News Wars Episode II: Attack of the Clones
by David Pritchett, amateur legal analyst and journalist
While Craig Smith’s Blog and Independent’s Media Blog already have published their thorough and punchy accounts (with great photos at the Indy blog) of the legal hearing held earlier today and Episode I held yesterday about the latest chapter of The Mess, I offer my own unique perspectives here on Ampersand vs. City of Santa Barbara, which we all are learning really is just Wendy vs. Jerry. Ampersand is the corporate owner of the News-Press.
http://www.west.net/~smith/blog/index.shtml
http://independent.com/news/2007/may/02/emnews-pressem-cant-have-child-porn-back/
I had not stepped into a Santa Barbara County Superior Court room since I was once called to a jury pool in 1984. I am far more accustomed to the exposed format of the legislative side of local government, in the County Board room or the City Council Chambers, where no one would dare restrict a camera and brandishing a wireless phone for listening and texting is standard procedure during the meetings.
Against the side wall in the court room, a projection of the Judge’s rulings as a text document was shown on a large screen. Very cool to see justice edited in real time, most unlike the City Council decisions I often watch, where the staff response to Council direction is repeatedly“we’ll get back to you.” On the big screen in the court room, several quick cases were handled prior to Ampersand, as the Judge decided what, if anything, in the preliminary rulings would be changed in the final ruling. Using his own computer on the Bench with the projector showing his computer display, Judge Brown simply deleted and added text from his preliminary ruling to make it a final ruling, and then he sent it to print for the plaintiffs and defendants to pick up their justice delivered through an inkjet. Just don’t forget to save the file, Your Honor.
The rapidly deployed reports by Craig Smith and Matt Kettmann (Indy Media Blog) earlier today (02 May) tell the facts of the court hearing well, but a series of points by the Ampersand attorney, Barry Cappello, struck me as most interesting. Early in the hearing, Cappello quickly corrected (in a nice way) the Judge when Judge James W. Brown said that the computer hard disk in question was acquired as used hardware prior to anyone at News-Press having that disk in the computer (as discussed at length all over the blogs and recent news). Cappello said (I paraphrase) that the guy who sold the disk (or the whole computer?) would write a note to the court to verify that it was a new disk. That elicited zero response from the Judge, and some smirks in the audience.
In addition, Barry Cappello argued, emphatically, that one reason that Ampersand needed the original hard disks returned was that the Santa Barbara City police investigators were not using the proper software tools to find the contraband files on the disk. Cappello said the City was using MicroSoft products, but instead should have been using Apple software to find the files.
That new tidbit of software-tools-as-the-answer may have inspired an eyebrow to raise by the Judge, but both of mine were rising at that same moment from the second row. I kept thinking about the TV commercials of the frumpy PC Guy and the hip Mac Dude quipping about how Macs are better and foolproof. Apparently, a law enforcement agency would not be capable of using Apple software, even if that really were the issue. I wondered if the quest for porn had come down to a Windows vs. Macintosh question. If the police did have MacOS, would they need Tiger or Panther? Maybe the FBI will be using Linux instead?
Further in the legal hearing, a lot of the other arguments on both sides were about which computer(s) had original hard disks, what files were on those disks, and whether the “clone” of the disks was good enough to find the contraband pornography files that were really on the original disk now sequestered as evidence to a crime. Lots of talk was about clones and Clones of the hard disk, as making such a disk clone first is standard procedure for a forensic analysis of hidden files, according to the “disk cloning” entry at Wikipedia. I kept thinking about the hip Mac dude with a light sabre decapitating some battle droids.
As I started to realize that a City Transportation and Circulation Committee was more my style of government rather than a Superior Court hearing on technical nuances of computer clonal evidence under the California Public Records Act, I was jolted alert by Cappello stating that City Attorney Steve Wiley was “grandstanding” because Wiley dared to point out that the intent of Ampersand really just might be to “tarnish the reputation” of Jerry Roberts before evidence is properly analyzed for a potential criminal case regarding illegal porn. What was Wiley thinking?!
I could not ask Wiley about that, as he evaporated from the court room upon the close of the hearing, even faster than Scott Steepleton and Travis Armstrong did. I think Steepleton had to verify if the entire population of Santa Barbara County, or at least the same number of people, actually did not visit Alameda Park last year for a May Day march.
While live cameras were prohibited in the court room, plenty of pics and vid were recorded after the half-hour hearing in the dark tile hallway outside the court. From what I could hear of it in the beautiful but acoustically impaired hallway, Ampersand’s attorney Barry Cappello seemed to be trying to convince viewers of KSBY-TV6 what he could not convince Judge James W. Brown to believe. Cappello did acknowledge, though, that the disposition of the original, non clonal, hard disk would be up the Arbitrationer.
After the KSBY interview with Cappello, independent (small I) video producer Sam Tyler assertively asked Cappello about who and how the initial News-Press “article” came about with no by-line to reveal its author in that infamous smear article against Jerry Roberts, published on the front page of News-Press on Sunday, 23 April (Happy Earth Day, Jerry!). Cappello had no comments for Sam Tyler as Barry briskly left the building.
The mood in the courthouse hallway then changed. Other interviews became a klatch gathered around Dennis Merenbach, the attorney for Jerry Roberts. The tone was a bit more relaxed and jovial, or at least that is how it felt. But what do I know, as I, like most or all of everyone else there, is part of the Cabal.
Merenbach was a smooth talker, with an ancient, highly distressed leather briefcase at his feet. The newsies who had gathered around him, both pro and amateur, were highly interested in the plans by Merenbach for pursuing a libel case against Ampersand. Of course, he revealed no strategic details, but he stressed again their demand for a retraction of the hit piece against Roberts published 10 days earlier.
One snarky (that word again!) inquisitor asked Merenbach if a front-page retraction still would be acceptable, considering how the News-Press subscriptions and readership must have plummeted since the infamous anonymous article was published 10 days prior. Others in the crowd mumbled that the retraction demanded by Roberts (through his attorney) was as likely as sit-down negotiation ever happening between News-Press management and the Teamsters.
Local news media were well represented at this whole event, both during the court hearing and the public demonstration held outside in the half-hour prior, with participation by 53 people on a Wednesday morning. Besides the now-usual blogger journos, MSM included Daily Nexus, Daily Sound, Independent, Santa Maria Times, Santa Barbara Newsroom, KJEE radio, KSBY-TV, and maybe others. KEYT-TV3 was conspicuously absent, again, on covering this latest chapter of The Mess.
The KSBY story included reporter Carina Corral acting very Matt-Cotan in her mastery of her craft as their de facto Santa Barbara Bureau Chief.
http://ksby.com/Global/story.asp?S=6462241
While this News Wars saga definitely started last July with The Phantom Menace, we all should have A New Hope that the next episode is not about Revenge of the Sith but instead goes directly to the Return of the Jedi. Help me Obi-Wan Kenobi, you’re my only hope....
While Craig Smith’s Blog and Independent’s Media Blog already have published their thorough and punchy accounts (with great photos at the Indy blog) of the legal hearing held earlier today and Episode I held yesterday about the latest chapter of The Mess, I offer my own unique perspectives here on Ampersand vs. City of Santa Barbara, which we all are learning really is just Wendy vs. Jerry. Ampersand is the corporate owner of the News-Press.
http://www.west.net/~smith/blog/index.shtml
http://independent.com/news/2007/may/02/emnews-pressem-cant-have-child-porn-back/
I had not stepped into a Santa Barbara County Superior Court room since I was once called to a jury pool in 1984. I am far more accustomed to the exposed format of the legislative side of local government, in the County Board room or the City Council Chambers, where no one would dare restrict a camera and brandishing a wireless phone for listening and texting is standard procedure during the meetings.
Against the side wall in the court room, a projection of the Judge’s rulings as a text document was shown on a large screen. Very cool to see justice edited in real time, most unlike the City Council decisions I often watch, where the staff response to Council direction is repeatedly“we’ll get back to you.” On the big screen in the court room, several quick cases were handled prior to Ampersand, as the Judge decided what, if anything, in the preliminary rulings would be changed in the final ruling. Using his own computer on the Bench with the projector showing his computer display, Judge Brown simply deleted and added text from his preliminary ruling to make it a final ruling, and then he sent it to print for the plaintiffs and defendants to pick up their justice delivered through an inkjet. Just don’t forget to save the file, Your Honor.
The rapidly deployed reports by Craig Smith and Matt Kettmann (Indy Media Blog) earlier today (02 May) tell the facts of the court hearing well, but a series of points by the Ampersand attorney, Barry Cappello, struck me as most interesting. Early in the hearing, Cappello quickly corrected (in a nice way) the Judge when Judge James W. Brown said that the computer hard disk in question was acquired as used hardware prior to anyone at News-Press having that disk in the computer (as discussed at length all over the blogs and recent news). Cappello said (I paraphrase) that the guy who sold the disk (or the whole computer?) would write a note to the court to verify that it was a new disk. That elicited zero response from the Judge, and some smirks in the audience.
In addition, Barry Cappello argued, emphatically, that one reason that Ampersand needed the original hard disks returned was that the Santa Barbara City police investigators were not using the proper software tools to find the contraband files on the disk. Cappello said the City was using MicroSoft products, but instead should have been using Apple software to find the files.
That new tidbit of software-tools-as-the-answer may have inspired an eyebrow to raise by the Judge, but both of mine were rising at that same moment from the second row. I kept thinking about the TV commercials of the frumpy PC Guy and the hip Mac Dude quipping about how Macs are better and foolproof. Apparently, a law enforcement agency would not be capable of using Apple software, even if that really were the issue. I wondered if the quest for porn had come down to a Windows vs. Macintosh question. If the police did have MacOS, would they need Tiger or Panther? Maybe the FBI will be using Linux instead?
Further in the legal hearing, a lot of the other arguments on both sides were about which computer(s) had original hard disks, what files were on those disks, and whether the “clone” of the disks was good enough to find the contraband pornography files that were really on the original disk now sequestered as evidence to a crime. Lots of talk was about clones and Clones of the hard disk, as making such a disk clone first is standard procedure for a forensic analysis of hidden files, according to the “disk cloning” entry at Wikipedia. I kept thinking about the hip Mac dude with a light sabre decapitating some battle droids.
As I started to realize that a City Transportation and Circulation Committee was more my style of government rather than a Superior Court hearing on technical nuances of computer clonal evidence under the California Public Records Act, I was jolted alert by Cappello stating that City Attorney Steve Wiley was “grandstanding” because Wiley dared to point out that the intent of Ampersand really just might be to “tarnish the reputation” of Jerry Roberts before evidence is properly analyzed for a potential criminal case regarding illegal porn. What was Wiley thinking?!
I could not ask Wiley about that, as he evaporated from the court room upon the close of the hearing, even faster than Scott Steepleton and Travis Armstrong did. I think Steepleton had to verify if the entire population of Santa Barbara County, or at least the same number of people, actually did not visit Alameda Park last year for a May Day march.
While live cameras were prohibited in the court room, plenty of pics and vid were recorded after the half-hour hearing in the dark tile hallway outside the court. From what I could hear of it in the beautiful but acoustically impaired hallway, Ampersand’s attorney Barry Cappello seemed to be trying to convince viewers of KSBY-TV6 what he could not convince Judge James W. Brown to believe. Cappello did acknowledge, though, that the disposition of the original, non clonal, hard disk would be up the Arbitrationer.
After the KSBY interview with Cappello, independent (small I) video producer Sam Tyler assertively asked Cappello about who and how the initial News-Press “article” came about with no by-line to reveal its author in that infamous smear article against Jerry Roberts, published on the front page of News-Press on Sunday, 23 April (Happy Earth Day, Jerry!). Cappello had no comments for Sam Tyler as Barry briskly left the building.
The mood in the courthouse hallway then changed. Other interviews became a klatch gathered around Dennis Merenbach, the attorney for Jerry Roberts. The tone was a bit more relaxed and jovial, or at least that is how it felt. But what do I know, as I, like most or all of everyone else there, is part of the Cabal.
Merenbach was a smooth talker, with an ancient, highly distressed leather briefcase at his feet. The newsies who had gathered around him, both pro and amateur, were highly interested in the plans by Merenbach for pursuing a libel case against Ampersand. Of course, he revealed no strategic details, but he stressed again their demand for a retraction of the hit piece against Roberts published 10 days earlier.
One snarky (that word again!) inquisitor asked Merenbach if a front-page retraction still would be acceptable, considering how the News-Press subscriptions and readership must have plummeted since the infamous anonymous article was published 10 days prior. Others in the crowd mumbled that the retraction demanded by Roberts (through his attorney) was as likely as sit-down negotiation ever happening between News-Press management and the Teamsters.
Local news media were well represented at this whole event, both during the court hearing and the public demonstration held outside in the half-hour prior, with participation by 53 people on a Wednesday morning. Besides the now-usual blogger journos, MSM included Daily Nexus, Daily Sound, Independent, Santa Maria Times, Santa Barbara Newsroom, KJEE radio, KSBY-TV, and maybe others. KEYT-TV3 was conspicuously absent, again, on covering this latest chapter of The Mess.
The KSBY story included reporter Carina Corral acting very Matt-Cotan in her mastery of her craft as their de facto Santa Barbara Bureau Chief.
http://ksby.com/Global/story.asp?S=6462241
While this News Wars saga definitely started last July with The Phantom Menace, we all should have A New Hope that the next episode is not about Revenge of the Sith but instead goes directly to the Return of the Jedi. Help me Obi-Wan Kenobi, you’re my only hope....
Labels: Jerry Roberts, Santa Barbara News-Press
posted by Sara De la Guerra | 5/02/2007 10:32:00 PM
Our Community Guidelines ask that you use the Blogger/Open ID login or the
more private Name/URL option when making comments. Comments using "Anonymous" will not be published. For more info, see choosing an identity.
22 Comments:
Thanks David for the eyewitness account!
Being an Apple fan, I do think Spotlight is better than anything Redmond can give the lackluster XP or Vista...but how hard is it to do a search for "*.jpg" on any given hard drive? You will not come up with different results on a WinDoze machine. That's what great about Boolean queries.
If anybody questions this, try it on your WinDoze machine or your Mac....every ".jpg" file will show up with the "*.jpg" command in your search tool.
Capello is hoping for technological ignorance on the part of the judge -- shame on him! It's just another lie perpetrated by the News-Press man. Does anybody remember In Living Color?
These are not the hard disks you are looking for. Move along, move along.
You do not try, you either do or don't.
Great report David. Love the luminous details like the "highly distressed leather briefcase at his feet" (Merenbach). That's writing!
From what I gather,those files,not necessarily .JPG, had been deleted or formatted over thus there were no date stamped on them AFTER being recovered by either PD or data recovery people.I'm not familiar with Apple OS but the lawyer may have a point.But then again it had been worked on by experts so I'm sure they know what they're doing.Therefore,NP's lawyer is blowing smoke.
But WAIT !!! While all this was going on, ace-local-columnist Dr. Laura was out scooping everyone...
DL, according to her column today, actually DROVE the LENGTH of STATE STREET (really mixing with the people!) and she discovered something no one else has noticed: there are EMPTY storefronts, lots of them!!! And then she shrewdly concluded that the empty store fronts must have something to do with the economy (we are lucky to have someone writing who can connect the dots instead of that silly old Biased Barney guy.) So then DL did some real investigative work and asked around "as to what is going on" "(good idea, DL!) and she was told that the "leasing entity" (apparently all storefronts on State Street are owned by the "leasing entity" - a fact we had been ignorant of previously) was raising the rents too high for our little mom and pop stores to afford!!! Ye Gads and little fishes: who knew???
The result is that local stores might soon be replaced by "chains and such"... you know, things like Starbucks, or Pier One, or World Marketplace or Barnes and Noble, or Borders, or such like... stores that would spoil the current "quaintness" of downtown. And DL then warns us that exactly such a trend just ruined Lake Arrowhead! She then concludes that the City Council should start to think about this disturbing trend.
Isn't it great to have such an insightful city watchdog-journalist at work in our community. Too bad about Lake Arrowhead, though.
The NP has again smeared Roberts this morning in its report on yesterday's hearing! The portion accessible online (to those who do not have a subscription) not only mentions (only) Roberts as the user of the porno puter but spins the story in favor of the NP!
Not sure if we can quote NP here without someone being sued but in case it is okay here is the opening sentence from their online story-
"A judge on Wednesday said the News-Press has the right to try to determine who is responsible for putting what police say are more than 15,000 images of child and adult pornography on the hard drive of a computer used by former editor Jerry Roberts,"
Barry is speaking out his rear saying use apple tools. The police are/were using accept tools and practices.
And if it was still going on, then it would be easy to detect the proper network monitoring.
The organization file system on the hard drive is Specific to a mac os, but at the lowest level a hard drive stores bits. Those bits make up files whose format is known. Those files are stored on a filesystem, whose data structures are known.
So the NP should learn a bit, and take action against future hardware policies. Future systems may come with secure hard drives, encrypted at the hardware level. This will make difficult to read information from the hard drive without the encryption key.
Long winded, am impossible read online.
Look, those files can be dated (and they might have been already). The News-Press has a point, as dirty as they are. Don't forget that they might already know (and probably do) that Roberts is not the culprit. Making them double dirty.
If the hard drive(s) is contraband due to the presence of porn, why aren't the clones (and cloned porn) held by SBNP or their trolls also contraband. If original and copies of the stuff are equally illegal, why isn't law enforcement moving to take them into custody as well.
Here are hot links to video clips I took of the rally outside the courthouse Wednesday morning for anyone who missed it.
First one is Cathy Murillo speaking and second one is David Pritchett:
http://www.youtube.com/watch?v=ReTVDhOV8zc
http://www.youtube.com/watch?v=p7AkrDyDMa8
Courtesy of BobbyLuigi channel at youtube.com, which now has 15 video clips documenting News-Press saga from January to present.
Wendy McCaw's lawyers keep ... losing.
Does she like spending a fortune on losing in court and stirring up demonstrations outside of court that make her and her newspaper look terrible?
Or is she kinda into the abuse?
Or maybe McCaw's lawyers told her up front what the judge told them: wrong way, guys, doncha know you're supposed to go after the drives through Wendy's $25,000,000.00 arbitration.
She has now has put "porn" and "Roberts" in the same sentence in two news articles.
Just "reporting" on a defamation-protected court action. Just the facts, ma'am.
"but how hard is it to do a search for "*.jpg" on any given hard drive?"
Uh, no offense, Sara, but like Barry Cappello you clearly don't know anything about computer forensics and you shouldn't pretend you do, especially by injecting silly "Mac is better than PC" ideology -- whether it is or not simply isn't relevant here. Neither Microsoft nor Apple "products" are used -- the forensic tools come from third parties The files have been deleted or otherwise obscured, so end-user search tools, especially for a blatant and easily hidden marker like the filename extension, are irrelevant. And the files may have been wiped, in which case they can't be found on the clone, only on the original, by examining it for residual signals (although that's not likely in this case).
"Look, those files can be dated (and they might have been already)."
*Look*, you don't know what you're talking about. The only way to "date" a file is with the binary timestamp stored with it when it is created or modified -- a timestamp that comes from the machine's clock, which is often wrong. And the timestamp is just a piece of data in the file's header, and can be changed just like the file's name or access bits can be changed. There is no independent dating of information akin to carbon dating (which, aside from only applying to organic materials, is way too imprecise) -- writing data on the disk is a matter of changing magnetic polarities, and there is no way, even in theory, to determine when that occurred.
"The News-Press has a point"
No, the News-Press has no "point", other than to get as many people as possible to buy into their guff.
jqb -- I realize that. At the level of search that Capello was talking about, however, I was actually saying either one would work for files that are still there, if there are.
As always, thanks for your expertise...
not sure what dse is referring to, but the magnetization zones on a hard disk do demagnetize with an exponential decay law. The readout method must be analog and not digital to exploit this fact, and internal comparisons/controls must be used to calibrate. So I'd have to differ with jqb. There is a way to date the time at which information was first stored on a disk. I don't know if anybody is currently using this technique outside of certain forensic labs.
Oh, and Mac clock resets are logged in a file, so the current time can be used to make a reference table of past Mac clock time versus real time.
[lots of geek talk ahead]
"At the level of search that Capello was talking about, however, I was actually saying either one would work for files that are still there, if there are."
Sorry, but if you put a Mac drive on a PC, Microsoft's end-user search won't be able to access it at all; it won't even have a drive letter, because the operating system doesn't support Mac's HFS filesystem.
I think you're misunderstanding what Cappello is saying. The police are running forensic software (not end-user search tools) on a PC to analyze a Mac drive. Cappello apparently is claiming that they should be using forensic tools running on a Mac instead, but the claim is absurd; as long as the tools are designed to understand the Mac's HFS filesystem structure, it doesn't matter what machine they are running on.
"As always, thanks for your expertise..."
You're welcome.
"the magnetization zones on a hard disk do demagnetize with an exponential decay law"
The rate of decay is largely a function of temperature; without a precise graph of the temperature of the surface of the disk over its history, no such "readout" is possible. And if there were any significant decay of magnetic strength, disk drives would be designed to remagnetize the platters to avoid decay to the point of data loss, so the amount of decay wouldn't be informative. But actually data errors result primarily from random switching of magnetization direction in the particles of magnetic media -- the rate of which again is largely a function of temperature.
"Oh, and Mac clock resets are logged in a file, so the current time can be used to make a reference table of past Mac clock time versus real time."
Only if the clock rate was constant over the entire period, and no one ever modified the clock via the BIOS or pulled the CMOS battery out of the machine -- which of course would not be recorded in any file. And, as I noted, the timestamp is just a piece of data in a file header; it can be human or software generated without reference to any clock. The only timestamp that would be indicative of anything is the file's modification time (mtime), which can be set to any value by anyone with write access to the file. For instance, someone could have put those files on the machine while working at the NP, and then backdated them to look as if the files had been created before the NP purchased the machine. Or somebody could modify the time to be while Jerry Roberts was using the machine-- but what sort of person would do that? There's often a way to tell that such changes have been made, but not by looking solely at the disk drive. (Which is a big hint as to what that way is.)
on the magnetization, the temperature effects are self calibrating... files of known age are used to calibrate the effects jqb mentions.
Clock resets can be corrected for, and the drift in the clock is not so large as to mess up the time extraction at a significant level.
It's easy to see that anonymous is just making stuff up, since his comments aren't responsive to what I wrote. He is still talking about "clock resets" and "drift in the clock" when, for the third time, "it can be human or software generated without reference to any clock." As for "the temperature effects are self calibrating", that's nonsense; as I said, you would need a history of the temperature values over history -- "files of known age", even if you had any, wouldn't get you that.
The bottom line is that it is false that "the News-Press has a point" -- they, Barry Cappello, and "anonymous" are blowing smoke.
the temperature history need not be reconstructed, just its impact on the demagnetization, and that impact is calibrated by files of known times, which are plentiful.
Not all timestamps in all files are mtime, BTW. Extended records and internal timestamps are present on some files. There are other methods too... looking at old fragments around files, for example. BTW, if the disk had been defragmented, that does destroy much (not necessarily all) of the demagnetization time recovery.
Get a grip, jqb, no need to vent your insecurities in this blog. I'm pretty sure someone knows the dates and times of the files already. The News-Press does have a point, although you may not like it or believe so. And the further point may be that they already know the dates of the files, and know Roberts is exonerated.
Of course if I actually knew anything, I'd get sued. Good think I don't actually know anything.
I have no doubt the time of download and erasure of the images is more than likely established; the process of elimination and narrowing down of suspects has, I am sure, begun.
Post a Comment
<< Home