Another Apology for Richard Warman

Over at Free Dominion -- which puts the 'dumb' back in Dominion -- there's another apology for Richard Warman. More to come in due course, I'd guess.

h/t

Richard Warman's new site

Richard Warman, who has been the subject of several series of posts, has a new website.

Jay Currie, Richard Warman's computers, and the Cools post

As many readers know, a nasty racist screed was made about Anne Cools in September 2003 on Marc Lemire's Freedomsite. During a hearing before the CHRT, Bernard Klatt argued that the author of that post was probably Richard Warman, who denied it under oath. The allegation that was subsequently repeated by a number of other bloggers whom Warman sued. The matter is now slowly working its way through the courts.

I have discussed the evidence extensively on this blog and came to the conclusion that:

1. there is no evidence that Warman is the author of the Cools post, 
2. Warman's computer could not be the source of the Cools post, 
3. Bernard Klatt's testimony before the CHRT was seriously deficient.

A recent news article discussing the case (here) was noticed by long-time blogger (and talented photographer) Jay Currie (here). Someone cited several of my postings on the subject, to which Jay responded (here):

I am aware of Buckets work, Harry, as you will see from the comments on those articles – however this was not “an investigation” nor were these “findings”. And, probably most to the point, virtually all of buckets work relies on the assumption that Lucy only had one computer. Now, he has entered a computer in evidence – though he won’t let the defence actually look at it – and it is a laptop computer. What are the chances that a super, duper, whooper secret internet hate buster like Lucy would only have one computer? And his wife? Perhaps she has a computer? And perhaps he has a computer from the CHRC or DOD. buckets is interesting but not at all depositive.

I am, of course, happy to learn that Jay finds me interesting. In saying that my work assumes that Warman had only one computer, however, he rather misses the point, since the one-computer thesis is not mine, but Klatt's.

If we ignore trivialities like the fact that Warman had a yahoo email and the Cools' poster had one from hotmail, Klatt's argument is twofold (see Klatt's affidavit, §§ 22-41):

1. that Warman's visits the site in October and November were made through the Rogers IP 66.185.84.204, the same IP as the Cools poster had used (see esp. §35)
2. that Warman's computer and computer of the Cools poster were configured identically and were therefore the same computer (see esp. § 36)

I have demonstrated that neither point helps identify the Cools poster:

1. Rogers set up 66.185.84.204 to act as a web-caching proxy, which means that it channelled the traffic of any of Rogers 800,000 subscribers or anyone who had access to their computers
2. The computer that Warman used to visit the site three times was different from the Cools poster's in several key respects, and Klatt misunderstood the logs he was using

Now Jay proposes a second computer. Does this help? Not really. Klatt's argument is that the IP was the same and the computer was the same. If the computer was not the same, all that's left is the IP, which was shared with millions.


(Comments welcome.)

An open letter to Senator Anne Cools about 90sAREover and the Richard Warman allegation

Dear Senator Cools,

There has been some buzz in recent days about the testimony of Professor Robert Martin of the University of Western Ontario regarding Human Rights Commissions, which (if you haven't heard it already) can be heard here (loading can be slow, so be patient).

Professor Martin, who spoke in his testimony of his high regard for you and noted that he regarded you as a dear friend, seems to have been especially exercised by allegations that Richard Warman was responsible for a nasty racist screed about you -- so nasty, that he wouldn't (quite rightly) repeat its words. (Nor will I.)

The problem with Martin's testimony is that Warman didn't write that post. He has denied the matter under oath and has sued for defamation those who have made the allegation in unprivileged circumstances. Moreover, the allegation was debunked over a year ago, largely on the internet (from where all these allegations began), including at my site.

One of the basic facts, as you may know, is that that the racist post in question was made by someone using the pseudonym "90sAREover". The allegation that this was Warman depends on the claim that "90sAREover" had the same IP as "lucy" (Warman's pseudonym) and a computer with the same set-up.

• the IP in question, however, was a web-caching proxy shared by most Rogers customers, as I have shown in a post called "Why there is room for doubt that Richard Warman wrote the Cools post". To summarize a long and technical argument, 90sAREover could have been any Rogers customer, or anyone with access to the computer of any Rogers internet customer. This could have been millions of individuals.

• It has also been claimed that Warman's computer was set-up identically to the one that made the racist post. This would not be especially helpful even if true: something over 10% of users had their computers set-up that way (see here), and 10% of millions is still hundreds of thousands. The set-up, however, was not identical. In a post called "why Richard Warman is innocent" , I demonstrate that the computer used to write the racist post was different in at least one key respect from Warman's computer, with the result that they must have been computers.

The technical argument of my posts may be unintelligible to you, and there is no reason that you should believe me -- an anonymous guy on the internet. If you forward this letter to someone knowledgeable in these matters they will confirm to you that there is no good evidence that Warman made the post in question. (That the IP was a proxy and therefore represents a potentially vast pool of users has been endorsed, for example, by the Conservative blog Catprint in the Mash.)^*

During his testimony, Prof. Martin said that you personally were greatly agitated at Warman for these remarks. You have every right to be agitated about this post. But not at Warman, who did not make it.

Obviously, if you have any questions that I can help with, I'd be happy to do so.

Best regards,

Buckets

cc:ReidS@parl.gc.ca, SilvaM@parl.gc.ca, ThilaE@parl.gc.ca, SweetD@parl.gc.ca, HiebeR@parl.gc.ca, MarstW@parl.gc.ca, CotleI@parl.gc.ca

Why there is doubt the Warman wrote the Cools post, Why Warman is probably innocent of the Cools post, Bernard Klatt

Edited to clarify catprint's analysis.^*

Two cases in point

Human Rights expert Richard Moon testified to a committee of the Ontario Legislature today. You can see more of Moon's testimony preliminary transcript at Kinsella:

There are a number of right-wing critics in Canada who, instead of offering serious and plausible criticism of the Human Rights Code regulations, engage in baseless personal attacks. Without compunction, they accuse the civil servants who are mandated to implement human rights legislation of corruption. They use the term “corruption” freely and very loosely, but always in a way that suggests a significant breach of public trust. The accusations have no substance; they are pieced together out of nothing. But what they achieve, what the commentators want them to achieve, is a general sense that there is a serious problem, even if the specifics of the problem are unknown.

Just what might Prof. Moon mean by "the accusations have no substance; they are pieced together out of nothing"? Two examples come to mind.

One of them was to accuse human rights activist Richard Warman of a nasty racist denunciation of Senator Anne Cools on a racist board in 2003, an accusation that was mindlessly repeated by many conservative bloggers. The problem? It was based on a tissue of half-truths, innuendos, and misunderstandings, as I have shown here and here and here and here, and Warman is suing for defamation.

Or, who can forget the crazy allegation that CHRC employee Dean Steacy had hacked the wifi of an Ottawa woman? Both the RCMP and the privacy commissioner investigated, but both quickly dropped the matter. Why? Because there was no clear evidence that any hacking had taken place (here and here).

My experience of investigating these allegations is that underlying them is a seemingly endless string of exaggerations or half-truths or outright lies.

As Prof. Moon testifies:

Over the last few years, these commentators have made a series of baseless accusations against the members and staff or the Canadian Human Rights Commission, and these claims have leaked into the mainstream media, into the National Post, and into the columns of the Globe and Mail. Believe none of it. As I said at the outset, there are some serious questions to be addressed, but I have come to the conclusion that certain individuals who have played a large role in the campaign against human rights laws and human rights commissions, particularly in the context of hate speech, have no interest in serious debate or in the truth.

And that, as we say, is that.

Hanging it up for a while

I'll be travelling on business for a few weeks and so blogging will be minimal.

In the meantime, if you've landed here looking for what I've written about Richard Warman, Bernard Klatt, and the Cools post, there's a lot to read. The more important posts, which summarize many of the others, are the following:

• "Why there is room for doubt that Richard Warman wrote the Cools post", which points out that the IP that Warman and 90sAREover shared was a web-caching proxy that during this period will have been shared by hundreds of thousands if not millions of Rogers customers;

• "Load-balancing in action: did Richard Warman and 90sAREover really have the same IP?", where I demonstrate that it is not completely clear that 90sAREover and Warman did in fact have the same IP;

• "One of these things is not like the others: why Richard Warman is innocent", where I point out that the computer used to write the Cools post was different from the one Warman was using when he visited these sites;

• "Klatt's Clunkers: why Bernard Klatt should be disbelieved, which lists posts in which I demonstrate deficiencies in Bernard Klatt's testimony about this matter;

• Revisiting the lucy-90sAREover identification, where I consider each element of the Cools case.
  

Keep well and be careful to eat your vegetables. And remember the Golden Rule of Blogging:

Blog about others as you'd have them blog about you.

Best regards.

Buckets

Jonathan Kay and journalistic standards

On Feb. 18, 2008, National Post columnist Jonathan Kay wrote an on-line piece with the title "Richard Warman and Canada's phony-racism industry", a column that was quickly withdrawn with an apology, and is now the subject of a lawsuit. I will not quote that essay or link to it, since Kay has retracted it and it is now before the courts. Many copies have circulated around the internet, however, and if you really want to read it, a google of the title will take you there.

Kay began his column by laying out Klatt's technical case against Warman: that both he and the Cools poster had the same IP, that their operating system and browser "were an exact match", and that Klatt's "expert" opinion was that they were identical.

Those who have followed my posts about this matter will know the technical weaknesses of that case: the IP was a web-caching proxy shared by hundreds of thousands; the Cools-poster's computer was actually set-up differently than Warman's; and the "expert" testimony of Bernard Klatt is deeply flawed.

Meanwhile, the lawsuit moves forward, and now Jonathan Kay and the National Post have filed their statement of defense. It is, as you will see if you follow the preceding link, hardly a riveting read. There are, however, a few interesting things there. Consider, for example, Kay's description of his research into the Cools allegations (paragraph 29):

Now, the first thing to note is that, as a research effort, this is not very impressive. Kay reviewed section 13.1 of the act (but he surely knew that before); he reviewed decisions involving the Lemire case, presumably some of those listed here (they are not, however, very informative); he attended a single CHRC hearing (which one, one wonders); he reviewed Klatt's affidavit and some previously published articles.

There are some odd choices here. Attending a hearing is praiseworthy, but less efficient than reading the transcripts, which are available on the internet. By contrast, Kay did use the Klatt affidavit, which was not (as far as I know) available on the internet until I posted a copy here,-- but I posted that months after Kay's controversial column. He does not mention making any interviews.

This raises a more important point. Kay's journalistic practices, at least as described here, seem decidedly sub-standard. He reported serious allegations against Warman as established fact when they were not so, and he did this on the basis of an affidavit that he did not understand (if he had understood it, he would have recognized its errors). He did not (apparently) bother reading Klatt's testimony and his subsequent cross-examination, where some serious gaps in his knowledge were exposed. Nor did he (apparently) consult Warman's counter-affidavit, read Warman's testimony on this question, or contact Warman to get his side of the story.

Now, I confess that I know little about journalism as a profession, and perhaps those with more experience than me can comment. But from my limited perspective, there is grounds for concern here. First, Kay got it wrong (that is, the technical evidence does not show that Richard Warman was responsible for the Cools post: quite the opposite). Second, and perhaps more disturbingly, Kay's column and the efforts that he describes in his statement defense, reveal no great concern for factual accuracy, fairness, or balance. This seems to me to be fundamental failure of journalistic standards.

Update.  Mark Bourrie at Ottawawatch has some interesting observations on the lawsuit.

Kay and the National Post have filed their statement of defence

Jonathan Kay has now filed his statement of defense, which is as follows:

KayDefence - Upload a doc
Read this doc on Scribd: KayDefence

Klatt's Clunkers: why Bernard Klatt should be disbelieved (summary thread)

Warren Kinsella, when this whole business broke out, wrote:

I understand that a number of haters - two in particular - have gleefully relied upon Messrs. Lemire and Klatt as sources to viciously defame a good man.

Would you regard two notorious supporters of neo-Nazi and white supremacist groups as "experts" in anything? Of course not. Only a hateful fool would do such a thing.

(He adds details about Bernard Klatt's background here.)

Jonathan Kay, having repeated Klattt's allegations, tried to retract them. When challenged by Ezra Levant, he explained:

I took the post down when a more intelligent colleague of mine gave me some background about who Bernard Klatt is. Whatever Klatt may know about electronic sleuthing and the like, I didn't feel comfortable citing his affidavit as a source, even if all of the technical details in it are correct.

Both are, simply, wrong. The reason to disbelieve Klatt's testimony is not because Klatt is or isn't (or was or wasn't) a neo-Nazi, alà Kinsella. Nor are his politics a reason to disregard his sleuthing skills, alà Kay.   No, the reason to disbelieve Klatt's testimony is because it was patently wrong on so many points and his "sleuthing skills" are decidedly substandard:

• Klatt's clunkers 1: Bernard Klatt given an award for tendentious testimony
  
• Klatt's clunkers 2: Bernard Klatt wrong on IE 6 date
• Klatt's clunkers 3: Bernard Klatt misreads the user agent string
• Klatt's clunkers 4: Bernard Klatt mistakes the combined log format for the common log format
• Klatt's clunkers 5: Bernard Klatt doesn't recognize RealPlayer browser
• Klatt's clunkers 6: Bernard Klatt on Rogers service in BC
• Klatt's Clunkers 7: Bernard Klatt doesn't understand Rogers web caching
• Klatt's Clunkers 8: Bernard Klatt comes close on proxies
• Klatt's Clunkers: why Bernard Klatt should be disbelieved (summary thread)

Klatt's Clunkers 8: Bernard Klatt comes close

Below and to the right is a long exerpt from Bernard Klatt's testimony of Feb. 8, 2007 (Richard Warman & the CHRC v. Marc Lemire, T1073/5405 vol. 9, pp. 1636-8) .

In it, Klatt, who had been summoned to testify as a technology expert, is discussing the phenomenon that we had identified in the last post: that is, in the logs of Sept. 5, 2003, the traffic associated with 90sAREover's visit sometimes appears as 66.185.84.204 and sometimes as 66.185.84.200. Indeed, in the three minutes following his notorious racist denunciation of Senator Anne Cools, the IP changes four times.

Klatt is unable to explain the phenomenon.

There are several troubling aspects of this. First, of course, is the fact that he he's not sure what is going on: one expects better of an "expert". Second, it is troubling that the shifting IPs (which is material to the identification that he's making) is a matter that was raised not by Klatt himself, but the Chair of Tribunal. He makes no allusion to it at all in his discussion of the Cools' post in his affidavit (paragraphs 34-41, here). His answer to the chair, however, reveals that this is something that he'd noticed before: "That one is interesting" (line 21 of p. 1636). Not interesting enough, apparently, that he should actually explain it in his testimony.

Most importantly, however, is that is a bit troubling how close Klatt came to the truth. At p. 1636, lines 22-23, for example, he recognizes that 66.185.84.200 might be a web-cache, which he repeats at p. 1638, lines 3-4, as "very likely". The correct answer, as we have seen, is that both these IPs are web-caches and that the shifting from one to the other is part of Rogers' practice of load balancing.  And the idea that he might suppose that 66.185.84.200 (which had a hostname of wc04.mtnk.rnc.net.cable.rogers.com) was a web-cache, but not guess that 66.185.84.204 (with hostname wc09.mtnk.rnc.net.cable.rogers.com) was also one is a bit baffling. He was so close!

One expects better than "close", however, from an expert. We want them to be right. Mistakes in expert testimony can ruin lives. In this case, the erroneous testimony has damaged the reputation of an innocent man and exposed those who have repeated Klatt's errors to financial harm.


Other posts in the Klatt's clunkers series:

• Klatt's clunkers 1: Bernard Klatt given an award for tendentious testimony
  
• Klatt's clunkers 2: Bernard Klatt wrong on IE 6 date
• Klatt's clunkers 3: Bernard Klatt misreads the user agent string
• Klatt's clunkers 4: Bernard Klatt mistakes the combined log format for the common log format
• Klatt's clunkers 5: Bernard Klatt doesn't recognize RealPlayer browser
• Klatt's clunkers 6: Bernard Klatt on Rogers service in BC
• Klatt's Clunkers 7: Bernard Klatt doesn't understand Rogers web caching
• Klatt's Clunkers 8: Bernard Klatt comes close on proxies
• Klatt's Clunkers: why Bernard Klatt should be disbelieved (summary thread)

Load-balancing in action: did Richard Warman and 90sAREover really have the same IP?

Below and to the right is an excerpt from the Freedomsite's logs, truncated on three sides to make it easier to read. (You can see an untruncated version here on p. 35.)

The top two entries (both with "POST") are related to the notorious Cools message: the first confirming the spelling of "nigger"; the second submitting the nasty message that is at the center of the present controversy. The bottom-most is the last entry for 90sAREover in the logs (or at least those that have been released).

The point to note is that 90sAREover did not have just one IP during his brief visit to the freedomsite message board, but two: 66.185.84.204 and 66.185.84.200, and in the space of three minutes he switches from one to the other at least four times.

I say "at least" four times here because it is important to remember that we are only seeing a portion of what was going on. These two IPs are both Roger's web-caching proxies -- their host names are (respectively) wc09- and wc04.mtnk.rnc.net.cable.rogers.com, showing the tell-tale wc (which abbreviates web-cache) -- and since they are caches there will have been traffic between them and 90sAREover's computer that is not forwarded to the visited site.

What does all this mean? The switching between these two web-caches is another example of load-balancing, a practice by which Rogers shifted traffic among its 42 web-caches to deliver the most efficient service to its subscribers. An attempt to sort out how all of this worked resulted in the string ball to the right (explained here), which traced shifts between proxy-IPs that can be identified in the years 2002-5. Each string in the ball is an example of a load-balancing shift.

This load-balancing provides another wrinkle in argument of identifying 90sAREover. It seems that Rogers' subscribers had what might be called a "home" proxy, which functioned as their default web-cache, and that they would rerouted to a another proxy only when needed, especially (one assumes) at peak hours. But when he made the racist Cools-post, was 90sAREover's "home" proxy 66.185.84.204 and 66.185.84.200 a temporary IP to which he was shifted through load-balancing? Or was his home proxy 66.185.84.200? Or might his "home" have been one of the other web-caches in the series, with the traffic rerouted into 200 and 204?

Klatt's clunkers 5: Bernard Klatt doesn't recognize RealPlayer browser

We have already seen how unsatisfactory Bernard Klatt's testimony about the Cools matter has been. One of his most serious mistakes involves the only evidence that we have about 90sAREover: the logs of his post of Sept. 5, 2003. Here is the entry in which "90sAREover" registered his username:

66.185.84.204 chat.freedomsite.org 90sAREover [05/Sep/2003:19:49:10 -0500] "POST /~Freedom/login HTTP/1.0" 200 1386 "http://chat.freedomsite.org:8080~Freedom"
"Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Rogers Hi·Speed Internet; (R1 1.3))"

This log entry includes both the referring IP (in red) and the user-agent string (in blue), which shows that this is in the Combined Log Format, a fact that Klatt missed.

The interpretation of the user-agent also presented Klatt with difficulties. If you surf over to www.useragentstring.com, you can see what your own user agent string is and what it means.

Internet Explorer 6.0
Mozilla	It's a Mozilla based browser
4.0	Mozilla Version
compatible	Compatibility flag Indicates that this browser is compatible with a common set of features
MSIE 6.0	Name : MSIE 6.0 Version = 6.0
Windows 98	OS-or-CPU : Windows 98
Rogers Hi-Speed Internet	Rogers Communications Internet provider. Partnered with Yahoo! to offer Rogers-Yahoo! Hi-Speed Internet.
R1 1.3	Using Real Player as a browser

If at that same site you type in 90AREover's user agent string (blue above), you'll find a table like the one to the right (I've added the blue and truncated it slightly). It gives the items of the string with an explanation for each element. As you can see, R1 1.3 refers to RealOne Player, a free media player that has a built in browser. R1 obviously abbreviates "RealOne"; 1.3 was version 2.0.

If you don't believe me, you can download your own copy from oldversion.com and visit useragentstring.com to experiment. Or you can look at the long list of user agent strings in which we find some version of the RealOne Player over at botsvsbrowsers.com.

What did Klatt make of "R1 1.3"? Below and to the right (from pp. 1634-5 of the transcripts of Warman v. Lemire) is Klatt's attempt to explain it.  

It is painfully obvious that he has no clue. The tip-off: statements like "the best explanation I've been able to determine" (lines 9-10), "the best of my ability" (lines 14-15), "the best explanation" (lines 19-20) betray his lack of confidence in his own answer. You never say this about what you know; you only say this when your guessing.  And his guess is a bad one -- embarrassingly bad. Instead of recognizing that this was the RealOne browser, Klatt embarks on a series of accumulated conjectures: Rogers used a 15660 Cisco router, and "R1 1.3" was a firmware release, and the update took place in few weeks between 90sAREover's visit in September and Warman's visits in November. (Or, as we know now, but Klatt seems to have missed, October.)

Clearly he has no clue. What is worse is that he does not even know where to look for the correct answer. He did some "research on the internet", but where this led him is a bit of a mystery, since there seems to be no Cisco product with the designation CXC 15660, and no Cisco firmware update with this number. (Perhaps he has the 15600 CXC in mind?)

Trying to figure out what was his exact error is in any case unlikely to be productive. The more important point is that Klatt has failed to recognize that 90sAREover was using the browser built into the RealOne Player, which invalidates paragraphs 36 and 64 of his sworn affidavit (which you can see here), and (as I have argued here) is exculpatory for Warman.

Other posts in the Klatt's clunkers series:

• Klatt's clunkers 1: Bernard Klatt given an award for tendentious testimony
  
• Klatt's clunkers 2: Bernard Klatt wrong on IE 6 date
• Klatt's clunkers 3: Bernard Klatt misreads the user agent string
• Klatt's clunkers 4: Bernard Klatt mistakes the combined log format for the common log format
• Klatt's clunkers 5: Bernard Klatt doesn't recognize RealPlayer browser
• Klatt's clunkers 6: Bernard Klatt on Rogers service in BC
• Klatt's Clunkers 7: Bernard Klatt doesn't understand Rogers web caching
• Klatt's Clunkers 8: Bernard Klatt comes close on proxies
• Klatt's Clunkers: why Bernard Klatt should be disbelieved (summary thread)

Klatt's clunkers 4: Bernard Klatt mistakes the combined log format for the common log format

We have seen that Bernard Klatt is the technology "expert" regularly summoned to defend those accused under section 13. In the Zundel hearing his testimony was dismissed as tendentious and incompetent, and that there are a number of ways in which his testimony in Warman v. Lemire is substandard (see the posts in the Klatt's clunkers series list at the bottom of this paragraph). Here is one of his paragraphs from his affidavit (which can be seen in full here):

Unfortunately for Klatt, however, this is simply wrong. The Common Log Format has seven elements (see here):

The Common Log Format (CLF) is a fairly basic form of Web server logging. It tracks seven different elements of the Web transaction. Each request is written to one line, with the different elements of the request separated by spaces (items in quotes or square brackets are considered one item), and items that aren't sent are listed as a hyphen or dash (-): The remote host: the hostname or IP address of the computer requesting the Web page. The client user name… Authenticated user name… Date… The Request… Status… Bytes: the number of bytes that were sent in the server's response. Here's how the log entry might look for this Web page in Common Log Format: 10.1.1.1 - - [08/Feb/2004:05:37:49 -0800] "GET /cs/loganalysistools/a/aaloganalysis.htm HTTP/1.1" 200 2758

As you can see, no user agent data is logged under the Common Log Format. To log that, one must use the Combined Log Format (see here):

The Combined Log Format uses the common log format but adds two items to the end: Referrer: the URL of the page that linked to the requested document. User-agent: the name and version of the browser or other client software making the request. Here's how the log entry might look for this Web page in Combined Log Format: 10.1.1.1 - - [08/Feb/2004:05:37:49 -0800] "GET /cs/loganalysistools/a/aaloganalysis.htm HTTP/1.1" 200 2758 "http://webdesign.about.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; YPC 3.0.2)"

Which log format was used in the freedomsite logs that Klatt consulted? Here is one entry:

Since this entry includes the referring url (blue underline), and the user agent string (red underline), it is the Combined Log Format.

Yet another of Klatt's clunkers, then.   There may be those who think that this is a simple quibble. That he is unable to get the basic terms correct, however, is consistent with the concern raised in the final decision of Zundel hearing, where he was criticized for being "unable to answer elementary questions in his field". It should be noted in addition, however, that Klatt's most serious errors in the 90sAREover matter relate to logs such as this. That he can't get the basic terms right is not confidence inspiring.

(The quoted material above have been edited and reformated slightly; for less technical descriptions of log formats, see here and here; more technical, here.)


Other posts in the Klatt's clunkers series:

• Klatt's clunkers 1: Bernard Klatt given an award for tendentious testimony
  
• Klatt's clunkers 2: Bernard Klatt wrong on IE 6 date
• Klatt's clunkers 3: Bernard Klatt misreads the user agent string
• Klatt's clunkers 4: Bernard Klatt mistakes the combined log format for the common log format
• Klatt's clunkers 5: Bernard Klatt doesn't recognize RealPlayer browser
• Klatt's clunkers 6: Bernard Klatt on Rogers service in BC
• Klatt's Clunkers 7: Bernard Klatt doesn't understand Rogers web caching
• Klatt's Clunkers 8: Bernard Klatt comes close

Klatt's clunkers 3: Bernard Klatt misreads the user agent string

We have seen that for an award-winning "expert", Bernard Klatt makes lots of mistakes. Here's another from Klatt's affidavit in Warman v. Lemire (here, p. 9), paragraph 36:

You can see for yourself, however, that Klatt got this wrong:

As you can see, the user agent string is not "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)" (as Klatt wrote in his sworn testimony), but "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Rogers Hi-Speed Internet; (R1 1.3))".

Other posts in the Klatt's clunkers series:

• Klatt's clunkers 1: Bernard Klatt given an award for tendentious testimony
  
• Klatt's clunkers 2: Bernard Klatt wrong on IE 6 date
• Klatt's clunkers 3: Bernard Klatt misreads the user agent string
• Klatt's clunkers 4: Bernard Klatt mistakes the combined log format for the common log format
• Klatt's clunkers 5: Bernard Klatt doesn't recognize RealPlayer browser
• Klatt's clunkers 6: Bernard Klatt on Rogers service in BC
• Klatt's Clunkers 7: Bernard Klatt doesn't understand Rogers web caching
• Klatt's Clunkers 8: Bernard Klatt comes close on proxies
• Klatt's Clunkers: why Bernard Klatt should be disbelieved (summary thread)

Klatt's clunkers 2: Bernard Klatt wrong on IE 6 date

As we have already seen, Bernard Klatt is the technology "expert" of choice of Canada's white supremacist movement, appearing most recently in Warman v. Lemire, where his testimony was substandard in several ways. But that was not his first appearance in court and found wanting. In the Zundel hearing of 2002, Klatt was criticized in the tribunal's final report for (among other things) being "unable to answer elementary questions in his field." If you've been following this blog over the last weeks, this won't come as a surprise.

Consider the transcript to the right. This is part of the cross-examination of his assertion that Richard Warman must be the racist-poster "90sAREover" because they both used Windows 98 and Internet Explorer 6.0. (As it turned out, that was itself wrong, a point to which we'll return.) Klatt wants to argue that IE 6.0 was not widely used: it was, he asserts a "relatively new release at that point" (that is, in Sept. 2003). The implication: that since "90sAREover" and "lucy" were both using it, they were more likely to be identical.

The problem? Internet Explorer 6.0 was released in August, 2001, a full two years before the posts in question. And far from being unusual or cutting-edge by 2003, it was far-and-away the most commonly used browser: 70% of all internet traffic used IE 6.0 in Sept. 2003.

This is, of course, a small mistake, and is less significant in itself than in the fact that it betrays Klatt's desire to throw everything possible at Warman. Still, we expect technology experts to get the basic facts right. And Klatt doesn't. And that's a problem.

Other posts in the Klatt's clunkers series:

• Klatt's clunkers 1: Bernard Klatt given an award for tendentious testimony
  
• Klatt's clunkers 2: Bernard Klatt wrong on IE 6 date
• Klatt's clunkers 3: Bernard Klatt misreads the user agent string
• Klatt's clunkers 4: Bernard Klatt mistakes the combined log format for the common log format
• Klatt's clunkers 5: Bernard Klatt doesn't recognize RealPlayer browser
• Klatt's clunkers 6: Bernard Klatt on Rogers service in BC
• Klatt's Clunkers 7: Bernard Klatt doesn't understand Rogers web caching
• Klatt's Clunkers 8: Bernard Klatt comes close on proxies
• Klatt's Clunkers: why Bernard Klatt should be disbelieved (summary thread)

Did Richard Warman lie about "lucy"?

In the recent debate about whether Richard Warman was responsible for the racist Cools-post, one sometimes finds the claim that Warman was caught in a lie about his membership on Freedomsite during the Lemire hearing. For example, one commenter at drdawgsblawg offered this summary

Warman previously denied under oath that he'd signed onto a message board as the infamous "Lucy", then recanted when it became clear moments later that he had indeed used that pseudonym. So, did he "lie" then? I suppose it depends on how finely one likes to split hairs.

When challenged, he linked to a graphic a snippet of the transcript that had been posted to freedominion, which I repost here (the red underline and arrow were added by me):

Based solely on this, one might conclude that Warman had lied. It is always worthwhile, however, to be attentive to how evidence is presented and how that presentation affects one's perception. In this case, note especially the tendentiousness of what I've underlined in red.

Was there some "incontrovertible proof" presented, as was claimed by whoever prepared this picture? No. Let's look at the actual transcripts. Here is a screen capture of the bottom of p. 769 and the top of 770, including the page break. Note the red arrows, which point to what the commentary has replaced.

As you can see, there was no evidence presented at all, much less 'incontrovertible proof', and what the commentary has replaced is nothing more than a page number. What happened? Warman was asked whether he had registered an account, he answered that he had not as far as he remembered. When he was shown an account name that jogged his memory, he immediately corrected himself.

Now, those who dislike Warman or his actions are free to disbelieve him if they choose. But we also know (from Klatt's affidavit) (1) that Warman never posted any messages on the board as "lucy", (2) that he had logged in under this name precisely twice (see here, p. 37 of the pdf), and (3) that both his log-ins occurred within a two-hour period on Nov. 15, 2003. Given that more than three years had passed between these logins in 2003 and his testimony in February, 2007, surely any fair-minded individual would have no difficulty believing that he had simply forgotten about the "lucy" account in the interim.

So. A lie or an honest mistake? Take your pick. But if we're going to call this a lie, what are we to make about the numerous misstatements of Klatt in his sworn testimony?

Edited and rewritten for clarity and concision.

One of these things is not like the others: why Warman is innocent

Much of Canada's right-wing blogosphere is aflutter with the idea that human rights lawyer Richard Warman might have posted a racist comment about Canadian senator Anne Cools on freedomsite.com, a white-rights forum. The evidence? Freedomsite's logs preserve data from some visits of "lucy" (a handle Warman is known to have used) and from 90sAREover, who had posted a hasty racist screed against black senator Anne Cools. According to freedomsite's expert witness Bernard Klatt, both the IP and the user-agent data were identical for "lucy" and for "90sAREover". Until now we have had to take Klatt's word on this.

Recently these logs have become available for scrutiny (they were included in Klatt's affidavit, which I've recently posted here). The logs make it clear, however, that there are two important differences between the computer used during Warman's visits and those of 90sAREover (the Cools poster); both of these differences are exculpatory of Warman. Here is the evidence in reverse chronological order (compare what is underlined in red).

The log of Warman's visit from Nov. 23, 2003 (p. 33 of Klatt's affidavit):

The log of Warman's visit from Nov. 15, 2003 (p. 30 of Klatt's affidavit, here):

The log of Warman's visit from Nov. 11, 2003 (p. 29 of Klatt's affidavit, here):

The log of Warman's visit from Oct. 15, 2003 (widely cited, e.g. here):

All of Warman's visits from Oct. 15 — Nov. 23, 2003, show the same IP (66.185.84.204 = wc09.mtnk.rnc.net.cable.rogers.com; see the blue underline) and the same operating system and browser (MSIE 6.0; Windows 98 — see the red underline — which points to a generic version of Explorer 6.0 and Windows 98).

Here is the log of 90sAREover of Sept. 5, 2003 (p. 34 of Klatt's affidavit, here). Here the browser details are different (again underlined in red:

Although both Warman and 90sAREover have the same IP and operating system, 90sAREover's user agent string has two key differences from Warman's computer-setup. First, 90sAREover had a customized version of Explorer 6.0 installed, which had been supplied by Rogers (as is signaled by the phrase "Rogers Hi-Speed Internet"); second, he did not actually use IE 6.0 to post, but instead was using RealOne Player version 2 (hence "R1 1.3": see here). None of Warman's log entries, by contrast, show any sign of RealOne, and for all four of his visits his browser was recorded as a generic version of Explorer, not a Rogers one.

These differences are important and exculpatory and overthrow the technical argument for identifying Warman as "90sAREover", which (given that the IP used, 66.185.84.204, could have been anyone of millions of Rogers customers) has now collapsed. The computer that posted the Cools post was set up differently than the one Warman was using three months later.

(Re-written for clarity and context.)

Klatt affidavit in Richard Warman & CHRC v. Lemire

I've been wondering aloud for the past few weeks (here and here) why it is that although Warman's critics have produced scores and scores of documents (see here, for example), the actual evidence that he was the Cools poster were nowhere to be found. Logs were produced to show that Warman visited the site without logging in on Oct. 15, 2003, and these have been cited as some kind of proof (here and here). But where were the logs of the notorious Cools post? Why was some evidence being fed into the blogosphere, but the most important evidence not?

Someone pointed out to me that the logs were part of the original Klatt affidavit, which I've managed to acquire. So that you can see the whole thing, I've uploaded into scribd.com and embedded it below. There are several serious mistakes in Klatt's testimony that I have already identified, and I hope to return to these soon. For now, however, the logs of the notorious "Cools" post is on p. 35, and these show that the case against Warman is fatally flawed: 90sAREover had a different browser installed than what we know Warman used for all of his posts in October and November. I'll clarify this later today.

Read this doc on Scribd: Klatt affidavit - 22 Aug 2006

Revisiting the lucy-90sAREover identification

Those who have been following the controversy about the Cools post will probably know the following chart. It apparently imitates one that Bernard Klatt presented at the CHRC hearing -- Klatt refers to such a chart during his testimony -- but this version (with my mark-up in red for point-by-point reference) was posted freedominion.ca on January 20 by "Entropy Squared". It is now part of Warman's statement of claim.

The chart was designed to make a case that Richard Warman was responsible for the posting of a racist denunciation of Senator Anne Cools on Sept. 5, 2003. The evidence argues against that conclusion. (Again, what is in red is my mark-up.)

A ~ a and B ~ b. Warman registered at Freedomsite.org using the pseudonym "lucy" and the IP 66.185.84.204, according to Klatt's testimony. Klatt also testified that 90sAREover (who wrote the notorious Cools post) had the same IP. I have shown here, however, that this IP is one of Rogers' web caching servers and could be used by any Rogers' subscriber -- indeed, the post could have been made by anyone with access to a Rogers-connected computer. This could be any one of millions (here).

• Update. Actually, the IP of "90sAREover" is less clear in the logs than Klatt's testimony implies: in the few minutes that 90sAREover spent at the site, his IP can be seen shifting back and forth between 66.185.84.204 and 66.185.84.200 five or six times. See here.

C ~ c. According to Klatt's testimony, the user-agent string recorded in the logs freedomsite.org show that both "lucy" and "90sAREover" used Windows 98. According to W3schools.com, 12.1% of computers were using Windows 98 in Sept. 2003, when the Cools screed was posted. 12% of millions (see previous), however, is still hundreds of thousands.

D ≠ d. During his testimony at the CHRC, Klatt asserted that "lucy" and "90sAREover" used the same browers. This is wrong. Details of a visitor's browser are found in the user-agent string, which is recorded by many sites. To judge from Klatt's testimony (here)*, the user-agent string of 90sAREover included the phrases "Rogers Hi-Speed Internet; (R1 1.3))". The R1 1.3 means that 90sAREover was not using Explorer as his browser, but in fact was using RealOne Player (version 2). The reference to "Rogers Hi-Speed" shows that the Cools poster had a version of Explorer that had been customized by Rogers for its customers (here), even though he was not using it to visit this site. To judge from Klatt's testimony, none of Warman's own visits show either the RealOne Player or the Rogers-customization. This argues against identification. (One wonders why there are not copies of these logs floating around the internet -- is it because they exonerate Warman?)

*Update. Now that the site logs are available for inspection, rather than Klatt's testimony, it is clear that Richard Warman's browser set-up was different than 90sAREover's.

E ≠ e. The IDs and emails are different. This can hardly be used as an argument that they're run by the same individual. Indeed, those trying to argue that they are identical need to explain why Warman registered "lucy" in mid-November (an account that he never posted from) if he already had the 90sAREover accout. If he were "90sAREover", why wouldn't he simply have used that account rather than registering the new one?

F ~ f. It is a matter of public record that "lucyaubrack@yahoo.ca" was Warman. We don't know, however, whether the "rob_m_simpson@hotmail.com" account was anonymous or whether it reflects someone's actual name.

G ~ g. Both "lucy" and "90sAREover" found their way to freedomsite.org, which was relatively obscure. This no more requires that these two were identical, however, than it would for any of the site's others users, or indeed for visitors of other obscure sites (such as the one you are visiting now). In any case, it is worth noting that 90sAREover is member #1331 (affidavit, p. 10), and "lucy" (Warman's handle) is member #1379 (affidavit, p. 10), which implies that at least 50 new members joined up in this period. These surely aren't all the same individual.

H ~ h. The entry seems slightly wrong.* Klatt only mentions a single log-in of "90sAREover", and mentions three log-ins by Warman (two as "lucy" and one as "guest"). (Cf. his summary at p. 1648, where he says that the two accounts logged in "once or twice".) But even if this were correct, it is not helpful. All internet sites attract one-time visitors who don't return. (By way of comparison -- 90% of my traffic at this blog are first-time visitors, and another 8% visit 2-5 times; less than 2% return more than 5 times.) Why would this suggest they are identical?

*Update. Klatt's testimony is less clear than his affidavit (here), which shows that both lucy and 90sAREover did in fact log-in only twice.

I ~ i. The respective usage times differ by a factor of ten. That is hardly an argument for regarding them to be identical.

J ~ j. When they registered both "lucy" and "90sAREover" filled none of the optional boxes. The question is how typical this is. Personally, I never fill in more than I have to, and I suspect that is a common approach to message boards.

K ~ k. "Created for a single purpose" states more than can be known -- the "purpose" (or intention) of one or both of these accounts may have been either grander or more modest than came to pass. Indeed, given that the "lucy" account was never used to post anything at Freedomsite, it's difficult not to assume that its original purpose was something different than what it was actually used for, given that it was never used.

L ~ l. I assume that the dates here are offered for context, not as an argument in favour of identification.

Updated several times for clarity.

More on R1 1.3 as the user agent string in the Cools post of 90sAREover

We have already seen that the user agent string of 90sAREover (who posted a nasty racist screed against Anne Cools on Sept. 5, 2003) was "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Rogers Hi-Speed Internet; (R1 1.3))".

The reference to Rogers here is to a special version of Rogers' browser distributed to its subscribers.

In a user agent string, R1 1.3, refers to Real Player, and we can now state definitively what the specific version was: RealOne Player, version 2, and as you can see here (red arrow for the RealOne version; violet arrow for the user agent string):

The difficulty, as commentator freemarkets pointed out in the comments to an earlier thread, is that we can only get the RealOne Player to show up in the user agent string if it is actually the browser that is being used. That is, Real Player versions for Windows, at least since RealOne, have a browser built into them, so that you can surf the web using Real Player.

It seems that the only possible explanation is that the Cools poster 90sAREover was using RealOne as his browser. But an important question remains outstanding. How is it that "Rogers Hi-Speed Internet" found its way into the user agent string. Was there a special Rogers version of RealOne Player?