Climate Audit

Two major new BBC programs, The Trick and the Hack That Changed The World, re-visit 2009 Climategate events on the eve of UK hosting the most recent international climate get-together. I was interviewed by The Hack and mentioned in The Trick as a villain.

In today’s article, I’m going to propose a theory of the Climategate hack that is very different from the grandiose conspiracy of Russian intel services and US fossil fuel corporations that is the prevalent fantasy of the climate “community” and chattering classes. Subsequent to my interview with the Hack That Changed, I’ve re-examined and cross-checked documents and noticed some interesting new connections. I don’t know the identity of the Climategate hacker, but do believe that deductions about his profile (e.g. motivated individual vs paid institutional hacker) can be made more intelligently by carefully examining details of what was exfiltrated and when – as I shall do here.

What We “Know”

Unbleached Document Datestamps

Although the exfiltration dates of the emails had been uniformly bleached to an uninformative datestamp, early on, “frank swifthack” noticed that exfiltration access-datetimes hadn’t been bleached for the majority of the several thousand documents that had also been exfiltrated. This observation attracted relatively little commentary at the time, but was something that I paid attention to.

A timeline of unbleached exfiltration dates is shown below. The “rug” at the base of the timeline shows dates on which any unbleached exfiltration is attested, while the log-scale shows the number of documents exfiltrated.

In late September and first week of October, several thousand tree ring datasets within a few directories were exfiltrated, with the largest number (2279) coming from the directory briffa-treering-external. Much of this data pertained to Briffa’s Yamal tree ring chronology, new information on which had become available in mid-September. Together with related information from Avam-Taimyr, another northern site, it was the topic of several well-publicized Climate Audit articles in late September and early October, especially the September 27, 2009 post entitled Yamal – A Divergence Problem. (Prior to Climategate, the resulting controversy led to a program on the issue on Finnish TV and an editorial in WSJ – Europe.)

The first exfiltration of Yamal tree ring data by Mr FOIA took place on Sep 27, 2009 at 19:58Z, only a few hours after publication of the Yamal – A Divergence Problem article at Climate Audit. The climate community and counterintelligence were so fixated on a “big” institutional hack related to Copenhagen that they paid no attention to this synchronism, but it spoke volumes to me. Mr FOIA was very up-to-date on Climate Audit issues. The idea that Putin or the president of Exxon were paying rapt attention to esoteric Climate Audit controversy on proxy reconstructions had always seemed risible to me, but the particular notion that they would commission the exfiltration of tree ring measurement data as a tool in a Dr Evil machination to derail Copenhagen was beyond risible. On the other hand, the exfiltration of tree ring data that had been withheld by CRU would be the sort of thing that would occur to a partisan in the Climate Audit-CRU disputes.

The other large exfiltration of documents (with unbleached timestamps) was the exfiltration of the mbh98-osborn.zip file on November 16, 2009, which proved to be the cut-off date of the hack. By coincidence or not. This zipfile connected to the longest standing Climate Audit controversy – our critique of the Mann et al 1998 Hockey Stick. My serious analysis of proxy reconstructions began on April 8, 2003 when I asked Mann for the FTP location of the MBH98 data. (The contemporary events on April 8, 2003 are relevant to a complete narrative, but outside the scope of his article.) Mann replied promptly, saying that he’d “forgotten” the location of the data, but his associate Scott Rutherford would locate it for me. Thus begins a long narrative that I’ve discussed on various occasions, but, for present purposes, the key point is that the mbh98-osborn.zip data exfiltrated on last day of Climategate hack was the very data that Mann had refused to provide me in 2003 (but which he had provided to Osborn with a covering note that it was his “dirty laundry” and, under no circumstances, to be provided to the “wrong” sort of person.

The (relatively small number of) documents exfiltrated between October 8 and 12 (many of which are distinctive peer reviews by Jones of articles by Jones’ close associates) pertain to Phil Jones, whereas documents prior to October 3 either pertain to Briffa or are unassignable.

The chronology indicated by unbleached document dates is consistent with 2012 closure statements by UK police, which placed the exfiltration between September 2009 and November 2009 [Operation Cabin Background Information, July 18, 2012; Operation Cabin Q&A, July 18, 2012].

The November 19, 2009 Sys Admin Report

In December 2017 (eight years after the incident), Mother Jones link, through an FOI to the University of East Anglia, obtained a redacted copy of a November 19, 2009 situation report by system administrator [Mike Salmon] together with a covering email by his supervisor [Jonathan Colam-French] link . […] denotes my interpretation of redactions. At the time of the report and email, Salmon and Colam-French had been informed by [Gavin Schmidt of Real Climate] that the Climategate zipfile had been loaded onto the Real Climate blog but had been quarantined by Schmidt, but were not yet in possession of the zipfile itself. Nor at the time of Colam-French’s email was there any public awareness of the hack: that would happen in about 1-2 hours.

Nonetheless, the report and covering email shed light that is otherwise unavailable. Of particular interest were excerpts from computer logs that Salmon associated with activity of Mr FOIA as shown below, together with Salmon’s commentary on the logs:

Salmon interpreted the first entries on October 5 as attempts to log into the backup server (BackupPC) with several different usernames. Salmon said that the first username attempt was backuppc, which wasn’t recognized and thus failed. The second username attempt (a 5-character username) similarly failed. Salmon commented that this user’s “PC is not on the Backup Service so they would not have found any information. The third attempt used [Salmon’s] 4-character username – possibly root – which was recognized, but failed on this occasion due to password mismatch.

Although this first sign-in from Salmon’s username appears to have been unsuccessful, Salmon and Colam-French reported that Mr FOIA’s subsequent access to BackupPC was obtained by cracking Salmon’s password (see below).

Two hours later (3:25 AM BST), Mr FOIA requested backup #390 for the account angara.cru.uea.uk (see log above.) Redactions to Salmon’s explanation of this instruction obscure its meaning, but much light is shed on events by the most plausible infills. Both in context and character counts, the subject PC is Keith Briffa’s, who is (now) known to have had a serious operation in July 2009 and to have been away sick during the hack and not to have been using his desktop computer. Salmon (and remember that this was November 19 and he had still not seen the emails) wondered whether the emails might all be earlier than July 27, 2009 and thus linked to Briffa’s backup. (This, of course, proved not to be the case.)

Also, keep in mind that Mr FOIA had already exfiltrated several thousand tree ring data files from Briffa’s computer between September 27 and October 3 – prior to the initiatives attested in the October 5 logs. Also, the IP address 139.222.104.250, used in these log-in attempts, was local to the university. The most obvious interpretation of these events is that Mr FOIA had obtained access to Briffa’s account on or before mid-September, that his access as of the very early morning of October 5 was limited to Briffa’s account and that, on October 5, Mr FOIA was attempting to expand his access via the BackupPC.

Colam-French’s email noted that the most likely way in which Mr FOIA obtained access to the BackupPC was by cracking Salmon’s administrator password, which could be compromised relatively easily through a known vulnerability in the university’s password setup, in which encrypted versions of user passwords appear to have been relatively unprotected (other than encryption). Colam-French (and Salmon) hypothesized that Mr FOIA (who by October 5 had guessed a username recognized by the backup server) then located encrypted versions of the passwords and used commonplace cracking programs to obtain Salmon’s password:

At the time, cracking of NIS passwords was a well-known vulnerability of networks, such as that operated by the University of East Anglia. It appears that the cracking program John the Ripper or some similar open source program could have cracked the password in several hours or at most a couple of days.

Mother Jones

In their December 2017 article, Mother Jones asked British cybersecurity expert Steve Lord to review the university memo. Lord reported that the methods showed “no real sophistication” and that, once Mr FOIA was in, “this is not rocket science”:

Steve Lord, a British cybersecurity expert who reviewed the university memo on the incident, told Mother Jones that the methods used to steal the climate emails, at least according to materials provided by the university, showed “no real sophistication.”

“It’s not a particularly complicated setup,” said Lord. “It’s not clear how they got in, but once they’re in, from the information we do have, this is not rocket science.” (You can read the university memo below.)

“Once They’re In”

Undiscussed in the Mother Jones article is “how they got in”. There is convincing circumstantial evidence that this wasn’t “rocket science” either.

In late July 2009, in the immediate wake of the “Mole” incident, Phil Jones began deleting documents from CRU’s FTP site, while Climate Audit readers were busy trawling through CRU’s FTP site as the documents disappeared from view. On July 31, Jones reported to university administrators that “people were crawling all over our ftp site” and that Jones was therefore “deleting more stuff from our ftp site” in order to stop people “making up more conspiracy theories”… about CRU deleting stuff from their ftp site,

The previous day, a Climate Audit reader had reported to UEA administration that their setup permitted ftp access to folders that, in a “customary directory layout”, “would contain private data”:

Instead of paying attention to this sensible advice, Salmon and Jones decided that this was “someone at CA [Climate Audit] trying to push us into commenting”.

One more contemporary circumstance: Salmon’s sys admin memo reported that new passwords were issued “in July” for “everyone” at CRU. This presumably was in response to the July 2009 spat between Climate Audit and CRU. The new passwords were eight characters:

I recall a CA reader telling me long ago that, in one such publicly accessible location, the user’s CRU password was sitting in plain view. It seemed odd at the time, but possibly made a bit more sense if new passwords had just been issued. I didn’t pay attention to the story at the time as I was preoccupied with the issues involving email content. However, a few days ago, I asked whether he recalled the incident and whose password was exposed to the public. He did and confirmed that he had absolutely seen a CRU employee’s password exposed in a public area.

Needless to say, the exposed password was to the Keith Briffa account where Mr FOIA got his foothold. At the time, Briffa was sick. (He died a few years ago, far too young.)

Conclusion

The Climategate hack did not involve malware: no X-Agent, X-Tunnel, Fancy Bear or Cosy Bear. Nor did it involve spearphishing emails or any of the paraphernalia that usually define “hacking”.

The first avatar of Mr FOIA in the CRU network was almost certainly via password access to Keith Briffa’s online account (through proxy servers). I’ve received a first-hand statement that Briffa’s password was exposed and available to the public in the period immediately prior to the “hack”. Signing on to Briffa’s account with this password via a proxy server did not require CIA or KGB level skills. Once in, according to the Mother Jones cybersecurity expert, the rest was “not rocket science”. The encrypted passwords were more or less in plain view and decryption of the sys admin password could be accomplished in a few hours or couple of days using open source software.

Nothing in the hacking technique or timeline points to Russian intel services or US fossil fuel corporations. I don’t know the identity of the Climategate hacker nor do I even have a guess. What we do know is what we knew more or less since the beginning: that Mr FOIA was a reader of Climate Audit, Watts Up, Real Climate and other climate blogs; that he was careful both in his use of proxy servers; and, that, unlike Guccifer 2, he had no interest in leaving a massive social media trail.