Introduction

The Appeal Court in Denmark has presented its verdict: Gottfrid Svartholm Warg is found guilty of hacking CSC. According to the verdict there could have been other persons that committed the actual crime, but if so, he is anyhow guilty as jointly responsible. As an expert he must have been aware of his computer having been hacked, the court claims. Further, according to the court, he hasn't managed in any way to explain why anyone among those that had been given remote access to the computer should misuse it. Such misuse is 'quite unlikely' according to the court. 

The court also criticises him for not being supportive to the police by not giving them any names. – But he did, he offered them a handful of nicks when questioned two years ago. These nicks were never checked by the police, however.

The controversial question about remote control was resolved by the court: it stated that there were 'not sufficient grounds for excluding' that Gottfrid’s computer had been remotely controlled. The testimonies of Jacob Appelbaum, and a Danish technical witness engaged by the defence, are mentioned as a basis for this conclusion. - Here I could add that no other technical expertise was approved by the prosecutor; Gottfrid’s lawyer had to fight for these two, as well as for getting economical support for the investigations she and the technical expert found necessary.  (‘Equality of arms’? In no way.) I am grateful to both of these witnesses. They had to bear severe insults from the prosecutor, who showed  ill-mannered arrogance in court - a chapter of its own in this sad story. 

In the following I will go through some main points in the verdict and compare them to what the defence has claimed. For this I have mostly used my notes from Gottfrid’s lawyer's concluding speech. Since I do not possess the skills needed for full in-depth understanding of the technical facts referred to, there might be some mistakes in my text - but I am confident that the mistakes and oversights of the verdict are many, many more than mine.

The encrypted container

To begin with, it has been fully clear from the very start that files from CSC were found at an encrypted container (TrueCrypt) in Gottfrid's computer. It is claimed that access to this had to be made manually, by using a password. - But: we don't know if this was the case before the laptop was seized and investigated by the Swedish police. The key to the container was found in the Windows system, at the hard drive. The police changed the password for some reason or another, which might have had consequences for how the container could be accessed, manually or automatically.

It is claimed that this container was created when the laptop was given its name, which is said to be at the same time as when Windows was installed. - No, it got its name much earlier, when MacBook was installed. The name could have been copied later, in connection to the installation of Windows. Cf. that TrueCrypt and a chat program were copied to the laptop from another computer, as shown by the Swedish investigation.

‘The installation of Windows etc was made by Gottfrid himself.’ - No, if so, he would most probably have reported the use of IPv6 much earlier. That IPv6 was used – making the door open for remote control –was not noted until his technical witness reported it just a few weeks ago.

In the container, files from CSC were found as well as files from Logica, the Swedish hack that he was convicted of in 2013. He must be guilty as to CSC as well. –  But, there were around 245.000 files in 41.000 folders in the container. The CSC files were found together with files from the Nordea hack, in the same folder. The Logica files were more scattered, some in that folder, other in other places. Thus, CSC and Nordea seem to be more close to each other than CSC and Logica. - Noteworthy, Gottfrid was aquitted from the Nordea thing, a fact that the prosecutor never told the court. Instead, it was the defence that presented the Swedish Appeal Court's verdict in this case. The defence could also show that CSC and Nordea are more similar, technically, than what CSC and Logica are. The prosecutor did not discuss this.

‘One of the log files from Logica shows that Logica was attacked simultaneously with CSC.’ - Yes, but why didn't the Danish police check the user's name found in that log file? The Swedish police report states the identity of this person. It is not Gottfrid.

The chat

The encrypted container contains a chat, central for linking Gottfrid to the CSC hack, together with information found in some other chats. – But, we don't know from where this chat file emanates. It is not found in its original form, it has been transformed into a text file, parts of it have been copied within the file itself, the names of the interlocutors have been changed, we don't know if there are more than two persons participating in the chat, and so on. It was presented in court in a translated version, from English to Danish. On what grounds can this text be 'assumed to represent the original' as stated by the court? 

The other person involved in the CSC hack, who got 6 months in prison for this in October last year, has admitted that he was one of the chat participants. He also claimed that the person he chatted with was not Gottfrid, but another one that he had met in Cambodia in 2010. This is further testified by a secret recording from his cell, made by the police, in which he tells a friend that he actually chatted with someone else. Further, in the chat he turns to his chat mate by using a nick never connected to Gottfrid. This was never noticed by the Danish police man responsible for investigating the chat. (On top of all this, the prosecutor claimed in court that ‘we can't be sure’ about who is actually talking in this secret recording from the prison. Here I wish to repeat myself: the recording was made by the police.)

Nothing is stated in the verdict about all this, nothing at all.

Claims about the chat

Claim 1: One of the two persons in the chat must be Gottfrid. - But, some part at the beginning of the chat is in Danish. Gottfrid didn't know any Danish at that time, particularly not for writing the language. 

Claim 2: The person in the chat lives in Cambodia. - Well, there were also other persons living there by then. (The connection to Phnom Penh in the chat isn't very clear to me; I do remember however that the prosecutor presented, as some sort of evidence when referring to another chat, that the flight time between Singapore and Phnom Penh is one hour. A simple googling shows it is two.)

Claim 3: The person is connected to Sweden. The evidence for this noted in the verdict is that he claims that 'he is registered in SPAR' (= the register of Swedish citizens). - But, the person in the chat writes ‘I don't exist in SPAR’. What is this?!?! Mistranslation?!?? Misinterpretation?!?? 

One quite simple way of checking any presumed connection between Gottfrid and the statement in the chat, taking the court’s erroneous interpretation aside, would of course be to check whether Gottfrid was registered in SPAR or not at that time. The Danish police officer responsible for this part of the investigation never did. He told the court that he didn't do that, just because it is supposedly difficult to search for someone that doesn't exist in a register. He also claimed that he had heard from the Swedish police that Gottfrid had tried to erase himself from SPAR - but when, and from whom he got this information, he couldn't remember. 

(If anyone wonders: Gottfrid does exist in SPAR.)

Claim 4: The chat includes references to a Hercules emulator. - Well, in the chat the emulator is said to work. The one found in Gottfrid's other computer didn't, files were missing. 'They could have been lost later' was the prosecutor's comment to this.

Claim 5: The chat refers to the user name connected to the Hercules emulator. – Yes, but the same name is also found in another chat, not connected to Gottfrid. 

Claim 6: There is a short-cut at the laptop’s desktop to the Hercules referred to in the chat.  Gottfrid must have noticed it. – Well, the short-cut was visible to one of its seven user only, not to the other ones. 

Claim 7: There is information in the chat about a file, transferred to Pastebin, with a copy found in the encrypted container. - Well, Pastebin has been used for another file connected to the case. This was done in October 2013 when Gottfrid was kept far away from Internet. Shouldn't this transfer have been investigated as well?

Claim 8: A specific server/domain, respectively (the court mixes up these terms), are mentioned ‘several times’ in the chat (as well as in other chats, presumably connected to Gottfrid).  - Yes, Gottfrid's company has registered the domain, just as it has registered many other domains. He doesn't 'own' it though, as claimed by the prosecutor (who, by the way, called it a ‘home page’). And Gottfrid doesn't 'own' the server, it is actually situated in Japan. And he is definitely not the only person using it, and definitely not the only one referring to it in his chats.

Claim 9: In the chat there is a quote from the article from 1983, "Real Programmers don't use Pascal", also found in a chat connected to Logica, in exactly the same wordings. This connects Gottfrid to the chat and thus also to CSC. - Yes, quotes should be, and often are, verbatim. As reported earlier by the Danish it-activist Peter Kofod in a tweet, some 2000 identical quotes are easily found out there on the internet. He found them by simple googling. The Danish police could have found them there as well. But they didn't check.

The conclusion made by the court from these 'facts' picked out from the chat is that Gottfrid must be identical to one of the two persons involved in it. - Here I could add that the chat contains some 300.000 lines. And that the police never checked whether there was any information in any of these lines that pointed away from him, to his advantage. 

About IP-addresses 

In addition to discussing the chat, the court mentions that an IP-address used in the CSC hack has been proven to be connected to Gottfrid’s  computer. - But what about the other IP-addresses found in the hacking of CSC:

(1) The Bahnhof-address, connected to the person convicted in Logica together with Gottfrid? - No, this IP was never investigated, simply because the Danish it-police believed that 'Bahnhof' means 'railway station' only. (FYI, Bahnhof is a quite famous Swedish ISP.) 

(2) The IP connected to the ISP Citylink in Cambodia, which was used more than 500 times in the CSC hack?  - No, this IP was never investigated, simply because the Danish it-police didn't believe that the Cambodian police could manage to find any information about it.

(3) The IP-address in IRAN to which data from CSC was transferred? - No, this IP was never investigated, simply because the Danish it-police didn't find it meaningful to try.

 (4) A forth – or, fifth - IP-address noted? ... - And so on.

Search for Schengen information

Further, the court states that searches made in downloaded Schengen files, found in Gottfrid's computer, must have been made by him and him only. The reason: they are particularly related to him, both his name and his birth date were used when searching for him. - But, if he wished to find information about himself in the register, why did not he use the efficient way of doing it, by his own passport number, instead of trying different versions of his birth date? Other searches for other persons were also made, by using names, a passport number and so on. Thus, the person who did these searches knew how to get information from the files. 

The attack stopped

As a closing statement the court finds it 'striking' that the CSC hack attack stops when Gottfrid was arrested. It concludes, however, that it can not be excluded ‘theoretically’ that the attack continued after this date - but this doesn't matter, the crucial fact is that the attack stopped in its previous form. - Yes, the attack could have been going on for several more months, no one knows, because CSC never noticed that anything was ongoing. And the Danish police was slow, very slow, in reporting the information they got from the Swedish police. (This is yet another chapter in this sad story.) - Yes, the attacked stopped when Gottfrid was arrested. The instrument used was seized that day. Surprised, anyone?

Conclusion

There are so many more things to write about from this process, technical as well as other. I hope, though, that from what I have summarized above – also when taking into account that I am biased as being his mother - it has become evident that the investigation has not been objectively conducted. 

This was also emphasized by Gottfrid's lawyer. Most of the technical investigations made throughout the process were of a surprisingly low quality, many things were left out from them - e.g., only one out of the seven users of the computer was examined - and other investigations were made only after the defence explicitly demanded that they should be conducted, e.g., scanning for viruses. 

Gottfrid's lawyer concluded that the Danish police had only searched for things that talked against him. She used the phrase 'cherry picking' for this. Instead of an objective investigation the police had made what she called a ‘targeted attack’ against her client.

For my own conclusion, I wish to refer to what the defence's technical witness said to me when he had finished his testimony and left the court room. He is a former it-police officer, today responsible for the it-security of a big international company. He has definitely nothing to gain personally from his involvement in this process - I would say, on the contrary. 

His comment was that to him it was not important whether my son was guilty or not. The only important thing for him was to contribute to making this a fair trial, with fair evidence presented in a fair way.

I deeply regret that he, Jacob Appelbaum, and Gottfrid's lawyer Luise Hoej, all failed in their efforts to do so.

Kristina Svartholm