The Wingnuterer

Update Nut #1 - It has been pointed out by Saskboy and one other highly placed person directly connected to this Poutine affair that I have one point in error, the IP Address linked to the Pierre Poutine has not been directly link to the Burke Campaign Office.  If the IP address is linked to Private Persons internet access or if it the IP address of publicly available WiFi HotSpot (say a Starbucks) then this would place the noose around Prescott’s neck.  So even if Prescott is outed as Pierre Poutine (I’m not saying that it is, at this point), there is still the question of who is/was covering for him when the CIMS database logs were altered.

Update Nut #2 : I have mistakenly identified the Burke Campaign Manager as Marty Morgan and once as Marty Burke when it should be Ken Morgan.  I have corrected these errors and thank you to readers at tyhe Galloping Beaver for pointing out this error.

UPDATE NUT #3 : The Wingnuterer would like to welcome visitors from the Privy Council Office in Ottawa and what I am assume are our Honorable Members of the House of Commons. Nice to see you gents back and reading quality blogs like mine again,… Ok, it’s nice to see gents back reading my somewhat questionable blog again.

The last big news in Pierre Poutine saga was back on April 16th when it was revealed that Robocalls probe extends to Tory headquarters. In that news article it was revealed that log entries in the CIMS Database were blank for the individual whom they were inquiring about.

What does this mean Blank.  Well in a Database system, you can delete a record, but that does not mean that record has been removed.  In fact, the method of “Deletion” is to mark the record as deleted and in subsequent queries made on the Database, records marked as Deleted are not processed/included during those queries.  A record can only be purged from the Database permanently by crunching/compacting/compressing the database.  During this process, the main database files and indexes are completely rewritten and all data marked as Deleted are removed.

So why does this distinction require such a detailed explanation?  The answer is simple, the only way to remove data in a log file is to over write record(s) with new data, and to selectively write to a log file in a database requires special security.  By Special Security I am referring to the type of security that is required by someone who has Administrative Privileges and the type of access/tools to the database that would facilitate this type of operation.  From my understand, I do not believe that the CIMS web interface has those required tools built into its program.

Now keep all of the above in mind and lets look at the bomb shell that was dropped on Friday, May 4th. Robocalls IP address same as one used by Conservative candidate campaign worker, Elections Canada alleges. I am just going to point out some the most critical information, but I recommend you the entire article for yourself.

The sworn statement filed by Elections Canada investigator Al Mathews and released Friday makes a crucial link between the calls and the Internet Protocol address (IP) used to arrange the fraudulent calls made through Edmonton voice-broadcasting company RackNine.

The IP address was used both by Burke campaign worker Andrew Prescott to arrange legitimate calls with the company and by whoever placed the fraudulent calls that sent hundreds of electors to the wrong polling stations, Mathews alleges.

RackNine records provided to Elections Canada showed that Prescott’s account had been accessed from 99.225.28.34, a Rogers IP address in Guelph. He used his account to send out robocalls promoting Burke campaign events.

Now I think its more than fair to say that there is no smoking gun proof that Prescott logged into to the Poutine account and made the illegal phone calls.  It can only be said that same computer in the Burke Campaign office logged into the both the Poutine (client #93) and Prescott’s (client #45) account.

Wait a second, couldn’t the Poutine account have been accessed from any computer in the Burke Campaign Office since it was behind the firewall IP that was recorded?   Well the short answer is yes, but the real answer is no.  Any computer in the Burke Campaign Office would appear to be coming from the Rogers IP Address is 99.225.28.34 (the IP on record for the Burke Campaign) with a NAT firewall (NAT Firewalling is the most common and prevalent form of Firewall) unless it was routed through a proxy server.  Poutine did use a Proxy Server to hide his true IP address from the Rak-9 Servers, but on May 2nd he made a critical error that circumvented his use of the Saskatchewan based freeproxyserver.ca.  To better understand this error, we have to look at another news article.

From the National Post article John Ivison: Closing in on Pierre Poutine, published on Marth 8th, 2012 we learn how the owner of Rack-9, Matt Meier, was rightly pissed off that his company had been used as an instrument to thwart democracy, and how Matt Meier continued to investigate to uncover the true ID of Pierre Poutine.

Mr. Meier said he had his “Eureka” moment at 3 a.m. one morning, and by 5 a.m. had written a 22 page report for Elections Canada. “He [Pierre Jones] screwed up. Just for a fraction of a second but it was enough for me to find him,” he said.

So what was this Eureka Moment, the answer is not in this article, but I do remember a more detailed article that out lined an interview with Matt Meier on how he tracked down the trail of IP addresses used by Pierre Poutine, a trail of cookie crumbs (it took me a while to locate the exact article again). From the article Pierre Poutine: Will Mystery Robocaller be unmasked Monday? we have this very interesting tidbit of information

Early last Tuesday morning – as in 2:45 AM early – Meier sent me this message: ”I think I know who Pierre Poutine is!!! I’ve been scouring all servers for logs and I’m pretty sure he messed-up hiding himself.”

The brain-wave hit him, he told me later, in the middle of the night, when he suddenly remembered that he had a tertiary server, which he hadn’t turned over to Elections Canada, because it wasn’t subject to the original court-issued production order. When he went back and analyzed the data on that server, he realized that the person who’d uploaded the fake calls had used a phony IP address. But when that user signed off, Meier told me, he left behind a tell-tale “cookie”, which left a trail of what you might call digital cookie crumbs, that led, in turn, to the real IP address.

It was the Rack-9 Server Cookie that led back to the Burke Campaign IP Address, but if Poutine was using a proxy server, how could have Poutine screwed up and not used proxy server on May 2nd? The answer is this, Poutine did use the Proxy Server, but it didn’t matter because the computer he used had initial picked up its initial Rack-9 Server Cookie when Prescott had connected to the Rack-9 Servers to place earlier, legitimate Robocalls.

To understand this better we need to look at how Internet Cookies are used and what they are comprised of.  An Internet Cookie is a simple text file that is stored in your internet browser cache.  A cookie is issued from a web server that you connect to and the cookie can contain many different pieces if information, but the one single unique piece of information that is common to all cookies is a Unique IDentification code (UID).  Now many web servers may issue several different Internet Cookies associated to a computer connecting to them, but the most simplest and common cookie is the Tracking Cookie. A Tracking Cookie will always be unique to computer and a local computer user profile.  This cookie is what used Meier to tracked down the computer in the Burke Campaign Office, and that cookie was issued under the account that was used to access the Client #45 account.  We know this is the case because the Prescott account was setup before the Poutine’s (Client #93) and Prescott’s account would have been issued a Rack-9 Server Cookie first.  So when Poutine logged into the Rack-9 Servers from the Burke Campaign Office, the Rack-9 Server requested if the computer being used had any Rack-9 Server Cookie, which according to Matt Meier, it did.  The Computer at the Burke Campaign relayed it’s cookies back to Rack-9 Servers, which in turn logged the UID of the cookies in the Server Logs.  Now the Internet Cookie in question was a Logout Cookie, and this type of cookie isn’t consider a user identification cookie type, like those associated with user accounts, but are commonly used to track the last time a specific computer was connected to a server, but there’s the rub, the Cookie is assigned a UID and that UID can be associated with more than one user server account, but with only with one computer and one local computer user account on that computer.

So where does this leave us?  Lets examine the facts that we know are 100% certain

1. Pierre Poutine made #robocalls calls using Rack-9.
2. Pierre Poutine claimed to have been given Matt Meier’s personal and private connect information.
3. Pierre Poutine had sufficient security access to access the CIMS database and pull digital lists of NON-CPC supporters
4. Pierre Poutine had sufficient knowledge of setting up and using Burner Phones and untraceable Pay-Pal accounts.
5. Pierre Poutine had sufficient knowledge on how to use masking proxy servers.
6. Pierre Poutine had access to same computer and local computer user profile that was used by Prescott to connect to Rack-9 on May 2nd to make the illegal voter suppression #Robocalls.
7. The computer used to make these illegal voter suppression calls was used from behind the Burke Campaign NAT Firewall and is directly linked to Burke Campaign Rogers Account that was assigned the IP Address 99.225.28.34

So was there anyone else in the Burke Campaign Office that had the personal and private contact information for Matt Meier?  Well according to Prescott, he shared this contact information with  Michael Sona and Burke Campaign Manager Ken Morgan.  So we have three possible people who did have Matt Meier’ personal and private contact information, but we can rule out Michael Sona as Pierre Poutine, since it is known that Michael Sona acting as an observer at one of Guelph’s polling stations all day, and as such he could not have been in the Burke Campaign Office to place the illegal voter suppression #robocalls with Rack-9.

So we are down to two rats in the Burke Campaign office on the Day of May 2nd, Campaign Manager, Ken Morgan and Andrew Prescott.

Now that is not the end of this, ignoring the other 199 ridings that are being investigated, there is the very important point I made at the beginning of the article.  Someone with Administrative Rights to the CIMS database blanked out the log records which point to the Poutine List pull.  Now I am fairly certain, that no one in their right mind is going to allow people who are under suspicion of being Pierre Poutine or who are even associated the Burke Campaign to be allowed access to the CIMS database in order to prep a copy of the database that is intended to be sent to Elections Canada for this investigation.  So it is obvious that we have a person higher up the CPC food chain actively and knowingly attempting to cover up this crime.

As for Sona, Prescott and Morgan, there is two possible scenarios to consider.  Let me VERY CLEAR, these are only hypothetical possibilities, none have been proven in a court of law, nor is there any clear evidence to support them.

Possible Senario #1 : All three of them could have been in on it.  From news reports we know Sona was mouthing off about the idea of using misleadng calls during the campaign.  We know Prescott had all the skills and knowledge to put the plan in action.  Morgan was the man who allowed it happen, because we all know that in the CPC if you want to break wind, you need permission, in triplicate, before you’re allow to unclamp your sphincter.  Now I am not saying that this is way it happened, but given the nature of the CPC, it does beg the question.

Possible Scenario  #2 :  It was one of the three of the people in the Burke Campaign who had Matt Meier’s personal and private contact information.  So pick among the three, Sone, Prescott or Morgan.

Possible Scenario #3 : Prescott isn’t Poutine, it was someone else.  If this is the case, then that person went through extraordinary lengths to frame Prescott as the most likely suspect in the event that the Poutine Rack-9 #Robocalls were tracked to the Burke Campaign Office.

Still in the very end, given any of these three possible scenarios, the unavoidable fact remains that someone deliberately, maliciously and criminally altered the CIMS database logs that were given to Election Canada.  What’s the punishment for altering evidence, obstruction an investigation and criminal conspiracy?

19 Responses to “#RoboCon - The Noose Tightens Around The #CPC Neck”