Thread by @ElizabethleaVos

#Guccifer 2.0’s American Fingerprints Reveal An Operation Made In The USA

disobedientmedia.com/2018/05/guccif…

#Forensicator has found some incredible evidence in his final segment of findings

theforensicator.wordpress.com/guccifer-2s-we…

The Forensicator’s earlier findings stated that Guccifer 2.0’s NGP-VAN files were accessed locally on the East Coast, and in another analysis they suggested that a file published by Guccifer 2.0 was created in the Central time zone of the United States.

theforensicator.wordpress.com/cf-files-metad…

Most recently, a former DNC official refuted the DNC’s initial allegations that Trump opposition files had been ex-filtrated from the DNC by Russian state-sponsored operatives.
theforensicator.wordpress.com/media-mishaps-…

disobedientmedia.com/2018/05/the-da…

Despite almost two years having passed since the appearance of Guccifer 2, legacy media is still trotting out the shambling corpse of Guccifer 2 to revive the legitimacy of the Russian hacking narrative. It is necessary to hammer the final nail into the coffin of the Guccifer 2.0

The #Forensicator writes that evidence suggests Guccifer 2.0 uploaded a document the operators of the persona had altered and saved, while located on the West Coast of the US.

theforensicator.wordpress.com/guccifer-2s-we…

In addition to Forensicator's finding of evidence showing a save on the West Coast: that same finding also invalidated prior indications that the document was saved in the GMT+3 Timezone.

theforensicator.wordpress.com/2018/05/29/guc…

Adding to all of this, independent journalist Adam Carter (@with_integrity) presented his own analysis which also showed that the Guccifer 2.0 Twitter persona interacted on a schedule which was best explained by having been based within the United States.

g-2.space

Though this last data point is circumstantial, it is corroborated by the previously discussed pieces of independently verifiable hard evidence described by the #Forensicator.

When taking all of these separate pieces into account, one observes a convergence of evidence that multiple US-based operators were behind the Guccifer 2.0 persona and its publications. This is incredibly significant because it is based on multiple pieces of concrete data.

It does not rely on “anonymous sources within the government,” nor contractors hired by the DNC. As a result, much of the prior legacy press coverage of Guccifer 2.0 as a Russia-based agent can be readily debunked.

Such tangible evidence stands in contrast to the claims made in a recently published Daily Beast article, for example: (which epitomizes the necessity of utterly debunking the Guccifer 2.0-based Russian-hacking-saga)

archive.is/l0Kxk

(1/2) The #Forensicator told us:

"With this additional finding added to previous findings along with the observation that the "Russian fingerprints" were intentionally injected into Guccifer 2's copy of the Trump opposition report - a compelling picture emerges....

(2/2) ".....#Guccifer2 was a primarily US-based disinformation operation that had a main goal of implicating Russians with the DNC hack and subsequent disclosures to @Wikileaks." -- #Forensicator

The Forensicator explained to Disobedient Media that their discovery process was initiated by the following Tweet by Matt Tait (@pwnallthings), a security blogger and journalist.

#Forensicator told us that Tait noticed a change revision entry in one of the Word documents published in Guccifer 2.0’s second batch of documents, (uploaded 3 days after #Guccifer2.0 first appeared on the scene).

The Forensicator corrects Tait, stating that the timestamp is in “wall time,” (local time) not UTC. The Forensicator explains that Tait’s mistake is understandable because the “Z” suffix usually implies “Zulu” (GMT) time, but that isn’t the case for “track changes” timestamps.

The #Forensicator writes that the document Tait refers to in his Tweet is named Hillary-for-America-fundraising-guidelines-from-agent-letter.docx; it has Word’s “track changes” feature enabled. Guccifer 2.0 made a trivial change to the document, using the pseudonym, Ernesto Che

The Forensicator correlated that timestamp (“12:56:00 AM”) with the document’s “last saved” timestamp expressed in GMT, as shown below courtesy of the #Forensicator’s study:

theforensicator.wordpress.com/2018/05/29/guc…

Based on the evidence above, the #Forensicator concludes that #Guccifer2 saved this file on a system that had a timezone offset of -7 hours (the difference between 0:56 AM and 7:56 AM GMT). Thus, the system where this document was last changed used Pacific Timezone settings.

The logical conclusion drawn from all this, is that #Guccifer2 was operating somewhere on the West Coast of the US when they made their change to that document. This single finding throws into shambles the claim that #Guccifer2 was operating out of #Russia.

Taken all together, the factual basis of the #Russianhacking story totally collapses. We are left instead with multiple traces of a US-based operation that created the appearance of evidence that #Kremlin-allied #hackers had breached the @DNC network.

Sorry, our typo on Tait's handle: It should have read @pwnallthethings