:

OdinPatrick cites two IPs here: one used to register, and one used to post. The second is identical to the IP that Black had given to Lemire: 70.48.181.203.

Jadewarr had only ever posted one message to Stormfront, on Sept. 15, 2006, that would have been his IP on that date, according to OdinPatrick's statement.

To be continued…

Other posts relevant to this controversy:

The spy who didn't shag my wifi 1: background

Those who have been following the Marc Lemire case before the Canadian Human Rights Tribunal have seen some weird twists and turns — and a bizarre series of allegations that have been made about the Commission and its employees. One allegation was that human rights activist Richard Warman (who had initiated the complaint against Lemire) had himself posted a racist attack against senator Anne Cools, and allegation that was ultimately proven false. Another weird allegation was that Warman had leaked confidential commission documents related to the Demigorgona case. Again false.

Today we turn our attention to another allegation that Commission employee, Dean Steacy, who is legally blind, had hacked an Ottawa woman's wifi to visit a racist website in December 2006. The details are scattered and complicated, but a fresh look at them will show that there is plenty of room for doubt, and that in fact the evidence suggests that there was no wifi hackery, just a simple miscommunication of facts.

First, some background. In his position at the Commission, Steacy is involved in investigations of websites accused of spreading hate. In these investigations, Steacy has occasionally actually registered in the sites in question -- some sites have areas that are limited to registered members only; others only allow members to view other members' profiles or use the site's search engines.

Such was the case with White Supremacist site, Stormfront, where Steacy registered the pseudonym "jadewarr". To the right is Jadewarr's member-profile there. (He was member number 58160, if you want to go there to look for yourself -- but in order to access the member profiles, you will have to become a member) He joined, as you can see, in February 2005 (note the left hand column, right under "Forum Info").

The wifi controversy arose with regards to a visit made to Stormfront on December 8th, 2006. On that date, Steacy had logged into the Jadewarr account in order to find a specific posting related to a hearing before the tribunal. (Stormfront's own search engine is only available to logged-in members.) He then printed the posting, but without logging-out, which meant that "jadewarr" was included on the print out. When the print-out was submitted as evidence, his pseudonym was exposed.

As I said, Lemire is himself a respondent before the Tribunal, and his defense strategy seems to be to delay, distract, and deflect. Spurious complaints are filed with the CHRC against opponents; allegations are made about CHRC unfairness, incompetence, or corruption. The exposure of Steacy's pseudonym gave him an opportunity to make new allegations. Indeed, given the information available, it should be possible to learn Steacy's IP, and once his IP was known, his actions on other sites might be examined.

Marc Lemire himself, however, had no access to that information -- Stormfont is based in the United States, having been founded by former KKK Grand Wizard, Don Black (who has a fairly nasty history of his own). Lemire, however, was (and is) a long-time member there: indeed, his profile (to the right), shows not only that he is a sustaining member, but also proclaims him to be a "Friend of Stormfront". Presumably it was on this basis that Black supplied him with an IP and hostname: 70.48.181.203 and bas2-ottawa23-1177597387.dsl.bell.ca.

We know all this from an affidavit that Lemire filed with the Tribunal in May 2007, requesting that Bell be subpoenaed to supply the name, address, and phone records associated with that IP address (here). The subpoena was granted, and on March 25, 2008, a Bell technician appeared in court to provide the information that he was asked for.

What the Bell technician reported, however, was a surprise to everyone: on Dec. 8, 2006, the IP 70.48.181.203 was assigned to someone with no apparent connection to Steacy, the Commission, or Stormfront. It was a woman named Nelly Hechme who lived in an apartment building in Ottawa not far from the CHRC offices. Once her name was made public, a reporter contacted her to ask whether she knew how and why her email might be involved in this affair, and the only available explanation was that someone had accessed her wifi. But since her wifi was secured with a pass-word, the usual suspects accused Steacy of having hacked it.

To be continued ....

Other posts relevant to this controversy:

Archaeology of a smear (summary thread)

(In progress)

Archaeology of a smear, part 5: who is this letter really to?

We have been looking at the letter of apology written by "Demi" in July, 2004. It was sent to someone c/o the Canadian Human Rights Commission, and it apologized fully for her postings at Stormfront and elsewhere.

As is often the case, however, the document reveals more than it means to. And in this case, it is fairly clear that Demi's apology was meant not only for the mystery addressee. Note the repeated references to her upbringing and family, and the values they had taught her that her racism had betrayed.

It is surely obvious to any sensitive reader of texts that this letter was also meant for Demi's parents and was an expression to them of her regret at the pain her racism had caused them.

Saturday, June 07, 2008

Lies, damn lies, or statistics: how reliable are Steyn's numbers?

In 2005, Steyn wrote an article for the Jewish World Review with the title ("U.S. can sit back and watch Europe implode"), which adumbrated the argument of his book, America Alone, that Europe was in the process of being overrun by Muslims. Money quote:

"By some projections, the EU's population will be 40 percent Muslim by 2025. " Whose projections? That has been not easy to determine. This post by blogger The Crossed Pond may have found the answers:

There is, of course, a big difference between 40 of 456 million (and if that was a round up) and 40% of 456 million.

But how many Muslims are in Europe? This study reports a French poll that asked the French what religion they identified with. 3% of those polled "identified most" with Islam. The map to the right is instructive. There are larger communities of self-identifying Muslim in Paris, Lyons, and Strassbourg. Elsewhere, not so much.

For comparision, look at those self-identifying as Catholics (below and to the right).

So, what of Steyn's thesis that Europe will eventually become Islamic? Not for a long, long time.

Wednesday, June 04, 2008

Archaeology of a smear, part 4: some documentary forensics

So far in this series, we have seen how the World Church of the Creator (WCOTC)-- a white-supremacist organization with a history of racist violence (see see part 1)--was brought to Canada by a young woman who used the pseudonym "Demigorgona" in the autumn of 2002 (see part 2). Her actions prompted a complaint to the Canadian Human RIghts Commission by activist Richard Warman.

Sometime during the following year, however, "Demi" seems to have seen the error of her ways. She repented of her racism and wrote a letter of apology.

To whom, exactly, however, did she write the letter? Paragraph 41 of the Fournier's statement of defense (here; read the whole thing here) describes the letter as having been "sent to the CHRC". If you look at the address on the letter itself, however, it is clear that it was sent not to the Human Rights Commission, but C/O the Commission. And "c/o", as everyone knows, is an (abbreviation for "care of").

"C/O" should mean that the Commision was not the intended recipient, but was to act as an intermediary and deliver the letter to the addressee. But the addressee's name is missing.

It has been removed, as a a close look at the image of the letter confirms. If you look at the images to right, you'll see a close-up of the letter's inside address. The top one is "au natural", and the bottom one has its contrast heightened and brightness lowered. in it you can see that there used to be something in the line between the date (July 31) and the line beginning "C/O".

Clearly the addressee's name has been removed -- or, rather, covered over. At first I thought that this was white-out. But in the darker of the two shots, you can see the outlines of a piece of scotch-tape that is affixing a small piece of paper over the addressee's name.

Now, I don't see any way of determining on the present evidence who the letter was addressed to, but I want to hazard a guess in my next post about who it was written for. As we shall see, they need not be the same.

To be continued…

Monday, June 02, 2008

Archaeology of a smear, part 3: "Demi" repents

In the first two parts of this series, we saw that the World Church of the Creator (WCOTC) was a white-supremacist organization with a commitment to (and history of) racist violence (see see part 1), and that "Demigorgona" and others had opened new chapters Canada in the autumn of 2002 (see part 2). This had soon attracted the attention of human rights activist Richard Warman, who is known for bringing cases of hate speech before the Canadian Human Rights Commission (CHRC), especially against those who used the internet to promulgate hatred. And by mid-2003, he had filed a complaint against the World Church of the Creator (WCOTC) and its leaders. They were not hard to find: "Demigorgona "(a fraction of whose writings we reviewed in part 2) signed her real name to many of her essays. (I will refer to her by her pseudonym in these posts and redact her real name from any documents I produce here: she has apparently left the racist movement and no doubt would prefer that this be left in her past.)

From that point, the Commission began its work. Unlike most of those confronted by the CHRC, "Demi" saw the error of her ways. She sent a letter to commission apologizing (a copy of which is to the right; you can see an un-redacted copy at Ezra Levant's site). In it she renounced her earlier racism, which she recognized was inconsistent with her upbringing. She had, she says, abandoned the racist sites where she had posted so many messages. Her letter dates from 31 July, 2004, and sometime in the months following she entered mediation through the CHRC. The case is listed at the Tribunal website as settled in 2005 (here).

Demi's letter, however, resurfaced some months after that, and has become controversial recently. I will discuss that controversy in a future post. In the meantime, however, there is some documentary analysis to be done with this text.

To be continued…

Saturday, May 31, 2008

Archaeology of a smear, part 2: WCOTC comes to Canada (2002)

In 2002 and 2003, the Creativity Movement (as the World Church of the Creator came to now known after losing a trademark dispute to the Church of the Creator in 2003) was growing. The crude racial hatred and incitement of racist violence (examined in the part 1 of this series) had brought exposure in the media and fueled its growth. New chapters were founded and new members recruited, including in Canada.

In September 2002, poster "Demigorgona" announced on the racist website Stormfront.org that a new chapter of the WCOC had been founded in Ottawa (to the right; google archive, here*). Contact information was given, followed by the invocation "RaHoWa!", a racist slogal abbreviating "Racial Holy War". At about the same time new chapters were started in Montreal and Alberta.

These Canadian chapters have since folded, and their web-pages have been deleted, but much of their contents can still be retrieved through the Wayback Machine, and many of Demigorgona's writings were cross-posted to racist websites, including Stormfront.

The message proclaimed on these pages was the same as the wider church: "the survival, expansion and advancement of the White Race", with frequent calls for "Racial Holy War".

The Canadian website hosted some of her writings, and many will be happy that that site is gone, since what it advocated is repellant to all decent people. The downside, of course, is educating people about racism is often best achieved by exposing its ugliness. And that there was plenty of ugliness can be seen in the following excerpts of Demigorgona's writing:

Keep Hate Alive (via google cache): "I love the white race and I HATE its enemies. It's enemies are all mud races. Whether consciously or unconsciously they are waging a war against us. Survival is the only glory in war. ……"

My Blood is True (via Google cache): "Racial Purity. The only way the white race will be able to prevail is to keep our racial bloodlines pure. … The Jew knows this as well. The Jews have known this for centuries! This is why the Jew brought Africans over to North America, why they duped good white men into believing they needed slaves. This is why they pushed freedom and then so called 'civil rights' for negros. This is why they have opened the non-white immigrant floodgates in all white lands. This is why they push their muddy-cultural...love everyone and question nothing drum-beat on us! They want to destroy the one true last bastion of white power; that is, pure blooded white men and women. ……"

To Victory White Man (via google cache): "The white man's greatest enemy is the Jew. For thousands of years the Jew has been a parasite on white civilization. They have not been workers in factories or any other type of labour. The Jews have for the most part been the bankers, the factory owners, the ones with the money and the power. Over time, they gained a monopoly over the world's monetary systems. Now they have gained complete control over most of the world's economy. …… The final step is to expel all non-whites, race traitors, and opponents to our cause to a non-white nation of their choice. We should even offer to pay for them to leave and never come back, it would after all be a worthwhile investment into the future of the white race."

Ernst Zundel (via google cache): "Ernst Zündel is a true hero in every sense of the word. He's dedicated his life to serving his race and to spreading the truth about the Jews and their so called "Holocaust." ……"

These are only a few of her essays, and her essays only make up a tiny portion of the thousands of racist posts that she made under her pen-names Demigorgona and NordischeDonner, as can be seen from two of her Stormfront user profiles:

She posted elsewhere, too, including the Vanguard News Network, and Creator.org. She had her own page at http://members.odinsrage.com/demigorgona (no longer active), and even started her own racist site at skinnation.tk (via google cache).

To be continued....

*I have linked to the google-caches of these pages rather than to Stormfront itself. If you want you can click on through.

Wednesday, May 28, 2008

Archaeology of a smear, part 1: the World Church of the Creator

Dr. Dawg notes that it seems that every-one is talking about neo-nazis today. Here's my contribution.

You may never have heard of the World Church of the Creator (WCOTC), which was founded by Ben Klassen, the author of the White Man's Bible (cover to the left). If you have heard of it, you will know that the WCOTC has a long history of racist violence that reached its peak on the July 4th weekend, 1999, when one of its adherents — whom the WCOTC calls 'creators' — Benjamin Nathaniel Smith went on a three-day killing spree in Indiana and Illinois, targeting blacks, orthodox Jews, and Asians. He killed two and wounded nine before committing suicide.

That rampage took place two days after WCOTC "pontifex maximus", Matthew Hale (pictured to the right), had been denied a license to practice law in Illinois on the grounds that he lacked the "requisite moral character" to be a lawyer: his open advocacy of racial hate and racist violence rendered him unsuitable. (Snark about lawyers if you must, but they do have some standards.)

In the aftermath of the spree, Hale admitted that the decision about his law license had probably been behind Smith's attack (here). He also admitted teaching hatred, but justified it on the grounds "If you love something, you must be willing to hate that which threatens it." The white race, according to Hale, is threatened by "mud races". By the end of the year, Hale had named Smith "Creator of the Year" because "he brought more media attention to the Church than any other Creator". He encouraged other adherents "to view Brother Smith's activism as an example to follow" (here).

Some members apparently took this exhortation seriously. In July 2002, two WCOTC-adherents were convicted of plotting to blow up black and Jewish landmarks in Boston. In late 2002, following a court ruling against him in a trademark infringement case, death threats started to circulate on white supremacists sites such as stormfront, and in Jan. 2003, Hale himself was recorded conspiring to murder her with an FBI informant and arrested, tried, and convicted. (He is currently serving a 40 year sentence.) This is all part of a long history of racist violence that the group had shown:

One member was convicted of killing a black sailor returning from the Persian Gulf war in 1991 in Florida. Two members pleaded guilty to the 1997 beating of a black man and his son in Miami, and last year, also in Florida, four members pleaded guilty to robbing and pistol-whipping a video store owner they believed to be Jewish. Potok of the Southern Poverty Law Center said members of the group had also been linked to a plot to bomb a large Los Angeles African Methodist Episcopal church in 1993 and to the bombing of an office of the N.A.A.C.P. in Tacoma, Wash., that year. [source]

You can read more about the group's history of violence here, here, here, here. The violence, unsurprisingly, brought the movement wide exposure, and in the week after Smith's rampage there were profiles in the New York Times, Time Magazine, CNN, and elsewhere. Sometimes (as here) this made the public wary of the group. The exposure also helped attract sympathizers, however, and the following years saw new members and new chapters (here), including in Canada.

To be continued…

Sunday, May 18, 2008

Hanging it up for a while

Bernard Klatt, Richard Warman, Cools, 90sAREover

I'll be travelling on business for a few weeks and so blogging will be minimal.

In the meantime, if you've landed here looking for what I've written about Richard Warman, Bernard Klatt, and the Cools post, there's a lot to read. The more important posts, which summarize many of the others, are the following:

"Why there is room for doubt that Richard Warman wrote the Cools post", which points out that the IP that Warman and 90sAREover shared was a web-caching proxy that during this period will have been shared by hundreds of thousands if not millions of Rogers customers;

"Load-balancing in action: did Richard Warman and 90sAREover really have the same IP?", where I demonstrate that it is not completely clear that 90sAREover and Warman did in fact have the same IP;

"One of these things is not like the others: why Richard Warman is innocent", where I point out that the computer used to write the Cools post was different from the one Warman was using when he visited these sites;

"Klatt's Clunkers: why Bernard Klatt should be disbelieved, which lists posts in which I demonstrate deficiencies in Bernard Klatt's testimony about this matter;

Revisiting the lucy-90sAREover identification, where I consider each element of the Cools case.

Keep well and be careful to eat your vegetables. And remember the Golden Rule of Blogging:

Blog about others as you'd have them blog about you.

Best regards.

Buckets

Saturday, May 17, 2008

Jonathan Kay and journalistic standards

On Feb. 18, 2008, National Post columnist Jonathan Kay wrote an on-line piece with the title "Richard Warman and Canada's phony-racism industry", a column that was quickly withdrawn with an apology, and is now the subject of a lawsuit. I will not quote that essay or link to it, since Kay has retracted it and it is now before the courts. Many copies have circulated around the internet, however, and if you really want to read it, a google of the title will take you there.

Kay began his column by laying out Klatt's technical case against Warman: that both he and the Cools poster had the same IP, that their operating system and browser "were an exact match", and that Klatt's "expert" opinion was that they were identical.

Those who have followed my posts about this matter will know the technical weaknesses of that case: the IP was a web-caching proxy shared by hundreds of thousands; the Cools-poster's computer was actually set-up differently than Warman's; and the "expert" testimony of Bernard Klatt is deeply flawed.

Meanwhile, the lawsuit moves forward, and now Jonathan Kay and the National Post have filed their statement of defense. It is, as you will see if you follow the preceding link, hardly a riveting read. There are, however, a few interesting things there. Consider, for example, Kay's description of his research into the Cools allegations (paragraph 29):

Now, the first thing to note is that, as a research effort, this is not very impressive. Kay reviewed section 13.1 of the act (but he surely knew that before); he reviewed decisions involving the Lemire case, presumably some of those listed here (they are not, however, very informative); he attended a single CHRC hearing (which one, one wonders); he reviewed Klatt's affidavit and some previously published articles.

There are some odd choices here. Attending a hearing is praiseworthy, but less efficient than reading the transcripts, which are available on the internet. By contrast, Kay did use the Klatt affidavit, which was not (as far as I know) available on the internet until I posted a copy here,-- but I posted that months after Kay's controversial column. He does not mention making any interviews.

This raises a more important point. Kay's journalistic practices, at least as described here, seem decidedly sub-standard. He reported serious allegations against Warman as established fact when they were not so, and he did this on the basis of an affidavit that he did not understand (if he had understood it, he would have recognized its errors). He did not (apparently) bother reading Klatt's testimony and his subsequent cross-examination, where some serious gaps in his knowledge were exposed. Nor did he (apparently) consult Warman's counter-affidavit, read Warman's testimony on this question, or contact Warman to get his side of the story.

Now, I confess that I know little about journalism as a profession, and perhaps those with more experience than me can comment. But from my limited perspective, there is grounds for concern here. First, Kay got it wrong (that is, the technical evidence does not show that Richard Warman was responsible for the Cools post: quite the opposite). Second, and perhaps more disturbingly, Kay's column and the efforts that he describes in his statement defense, reveal no great concern for factual accuracy, fairness, or balance. This seems to me to be fundamental failure of journalistic standards.

Update. Mark Bourrie at Ottawawatch has some interesting observations on the lawsuit.

Thursday, May 15, 2008

Kay and the National Post have filed their statement of defence

Jonathan Kay has now filed his statement of defense, which is as follows:

KayDefence - Upload a doc

Tuesday, May 06, 2008

Klatt's Clunkers: why Bernard Klatt should be disbelieved (summary thread)

Warren Kinsella, when this whole business broke out, wrote:

(He adds details about Bernard Klatt's background here.)

Jonathan Kay, having repeated Klattt's allegations, tried to retract them. When challenged by Ezra Levant, he explained:

I took the post down when a more intelligent colleague of mine gave me some background about who Bernard Klatt is. Whatever Klatt may know about electronic sleuthing and the like, I didn't feel comfortable citing his affidavit as a source, even if all of the technical details in it are correct.Both are, simply, wrong. The reason to disbelieve Klatt's testimony is not because Klatt is or isn't (or was or wasn't) a neo-Nazi, alà Kinsella. Nor are his politics a reason to disregard his sleuthing skills, alà Kay. No, the reason to disbelieve Klatt's testimony is because it was patently wrong on so many points and his "sleuthing skills" are decidedly substandard:

Klatt's Clunkers 8: Bernard Klatt comes close

Below and to the right is a long exerpt from Bernard Klatt's testimony of Feb. 8, 2007 (Richard Warman & the CHRC v. Marc Lemire, T1073/5405 vol. 9, pp. 1636-8) .

In it, Klatt, who had been summoned to testify as a technology expert, is discussing the phenomenon that we had identified in the last post: that is, in the logs of Sept. 5, 2003, the traffic associated with 90sAREover's visit sometimes appears as 66.185.84.204 and sometimes as 66.185.84.200. Indeed, in the three minutes following his notorious racist denunciation of Senator Anne Cools, the IP changes four times.

Klatt is unable to explain the phenomenon.

There are several troubling aspects of this. First, of course, is the fact that he he's not sure what is going on: one expects better of an "expert". Second, it is troubling that the shifting IPs (which is material to the identification that he's making) is a matter that was raised not by Klatt himself, but the Chair of Tribunal. He makes no allusion to it at all in his discussion of the Cools' post in his affidavit (paragraphs 34-41, here). His answer to the chair, however, reveals that this is something that he'd noticed before: "That one is interesting" (line 21 of p. 1636). Not interesting enough, apparently, that he should actually explain it in his testimony.

Most importantly, however, is that is a bit troubling how close Klatt came to the truth. At p. 1636, lines 22-23, for example, he recognizes that 66.185.84.200 might be a web-cache, which he repeats at p. 1638, lines 3-4, as "very likely". The correct answer, as we have seen, is that both these IPs are web-caches and that the shifting from one to the other is part of Rogers' practice of load balancing. And the idea that he might suppose that 66.185.84.200 (which had a hostname of wc04.mtnk.rnc.net.cable.rogers.com) was a web-cache, but not guess that 66.185.84.204 (with hostname wc09.mtnk.rnc.net.cable.rogers.com) was also one is a bit baffling. He was so close!

One expects better than "close", however, from an expert. We want them to be right. Mistakes in expert testimony can ruin lives. In this case, the erroneous testimony has damaged the reputation of an innocent man and exposed those who have repeated Klatt's errors to financial harm.

Other posts in the Klatt's clunkers series:

Load-balancing in action: did Richard Warman and 90sAREover really have the same IP?

Below and to the right is an excerpt from the Freedomsite's logs, truncated on three sides to make it easier to read. (You can see an untruncated version here on p. 35.)

The top two entries (both with "POST") are related to the notorious Cools message: the first confirming the spelling of "nigger"; the second submitting the nasty message that is at the center of the present controversy. The bottom-most is the last entry for 90sAREover in the logs (or at least those that have been released).

The point to note is that 90sAREover did not have just one IP during his brief visit to the freedomsite message board, but two: 66.185.84.204 and 66.185.84.200, and in the space of three minutes he switches from one to the other at least four times.

I say "at least" four times here because it is important to remember that we are only seeing a portion of what was going on. These two IPs are both Roger's web-caching proxies -- their host names are (respectively) wc09- and wc04.mtnk.rnc.net.cable.rogers.com, showing the tell-tale wc (which abbreviates web-cache) -- and since they are caches there will have been traffic between them and 90sAREover's computer that is not forwarded to the visited site.

What does all this mean? The switching between these two web-caches is another example of load-balancing, a practice by which Rogers shifted traffic among its 42 web-caches to deliver the most efficient service to its subscribers. An attempt to sort out how all of this worked resulted in the string ball to the right (explained here), which traced shifts between proxy-IPs that can be identified in the years 2002-5. Each string in the ball is an example of a load-balancing shift.

This load-balancing provides another wrinkle in argument of identifying 90sAREover. It seems that Rogers' subscribers had what might be called a "home" proxy, which functioned as their default web-cache, and that they would rerouted to a another proxy only when needed, especially (one assumes) at peak hours. But when he made the racist Cools-post, was 90sAREover's "home" proxy 66.185.84.204 and 66.185.84.200 a temporary IP to which he was shifted through load-balancing? Or was his home proxy 66.185.84.200? Or might his "home" have been one of the other web-caches in the series, with the traffic rerouted into 200 and 204?

Monday, May 05, 2008

Klatt's Clunkers 7: Bernard Klatt doesn't understand Rogers web caching

As we have seen, one of the key pieces of evidence in the Cools-post debate has been the IP 66.185.84.204 (which has the host name wc09.mtnk.rnc.net.cable.rogers.com). As I have shown at length in this post, the wc stands for web-cache. A web-caching proxy server keeps copies of web-pages in its storage in order to save bandwidth. This practice, now in Roger's past, is important for the present controversy for two reasons. First, Rogers proxies hid the IPs of the individual computers that they are proxying for, and it was the proxy's IP that was logged at the websites visited. Second, because the proxy is performing this function for tens of thousands of Rogers subscribers at a time, the IP by itself is of little help in tying any one of them to any specific post.

In his testimony, however, Bernard Klatt seems to have missed this important fact. Indeed, when the topic of Rogers web-caching arose, he pleaded ignorance.

Since the IP in question was a such a proxy, and in fact the single most relevant fact to the case, Klatt's admission has the effect of rendering his testimony useless.

Other posts in the Klatt's clunkers series:

Klatt's clunkers 6: Bernard Klatt on Rogers service in BC

Bernard Klatt, the technology "expert" whose bunglings we have been reviewing in this series (for other posts, see the index at the foot of this post), argued before the Canadian Human Rights Tribunal that Richard Warman was responsible for the notorious Cools posting.

Another mistake can be found in his testimony of February 7, 2007 (T1073/5405, p. 1638-9), which you can see to the right. The problem? Rogers hadn't offered cable service in BC since 2000. The chair's question seems to imply that he knows better and gave Klatt the opportunity to extract himself from an obvious error. Still, Klatt is adamant.

(And in case you might think that this was a temporary slip he repeated the error at p. 1723, lines 3-5.)

Again, this is simply wrong. By the time of Klatt's testimony, Rogers had not been in British Columbia for seven years. Shouldn't an expert know things like this?

Other posts in the Klatt's clunkers series:

Sunday, May 04, 2008

Klatt's clunkers 5: Bernard Klatt doesn't recognize RealPlayer browser

We have already seen how unsatisfactory Bernard Klatt's testimony about the Cools matter has been. One of his most serious mistakes involves the only evidence that we have about 90sAREover: the logs of his post of Sept. 5, 2003. Here is the entry in which "90sAREover" registered his username:

http://chat.freedomsite.org:8080~Freedom

Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Rogers Hi·Speed Internet; (R1 1.3))

This log entry includes both the referring IP (in red) and the user-agent string (in blue), which shows that this is in the Combined Log Format, a fact that Klatt missed.

The interpretation of the user-agent also presented Klatt with difficulties. If you surf over to www.useragentstring.com, you can see what your own user agent string is and what it means.

Internet Explorer 6.0
Mozilla	It's a Mozilla based browser
4.0	Mozilla Version
compatible	Compatibility flag Indicates that this browser is compatible with a common set of features
MSIE 6.0	Name : MSIE 6.0 Version = 6.0
Windows 98	OS-or-CPU : Windows 98
Rogers Hi-Speed Internet	Rogers Communications Internet provider. Partnered with Yahoo! to offer Rogers-Yahoo! Hi-Speed Internet.
R1 1.3	Using Real Player as a browser

If at that same site you type in 90AREover's user agent string (blue above), you'll find a table like the one to the right (I've added the blue and truncated it slightly). It gives the items of the string with an explanation for each element. As you can see, R1 1.3 refers to RealOne Player, a free media player that has a built in browser. R1 obviously abbreviates "RealOne"; 1.3 was version 2.0.

If you don't believe me, you can download your own copy from oldversion.com and visit useragentstring.com to experiment. Or you can look at the long list of user agent strings in which we find some version of the RealOne Player over at botsvsbrowsers.com.

What did Klatt make of "R1 1.3"? Below and to the right (from pp. 1634-5 of the transcripts of Warman v. Lemire) is Klatt's attempt to explain it.

It is painfully obvious that he has no clue. The tip-off: statements like "the best explanation I've been able to determine" (lines 9-10), "the best of my ability" (lines 14-15), "the best explanation" (lines 19-20) betray his lack of confidence in his own answer. You never say this about what you know; you only say this when your guessing. And his guess is a bad one -- embarrassingly bad. Instead of recognizing that this was the RealOne browser, Klatt embarks on a series of accumulated conjectures: Rogers used a 15660 Cisco router, and "R1 1.3" was a firmware release, and the update took place in few weeks between 90sAREover's visit in September and Warman's visits in November. (Or, as we know now, but Klatt seems to have missed, October.)

Clearly he has no clue. What is worse is that he does not even know where to look for the correct answer. He did some "research on the internet", but where this led him is a bit of a mystery, since there seems to be no Cisco product with the designation CXC 15660, and no Cisco firmware update with this number. (Perhaps he has the 15600 CXC in mind?)

Trying to figure out what was his exact error is in any case unlikely to be productive. The more important point is that Klatt has failed to recognize that 90sAREover was using the browser built into the RealOne Player, which invalidates paragraphs 36 and 64 of his sworn affidavit (which you can see here), and (as I have argued here) is exculpatory for Warman.

Other posts in the Klatt's clunkers series:

Saturday, May 03, 2008

Klatt's clunkers 4: Bernard Klatt mistakes the combined log format for the common log format

We have seen that Bernard Klatt is the technology "expert" regularly summoned to defend those accused under section 13. In the Zundel hearing his testimony was dismissed as tendentious and incompetent, and that there are a number of ways in which his testimony in Warman v. Lemire is substandard (see the posts in the Klatt's clunkers series list at the bottom of this paragraph). Here is one of his paragraphs from his affidavit (which can be seen in full here):

Unfortunately for Klatt, however, this is simply wrong. The Common Log Format has seven elements (see here):

The Common Log Format (CLF) is a fairly basic form of Web server logging. It tracks seven different elements of the Web transaction. Each request is written to one line, with the different elements of the request separated by spaces (items in quotes or square brackets are considered one item), and items that aren't sent are listed as a hyphen or dash (-):

The remote host: the hostname or IP address of the computer requesting the Web page.
The client user name…
Authenticated user name…
Date…
The Request…
Status…
Bytes: the number of bytes that were sent in the server's response.

Here's how the log entry might look for this Web page in Common Log Format:

10.1.1.1 - - [08/Feb/2004:05:37:49 -0800] "GET /cs/loganalysistools/a/aaloganalysis.htm HTTP/1.1" 200 2758

As you can see, no user agent data is logged under the Common Log Format. To log that, one must use the Combined Log Format (see here):

The Combined Log Format uses the common log format but adds two items to the end:

Referrer: the URL of the page that linked to the requested document.
User-agent: the name and version of the browser or other client software making the request.

Here's how the log entry might look for this Web page in Combined Log Format:

10.1.1.1 - - [08/Feb/2004:05:37:49 -0800] "GET /cs/loganalysistools/a/aaloganalysis.htm HTTP/1.1" 200 2758 "http://webdesign.about.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; YPC 3.0.2)"

Which log format was used in the freedomsite logs that Klatt consulted? Here is one entry:

Since this entry includes the referring url (blue underline), and the user agent string (red underline), it is the Combined Log Format.

Yet another of Klatt's clunkers, then. There may be those who think that this is a simple quibble. That he is unable to get the basic terms correct, however, is consistent with the concern raised in the final decision of Zundel hearing, where he was criticized for being "unable to answer elementary questions in his field". It should be noted in addition, however, that Klatt's most serious errors in the 90sAREover matter relate to logs such as this. That he can't get the basic terms right is not confidence inspiring.

(The quoted material above have been edited and reformated slightly; for less technical descriptions of log formats, see here and here; more technical, here.)

Other posts in the Klatt's clunkers series:

Friday, May 02, 2008

Klatt's clunkers 3: Bernard Klatt misreads the user agent string

We have seen that for an award-winning "expert", Bernard Klatt makes lots of mistakes. Here's another from Klatt's affidavit in Warman v. Lemire (here, p. 9), paragraph 36:

You can see for yourself, however, that Klatt got this wrong:

As you can see, the user agent string is not "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)" (as Klatt wrote in his sworn testimony), but "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Rogers Hi-Speed Internet; (R1 1.3))".

Other posts in the Klatt's clunkers series:

Klatt's clunkers 2: Bernard Klatt wrong on IE 6 date

As we have already seen, Bernard Klatt is the technology "expert" of choice of Canada's white supremacist movement, appearing most recently in Warman v. Lemire, where his testimony was substandard in several ways. But that was not his first appearance in court and found wanting. In the Zundel hearing of 2002, Klatt was criticized in the tribunal's final report for (among other things) being "unable to answer elementary questions in his field." If you've been following this blog over the last weeks, this won't come as a surprise.

Consider the transcript to the right. This is part of the cross-examination of his assertion that Richard Warman must be the racist-poster "90sAREover" because they both used Windows 98 and Internet Explorer 6.0. (As it turned out, that was itself wrong, a point to which we'll return.) Klatt wants to argue that IE 6.0 was not widely used: it was, he asserts a "relatively new release at that point" (that is, in Sept. 2003). The implication: that since "90sAREover" and "lucy" were both using it, they were more likely to be identical.

The problem? Internet Explorer 6.0 was released in August, 2001, a full two years before the posts in question. And far from being unusual or cutting-edge by 2003, it was far-and-away the most commonly used browser: 70% of all internet traffic used IE 6.0 in Sept. 2003.

This is, of course, a small mistake, and is less significant in itself than in the fact that it betrays Klatt's desire to throw everything possible at Warman. Still, we expect technology experts to get the basic facts right. And Klatt doesn't. And that's a problem.

Other posts in the Klatt's clunkers series:

Klatt's clunkers 1: Bernard Klatt given an award for tendentious testimony

We have been seeing that the testimony of Bernard Klatt in the Lemire hearing has been substandard in many ways: indeed, the entire notion that "lucy" and "90sAREover" were the same user, which can now be confidently dismissed, was based almost entirely on his error-riddled testimony.

This all makes the image to the left all the more problematic. In it Klatt is being presented with an award from lawyer Doug Christie -- the same Doug Christie who is famous for having defended holocaust deniers Jim Keegstra and Ernst Zundel. The "Orwell Award" (named apparently without much of a sense of irony) was given to Klatt for his "expert" testimony in several human rights cases, including the Lemire hearing. In all of them Klatt appeared for the defense.

Thankfully, the award has not been noticed by any mainstream venues. The places that it's appeared, however, are themselves noteworthy, being the usual suspects when it comes to hate-propaganda.

Freedomsite.org (which is Lemire's site);
Stormfront;
David Duke.

That Klatt should be recognized for his testimony is a bit rich. His testimony at the Zundel case (where he argued that webpages should not be included among communications made "telephonically") was criticized in the final decision as under-informed and tendentious:

[103] … The evidence of Mr. Bernard Klatt was of very limited assistance to us. Mr. Klatt demonstrated an extremely shallow foundation of knowledge in his area of expertise during the course of his testimony. A series of dictionary definitions were put to him, many of which he acknowledged he had not seen before his preparation for this hearing. From the Tribunal's perspective, he seemed unable to provide much information independent of the written materials placed before him by Mr. Christie.

[104] During cross-examination, Mr. Klatt was frequently argumentative, evasive and unable to answer elementary questions in his field. Most troubling to the Tribunal was the extent to which this witness responded as an advocate for the Respondent and not as an objective, independent expert. Mr. Klatt's responses are replete with references to what "we are arguing", and similar allusions to his shared common cause with the Respondent.

Some of these problems appeared again during Klatt's testimony at the Lemire hearing, as we'll see in coming posts.

Other posts in the Klatt's clunkers series:

Wednesday, June 11, 2008

Tuesday, June 10, 2008

Monday, June 09, 2008

Saturday, June 07, 2008

Wednesday, June 04, 2008

Monday, June 02, 2008

Saturday, May 31, 2008

Wednesday, May 28, 2008

Sunday, May 18, 2008

Saturday, May 17, 2008

Thursday, May 15, 2008

Tuesday, May 06, 2008

Monday, May 05, 2008

Sunday, May 04, 2008

Saturday, May 03, 2008

Friday, May 02, 2008

Noteworthy posts

Worth Reading

Blog Archive