Bouquets of Gray: Bernard Klatt

Showing posts with label Bernard Klatt. Show all posts

Tuesday, May 06, 2008

Klatt's Clunkers: why Bernard Klatt should be disbelieved (summary thread)

Warren Kinsella, when this whole business broke out, wrote:

(He adds details about Bernard Klatt's background here.)

Jonathan Kay, having repeated Klattt's allegations, tried to retract them. When challenged by Ezra Levant, he explained:

I took the post down when a more intelligent colleague of mine gave me some background about who Bernard Klatt is. Whatever Klatt may know about electronic sleuthing and the like, I didn't feel comfortable citing his affidavit as a source, even if all of the technical details in it are correct.Both are, simply, wrong. The reason to disbelieve Klatt's testimony is not because Klatt is or isn't (or was or wasn't) a neo-Nazi, alà Kinsella. Nor are his politics a reason to disregard his sleuthing skills, alà Kay. No, the reason to disbelieve Klatt's testimony is because it was patently wrong on so many points and his "sleuthing skills" are decidedly substandard:

Klatt's Clunkers 8: Bernard Klatt comes close

Below and to the right is a long exerpt from Bernard Klatt's testimony of Feb. 8, 2007 (Richard Warman & the CHRC v. Marc Lemire, T1073/5405 vol. 9, pp. 1636-8) .

In it, Klatt, who had been summoned to testify as a technology expert, is discussing the phenomenon that we had identified in the last post: that is, in the logs of Sept. 5, 2003, the traffic associated with 90sAREover's visit sometimes appears as 66.185.84.204 and sometimes as 66.185.84.200. Indeed, in the three minutes following his notorious racist denunciation of Senator Anne Cools, the IP changes four times.

Klatt is unable to explain the phenomenon.

There are several troubling aspects of this. First, of course, is the fact that he he's not sure what is going on: one expects better of an "expert". Second, it is troubling that the shifting IPs (which is material to the identification that he's making) is a matter that was raised not by Klatt himself, but the Chair of Tribunal. He makes no allusion to it at all in his discussion of the Cools' post in his affidavit (paragraphs 34-41, here). His answer to the chair, however, reveals that this is something that he'd noticed before: "That one is interesting" (line 21 of p. 1636). Not interesting enough, apparently, that he should actually explain it in his testimony.

Most importantly, however, is that is a bit troubling how close Klatt came to the truth. At p. 1636, lines 22-23, for example, he recognizes that 66.185.84.200 might be a web-cache, which he repeats at p. 1638, lines 3-4, as "very likely". The correct answer, as we have seen, is that both these IPs are web-caches and that the shifting from one to the other is part of Rogers' practice of load balancing. And the idea that he might suppose that 66.185.84.200 (which had a hostname of wc04.mtnk.rnc.net.cable.rogers.com) was a web-cache, but not guess that 66.185.84.204 (with hostname wc09.mtnk.rnc.net.cable.rogers.com) was also one is a bit baffling. He was so close!

One expects better than "close", however, from an expert. We want them to be right. Mistakes in expert testimony can ruin lives. In this case, the erroneous testimony has damaged the reputation of an innocent man and exposed those who have repeated Klatt's errors to financial harm.

Other posts in the Klatt's clunkers series:

Monday, May 05, 2008

Klatt's Clunkers 7: Bernard Klatt doesn't understand Rogers web caching

As we have seen, one of the key pieces of evidence in the Cools-post debate has been the IP 66.185.84.204 (which has the host name wc09.mtnk.rnc.net.cable.rogers.com). As I have shown at length in this post, the wc stands for web-cache. A web-caching proxy server keeps copies of web-pages in its storage in order to save bandwidth. This practice, now in Roger's past, is important for the present controversy for two reasons. First, Rogers proxies hid the IPs of the individual computers that they are proxying for, and it was the proxy's IP that was logged at the websites visited. Second, because the proxy is performing this function for tens of thousands of Rogers subscribers at a time, the IP by itself is of little help in tying any one of them to any specific post.

In his testimony, however, Bernard Klatt seems to have missed this important fact. Indeed, when the topic of Rogers web-caching arose, he pleaded ignorance.

Since the IP in question was a such a proxy, and in fact the single most relevant fact to the case, Klatt's admission has the effect of rendering his testimony useless.

Other posts in the Klatt's clunkers series:

Klatt's clunkers 6: Bernard Klatt on Rogers service in BC

Bernard Klatt, the technology "expert" whose bunglings we have been reviewing in this series (for other posts, see the index at the foot of this post), argued before the Canadian Human Rights Tribunal that Richard Warman was responsible for the notorious Cools posting.

Another mistake can be found in his testimony of February 7, 2007 (T1073/5405, p. 1638-9), which you can see to the right. The problem? Rogers hadn't offered cable service in BC since 2000. The chair's question seems to imply that he knows better and gave Klatt the opportunity to extract himself from an obvious error. Still, Klatt is adamant.

(And in case you might think that this was a temporary slip he repeated the error at p. 1723, lines 3-5.)

Again, this is simply wrong. By the time of Klatt's testimony, Rogers had not been in British Columbia for seven years. Shouldn't an expert know things like this?

Other posts in the Klatt's clunkers series:

Sunday, May 04, 2008

Klatt's clunkers 5: Bernard Klatt doesn't recognize RealPlayer browser

We have already seen how unsatisfactory Bernard Klatt's testimony about the Cools matter has been. One of his most serious mistakes involves the only evidence that we have about 90sAREover: the logs of his post of Sept. 5, 2003. Here is the entry in which "90sAREover" registered his username:

http://chat.freedomsite.org:8080~Freedom

Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Rogers Hi·Speed Internet; (R1 1.3))

This log entry includes both the referring IP (in red) and the user-agent string (in blue), which shows that this is in the Combined Log Format, a fact that Klatt missed.

The interpretation of the user-agent also presented Klatt with difficulties. If you surf over to www.useragentstring.com, you can see what your own user agent string is and what it means.

Internet Explorer 6.0
Mozilla	It's a Mozilla based browser
4.0	Mozilla Version
compatible	Compatibility flag Indicates that this browser is compatible with a common set of features
MSIE 6.0	Name : MSIE 6.0 Version = 6.0
Windows 98	OS-or-CPU : Windows 98
Rogers Hi-Speed Internet	Rogers Communications Internet provider. Partnered with Yahoo! to offer Rogers-Yahoo! Hi-Speed Internet.
R1 1.3	Using Real Player as a browser

If at that same site you type in 90AREover's user agent string (blue above), you'll find a table like the one to the right (I've added the blue and truncated it slightly). It gives the items of the string with an explanation for each element. As you can see, R1 1.3 refers to RealOne Player, a free media player that has a built in browser. R1 obviously abbreviates "RealOne"; 1.3 was version 2.0.

If you don't believe me, you can download your own copy from oldversion.com and visit useragentstring.com to experiment. Or you can look at the long list of user agent strings in which we find some version of the RealOne Player over at botsvsbrowsers.com.

What did Klatt make of "R1 1.3"? Below and to the right (from pp. 1634-5 of the transcripts of Warman v. Lemire) is Klatt's attempt to explain it.

It is painfully obvious that he has no clue. The tip-off: statements like "the best explanation I've been able to determine" (lines 9-10), "the best of my ability" (lines 14-15), "the best explanation" (lines 19-20) betray his lack of confidence in his own answer. You never say this about what you know; you only say this when your guessing. And his guess is a bad one -- embarrassingly bad. Instead of recognizing that this was the RealOne browser, Klatt embarks on a series of accumulated conjectures: Rogers used a 15660 Cisco router, and "R1 1.3" was a firmware release, and the update took place in few weeks between 90sAREover's visit in September and Warman's visits in November. (Or, as we know now, but Klatt seems to have missed, October.)

Clearly he has no clue. What is worse is that he does not even know where to look for the correct answer. He did some "research on the internet", but where this led him is a bit of a mystery, since there seems to be no Cisco product with the designation CXC 15660, and no Cisco firmware update with this number. (Perhaps he has the 15600 CXC in mind?)

Trying to figure out what was his exact error is in any case unlikely to be productive. The more important point is that Klatt has failed to recognize that 90sAREover was using the browser built into the RealOne Player, which invalidates paragraphs 36 and 64 of his sworn affidavit (which you can see here), and (as I have argued here) is exculpatory for Warman.

Other posts in the Klatt's clunkers series:

Saturday, May 03, 2008

Klatt's clunkers 4: Bernard Klatt mistakes the combined log format for the common log format

We have seen that Bernard Klatt is the technology "expert" regularly summoned to defend those accused under section 13. In the Zundel hearing his testimony was dismissed as tendentious and incompetent, and that there are a number of ways in which his testimony in Warman v. Lemire is substandard (see the posts in the Klatt's clunkers series list at the bottom of this paragraph). Here is one of his paragraphs from his affidavit (which can be seen in full here):

Unfortunately for Klatt, however, this is simply wrong. The Common Log Format has seven elements (see here):

The Common Log Format (CLF) is a fairly basic form of Web server logging. It tracks seven different elements of the Web transaction. Each request is written to one line, with the different elements of the request separated by spaces (items in quotes or square brackets are considered one item), and items that aren't sent are listed as a hyphen or dash (-):

The remote host: the hostname or IP address of the computer requesting the Web page.
The client user name…
Authenticated user name…
Date…
The Request…
Status…
Bytes: the number of bytes that were sent in the server's response.

Here's how the log entry might look for this Web page in Common Log Format:

10.1.1.1 - - [08/Feb/2004:05:37:49 -0800] "GET /cs/loganalysistools/a/aaloganalysis.htm HTTP/1.1" 200 2758

As you can see, no user agent data is logged under the Common Log Format. To log that, one must use the Combined Log Format (see here):

The Combined Log Format uses the common log format but adds two items to the end:

Referrer: the URL of the page that linked to the requested document.
User-agent: the name and version of the browser or other client software making the request.

Here's how the log entry might look for this Web page in Combined Log Format:

10.1.1.1 - - [08/Feb/2004:05:37:49 -0800] "GET /cs/loganalysistools/a/aaloganalysis.htm HTTP/1.1" 200 2758 "http://webdesign.about.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; YPC 3.0.2)"

Which log format was used in the freedomsite logs that Klatt consulted? Here is one entry:

Since this entry includes the referring url (blue underline), and the user agent string (red underline), it is the Combined Log Format.

Yet another of Klatt's clunkers, then. There may be those who think that this is a simple quibble. That he is unable to get the basic terms correct, however, is consistent with the concern raised in the final decision of Zundel hearing, where he was criticized for being "unable to answer elementary questions in his field". It should be noted in addition, however, that Klatt's most serious errors in the 90sAREover matter relate to logs such as this. That he can't get the basic terms right is not confidence inspiring.

(The quoted material above have been edited and reformated slightly; for less technical descriptions of log formats, see here and here; more technical, here.)

Other posts in the Klatt's clunkers series:

Friday, May 02, 2008

Klatt's clunkers 3: Bernard Klatt misreads the user agent string

We have seen that for an award-winning "expert", Bernard Klatt makes lots of mistakes. Here's another from Klatt's affidavit in Warman v. Lemire (here, p. 9), paragraph 36:

You can see for yourself, however, that Klatt got this wrong:

As you can see, the user agent string is not "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)" (as Klatt wrote in his sworn testimony), but "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Rogers Hi-Speed Internet; (R1 1.3))".

Other posts in the Klatt's clunkers series:

Klatt's clunkers 2: Bernard Klatt wrong on IE 6 date

As we have already seen, Bernard Klatt is the technology "expert" of choice of Canada's white supremacist movement, appearing most recently in Warman v. Lemire, where his testimony was substandard in several ways. But that was not his first appearance in court and found wanting. In the Zundel hearing of 2002, Klatt was criticized in the tribunal's final report for (among other things) being "unable to answer elementary questions in his field." If you've been following this blog over the last weeks, this won't come as a surprise.

Consider the transcript to the right. This is part of the cross-examination of his assertion that Richard Warman must be the racist-poster "90sAREover" because they both used Windows 98 and Internet Explorer 6.0. (As it turned out, that was itself wrong, a point to which we'll return.) Klatt wants to argue that IE 6.0 was not widely used: it was, he asserts a "relatively new release at that point" (that is, in Sept. 2003). The implication: that since "90sAREover" and "lucy" were both using it, they were more likely to be identical.

The problem? Internet Explorer 6.0 was released in August, 2001, a full two years before the posts in question. And far from being unusual or cutting-edge by 2003, it was far-and-away the most commonly used browser: 70% of all internet traffic used IE 6.0 in Sept. 2003.

This is, of course, a small mistake, and is less significant in itself than in the fact that it betrays Klatt's desire to throw everything possible at Warman. Still, we expect technology experts to get the basic facts right. And Klatt doesn't. And that's a problem.

Other posts in the Klatt's clunkers series:

Klatt's clunkers 1: Bernard Klatt given an award for tendentious testimony

We have been seeing that the testimony of Bernard Klatt in the Lemire hearing has been substandard in many ways: indeed, the entire notion that "lucy" and "90sAREover" were the same user, which can now be confidently dismissed, was based almost entirely on his error-riddled testimony.

This all makes the image to the left all the more problematic. In it Klatt is being presented with an award from lawyer Doug Christie -- the same Doug Christie who is famous for having defended holocaust deniers Jim Keegstra and Ernst Zundel. The "Orwell Award" (named apparently without much of a sense of irony) was given to Klatt for his "expert" testimony in several human rights cases, including the Lemire hearing. In all of them Klatt appeared for the defense.

Thankfully, the award has not been noticed by any mainstream venues. The places that it's appeared, however, are themselves noteworthy, being the usual suspects when it comes to hate-propaganda.

Freedomsite.org (which is Lemire's site);
Stormfront;
David Duke.

That Klatt should be recognized for his testimony is a bit rich. His testimony at the Zundel case (where he argued that webpages should not be included among communications made "telephonically") was criticized in the final decision as under-informed and tendentious:

[103] … The evidence of Mr. Bernard Klatt was of very limited assistance to us. Mr. Klatt demonstrated an extremely shallow foundation of knowledge in his area of expertise during the course of his testimony. A series of dictionary definitions were put to him, many of which he acknowledged he had not seen before his preparation for this hearing. From the Tribunal's perspective, he seemed unable to provide much information independent of the written materials placed before him by Mr. Christie.

[104] During cross-examination, Mr. Klatt was frequently argumentative, evasive and unable to answer elementary questions in his field. Most troubling to the Tribunal was the extent to which this witness responded as an advocate for the Respondent and not as an objective, independent expert. Mr. Klatt's responses are replete with references to what "we are arguing", and similar allusions to his shared common cause with the Respondent.

Some of these problems appeared again during Klatt's testimony at the Lemire hearing, as we'll see in coming posts.

Other posts in the Klatt's clunkers series:

Sunday, April 13, 2008

What does "R1 1.3" mean in a user agent?

In the last post (here), we saw that Bernard Klatt, Lemire's expert witness in his ongoing CHRC hearing, revealed 90sAREover's user agent data to be this:

"Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Rogers Hi-Speed Internet; (R1 1.3))"Now, Klatt successfully identified the browser (Internet Explorer version 6.0) and Operating System (Windows 98). He was less successful in explaining the latter two items "Rogers Hi-Speed Internet; (R1 1.3))".

Apparently he didn't know User Agent String, a handy-dandy site that takes any user-agent and breaks it up into nice understandable parts. Entering our string yields the following table

Internet Explorer 6.0
Mozilla	It's a Mozilla based browser
4.0	Mozilla Version
compatible	Compatibility flag Indicates that this browser is compatible with a common set of features
MSIE 6.0	Name : MSIE 6.0 Version = 6.0
Windows 98	OS-or-CPU : Windows 98
Rogers Hi-Speed Internet	Rogers Communications Internet provider. Partnered with Yahoo! to offer Rogers-Yahoo! Hi-Speed Internet.
R1 1.3	Using Real Player as a browser
All Internet Explorer user agent strings

Now, especially to be noted is how wide of the mark is Klatt's explanation of R1 1.3. His explanation (p. 1634):

This is clearly wrong, as the useragent.com search shows. "R1 1.3" does not refer to Cisco firmware, but to the fact that the user of this computer had a Real Player installed.

The "Rogers Hi-Speed Internet" is less clear. Not all Rogers' users have it. In the thirty visits from a dozen or so users of 66.185.84.204 here, only a couple have it. (To judge from this, the Rogers-tag here means that the version of Explorer being used was one supplied by Rogers, not a generic version.)

More shortly.

Update. Commenter "freemarkets" points out that the Real Player only shows up in the string if it is being used, not installed.

Clarifications to Rogers Hi-Speed made; quote from Klatt on R113 added.

Klatt on 90sAREover's user agent

Here are pages 1633-5 of Richard Warman and the Canadian Human Rights Tribunal v. Marc Lemire (T1073/5405 vol. 9) of Feb. 8, 2007. In it, Lemire's expert witness, Bernard Klatt, is testifying about the logs of Lemire's site, and trying to make the case that "90sAREover" was identical to "lucy" (a username of Richard Warman).

In the following passage, Klatt describes a few of the log-entries. He has already pointed out that "90sAREover" and "lucy" share the same IP: 66.185.84.204, but as we've seen elsewhere, this does not prove they were identical: that IP is a proxy shared by hundreds of thousands of Rogers' customers. Below Klatt describes other facts found in the entry:

p. 1633

p. 1634

p. 1635

Now, to judge from Klatt's remarks here, the log entry, which will have ended with user-agent data, must have looked something like this:

"Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Rogers Hi-Speed Internet; (R1 1.3))"This is something that we have paralleled in weblogs elsewhere. This exact same configuration can be found in this log of June 4, 2004, of the Engineering School at the University of Illinois. The date of that log rather spoils Klatt's theory that this is a firmware update from Cisco. There is a better explanation that we'll return to in the next post.

Update As you can see from the actual logs (which can be perused in my post on the Klatt affidavit in Warman v. Lemire), the conclusion reached above is correct and 90sAREover's user agent string was follows: "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Rogers Hi-Speed Internet; (R1 1.3))". Since this is different from the set-up used by Warman in October and November, the posts were made from different computers.

Bouquets of Gray

Tuesday, May 06, 2008

Klatt's Clunkers: why Bernard Klatt should be disbelieved (summary thread)

Klatt's Clunkers 8: Bernard Klatt comes close

Monday, May 05, 2008

Klatt's Clunkers 7: Bernard Klatt doesn't understand Rogers web caching

Klatt's clunkers 6: Bernard Klatt on Rogers service in BC

Sunday, May 04, 2008

Klatt's clunkers 5: Bernard Klatt doesn't recognize RealPlayer browser

Saturday, May 03, 2008

Klatt's clunkers 4: Bernard Klatt mistakes the combined log format for the common log format

Friday, May 02, 2008

Klatt's clunkers 3: Bernard Klatt misreads the user agent string

Klatt's clunkers 2: Bernard Klatt wrong on IE 6 date

Klatt's clunkers 1: Bernard Klatt given an award for tendentious testimony

Sunday, April 13, 2008

What does "R1 1.3" mean in a user agent?

Klatt on 90sAREover's user agent

Noteworthy posts

Worth Reading

Blog Archive