TEST IT YOURSELF, THE 2-SECOND-ROUNDING FACT PATTERN IN THE DNC EMAILS By William Binney and Larry Johnson

Larry Johnson

Bill Binney

Bill and I published a piece a few weeks back that provides actual evidence that challenges the claim that “Russia hacked the DNC.” Yes, we know, the Mueller Report continues to insist that theft of emails from the DNC was done over the internet. But that conclusion rests on the opinion of third parties who offer no actual forensic evidence. We, by contrast, are offering up actual evidence that points to an alternative explanation. We do not asky you to take our word for it. Instead, we want to show you how you can test the data yourself ..

First, let’s review our key findings from the original piece:

An examination of the Wikileaks DNC files shows they were created on 23 and 25 May and 26 August respectively. The fact that they appear in a FAT system format indicates the data was transfered to a storage device, such as a thumb drive.

How do we know? The truth lies in the “last modified” time stamps on the Wikileaks files.  Every single one of these time stamps end in even numbers.  If you are not familiar with the FAT file system, you need to understand that when a date is stored under this system the data rounds the time to the nearest even numbered second.

We have examined 500 DNC email files stored on Wikileaks and all 500 files end in an even number—2, 4, 6, 8 or 0. If a system other than FAT had been used, there would have been an equal probability of the time stamp ending with an odd number. But that is not the case with the data stored on the Wikileaks site. All end with an even number.

(For an overview of FAT please see this link–http://www.ntfs.com/fat-systems.htm)

Here’s what you need to do to replicate what we found.:

Step One—Go to the Wikileaks DNC email database. Click here: https://wikileaks.org/dnc-emails/)

Step Two—Search the DNC database using the any word. We opted for “Clinton.”

This will produce the following results (see link https://wikileaks.org/dnc-emails/?q=Clinton&mfrom=&mto=&title=&notitle=&date_from=&date_to=&nofrom=&noto=&count=50&sort=0#searchresult)

The first message in terms of “relevance” is number 100 (i.e., DOC ID 100)

Step Three—Go to the websniffer site and direct it to “get/100”. https://websniffer.cc/?url=https://wikileaks.org/dnc-emails//get/100… This is computer speak telling the program to find message 100 (which is titled POLITICO’s 2016 Blast: Bernie’s DNC concessions — Hillary Clinton’s fall preparations — Trump and Clinton get personal again — 5 Things You Need To Know.”)

Step Four–Click on submit. That will take you to the following document:

Step Five–scroll down to the “HTTP response headers” section where you will find the “Last-Modified” timestamp.

Message 100 shows a Last Modified Timestamp of 05:22:00 GMT.

That time equates to 01:22:00 Eastern Daylight Time.

It ends in 0, an even number. Our search and analysis of all the messages from the DNCin the first Wikileaks release published July 22, 2016″ show that all end in an even number.

If you wish, you can search each of the 500 messages from the DNC that we have examined for yourself. You should get the same result. Just go to https://websniffer.cc/?url=https://wikileaks.org/dnc-emails//get/105(or any other message number you wish).

We repeat our conclusion from the original article:

The random probability that FAT was not used is 1 chance in 2 to the 500th power or approximately 1 chance in 10 to the 150th power – in other words, an infinitely high order.

This data alone does not prove that the emails were copied at the DNC headquarters. But it does show that the data/emails posted by Wikileaks did go through a storage device on the 25^thof May, like a thumbdrive, before Wikileaks posted the emails on the World Wide Web.

We do not know if a person or persons with access to the DNC server accessed the emails from their home. That is possible. What is certain, however, is that email message 100 demonstrates forensic evidence that indicates the email was physically copied onto a storage device, like a thumb drive or CD-Rom, with a last modified date of 05:22:00 GMT on Wednesday the 25^thof May 2016, before it was published on the Wikileaks site. The fact that these messages are in FAT format is not evidence that supports Mueller’s claim a “hack.”

Perhaps Mueller’s team of investigators turned up forensic data that proves a Russian hack. There was no such evidence, however, presented in June and July of 2016 when the initial claim was made blaming Russian intelligence operatives.

We also are confident that there was no solid forensic evidence available in January 2017 to substantiate the Intelligence Community Assessment attributing the “hack” to the Russian Government because NSA analysts only agreed that they had “moderate confidence” in that claim. We know from our prior experience in producting such assessments that if there existed actual forensic evidence, such as tracing the packets back to a server operated by the Russian Government then there would be “strong confidence” in the conclusion.

Who was the person or persons who had access to the DNC server that were copying these messages to a storage device, like a thumb drive, early in the morning on Wednesday the 25^thof May? We have an opinion, but our focus is not on speculation. Let us first deal with the hard forensic evidence. We are certain of one thing—the available evidence does not support the claim that the DNC emails were “hacked” via an internet cyber attack.