Obstructive Timelines

by emptywheel

We Plamologists are still trying to figure out the timelines associated with the newly revealed Vivnovka story. And I thought I would try to synthesize pollyusa's and Jeralyn's and  Anonymous Liberal's excellent work on timelines and see where it got me. Looking at this timeline, while I admit the email probably couldn't have been created after the fact, I think it highly likely that its content was adapted after the fact, at least once.

Before I look at the individual timeline, though, here's what we know the email to have said:

Matt Cooper called to give me a heads-up that he's got a welfare reform story coming, When he finished his brief heads-up he immediately launched into Niger. Isn't this damaging? Hasn't the president been hurt? I didn't take the bait, but I said if I were him I wouldn't get Time far out in front on this.

Update: extra "bait" comment removed.

(Note, we don't know what the subject line of the email was--presumably this is very hard to alter, so I'd be very curious what it is.)

The first subpoena

The first request for materials came on September 30 2003, after the 11-hour gap between Abu Gonzales' first notice there'd be an investigation, and the actual document request (there was also a 4-day gap between the time Abu G was notified and the WH was notified).

[F]or the time period February 1, 2002 to the present, all documents, including without limitation all electronic records, telephone records of any kind (including but not limited to any records that memorialize telephone calls having been made), correspondence, computer records, storage devices, notes, memoranda, and diary and calendar entries, that relate in any way to:

1. Former U.S. Ambassador Joseph C. Wilson, his trip to Niger in February 2002, and/or his wife's purported relationship with the Central Intelligence Agency;
2. Contacts with any member or representative of the news media about Joseph C. Wilson, his trip to Niger in February 2002, and/or his wife's purported relationship with the Central Intelligence Agency; and
3. Contacts with reporters Knut Royce, Timothy M. Phelps, or Robert D. Novak, or any individual(s) acting directly or indirectly, on behalf of these reporters.

Abu Gonzales went on to say:

You must preserve all documents relating, in any way, directly or indirectly, to these subjects, even if there would be a question whether the document would be a presidential or federal record or even if its destruction might otherwise be permitted.

I agree with Anonymous Liberal that it is possible that Rove's email (as we know it) was not found at this period. For example, if the search looked for "Wilson" and "Niger" they'd miss the email because Wilson's name did not appear in the email.

It's worth noting that Abu G was at least considering withholding some materials through executive privilege. Rove's status would be disputable, but Hadley clearly falls into the National Security Council structure. A favorite ploy, of course, is to claim executive privilege for NSC staffers, where (coincidentally) a lot of dirty trick campaigns get hidden. So it's possible that Hadley's materials (and therefore this email from Rove) were treated with some deference to executive privilege, at least during the period when Ashcroft was helping BushCo whitewash the investigation. Also, recall that Abu Gonzales reviewed the materials submitted at this time for two weeks before passing them onto DOJ.

The second subpoena

All of that might have meant that Abu G dreamt up some reason to withhold the email. But those reasons should have been void by the time Fitzgerald sent a further request for email on January 22 2004.  The Rove email was clearly responsive to this second document request, which asked for:

A federal grand jury has subpoenaed White House records on administration contacts with more than two dozen journalists and news media outlets in a special investigation into the improper leak of a covert CIA official's identity to columnist Robert Novak last July.

Now, Matt Cooper was included in that list along with the coauthors of his original Time story, John Dickerson and Massimo Calabresi, which suggests Fitzgerald did not yet know that Cooper had been the sole Time recipient of the White House leak (if indeed he was). Now, the Libby indictment says that Libby testified to speaking to Cooper about this in an FBI interview on October 14 and November 26, 2003, so Fitzgerald clearly knew when he issued this subpoena that Cooper was one of the reporters who received this leak. But Fitzgerald also knew that more than one administration official leaked this information to Time. As the July 17 2003 Cooper story described:

And some government officials have noted to TIME in interviews, (as well as to syndicated columnist Robert Novak) that Wilson's wife, Valerie Plame, is a CIA official who monitors the proliferation of weapons of mass destruction.

So presumably Fitzgerald was subpoenaing these records to determine whether Cooper received both (all?) of the leaks, or whether he received one and another of the journalists received another.

Which raises a question. Fitzgerald knew he had to find at least two conversations between White House officials and Time reporters before July 17. He wouldn't have found the Rove conversation, because that conversation had been stricken from didn't appear in the phone logs. Was there another conversation he found, presumably between a White House official and one of the other writers (since he didn't seem to know of Rove's conversation at all when Cooper first testified)? Perhaps, then, someone called Calabresi or Dickerson after the Novak column appeared.

Rove's first grand jury appearance

Sometime presumably between that January subpoena and Rove's first appearance before the grand jury, Vivnovka and her buddy Luskin had a few drinks and discussed the case. During that conversation, Vivnovka in some way hinted that she knew Rove had spoken with Cooper.

In fact, this person said, Novak told Luskin about the Rove-Cooper connection before Rove's first appearance before the grand jury in February 2004.

But this hint was not enough for Luskin and Rove to decide to reveal the Cooper conversation when he first testified.

Cooper's first subpoena

On March 5 and March 21 2004, Libby testified before the grand jury. Two months later, on May 21, Fitzgerald subpoenaed Matt Cooper and Tim Russert about conversations with one specific official who was not revealed publicly, presumably so Fitzgerald could compare their stories with Libby's. As part of the negotiations before the appeal, Fitzgerald offered to narrow the scope of his Cooper questioning to Libby. This was not enough to convince Cooper to testify. It wasn't until after Cooper had appealed, Stauber called Libby and asked for a specific waiver, Libby had said he wanted Cooper to testify, and Cooper and Stauber renegotiated Fitzgerald's willingness to limit the questioning to Libby that Cooper testified.

Now, it's not clear when Rove would have definitively learned that Libby--and not he--was the subject of this first subpoena. At the least, he would have figured it out when he read accounts of Libby giving Russert and Cooper specific waivers, presumably in August. But he probably would have known as soon as Cooper was subpoenaed with Russert that he was off the hook ... particularly if Libby had told Rove he spoke with Russert (we know Rove was shown Libby testimony reflecting his conversation with Russert, but it's not clear which grand jury appearance this was). In any case, Rove and Luskin knew that some people knew Rove was Cooper's source. But they presumably figured the tampering with gaps in the phone log had prevented Fitzgerald (as opposed to the Time newsroom) from discovering Cooper's first source.

It appears that it wasn't until Cooper testified that Fitzgerald learned that Libby was not Cooper's first source.

Cooper's second subpoena

In September 2004, once Fitzgerald realized that Libby hadn't been Cooper's first source, he subpoenaed Cooper more generally for any sources relating to the Plame affair. Cooper again fought this. But on October 13, Cooper was named in contempt.

Two days later, Rove testified, for the first time admitting that he had spoken to Cooper.

Rove's third (or is it second?) grand jury appearance

Now, the chronology in Fall 2004 actually seems more critical than the earlier chronology. Here's how yesterday's VandeHei story describes it:

Shortly before his client's second appearance before the grand jury in October, Luskin personally conducted a review of thousands of e-mails Rove had sent during the crucial weeks in 2003, including those from accounts reserved for personal and political correspondence, a source familiar with the situation said. Amid the e-mails, Luskin found one sent from Rove to Stephen J. Hadley, then deputy national security adviser, in which Rove mentioned his conversation with Cooper. The e-mail was written from Rove's government account, which investigators searched early in the inquiry. It is unclear why the e-mail was not discovered at that time.

Once found by Luskin, the e-mail was shared with Rove and then quickly turned over to Fitzgerald, the source said. Rove then testified that the e-mail "established that he had in fact had a conversation with Cooper," the source said.

Legal sources involved in the probe said Rove's timing in ultimately recalling -- or finally revealing -- his conversation with Cooper is certainly significant to Fitzgerald as he considers whether to charge the White House adviser. Rove provided the information on Oct. 15, 2004, to the grand jury. That new testimony came exactly one month after Fitzgerald issued a new subpoena to Cooper calling upon him to testify before the grand jury about Rove.

It also came two days after Chief U.S. District Judge Thomas F. Hogan issued a contempt citation that ordered Cooper to testify. [emphasis mind]

And here we were congratulating VandeHei for--after getting scooped by Jane on the real substance of the Vivnovka leak--really providing details in this story. But look at the details he doesn't provide. VandeHei admits Rove testified to having spoken to Cooper two days after Cooper was held to be in contempt. But he doesn't tell us whether Rove turned over the email before or after Cooper was held to be in contempt. Seems relevant, doesn't it? That is, did Luskin and Rove wait until it seemed likely that Cooper would testify before turning over the email? Sure looks that way, although VandeHei tries to hide that detail.

Also, VandeHei says this was Rove's second grand jury appearance. I'm 90% sure this was his third appearance. (I'm going to research these details and update the post.) Why suggest this was the second appearance unless you're stupid, sloppy, or trying to hide the fact that Rove testified twice, not once, before revealing his conversation with Cooper.

And I suspect that Rove was still leaving open the possibility that he had not leaked to Cooper.  VandeHei's source says that Rove testified that:

he had in fact had a conversation with Cooper

And the email indicated that:

Matt Cooper called to give me a heads-up that he's got a welfare reform story coming, When he finished his brief heads-up he immediately launched into Niger. Isn't this damaging? Hasn't the president been hurt? I didn't take the bait, but I said if I were him I wouldn't get Time far out in front on this.

The email is carefully constructed to avoid any mention of the substance of the Plame conversation. It makes it appear as if the conversation didn't even mention the substance of the White House's counterargument to Wilson, much less Plame's identity.

Further, this email makes it appear as if the central thrust of the conversation wasn't Plame or Niger, but welfare reform. As we'll see later, that doesn't accord with what we know of the truth.

Finally, why not tell Hadley the truth. It is almost certain that Hadley was aware of this leak. And we know Rove and Libby were trading notes about who (Novak) was going to write a story, so we ought to assume that Hadley was also receiving similar updates. So why not tell Hadley the truth, which would have been something like, "I talked to Cooper and seeded the Plame identity with him."

It seems, then, no matter when this was written, as delivered to Fitzgerald it was written entirely to obfuscate the conversation with Cooper. One way or another, this is part of Rove's obstruction of justice. It's just not entirely clear how he tried to pull it off.

Cooper's Rove testimony

Luskin and Rove were still trying to avoid telling the truth.

On July 11, after Time had revealed that Rove was Cooper's source but before Cooper testified, Luskin was still unwilling to admit that Rove was Cooper's source.

Reached last night at home, Luskin said he would neither confirm or deny that his client, Rove, ever spoke to Novak about Plame: "That particular question is not something I want to address at this point," he said.

But then by July 15, Rove and Luskin were not only willing to admit that Rove had talked to Cooper, they were releasing the content of Rove's email about Cooper.This was almost certainly an attempt to coach Cooper's testimony. As Cooper says of his testimony,

A surprising line of questioning had to do with, of all things, welfare reform. The prosecutor asked if I had ever called Mr. Rove about the topic of welfare reform. Just the day before my grand jury testimony Rove's lawyer, Robert Luskin, had told journalists that when I telephoned Rove that July, it was about welfare reform and that I suddenly switched topics to the Wilson matter. After my grand jury appearance, I did go back and review my e-mails from that week, and it seems as if I was, at the beginning of the week, hoping to publish an article in TIME on lessons of the 1996 welfare-reform law, but the article got put aside, as often happens when news overtakes story plans. My welfare-reform story ran as a short item two months later, and I was asked about it extensively. To me this suggested that Rove may have testified that we had talked about welfare reform, and indeed earlier in the week, I may have left a message with his office asking if I could talk to him about welfare reform. But I can't find any record of talking about it with him on July 11, and I don't recall doing so.

One thing I'm curious about ... did Cooper tell the person on the White House switchboard, who first begged off but then put Cooper through, what he was writing about? Cooper doesn't say.

As I told the grand jury--and we went over this in microscopic, excruciating detail, which may someday prove relevant--I recall calling Rove from my office at TIME magazine through the White House switchboard and being transferred to his office. I believe a woman answered the phone and said words to the effect that Rove wasn't there or was busy before going on vacation. But then, I recall, she said something like, "Hang on," and I was transferred to him.

But I can't think of any phone screening situation where you get connected before the receptionist  learns the intent of the call, as well as the name of the caller. And given the circumstance--Rove's about to go on vacation at the end of stressful week, he's trying to get out the door--I can't believe the receptionist would have put through the call without inquiring to find out how timely the call was. Could it wait until Karl returned to vacation? Was this a pressing issue? What is the deadline, if any? Add in the fact that Cooper's call was first denied, and then put through, and I strongly suspect the receptionist (and Susan Ralston, who presumably judged Karl should take the call) learned that Cooper was calling about Wilson, not about welfare reform.

In other words, the sheer fact that this call got put through supports Cooper's version of the story, and not Karl's. Which means the reference to welfare reform is almost certainly fraudulent. (Note, this raises the possibility that this email was altered when Cooper wrote the welfare reform story, two months later, at which point it would have been clear that there was an interest in burying evidence of the call. Update: Cooper's welfare reform story appeared in the September 22 issue of Time--although it looks like there was an earlier part to this.This would be the perfect timing for it to be fresh in Rove's brain when he was cooking up a coverup around September 28.)

In any case, Luskin offered to have Rove testify again at "the end of July." Cooper's story on this is dateed July 25 (it appeared before that). I'm not exactly sure of this timeline, but the dates suggest that Rove didn't offer to testify again until after Cooper had shot down the welfare reform story (that is, when it was clear that Cooper had not accepted Luskin's coaching). Fitzgerald, of course, waited until after Judy spilled her beans before he brought Rove before the grand jury. Presumably, that grand jury appearance by itself didn't impress Fitzgerald. It wasn't until the day before Fitzmas that Luskin admitted something that raised Fitzgerald's interest enough to get him to hold off. Was that something Vivnovka's testimony? I don't know how it would help. It doesn't change the fact that Rove had been "reminded" he had talked to Cooper before he first testified, but that he didn't admit to that conversation until he had already testified twice before.

Analysis

I'm hoping some techies will come by and either shoot down or fine tune this theory. But here's what I think.

I know that emails are notoriously difficult to eliminate or create after the fact. That's because it's almost impossible to change the time attributes of the email, to remove it from an email register or to change where it appears in that register.

But how difficult is it to change its content? If it's easier--or even feasible--to change email content, here's what I think happened:

1. Rove wrote Hadley an email with a generic subject line (Update?) that said something like, "I spoke to Cooper, gave him the Plame leak. He seemed a little hostile to our story, but that's one more person we've seeded this with.")
2. In those 4 days plus 11 hours that Abu Gonzales bought Rove, he had this email (and any others that he's probably still hiding) altered to read something like, "Had a conversation with a Time reporter before I went on vacation." No mention of the subpoena search terms you might expect--Niger, Wilson, Plame--nor even a mention of the journalist's name. This altered email would not appear in a sort of emails related to the Plame leak.
3. This altered email ALSO would not be responsive to the second subpoena, asking for conversations related to Cooper. (Of course, if it's possible to alter emails like this, then it's just as likely they stripped it of the name Cooper once the second subpoena went out; Abu G reviewed the emails that went out in this second batch, too, so there would have been time to do the fix.)
4. Vivnovka's leak back to Luskin did nothing more than put Rove and Luskin on guard--some people were talking about Rove's conversation with Cooper. But since they knew (probably having been involved in this obstruction as well) that the phone logs didn't mention Cooper, they believed Fitzgerald would have no evidence of a Rove-Cooper conversation (and on this point, they'd be right).
5. Rove and Luskin probably reviewed the situation when Cooper received his first subpoena, and figured they were still safe. If the Russert and Cooper subpoenas were after the same person (as they appeared to be) then Rove knew they were not for him. He probably knew they named Libby.
6. Rove and Luskin started sweating after Fitzgerald subpoenaed Cooper again in September. That told them that a) Cooper had revealed that Libby wasn't his first source--he had at least hinted to Fitzgerald he had an earlier source, and b) Fitzgerald was going to pressure Cooper to get that information. Now, perhaps Rove and Luskin believed that Cooper might not be held in contempt for such a broadly-drawn subpoena. But they were almost certainly trying to find a way to admit they had spoken with Cooper, provide an excuse for why they hadn't admitted this previously, yet leave the testimony open enough so that if Cooper didn't reveal that Rove was the first source, Rove would not have to admit that fact.
7. As soon as it became clear that Cooper would be held in contempt, they had the email altered one more time, this time to admit there had been a conversation without admitting that Rove had revealed Plame's identity. Note that--once they handed this email over--they were stuck with whatever story it said. They wouldn't be able to alter it again.
8. In July 2005, after Time revealed Rove was Cooper's source but before Cooper testified, Luskin and Rove then released the content of this email. They almost certainly released this email in an attempt to coach Cooper's testimony, to try to convince Cooper that he had called about welfare reform, not Wilson--it didn't work. And, at the same time Luskin "offered" to have Rove testify again, in hopes he'd get an opportunity to fix his testimony.
9. Finally, Luskin has been throwing everything at the wall of late, in an attempt to explain away the fact that he didn't produce the email, or Rove's marginally honest testimony, until after he knew Cooper would testify.

I just wonder how many other journalists' phone calls to Rove have been hidden from Fitzgerald.

Update:

Some clarification to the timeline and formatting fixes.

Update 2:

To support the notion that--however Rove obstructed the investigation, he did it after the fact--is this quote from Joe Wilson:

Apparently, according to two journalist sources of mine, when Rove learned that he might have violated the law, he turned on Cheney and Libby and made it clear that he held them responsible for the problem they had created for the administration. The protracted silence on this topic from the White House masks considerable tension between the Office of the President and the Office of the Vice President.

Are Wilson's sources really in a position to know when Rove learned of this leak? I'd say no ... except that Tweety, who does have close ties to Rove and a reason to dislike Libby, has demonstrably provided Wilson some pretty critical information on this leak.

If Wilson's sources are correct, then I find it harder (although not impossible) to believe that Rove's email really said what has been reported.

Also, check out Greg's comment, where he describes the hoops a budding conspirator would have to jump through to alter these emails after the fact. Thanks Greg!

Comments

[KM]

Intriguing. I await the techies' response.

At any rate, the e-mail is too clearly, conveniently and precisely self-exculpatory not to have been deliberately drafted as such, irrespective of timing.

BTW, do you mean "... when Cooper received his first *subpoena*" in item #5 above?

[al-Fubar]

its content was adapted after the fact

You mean edited? (In a way that wouldn't stick out like a sore thumb to Fitz's FBI guys.) Is that technically feasible, for anyone but an ubergeek?

I wish I could comment on the substance, but people like you and Jeralyn are downright scary in keeping score on this timeline stuff.

-- Rick

[emptywheel]

Rick, that's the idea, that the content of the email changed, probably three times, from:

"I talked to Cooper and it seems like he's going to write a story on Plame's identity, although he sounds hostile to our story" (which would closely parallel what Rove told Libby about his Novak conversation.

to

"I had a conversation with a reporter

[emptywheel]

Oops, didn't mean to post that yet.

to

"Had a conversation abotu welfare reform"

to

"Had a conversation about welfare reform and Niger came up."

KM

Yes, you're right. Fixed now.

[MediaFreeze]

Forged email is one possibility.

Another is that the Rove was not supposed to tell Cooper about Plame yet, since it had been decided that Bob Novak was going to be the reporter to break the story. So, Rove was lying to Hadley.

It is also possible that the investigation did have the email. They were under no obligation to share this fact with anyone. Perhaps Rove didn't know they had it, or was simply betting that Cooper would not be compelled to testify.

There was quite a spirited discussion of this in pollyusa's dKos diary yesterday UPDATE: WAPO: Viveca/Luskin talk before Rove's 1st testmony in early 2004, that I think is good Plamology reading.

What I now think is:

1. Rove did write the email to Hadley on July 11, 2004.

2. Rove lied to Hadley about what he said to Cooper because he was not supposed to blab it out yet.

3. The investigators did find the email in 2003, but did not mention it to anyone in the WH.

4. Novak told Luskin about Cooper around January 2004.

5. Rove decided to lie to the GJ and not mention his contact with Cooper even though he could not know whether or not they had found the email. Even if they had the email Rove was betting that Fitz would not get to the reporters.

6. Once it becomes clear that Fitz is going after the reporters Rove gets afraid that Cooper will testify. Rove coughs up the email and goes in to testify in October 2004.

This raises some very interesting questions:

Why did Rove lie to Hadley?

Was Hadley coordinating or involved in an intentional leak strategy?

Was Hadley supposed to get the info out to Novak first?

[along]

Re, the very beginning: Can you clarify the events and procedures a bit? I'm not familiar with what went on then:
1. The DOJ initiates an investigation, at the request of the CIA.
2. On Sept. 29, the DOJ contacts Gonzales to inform him, and hence the WH, of this. Are you saying that Gonzales knew of the investigation 4 days earlier, and didn't inform anyone else at the WH until this DOJ contact? See transcript of earlier and subsequent memos: http://www.fas.org/sgp/bush/leakmemos.html
3. Sept. 30: Gonzales informs entire WH staff of investigation, and instructs them to preserve and maintain all related materials, but does not specify parameters.
4. Later that day: (is this the 11 hour gap you mention?) Gonzales specifies the parameters of the investigation, presumably word for word from the DOJ request. (Is the actual DOJ request available to us?) His memo still is concerned only wth perserving and maintaining, not producing.
5. Oct. 3: Gonzales memo goes out to entire WH staff requiring THEM to search for, copy, and then hand over, all relaveant materials within four days.
Several questions here: Is this when the WH IT guys enter the picture? They go around from office to office searching hard drives and email accounts? It doesn't sound like it. It sounds like each employee (and/or their assistants) were required to produce everything on their own.
Which production is then what the DOJ investigators have to go on.
Is that right?
And were FBI investigators involved? Or does that come later in 2003?
If so, did they have access to the primary documents and hard drives, or just to the copied versions created by WH staff?

Thanks,
Andrew

[emptywheel]

MF

Hadley is probably the leading candidate to be Novak's Mr. X (and possibly Woody's too). Which would mean he DID get the info to Novak first.

Also, keep in mind that Rove and Libby were leaking about a DIFFERENT communication to Hadley during the summer. They were trying to spin it as part of the discussion of what Tenet would say in his mea culpa.

Back at the White House, Mr. Rove and Mr. Libby had been at work all week, along with Ms. Rice's deputy, Stephen Hadley, helping to craft a statement that was issued on Friday by George Tenet, the C.I.A. director. Mr. Tenet did precisely what the White House needed: he took responsibility for the inclusion of the 16 words on uranium in the president's speech, and he made clear that Mr. Cheney had neither dispatched Mr. Wilson to Niger nor been briefed on what he found there.

But CIA quickly refuted that claim.

In other words, this isn't the only communication with Hadley that Rove or Libby seems to be attempting to clean up.

[Crazy]

Call me crazy, but what if it's the email that Luskin leaked to the press right before Cooper testified that has been altered?
After seeing all the Bullshit that Luskin's throwing around lately, it wouldn't surprise me if the actual email sent to Hadley (which Fitz has a copy of) reads a little something like this....

Matt Cooper called to give a heads-up that he's got a welfare reform story coming, when he finished, immediately launched into Niger.
"Isn't this damaging? Hasn't the president been hurt?" ......didn't take the bait, but I said if I were him I wouldn't get Time out on this..... didn't take the bait....stupid fucking Cooper.

[MediaFreeze]

I realize that Mr. X may have talked to Novak at this point, but the story was not published until July 14, 2003, so Cooper could have scooped Novak after talking to Rove.

We spent a lot of time noodling the email stuff yesterday, and both the forgery and the this other posibility could explain the discrepency between the email and the Cooper testimony. I just think this is more likely, because forging emails would involve more people and seems too complex to pull off.

Anyway, please review our thoughts over there and let us know what you think.

And, by the way, thanks for all your bulldoggedness on this issue. It has been very inspiring.

[LindyH]

I spoke to my domain host. He says that if the e-mail in the original resides on the WH network, it is possible to alter that by pressing "send again" and going into the text, but then you have to print it, because if you send it again, the mail server will show the updated time in its transaction log. The mail server doesn't hold a copy of the actual e-mail, it just maintains a transaction log. Seems that they should be looking for the received version to see if the two match up if they want to prove the e-mail was altered.

[Gregs]

Forging email:

Depends on how the sytem is setup. If I were the Tech in charge of getting the stuff, AND interested in the truth, here's how it would happen. (And in short, nearly impossible to forge or change an email with out massive help from a wide variety of people, including the technical people.)

I'd likely have archive tapes from the days/weeks/months in question. These tape would have been created/mastered at the time they represent and removed from the system physically. I'd simply restore the data from these tapes to an offline server, and recover all the email into it. Then I'd do a series of searches.

So, to forge this information, you'd have to have physical access to the tapes and probably an offline system that you could reconstruct the whole thing back to, then forge/change it, and then "recreate" the backup tape, taking extreme care that the file and other dates all matched the time and date the "real" backup had occured on.

That's a huge bit of work, and IMHO, likely to be caught unless you have massive compliance and cover-up from a very wide variety of people.

That also requires that there's no careful independent audit of the process from someone who's going to review things (the backup tape, and its contents) in a forensic and methodical way.

If you are simply going to provide hard copies, then probably it's doable without anyone noticing. However, if these hard-copies come into question, it's going to become blaringly obvious in short order that someone's tampered with things. Since a techie isn't likely to want to go to do hard time, it's going to turn really ugly really quickly.

I can't say it wasn't forged, but to do so with any real plausability will require a very careful, and very involved operation requiging the cooperation of at least several individuals, lots of time and resources in terms of hardware and such. Stuff that's not likely to go unnoticed by others uninvolved with such a conspiracy.

I'm available to discuss this offline too. I'd be more than glad to offer my expertise to the discussion. Email and phone work fine - email me first and I'll get you other contact methods.

Cheers,
Greg

[Swopa]

Fitzgerald knew he had to find at least two conversations between White House officials and Time reporters before July 17.

Well, we know that Cooper spoke with Libby. And we know from the missing-passage WaPo article Josh Marshall rescued a while back that in discussing how Libby should reply to Cooper and other "pending media inquiries" (in the words of Libby's indictment), Cheney told Scooter to refer reporters to Ari Fleischer.

As you're no doubt aware, there's a crackpot theory floating around the Internet that this decision by Cheney/Libby led to Ari Fleischer and someone else leaking about Plame to at least six reporters from Air Force One. Since Cooper spoke to Libby after the Air Force Two powwow, isn't it likely that he put a call in to Fleischer and wound up being one of the 1x2x6 leakees, too?

If Fitz knew Cooper had been leaked to from Air Force One and also spoke to Libby, he might have assumed those were Time's multiple government officials ... and been surprised to find there was one more he hadn't known about.

[al-Fubar]

Greg's discussion really puts a strain on the edited-email aspect, IMHO. It requires that techies down in the WH computer-operations department be willing to commit a crime, and the more people you bring into a cover-up the greater your security problem.

Moreover, it requires that Rove be aware of the problem. Most people aren't, particularly of his generation, which grew up when the only computers were in a special room somewhere, tended by a white-coated priesthood.

Look at the embarrassment - discussed by DemFromCT just down-board - about the "Strategy for Victory" pdf document, which had the author's name a keystroke away from easy view. That says volumes about the tech-savviness of WH heavyweights. Zero.

-- Rick

[emptypockets]

I hate to even dip my toe into these discussions because I am so far out of my league in keeping track of how all the currents flow as you & colleagues have mapped, emtpywheel, but one quite non-techy thought:

does it need to be an alteration of an earlier email, or could Rove just have set his computer clock back & sent a new email with that date on it?

It would explain why the email didn't turn up in earlier searches (it hadn't been written yet) and it is not a bad panic move if he realized his conversations with Cooper were about to come out & Rove needed some evidence that he hadn't said anything about Plame in them.

I imagine how the time-stamping works depends on the server -- there is probably a log somewhere of when the message was received by the server, and that wouldn't jibe with the date on the message -- and if there are archive tapes as Greg suggests (& sounds likely) the whole plan is sunk... but that's all assuming someone thinks to check those things & not trust the timestamp on the message. And one can imagine excuses at the ready for the discrepancy ("it was in my outbox but for some reason hadn't gotten sent yet..."). Also, if these are accounts used for "personal and political" messages they probably are not allowed to go through White House servers, is that possible? (like on west wing, they have to leave the offices to make campaign calls.) Maybe he's just got a freaking gmail account they're pulling stuff from, for all we know. Makes retracing tracks harder.

most email programs, though, trust the timestamp that the sender puts on the message... and if they are just pulling messages off Rove's computer, not from the receipient's, seems like this would be sufficient to fake an old message. possible?

[Anonymous Liberal]

I agree with Swopa. It's too hard to edit emails, and it would involve too many people. Moreover, the government tends to ask for emails in their native format (i.e. in electronic form), not simply printed out. They do that because they want not only the email, but the meta-data that comes with it. It's one thing to forge a printed email, but it's quite another to forge a .pst file, complete with all the correct meta-data.

[emptywheel]

Greg, thanks very much for the information.

I agree with Rick, your take on it makes the altered email theory much less likely. Although, Rick, don't forget Manuel Miranda and someone else (at SSCI) who have gone through the Dem archives seemingly at will. I understand the Justice hack was very very easy. I'd assume the Intelligence committee hack (where the GOP got a different strategy email) HAS to be more difficult.

Swopa,

How do you reason that Ari could be one of the 1X2X6 people when he is clearly a key witness in indicting OTHER people. There's no way in hell that Fitz would use someone as compromised as Ari would be (if he were the leaker) as the critical witness in his Libby indictment.

[emptywheel]

There an interesting detail that appears somewhere in a VandeHei story from earlier this year.

It said that the email wasn't turned over until sometime this year.

But we know Rove testified to the content of the email last Fall. If you look at the questions I had about VandeHei's article from yesterday, the date the EMAIL was turned over is still vague.

It'd be really really hard to believe. But is it possible Rove testified to teh existence of an email last fall. But didn't turn it over until closer to the Cooper testimony?

[Swopa]

Isn't the whole idea of "flipping" people that you get guilty people to turn on the higher-ups who told them to do it?

[emptywheel]

~pockets

This email, at least according to the Luskin leak du jour, is from Rove's government account. So everything Greg says would apply to the difficulty of faking it.

[QuickSilver]

EW, I remember Luskin telling journalists in early July 2005 that Rove had testified "two or three times" before. The Los Angeles Times was the first to correctly report that Rove had testified three times as of that point.

VandeHei's source is Luskin, so naturally Luskin is trying to paint an opportunistic picture for his client (and for himself). I'm 90% sure you're right, and that Oct 2004 marked Rove's third appearance.

[Semblance]

If Rove was going to fake the email, he would not have put the word "Niger" in it, since that would make the previous search failure hard to explain.

[Manys]

If the WH is using Microsoft Exchange, the architecture is such that the server stores one copy of every email, with a pointer from every recipient's mailbox to that one message. When all of the recipients delete their pointer (what appears to be the email in Outlook), then the actual email is finally deleted from the database. Though I'm not sure what would actually be required here (it would be fairly easy to find out), what this means is that as long as the email is in the Exchange system then someone only has to change the body of the text in the actual database and the text in everyone's copy will change. Given that the JET database used in Exchange is fairly well documented and that it also has groovy NSA backdoors and surveillance features, I don't imagine alteration being very difficult for someone who probably already knows how to do it anyway.

[Pat]

Can the other half of E-mail to Hadley be obtained.
Every sent e-mail should also have a received component.
How does the received portion of the e-mail read? Is it available?

[KM]

Semblance, I think the more remarkable point is that "Niger" is the *only* searchword that appears in the e-mail -- no mention even of "Wilson". Can you construct your own version of Rove's exculpatory e-mail without *any* of the relevant searchwords in it?

[emptywheel]

Yes, Swopa. But you need to prove that the flipees interest in flipping doesn't discredit the witness. If the witness has a ton to lose and he ends up getting off very easy, than all your trials based on the witness will fail.

Libby could very credibly argue, if Ari is one of the 1X2X6 leakers, than he is actually a BIGGER criminal (espionage) than Libby (perjury) is. And Ari's testimony is really really critical to the Libby testimony. His is the one that discredits the whole "I forgot" claim. So you can't have someone who flipped to avoid an espionage charge be the key witness to prove a perjury charge. Your case would be laughed out of court.

[emptywheel]

KM

How's this:

I talked to Cooper about the 16 words. I told him to back off the story.

Would only show up in the Cooper search, not the Wilson one. After all, Novak is the guy who develops the talking points, doesn't he?

[orionATl]

damn this is fun to read. a print soap opera acted sans script and fascinating as hell.

i'm going to be really sad when all these sons of bithches end up in jail. but then again there will be the abrahmson/rove scandals to keep me happy.

[emptywheel]

Yeah, Orion, about the only upside of the GOP scum is that they're the corruption gift that keeps on giving.

Not much of an upside, really.

[KM]

Darn, EW, was trying to help out.

Well, I do think Rove needs to leave in "Matt Cooper called", "welfare reform", "When he finished ... he immediately launched into" and "I didn't take his bait" in order to achieve his self-exculpatory aims.

So I guess the question is whether the edited e-mail works just as well with "the 16 words" substituted for "Niger". Maybe it does. IMO it becomes suspiciously vague and the wording even more tortured than before; and it's much farther (and clearly so) from the subject of Wilson's trip than "Niger" is. My point to Semblance was that I don't think the fact that "Niger" is in the e-mail is on its own all that damaging to the ex-post content-editing case. It would have been very hard to reconstruct that e-mail, and achieve its possible or likely objectives, in a way that would have avoided any of the relevant search terms altogether.

[Gregs]

---quote---
If the WH is using Microsoft Exchange, the architecture is such that the server stores one copy of every email, with a pointer from every recipient's mailbox to that one message. When all of the recipients delete their pointer (what appears to be the email in Outlook), then the actual email is finally deleted from the database. Though I'm not sure what would actually be required here (it would be fairly easy to find out), what this means is that as long as the email is in the Exchange system then someone only has to change the body of the text in the actual database and the text in everyone's copy will change. Given that the JET database used in Exchange is fairly well documented and that it also has groovy NSA backdoors and surveillance features, I don't imagine alteration being very difficult for someone who probably already knows how to do it anyway.
---quote---

True, at least as far as it goes.

This follows the same path as the printed version.

If I happen to want to examine the authenticity more closely, then I'd go to the archive tapes/system. These tapes would have been archived, say the end of the week of the actual date on the email or daily etc.

I'd restore these archives to a backup server and comb through them. If the version in the archive didn't match exactly to that provided in hard-copy you have a vast net to throw over everyone. Some tech somewhere did the deed. He'll be *very* scared of the result/outcome of the criminal act of doing what he'd been told. Undoubtedly he'll fold quickly and give up the people above him who instructed him to do so.

The only way a forgery of modification can work is if you can either do it prior to it's being archived - and if I were the gvmt where cost is almost no object, archives would occur DAILY or more often, say snap-shots every hour, and written to tape at the end of the day. Or the other way, would be to make the archives disappear. (Does eighteen and a half minutes, ring a bell?) The first doesn't appear likely. The second, who knows.

(Also, perhaps someone else knows about the working structure at the WH, but I'd assume the IT staff is government employed and isn't direcly controlled by the WH. Thus the actual technical staff probably has a lot less political bent than others and would be a lot less likely to be involved in some jiggy stuff... In short, these are not politicos and hired and fired for their political correct-ness. I'd be *very* interested in anyone that can shed light on the employee structure and command chain etc...)

In short, a technical cover-up would be difficult to do so it would be undetectable if examined.

That DOES NOT mean a forgery, or modification did not occur. It only means that if examined with any vigor, it likely will fall more quickly than a toilet paper bridge in a monsoon. The technical requirements to do it right probably preclude it being done well, though I, being the ultra paranoid type, wonder about the willingness of the government to cover up. But, I suspect those most technically capable and able to do this work are not happy with this administration and thus, it makes it less likely.

Cheers,
Greg

[Tilli (Mojave Desert)]

Re the email contents:

Why would Rove mention "welfare reform" to Hadley? Hadley isn't involved with domestic issues.

Why didn't he just cut to the chase re Niger? Rove doesn't strike me as a chatty type of emailer, so it must be some kind of cushion.

[QuickSilver]

EW, what do you make of "I didn't take the bait"?

That phrase really gets under my skin. It is the main reason I'm sure this isn't a forgery. After all, Rove said in his e-mail that he told Cooper and Time not to get too far out on the story. But what is "bait"? What did the word "bait" mean to Hadley? Hadley would have to know that if Rove took the bait, it would mean saying something more than he already did (presumably about Mrs. Wilson's CIA identity and position). The e-mail is a tell, and the word "bait" is highly problematic and incriminating.

*

I didn't really explain my point (above) about Luskin saying to journalists, back in July 2005, that his client has spoken to the grand jury "two or three times." I remember reading that back then and thinking to myself, what? Luskin doesn't know how many times his client has testified to the grand jury? What kind of lawyer is he?

But the truth is more complex... Luskin was trying to be vague about the exact number of grand jury appearances because their timing clearly relates to obstruction of justice charges against his client (and very possibly for Luskin as well). I'm sure Luskin was highly aware of Rove's legal exposure back in July.

By the way, your comments assume that Luskin made the e-mail public himself -- are you sure of that? I recall that it was reported by the AP. At the time, I wondered who leaked the e-mail and how the e-mail helped Rove's case... yes, I know Luskin spun it as a record of a welfare reform conversation, but in light of Cooper's testimony it has turned out to be very damaging to Rove. FWIW, I think the e-mail was produced by Luskin only after Rove's third grand jury appearance, with an open offer for his client to come in and discuss it again before the grand jury... To my mind that's the only reason I can see for Luskin making it public, since the e-mail doesn't help Rove much otherwise.

Good work on that switchboard stuff, by the way. I think you're right, only the Wilson/Niger topic would have persuaded Rove to take the call. It's quite obvious Cooper left certain details out of his Time magazine account of his testimony, and this was probably one of them.

[Swopa]

EW, what do you make of "I didn't take the bait"?

That's a great question. It's an important enough point to Rove that he says it twice. Is it a coded way of saying that he didn't use the dirt about Wilson's wife (i.e., lying to Hadley)? Or is their code sufficiently convoluted that it's a way of saying that he did?

Are their any examples in Libby's book of someone speaking in code? Especially using a negative phrase to connote a positive action? :-)

(P.S. Emptywheel, about Fleischer ... this is yet another fine mess you've gotten us into!)

[Swopa]

Ooops, I revoke the part about Rove saying it twice. That appears to be an error in EW's transcription.

[QuickSilver]

wait, wait, I take that back...I've got the flu and am not thinking right. The Hadley e-mail was apparently produced just before Rove's third grand jury appearance.

But there was something else that was brought to Rove/Luskin's attention following that third grand jury appearance (perhaps more testimony from Hadley?) that prompted Luskin to give Fitz an open-ended offer for Rove to come in once again to clear things up.... I'm still unclear why Luskin would leak the e-mail to help his client's story.

[a gnostic]

if they have ms exchange, which I kinda doubt but you never know, i could shed some light on that being an ms systems admin... i hope i don't embarass myself that being the case...

anyhow, the sent items emails can't be just edited, you would have to jump through some hoops to edit that...

now. they COULD import an edited sent items folder that has been tampered with and overwrite the existing sent items... then their hired techie could go back in the backup system, painstakingly removing each days sent items per the original while changing the date on the server for the each day's back-up of Rove's mailbox to include the tampered sent items of each day.... etc. etc. etc.

point is, I think that it could be done but it would be tedious work and what if the techie gets subpoenaed... whose ass is he going to save, especially if a better techie comes in and finds some evidence of tampering, like in the security event logs? (fitz, if you read blogs, and might be reading this, THINK my man, think of ALL the possibilities, programmers can EASILY change dates around, moreso than a lowly admin such as myself.)

[emptywheel]

QS

"Take the bait."

This has never made sense to me. But I suspect it is meant to appear as if Reporters were out there trying to entrap SAOs to leak Plame's identity, but that Rove nobly withstood the temptation. But I think that reading would support the fraudulent email. I can't think of ANY legitimate reading of "bait." None.

I agree Luskin (and faithful mouthpiece VandeHei) are obscuring when and how many times Rove testified. We know it was four. But we don't know when the second happened. But if we take the Libby pattern as any indication, maybe Rove testified twice in quick succession? I know someone has better dates somewhere ... I just can't find them.

I have no real evidence that Luskin turned over the email, that's a good point. But this is one of the things I'm fairly sure about. There is no source listed in the article--it's virgin birth. But if I were planting a leak that I knew could be construed as tampering, I'd want to hide all attribution. And there's no reason for anyone else to leak it at that point. Either the person who was willing to leak already would have. Or he (Fitz) wouldn't leak it.

I think the chronology was:

Release email (or not) simultaneous with Rove's third GJ appearance

Leak it the day before Cooper's testimony (when I write it like that, it appears even more likely it was a leak)

Cooper testifies

Luskin offers to have Rove testify again

I'm not sure of the timing of the last--it's another thing being obscured. But it is always reported (that I can find) that Luskin made the offer "at the end" of July. Cooper had not only testified, but he had published his version of the testimony.

Which is one more piece of evidence suggesting Rove was waiting to see if he had to go back.

Swopa

Sorry about that Fleischer thing. You had me absolutely convinced (and I still might believe he's Pincus' Mr. X). But there's no way he's witness 1 against Libby and he's also one of the big leakers. I DO think it increasingly likely he's SAO (and if it were Ari, it would explain Tom Maguire's demotion point, that he goes from SAO to AO to aide). Most importantly, though, I think it impossible that Ari is the one who leaked Plame's covert status.

I took out that second bait comment. Thanks, swopa.

[emptywheel]

Here's a pretty comprehensive Jeralyn timeline of Rove's lying ways. But no details about when the (presumably) second GJ appearance was.

[Armando]

Motive is not an element of the crime I know, but it is persuasive.

And I think one thing your timeline ignores is the timing of the potential obstruction - the 2004 election.

It is my view, expressed in my post of a few days ago, that Rove took the obstruction plunge (if he did) because he simply could not step away at the time, he reall is Bush's Brain, and he ratonalized it by saying the damage to the camapaign would be too great.

In that respect, it has some resemblance to the Watergate coverup.

Making Woodward's obtuseness even more ironic.

[Armando]

My post - http://www.dailykos.com/storyonly/2005/12/1/215513/292

[AvengingAngel]

For all the latest Rove/PlameGate news, briefings, documents, timelines and other key materials, visit:

"The Rove/PlameGate Scandal Resource Center."

[Barn Babe]

We assume that you can not fix an e-mail. But, first of all, these guys are good at fixing things. Now, I sent an e-mail to myself after I changed the date on my PC to read Dec 25. It came in at Dec 4, BUT, the sent e-mail says Dec 25 in the body and in my Sent folder. I believe if I had changed it in Dos or my configs, that the Dec 25th date would have shown on the incoming e-mail. I would like to know we are looking at a copy of the sent e-mail or the received? How wrong am I?

[mainsailset]

Please bear with my digression and try this little exercise. Say out loud to yourself ... very slowly and let it sink in, "Rove, Cheney, Libby, Hadley knew the Niger papers were forgeries" Now, let yourself ask when they knew and how they knew.

[sferrris]

I do not think there is any evidence to suggest any email message(s) were altered. First, if an unaltered email was found and compared against an altered email it would be highly inculpatory and would be more damaging in the end then the content of the orginal message. Second, to alter any email would obviously need the complicity of a number of IT personel who would know they were committing a felony. The email message may have likely existed on a number of servers and/or backup systems. A data recovery expert would very likely be able to tell whether or not an email message was altered and also recover the original message. I have nothing but contempt for Rove and Company, but I think it would be unlikely they could have altered an email message and gotten away with it.

[emptywheel]

Armando

Very good point. Never forget the image of Rove putting himself under the wheels of Air Force One, between the time he testified in Fall 2003 and the election. He said something to make sure his cover-up wouldn't be discovered until after the election.

sferris

Let me put it this way. There is absolutely evidence that obstruction occurred. It may have occurred because the WH conducted a farcical search and therefore missed a lot of responsive, but damaging, email. It may have occurred more prosaically, with someone simply withholding the incriminating email. Or it may have occured through some technical obstruction. But it happened. There's no innocent way the email was not found in searches responding to the known subpoenas.

Now all three of the scenarios I've described involve multiple people. Rove probably didn't do the search himself. Maybe Ralston did it. Maybe an IT person. Maybe Abu G is implicated in this. If Watergate AND Iran-Contra are any indication, Republican crooks do what needs to be done to protect POTUS and his closest advisors.

Does the altered email have advantages over the withheld email? Yes. It would take longer to discover (see also Armando's election point). It might NOT be discovered. It would explain why the email makes absolutely no sense given what we know about the conversation. And it would explain why Rove sent an email that made no sense when--according to Wilson's sources, at least--Rove didn't even know he was breaking the law when he supposedly "sent" the email.

In other words, they did something which will probably be discovered. Why is the technical trick any less likely than the non-technical one which would be discovered even earlier (and which doesn't make logical sense).

[emptywheel]

One more point. Adam Levine was interviewed about an email Rove sent in the minutes after he spoke to Cooper in July 2003 (it was spun by Luskin as proof that Rove wasn't obsessed with this call).

I think it much more likely Fitz brought him in to assess the validity of the email he had in hand. Is the time stamp on teh Rove-Hadley email before or after the Rove-Levine email? Inquiring minds want to know.

[seesdifferent]

David Corn is defending Novak. See my comment at dKos LINK

[MediaFreeze]

You guys are not considering the possibility that the investigation did uncover the email, and Fitz had it, but did not tell Rove before or after his first testimony. Fitz still needed Cooper's testimony.

Rove/Luskin began to suspect that they had it in summer 2004 and that's what caused them to cough it up.

[Garrett]

Regular network administrators (like myself) really can't weigh in on the difficulty of forging emails at the White House. You would hope and pray their setup is way more secure than your average system. Certainly for Hadley and friends, if not Rove.

There's a recent post out there by someone describing a system, post-Ollie North, that each email is encrypted and sent to seven secure offsite storages. They're checksummed, and the seven offsite storages occasionally check up on each other to make sure nothing is missing.

Though, caveat on security needed not necessarily meaning security in place. And mostly really just to tell the story.

I went to a party Friday night at the office of a company subcontracting out an important portion of Rendon Group's big "Slurp all newspaper articles in the world. Conduct information war with the results" plan. They wouldn't actually say, Rendon Group, out loud, but it's on their website. The president of this firm, that wouldn't say out loud who they work for, told me how they're setting up the wireless. Business plans, accounting memos, emails, problem and status reports for this somewhat secretive company, wireless!

It reassured me a bit, that a part of the information war is in the hands of know-nothings.

[carot]

"We assume that you can not fix an e-mail. But, first of all, these guys are good at fixing things. Now, I sent an e-mail to myself after I changed the date on my PC to read Dec 25. It came in at Dec 4, BUT, the sent e-mail says Dec 25 in the body and in my Sent folder. I believe if I had changed it in Dos or my configs, that the Dec 25th date would have shown on the incoming e-mail. I would like to know we are looking at a copy of the sent e-mail or the received? How wrong am I?"

I don't think that would be possible in this case. All emails in government departments would be encrypted, otherwise the Chinese or someone could read them with a sniffer at an ISP or router, or even by satellite like the NSA does. So any email would likely be stored in encrypted format which means no techs would be able to read any changes.

Also encryption would be using Kerberos which time stamps all communications. Usually if one computer is more than 5 minutes out time wise from another computer they can't communicate under Kerberos. This is to stop someone grabbing data, decoding it and then sending it on at a different time.

I would point out though these things need not be that secure. The Republicans were reading the Senate Democrats computer data for months at one point, and the network tech didn't even know how to set up network security let alone do it wrongly. It may well be the email is a similar problem.

[Sara]

I ditto the comment upthread calling attention to the fact that Hadley's work in the administration is about as far away from a reassessment of the 1996 Welfare Reform Bill as it could possibly be. It just makes no sense Hadley would be given a "heads up" on this topic.

I do remember that the day Bush took over from Clinton (while they were flogging the W-less keyboard stories) the Bushies totally tore out the Clinton Era WH system, and installed their own. Wouldn't it make sense at that time to have a programmer design a back-door system for "fixing" E-Mail messages as needed in the future? Maybe that accounts for why the Deputy National Security Advisor was seemingly pulled into a discussion of an eight year old Welfare Reform matter.

[joejoejoe]

al-Fubar - You make a good point about the PDF screw ups. It's not the first time either, the Pentagon screwed up the redaction of a report on the Calipari/Sgrena checkpoint shooting in Iraq. That's two instances of document mismanagement that a tech savvy White House might have avoided. That's circumstantial evidence that technology is an afterthought in the political operations.

[Leslie in CA]

Okay, I have to ask a stupid question. If Rove/Luskin released the content of the Hadley email in July, around the time of Cooper's testimony, then how is it possible that Luskin, in October, "discovered" the email, "quickly" turned it over to Fitz, and had Rove go in and change his testimony about talking with Cooper?

If they released info about the email in July, then they had to have "found" it by July, and the October discovery story is patently absurd. So what am I missing here?

[wrog]

> It's one thing to forge a printed email, but it's quite another to forge a .pst file,
> complete with all the correct meta-data.

I don't know where people are getting this from, but if it's just bits on disk, you can always rewrite them undetectably.

And if you're just changing text in the message body, you don't need to touch the meta-data.

The only thing you might have to do is fix a checksum, if .pst format even has individual checksums for the various message bodies, which I doubt, but even if so, I'd be really surprised if someone hasn't reverse-engineered the algorithm by now (the file format's been out there for something like 10 years -- even if Microsoft doesn't publish it, you can still attack the .dll that implements IBodyPart::Save() with a disassembler and see if it does anything other than write body text -- yes this is a gross violation of the EULA; like the people doing this are going to care...), at which point you basically have the tool to do whatever you like with a .pst file.

Note that without checksums, life is really simple w.r.t. mail kept on your own .pst (as opposed to a server):

Shut down your exchange/outlook client.
Edit the .pst file using EMACS in overwrite mode (or some other editor that's capable of editing binary files).
Search for the phrase that you want to change (presumably something that's unique to the message in question)
Make sure your substitute content is roughly the same length or slightly shorter (put in CRLFs at the end to make up the difference).
Save file.
Use utime() or a corresponding NT utility to restore the original file-write/access times.
Restart exchange/outlook.

Takes about 5 minutes and it's completely undetectable. The only thing that defeats it is having multiple backup copies of the .pst file or the original message to compare against -- and it is true that if the message lives on the server rather than in Karl's private .pst, then there will be lots of backups to mess with, thus making this scenario much less likely.

But if it's just Karl's own .pst on his personal machine, I wouldn't trust it for anything.

Yes, only a techie is going to know how to do this. And he's going to have to be fairly motivated. But we're dealing with folks who have access to lots of money and power. And you only need one techie.

The real question is, given the huge potential for blackmail, whether Karl is willing to let anyone have this kind of a hold over him.

[carot]

I wonder if Rove and Hadley used Blackberries for email, I know Rove often did. So the mail server might not be government, but from Research in Motion, probably in Canada. This sounds a bit more likely, that Luskin could access someting like that.

[ExcuseMeExcuseMe]

Greg and Others:

White House employees serve "at the pleasure of the President", which basically means that they can be hired or fired at will without explanation.

Having said that, though I believe that changing the email without detection of such alteration is neigh impossible, it isn’t unreasonable to suspect that this crew has placed operatives at every level for any possible future need.

I quite think that this administration is like the Mob as so many have stated, though I do believe the Mob operates with more honor. One way it might be comparable is that 1) if they do you a favor you owe big time, or 2) they make offers one can’t refuse. I’m not suggestion they are in the murder for hire business but I’m sure at least Rove has an index card file of pertinent personal information for most employees that could ever be of use to him. It is the way he operates, after all.

Furthermore, many in this administration are the dregs of the Reagan – or Iran-Contra – age, so they may have learned some lessons vis a vis email.

[ExcuseMeExcuseMe]

One other thing - though this is always considered "tinfoil hattery" and my intention is not to muddy the email waters or rehash the election - if changing election tabulation results is at all possible (and considering talk of Rove going into a room to make some phone calls and thereafter totals changing remarkably) – it isn’t farfetched to think that technical knowledge is available and possibly on the “Payroll”.

This is not an accusation, it is not even a suspicion, please don’t flame me. History with this administration tell us, however, that they are pretty much capable of anything. That we live in an environment where such thoughts or actions are not at all implausible is quite frightening.

[emptywheel]

carot

That's a good point. But I wonder whether (again) the Adam Levine interview wasn't designed to suss that out. If Rove sent Hadley an email on his Blackberry just after talking with Cooper, but then sent Levine an email on his main email account, then you've got to wonder why. Like I said, I think the Adam Levine interview may have served as a kind of index about the email process--or even simply to get a copy of the next consecutive email ROve sent.

[carot]

You can tell by the routers an email goes through whether it was the Blackberry, and they are listed in the email. The most likely way for Luskin to review Rove's emails was if Rove archived his emails himself. I doubt Blackberry would archive emails for anyone. Usually someone has a mailbox of a certain size which needs to be cleaned out, not many ISP's give email storage.
This would be a variation of switchboard calls, using Blackberries, encrypting communications and then delete or alter emails later if need be. This would imply though that Rove couldn't just delete it for some reason.

[cjdla]

do you folks even care that in the whole plamegate thing, there was no crime committed until AFTER the investigation started?

[ExcuseMeExcuseMe]

cjdla:

Do you mean no crime as yet prosecuted? The CIA asked the DOJ to investigate the "outing" of a CIA operative, which, if proven, is a crime. It may not have been proven yet (to our knowledge) but the investigation does, in fact, concern a crime.

What we are seeing is the possible attempt to cover-up a crime and obstruction of justice.

[carot]

If the Republicans would stop the perjury and obstructing justice we could see if there was an underlying crime or not.

[John Casper]

Thanks a ton emptywheel for all your work.

[Redshift]

Unless someone has specific information, I would definitely not assume the WH is using Outlook/Exchange, or anything modern. I don't have specific information about WH communications (and I would guess it's not publicly available, since they won't even confirm the floor plan of their offices) but the one thing I know from plenty of friends who've worked for the federal government is that their computer systems are, in general, more ancient than anything you can imagine seeing in the private sector.

For example, the closest thing I know from personal experience is that a certain high-security agency was still using Lotus Notes in some significant capacity as recently as a couple of years ago. (Of course, I have no knowledge of whether it was the system for the entire agency or not.) That's fairly mild, a more extreme example happened to a friend who worked on the healthcare system for government employees, who told of a co-worker wandering out after discussing how to exchange data with an insurance company, declaring in amazement "I've found someone who has older computers than we do!"

The WH may well be near the leading edge of IT for the Feds, but considering the general unwillingness of Congress to fund government operations adequately, the sluggish pace of gov't IT upgrades, and security and backup considerations, that's not saying much. I think that makes the "Diebold" scenario unlikely -- all this stuff is likely to be old enough and customized enough that they couldn't bring in politically-loyal IT types, even if they had them when they took office, or hire contractors to easily hack with it like Diebold's Access databases. Any alterations would have to be done by experienced federal IT staff, and the only leverage they'd have over them would be that they work at the White House and they can threaten them with all sorts of security crap. I don't see Rove making a plan to rely on that to save his bacon.

I could see him thinking he was very clever and modifying it in a way that is ultimately traceable, and then being stunned to find out he's not smarter than all those techies. That's what happened in Iran-Contra, if you'll recall -- a bunch of the conspirators thought they were in the clear because they'd deleted their emails to cover their tracks, and then stood there open-mouthed as investigators came in and pulled the automatic backups.

(It occurs to me that this may be a better explanation for the Fitzmas "meltdown" of WH political operations than the standard "Bush was mad at Rove and Cheney, and Rove was too busy covering his ass to do his job." Suddenly finding out that all your private electronic communications aren't as private as you thought can be quite a shock for executive/advisor types like Rove, and he may have been hampered simply by second-guessing what was safe to send.)

[Libby Sosume]

I think it is extremely unlikely that the email was planted or altered. Rove wouldn't be capable. If he really thought it was dangerous, he wouldn't have taken the chance of involving an IT geek to do it. And Rove is arrogant, so I don't think he would have bothered.

What I think happened is that he wrote the email originally that way, either

1. (as has been speculated) to give a heads up to Hadley without to appearing to be treading on Hadley's turf, or

2. (more likely) to chime in on a hot issue - but keep his own direct role under wraps.

My own bias is that I've always thought the Plame leak to be more likely the work of Cheney's office than Rove's.

[Libby Sosume]

I would add also that it is virtually impossible for even an IT geek to alter an electronic communication after the fact. There would be nightly and weekly backups. There would be copies of that email in so many places no one would be sure to find them all. And most likely it would still be IMpossible to alter the backup tapes and databases even if you found them all.

There is no "safe" way to use electronic email for criminal conspiracy.

[chris]

Mitchell Wade - coconspirator #2 in the Duke Cunningham case- had a defense and intelligence company named MZM that didn't do much until Wade bribed the Duke. One of the first contracts for MZM was in 2002 - for office furniture and intelligence work for the White House. The full nature of this work has never been disclosed- but I think that it is not unlikely that the WH had addressed the need for access to IT people who they thought would be very loyal.

[William Ockham]

The notion of an altered email is a red herring. If Rove or somebody else altered the email, why would they have altered in this way? Furthermore, when do you supposed they altered the email? Email is a particularly dicey thing to alter. It's very hard to know exactly where all the copies are (i.e., you have to wonder where are all the backups, did Hadley forward it to somebody else, etc.).

Let's think about the most straightforward explanation for this email, i.e. that Rove actually sent this email to Hadley and that the distortion of his phone conversation with Cooper is a deliberate act by Rove at the time. We know that during the summer of July 2003, the White House was desperately trying to play the blame game by scapegoating the CIA. They saw Wilson as a tool of the CIA in an internecine bureaucratic leak war over who would take the fall for the bogus reasons for the war. They needed to get out the story that Wilson was sent by low-level CIA bureaucrats (they didn't want Tenet to take the fall just yet, they needed his cooperation in the 16 words mea culpa). The easiest way to do that was to highlight the Plame-Wilson connection. Unfortunately, Plame was a NOC (and they knew it).

So, the WHIG came up with a strategy (which was also a criminal conspiracy). First, they would leak Plame's CIA association (but not her NOC status) to a few friendly reporters. These first leaks would be intended to get the D.C. gossip circuit going (by this point Joe Wilson was the talk of the town and several folks had figured out who he was). It was imperative that these reporters think this was just casual gossip. This was solely to establish the bogus "I heard it from reporters" defense. The conspirators absolutely believed that the reporters would never give up their sources (cf. Bush's remarks at the time). I suspect that Joe Wilson went public much sooner than they expected. I bet they didn't know that the CIA hadn't made him sign an NDA.

Now, re-read Rove's email. He needs to let Hadley know that the plan is working and Plame's name is out there, but he's not about to put any incriminating information in an email. He stuck in the the welfare reform bit because he knew he had documentation of a previous call about welfare reform. The Niger line communicates to Hadley the real subject of the call and fits with the cover story about reporters being the ones pushing the story. Without Cooper's testimony this email presents Rove as somebody who's not leaking, but rather valiantly trying to protect the President from a bogus story. The email only makes sense in the context of a contemporaneous cover story, not an after-the-fact cover-up.

[emptywheel]

William

The problem with your scenario is that somehow this email was not turned over to investigators, which is obstruction just as surely as altering the email is. So why would Rove EVER turn over the email, particularly as part of a ploy to get out of a perjury charge? He'd be trading obstruction for perjury, not a very good trade.

You see, one way or another, obstruction happened. So you need to figure out what method of obstruction is the most likely. Add in the many other problems with the email (its factual inaccuracy), and the contemporaneous cover story makes zero sense. Now, granted, Libby's lies don't make sense either. SO it's possibe they're just idiots. I'd buy that.

[Libby Sosume]

Actually, William's scenario is right on, and the same one I espouse.

There's no doubt there was both obstruction and perjury. But to construct a highly unlikely hypothesis about an altered email is probably barking up the wrong tree.

And for what? To explain an unstated assumption, perhaps that Haley and Rove were co-conspirators in a plan that was Rove's initiative from the beginning?

Maybe they weren't co-conspirators. Maybe the whole Plame leak deal was coooked up between NSC and Cheney - and Rove, while aware of it, wasn't really in on it, and while personally supportive of it, didn't want to acknowledge everything he knew, much less that he was helping it along on his own.

Rove didn't want to turn over the email because he was staying as far as possible from ground zero. The email isn't exculpatory anyway because the other party (Cooper) has testified quite differently. It's he-said, she-said. And once it became clear that Cooper already had or would probably testify, Rove had to turn it over and make the best of it he could.

Personally, though I despise Rove and feel he's culpable in this affair, I am not hung up on finding him to be the mastermind. Though I'd love to see himn frog-marched for something, I would not slit my wrists if it turned out the blame for this one couldn't be laid at his doorstep.

If the White House goes down because of Plame, Rove will go with it, regardless.

[emptywheel]

Libby

I don't think you understand my scenario.

But first, let me explain why yours, by itself, doesn't work.

Rove has admitted he leaked to Novak (after Novak testified to that fact). So there's no doubt he was involved in this. There's no doubt he's a co-conspirator--he has admitted as much. Maybe just as one mouthpiece (which is what I really think). But definitely AS a mouthpiece.

That doesn't make him the mastermind. It makes it likely that he shared data with Hadley (the email) and Libby (his conversation about his Novak conversation) about how much he had leaked. Again, both things he has testified to.

Now given that we know he was sharing this information, the question is what is most likely that he shared, and why. Frankly, we don't know. We have some evidence that suggests he didn't think this was a crime. Which would suggest he would have aimed for clarity over obfuscation. But we also know Rove is crafty as hell, which would support the contemporaneous CYA.

Still, if he was just trying to CYA when he wrote it and he was tangentially involved in the leak, it makes no sense that he ever turned over the email. Better to just say, I lied. Or better to say, gosh, now I remember. Because if you do that, you might get charged with perjury, but not obstruction. Once you turn over the email, you might avoid perjury charges (which seems to be why it was turned over). But you're liable for obstruction charges.

The only reason it makes sense to turn over the email when Rove did is if he is hiding something bigger (which might be the NOC status leak to Novak) until after the election. I'm not saying it didn't. I am saying that people who assume the withheld email option is somehow better from a strategic standpoint aren't really considering everything we know.

[William Ockham]

emptywheel is assuming that the email was deliberately not turned over to investigators and I don't think there is any indication of that. I think it really was just missed. It would have been better for Rove if this email had been turned over initially(assuming the contents have been honestly reported, if not, all bets are off). He could have repaired his testimony earlier ("Oh, yeah, I did talk to Cooper"). It doesn't implicate him at all for outing Plame.

Unfortunately (for Rove), the email doesn't help Rove at all after Cooper testified. It's entirely possible that Luskin really did find the email and turn it over (he's not the idiot people have been making him out to be). Once Luskin found the email, he had to turn it over. The whole bit about this somehow clearing Rove has always just been spin. The real deal here is covering up for the criminal conspiracy to violate the Espionage Act and/or the IIPA, because that conspiracy implicates the Vice President and the President. Rove, Libby, et. al. had two overriding goals in all this. First, they had to do whatever it took to delay past the 2004 election. Fitzgerald's respect for grand jury secrecy allowed them to do that. Second, they still have to protect the Vice President and President. If they have to fall on their swords to do that, I expect they will.

[emptywheel]

I guess there are two reasons why I find the evidence to be overwhelmingly in favor of the withheld email, no matter the method.

First, if you get a subpoena for records relating to Niger from a certain date, you search on Niger. If you get a subpoena for records relating to Matthew Cooper, you search on Cooper. Digitally. In which case, the only way this email didn't show up is if it said, "I spoke to Coooper about Nigeria" or something like that. Luskin is claiming the search terms didn't return the email. Fine, maybe they didn't. But if that were true, then the search terms were clearly unresponsive to the subpoena. One of the two cases must be true.

Second, the revelation of the email precisely matches Rove's defense. Rove has slowly revealed every more incriminating evidence each time he testified. He never revealed something he didn't have to, until he had to. And Rove and Luskin clearly timed their testimony (the GJ appearance just as Cooper was held in contempt, the offer to appear again just after Cooper had published his own account clearly contradicting Rove's) to the revelation of incriminating evidence. The submission of the email last fall would perfectly coincide with that strategy. Add in Waas' stories about additional clear evidence they obstructed evidence (particularly in coordinating stories with Novak), and you've got a pretty good indication they're willing to obstruct justice. (Note, this is not to say Luskin is incompetent. While I think Luskin blabbing about Cooper was a big fuckup, I think Luskin is clearly following a strategy that Rove likely pushed, one that is probably not going to get Karl off the charges, but already has put off the resulution of this until after the election.)

[ExcuseMeExcuseMe]

Why turn over the email at all, indeed. The answer is the search parameters. He knew what was out there and steered clear of it. He threw the dice on whether or not Fitzgerald had it. He may have thrown those same dice on whether or not Hadley would turn it over, or he and Hadley may have discussed the email.

Rove may be thought of as brilliant, but his sloppiness in this matter is gonna get him.

1) The email makes absolutely no sense unless Hadley was the “point man” on the smear. Hadley was Assistant to the President for National Security Affairs. These were not two buddies chewin the shit.

2) Consider that Cooper had left messages about welfare reform, and as far as we know, Rove did not return those calls. Consider Cooper as fairly new to the White House beat – why would Rove, who already has a tamed and eager press, speak to Cooper? Suddenly, Rove decides on the day he is leaving for vacation to take a call from Cooper. Why?

3) Consider that Rove, whether or not he knew Plame was NOC, said at the end of the conversation “I’ve already said too much.” That was not an accident. Rove admits to a “cub” reporter that he may have just said something that is classified? Sounds like Rove wanted someone to take the bait.

4) Remember that Rove spins all day everyday. He took the call from a somewhat unknown reporter calling (ostensibly) about welfare reform, never talks about welfare reform (according to Cooper) and then just happens to mention Plame/Wilson and then backs up by saying that he might have said too much?

5) Rove then writes an email to Hadley about welfare reform and then casually tosses in Plame/Wilson? Not on your life. Washington DC is a web of turf wars. Unless there was collusion for any reason, Rove and Hadley have nothing to share with each other. These are not altruistic people we are dealing with. It is either in their nature, or they spend most nights calculating how to get more power and how to deal with all those that are at the same time calculating how to get more power for themselves especially if they might impinge on your power.

The Rove email is “cover your ass” no matter when he wrote it.

Just my two cents.

[ExcuseMeExcuseMe]

Of course I left out my point - and I did have one - the answer lies somewhere, I think, with the search parameters.

My understanding is that at least initially, the prosecutor allows the subjects to do their own searches (as horrifying as that seems). Perhaps emptywheel has the definitive answer to that.

[ExcuseMeExcuseMe]

Oh. Chewin the fat. Sorry.

[emptywheel]

EMEM

I don't know the answer to that. Pachacutec, who is not a lawyer but talks fairly intelligently on such matters, once said prosecutor and searcher agree on search parameters. But that doesn't seem possible here. Otherwise, how would Fitz not have insisted on a straight "Niger" from the start or a straight "Cooper" in January. That's what just doesn't make sense to me. There's no way you'd search for communication about Cooper without sorting on Cooper.

[William Swann]

I doubt the forged email theory is true. But I do wonder about one aspect of this discussion. What mechanism would the prosecutor use to double-check any of these files or documents? His people would't have direct access to the email logs, as I'm sure there's a lot of unrelated sensitive information in there. Aren't they pretty much relying on the technical staff at the White House to sort through the information and turn relevant stuff over?

If that's the case, why would the White House staff double-check what they find through one source with a backup, or with any other source?

Of course, assuming they use one source, how would Rove or anyone anticipate what source it would be, and how would he access that source?

I'm not so sure that a forgery would have been discovered, even if there's a clear discrepancy with the backups. But I also think it's fanciful to think of Rove accessing the right database somewhere to alter that information.

[ExcuseMeExcuseMe]

I'm right there with you. Pachacutec was responding to questions I was pondering.

Everything he said made sense regarding agreement on search parameters, but it doesn't answer the question of who physically runs the search. If the prosecutor allows the target latitude in this matter – meaning the target runs the search – then there are certain things one could do – knowing what the email said – that would negate the selection of this email. For instance, if for some reason the word “kangaroo” was somewhere in the email, you could search for every email with Cooper but not if it contains “Kangaroo”. Just as a google search [+Cooper -kangaroo]. I figure you have probably covered this info, but others may be curious about how the email didn’t show up.

Admittedly, there would have to be a rather unique word in the particular email so that other emails wouldn’t be erroneously omitted. Though, having said that, an unattended person could search for all things Cooper except emails

1. Written by “X”
2. Sent to “Y”
3. on “99/99/9999”
4. at 99:99:99

Rove would still have been taking the chance that – or had knowledge that – others would also not provide this particular email. Or that Fitzgerald wouldn’t eventually get his hands on it. This means rock and a hard place. Hmmm. Perjury/Obstruction or Treason? Treason or Perjury/Obstruction? I may not have the proper criminal statutes, but you know what I mean. Which I believe is your line of thinking.

On the other hand, if the prosecutor has a representative watching the search, I have no clue how this email would not have turned up. I don’t think the prosecutor went in and removed computers because that would have raised hell about restricted and confidential information. Plus, I would think that Fitzgerald would not want to antagonize the White House and I could also believe that he would not do that – raid for computers - in deference to the Office of the President – or White House.

All of which tells me nothing because I think the email sits in many places on many computers if it was written at the time in question, I think it would be nearly impossible to create or change this email without detection, but I also believe that it is not implausible – well, I said all this above – and everything else is basically tin foil hat territory.

I wrote a longer piece up thread with some thoughts about how sloppy Rove is. I have no idea if any of those thoughts hold water for the detectives among us.

[ExcuseMeExcuseMe]

Sorry emptywheel - your long response on searches went up while I was writing mine. Sorry for the overlap.

[ExcuseMeExcuseMe]

William:

There could be any number of reasons it never made it - I've been speaking of searches, but it could just as easily be deleting the email from the records you provide to the prosecutor. Then hope everyone else does the same thing, which would make sense in a conspiracy type of way.

Fitzgerald could have gotten the email from another person's search. Or, he may have never had the email and they all tripped up and exposed it thinking it would exonerate Rove, which it does not.

[ExcuseMeExcuseMe]

William:

I wasn't clear on that. All of the points you mention support the idea that the email was a late night addition. I can't imagine Rove even knowing how many places this email resided. Except of course if they had an IT mole. I suppose that's possible.

But, after doing the searches as directed in the subpoena, they could have deleted those that they did not want to provide Fitzgerald. That's what I meant above.

It's all very "my sister my daughter my sister my daughter."

[emptywheel]

my sister my daughter my sister my daughter

LOL

[ExcuseMeExcuseMe]

EW:

I can't keep up. I swear I am not a troll and didn't see the Cost/Benefit Analysis before I posted these comments.

Mea Culpa

[Redshift]

Knowing that the prosecutors in Iran-Contra had people go and pull the backups (which included all the deleted email), it seems unlikely that prosecutors in this case would be limited by security constraints to just letting the potential targets and their staff do the searches. There may well have been some cleared official reviewing the results for "need to know" classified information, but I can't imagine it would be someone who works for the White House.

[ExcuseMeExcuseMe]

Redshift:

I don't think anyone knows for sure how the search was conducted and by whom under what circumstances.

But, if I remember correctly, Ashcroft and Gonzalez each vetted what was to be turned over (at different times, obviously.)

[William Ockham]

I see a very easy scenario for this email being missed. If you look at the wording of the Gonzalez memo, you see that, knowing what we know now, this email clearly was relevant, but was that obvious at the time the search was done? I think it is a mistake to assume that the email searchs were done by individuals. It seems far more likely that they were done centrally on the email server. The person(s) doing the search wasn't under an obligation to turn over every White House email that referenced Niger, just ones that referenced Wilson's trip, Wilson/Plame or the three mentioned reporters. In September 2003, a naive or uninformed person could easily have overlooked a message from Rove to Hadley about Cooper and Niger. Even in the Fitzgerald subpoenas in January 2004, there's still no mention of Cooper.

It seems quite plausible to me that Luskin, upon getting an inkling of a Rove-Cooper communication, decided to request a search of his client's emails that mentioned Cooper. Better to have your client volunteer the information, if it's going to come out anyway. Of course, this required Rove to change his testimony again (How many do-overs do you get, anyway?). I have no doubt that Rove is guilty of perjury, obstruction, and a bunch of other things.

[emptywheel]

William

Actually, there is a specific mention of Cooper in the January subpoenas (I just didn't include the list--click through to Tom Maguire's blog to see the list). As I explained, the subpoena mentions BY NAME Cooper and his two co-writers and a few more people at Time.

[Redshift]

EMEM,

I don't think anyone knows for sure how the search was conducted and by whom under what circumstances.

But, if I remember correctly, Ashcroft and Gonzalez each vetted what was to be turned over (at different times, obviously.)

Good point. I was forgetting that in this case, we can't count on all the refs being impartial. Still, I doubt that anything since Ashcroft recused himself would have been that sloppy.