Hack, Now Ex-Bellingcat, Gets Climategate Timezones Backwards

Bellingcat’s Iggy Ostanin, [update: who Eliot Higgins says is now ex-Bellingcat]  recently claimed to have discovered that the nomenclature of Climategate-1 emails was based on Unix timestamps and that the nomenclature proved that Russians hacked CRU from timezone +05:00. Amidst much uninformed hyperventilating. Ostanin’s assertions were swiftly retweeted by Andy Revkin, Roger Harrabin, Ken Rice and many others. However, his claims are backwards – or perhaps, in true Mannian style, upside down.

The connection of CG email nomenclature to Unix timestamps was observed as early as Dec 7, 2009 (see WUWT commenter crosspatch here)m who similarly noticed discrepancies between nomenclature and email times, but concluded that they showed that hacker used a computer set to Eastern North American time (-05:00 Standard).

I pointed the error out on Twitter with technical analysis. I also linked Ostanin to the original WUWT comment making similar point.

Ostanin  responded by claiming that my (correct) replication of CG1 nomenclature was “needlessly complicated” and doubled down with his incorrect assertion that “time seen in hacked email headers is 5 hours behind – to the second – of the time in the decoded email file names”:

Ostanin challenged everyone “to try to see for themselves” – pointing to a internet utility:

After I re-iterated my technical criticism, Iggy stated that he wasn’t “sure if either of [me or Charles Wood] ever came across a Kremlin narrative they didn’t endorse”. Then, in true Mannian (and Eliot Higgins) style, Ostanin blocked me on Twitter.

While it’s a bit absurd to waste time on this trivia, Iggy’s falsehoods remain in circulation. He hasn’t conceded anything. Nor have Revkin, Harrabin, Rice or other re-tweeters conceded that Iggy’s analysis was nonsensical.

In my tweets, I observed that Iggy’s analysis was based on an email sent from GMT timezone and that the 5-hour difference between nomenclature and email time only held for emails from that time zone.  What any competent analyst (and we may safely exclude Iggy from that category) would have done is to compare email timestamp to nomenclature across multiple timezones and Daylight/Standard times. I’ve done so in the table below.

Nomenclature for GMT timezone emails in winter are 5 hours ahead, but only 4 hours ahead in summer. This should have caused Iggy to pause.  Nomenclature for emails sent from Eastern timezone exactly matched the email time – both in Standard (winter) and Daylight (summer) time. Nomenclature for emails sent from Mountain time (two hours behind Eastern) were – 2 hours in both winter and summer.

Ironically, the very first email in the Climategate dossier was sent from Iggy’s Ekaterinaburg (+05:00).  But instead of the nomenclature exactly matching the email time, the nomenclature was 10 hours ahead.

In other words, Ostanin got everything pretty much backwards and upside down. It’s about as bad a bit of analysis as it is possible to imagine. And, instead of simply conceding that he’d made a mistake (which is easy enough to do), Ostanin got belligerent and shut his ears. Unfortunately, Ostanin’s falsehoods are now in circulation and, like Mann’s, will probably fester forever.



  1. MikeN
    Posted Jul 4, 2019 at 11:58 AM | Permalink

    Michael Mann retweeted this analysis by Ostanin. Of course, he had already blamed the Russians in one of his books.

    • Rich G
      Posted Aug 25, 2019 at 8:35 AM | Permalink

      Just like the ‘hack’ of the DNC server, where despite the plain evidence that the data was transferred at LAN speeds, implying an inside threat, the hack was attributed to ‘Russia’.

      It is just a coincidence that a DNC staffer, identified by Wikileaks as a source, was murdered days later. DC police, despite the fact that nothing was stolen, ruled it a ‘robbery gone bad’.

      • Rich G
        Posted Aug 25, 2019 at 8:40 AM | Permalink

        Oh, and the DNC refused to let the FBI access the hacked server. The FBI accepted the DNC explanation of a ‘’Russian” hack. The head FBI investigator ? Peter Strok.

  2. Bravius
    Posted Jul 4, 2019 at 2:37 PM | Permalink

    When I received notification of this post in my web-based gmail and clicked on the link, I got this popup message:

    Suspicious link

    This link leads to an untrusted site. Are you sure you want to proceed to climateaudit.org?

    It appears Google has decided that your site is suspicious and untrustworthy.

    No explanatory link to why or how Google determined this.

    Me thinks the Google monster is up to its usual suppression tricks.

    • Duker
      Posted Jul 20, 2019 at 3:19 AM | Permalink

      It can be a whole lot of things why Google does it
      But they do have one at #7

      “Here’s a simple question to ask yourself: Is what you’re doing providing false information to your audience?”

      You can see that ‘the team’ would be all over that one with their anonymous claims

  3. None
    Posted Jul 4, 2019 at 5:57 PM | Permalink

    Stephens commentary can be trivially confirmed by the following shell commands (lines preceded by $):
    File 1123622471.txt
    Date from email content is: Tue Aug 9 17:21:11 2005
    Sent from the UK.
    $ TZ=’GMT’ date –date=’Tue Aug 9 17:21:11 2005′ +%s
    # ==> 1123608071 is the “real” seconds since epoch of sending.
    $ TZ=’America/New_York’ date –date=’Tue Aug 9 17:21:11 2005′ +%s
    # ==> 1123622471 matching exactly the file name.

    Climate alarmists barking up the wrong tree. Yet again. Of course, this “will not matter”.

    • None
      Posted Jul 4, 2019 at 6:05 PM | Permalink

      WordPress converted all my single quotes to backticks. In order to run the commands you’d need to replace them again with single quotes.

  4. Duke C.
    Posted Jul 4, 2019 at 9:56 PM | Permalink

    Minor correction- the very first email was sent from Ed Cook to Keith Briffa on 3/5/1996


    Steve: the very first email with timestamp nomenclature (CG1). There’s probably a CG3 email earlier than 3/5/1996.

  5. Posted Jul 5, 2019 at 9:18 AM | Permalink

    Ken Rice backtracks on Twitter without h/t?:

    Ken Rice

    2h2 hours ago
    More Ken Rice Retweeted Ken Rice
    I have to admit that it does seem as though the argument in this article about timestamps is the wrong way around. It does seem more likely that the epochgenerator regarded the email timestamps as being at GMT – 5, rather than the local computer being at GMT + 5.

  6. John Archer
    Posted Jul 5, 2019 at 9:58 AM | Permalink

    Ostanin is an anagram of onanist.

    Seems reasonable. 🙂

  7. Posted Jul 5, 2019 at 1:34 PM | Permalink

    Ken Rice was the one name on that list of retweeters that surprised me, because he’s pretty smart. I didn’t think he would be so easily misled.

    • Adam Gallon
      Posted Jul 6, 2019 at 2:20 AM | Permalink

      Maybe because he wanted it to be true?

      • kim
        Posted Jul 6, 2019 at 5:19 PM | Permalink

        And Then There’s Phacts.

      • Posted Jul 7, 2019 at 8:01 AM | Permalink

        Indeed, “because he wanted it to be true” is the reason for many errors, by many people. As Feynman said, “The first principle is that you must not fool yourself — and you are the easiest person to fool.”

        One of the ways that bias creeps into scientific experiments and measurements is that scientists tend to scrutinize results which conflict with their expectations much more closely than they scrutinize results which support their expectations. It’s not even dishonest, it’s just human nature, but it still distorts the results. It’s hard to avoid, and it’s why medical studies are “blinded,” and even double-blinded.

        Too often, errors which bias the results the “wrong way” get found and corrected, but errors which bias the results the “right way” (i.e., in the way that the researchers are looking for) don’t. It’s bad science — usually done by people who don’t INTEND to do bad science — but bad science, nevertheless.

        That’s why there’s a running joke in the Climate Biz, that “it’s ALWAYS Worse Than We Thought.”™

        Of course, in the real world, it’s not always worse than we thought. It’s often BETTER than we thought. But the Climate Biz is run by alarmists, and they predictably doubt or ignore good news, and tout bad news.

  8. Posted Jul 5, 2019 at 10:15 PM | Permalink

    If it was the Russians we know now they would’ve changed the document’s author name to Felix Dzerzhinsky and changed the font back and forth from English to Cyrillic.

  9. michakobs
    Posted Jul 6, 2019 at 5:46 PM | Permalink

    Check out the spec at https://docs.python.org/3.4/library/email.util.html
    The “-0000” isn’t a timezone at all. “-0000” is printed in the email when no valid timezone is available (mostly due to a conflict between computer time settings and email account timezone setting. Hence, that email might be sent from a laptop on a trip to any other timezone.

    email.utils.format_datetime(dt, usegmt=False)

    “Like formatdate, but the input is a datetime instance. If it is a naive datetime, it is assumed to be “UTC with no information about the source timezone”, and the conventional -0000 is used for the timezone.”

    Steve: many of the emails actually originate in GMT and not by assumption. I’m not including any GMT examples that are not from GMT

  10. ianl
    Posted Jul 7, 2019 at 4:59 PM | Permalink

    It wasn’t the Russkis, but the eagerness of Harrabin et al to agree with Ostanin on blame Russian hacking reveals the extent of the damage Climategate really did to their credibility.

    If a conspiratorial plot can be conjured up to explain the appearance of the Climategate emails, then their potency is reduced – by magic.

    I have long ago despaired at the dishonesty and hypocrisy without bottom. There really is no end to it.

    • Adam Gallon
      Posted Jul 8, 2019 at 3:02 AM | Permalink

      I’d say Climategate did little to their credibility.
      We’ve the same cast of characters (less the retired & deceased), pushing the same claims & using the same flawed proxies.

      • kim
        Posted Jul 8, 2019 at 5:14 PM | Permalink

        The play of defamy on the way of infamy.
        Day after day after day after may.

  11. R.S. Brown
    Posted Jul 10, 2019 at 7:01 AM | Permalink

    …and now the BBC claims the “sceptics” tricked the public with Climategate:


  12. 2anhedonic
    Posted Jul 11, 2019 at 2:51 PM | Permalink

    I commented on his Medium.com article and guess what:

    This user had blocked you from following them or viewing their stories.”

    What a great “news” source that it lets “authors” block you from reading what they write publicly. Pathetic garbage-level human being right there

  13. paul courtney
    Posted Jul 11, 2019 at 3:06 PM | Permalink

    To our host: Thanks for this reminder of how CliSci works. When error is identified, ignore the error and attack the messenger!
    And I thought smearing somebody as a russophile was a new thing.

  14. Posted Jul 16, 2019 at 7:38 AM | Permalink

    I can’t understand how people can be so blatantly wrong and seemingly fail to recognize it. Everything in their perception has to be twisted into some kind of mobius truth so that the ends can match up. Schmidt was out there recently claiming that climategate was simply emails taken out of order. Somehow people seem to find ways to cram that bit of wrinkled logic into their reality. It’s like a psychological defense mechanism gone wrong.

    • Michael Jankowski
      Posted Jul 17, 2019 at 7:44 PM | Permalink

      Yes Jeff, they seem to ironically be in “denial.”

  15. Michael Jankowski
    Posted Jul 17, 2019 at 7:42 PM | Permalink

    So Steve, can you please confirm that you have come across at least one Kremlin narrative that you didn’t endorse? Lol

  16. Richard Case
    Posted Jul 22, 2019 at 12:21 PM | Permalink

    Iggy even still has this story as his pinned tweet. What a maroon.

    • Michael Jankowski
      Posted Aug 12, 2019 at 5:25 PM | Permalink

      Still pinned. Amazing.

      Is he that ignorant, or does he just realize that there is a herd of dolts who will take his side regardless?

  17. Posted Jul 23, 2019 at 10:15 AM | Permalink

    Steve, in a recent twitter post (No. 19) regardingg potential conflicts of interest and Comey’s role in FISA matters, you stated: “given Comey’s acquiescence, if not complicity, in FISA abuse by Obama administration… ”

    I believe his complicity is clear. He signed off on two FISA warrants against Carter Page when the allegations were 100% wrong. He would potentially have a small sliver of an excuse for the first one, but there are no excuses for the second one filed after 90 days of spying based on the first warrant. Any minimal investigative effort would have shown that Page was 100% innocent.

    Since I don’t use twitter, I responded here. If you think that is inappropriate, you can delete my post with no problems on my end.


    • kim
      Posted Jul 24, 2019 at 3:42 PM | Permalink

      Who is Joseph Mifsud?

      Mueller? Mueller? Mueller?

  18. Michael H Anderson
    Posted Jul 31, 2019 at 4:56 PM | Permalink

    To my regret I haven’t visited here in a long time, so this comes as quite a surprise. My dear God in heaven, who on earth CARES who released the emails? Why is this still being discussed at all? I remember very well that when the whole thing blew up some dunderheaded Democrat senator said that “the real crime here is the release of the emails; the perpetrator must be found and prosecuted.” Words to that effect anyway; she might as well have had “you’re a bunch of gullible idiots and I’m going to treat you that way” tattooed right on her forehead.

    I was appalled at the childish attempt at obfuscation then and still am. Slimy, despicable, lowbrow and in the final analysis stupidly pointless misdirection. Shame!

  19. Luke
    Posted Oct 9, 2019 at 5:05 AM | Permalink

    Ostanin challenged everyone “to try to see for themselves” – pointing to a internet utility:

    even Ostanin’s language indicates deception. “to try” = to attempt without success.

5 Trackbacks

  1. […] https://climateaudit.org/2019/07/04/bellingcat-hack-gets-climategate-timezones-backwards/ […]

  2. […] Hack, Now Ex-Bellingcat, Gets Climategate Timezones Backwards […]

  3. […] Hack, Now Ex-Bellingcat, Gets Climategate Timezones Backwards […]

  4. […] https://climateaudit.org/2019/07/04/bellingcat-hack-gets-climategate-timezones-backwards/ […]

  5. […] recently saw this comment over at Climate […]

%d bloggers like this: