News Blog Communication: Climategate detective: 'I'm deeply disappointed' we didn't catch hacker

Climategate detective: 'I'm deeply disappointed' we didn't catch hacker | Leo Hickman:

Norfolk police's Julian Gregory explains why investigation into the University of East Anglia's hacked emails was so complex
On Wednesday, Norfolk Police announced that it was formally ending its two-and-a-half-year investigation into the theft of thousands of private emails stored on servers at the University of East Anglia's Climatic Research Unit (CRU) – an event that has commonly come to be known as "Climategate".
Detective chief superintendent Julian Gregory, the senior investigating officer, said that due to the three-year statutory limitation placed on the investigation by the Computer Misuse Act 1990, he was closing the case now because there was no realistic chance of bringing a prosecution ahead of the third anniversary of the theft in November. He did say, though, that the "the data breach was the result of a sophisticated and carefully orchestrated attack" and that there was no evidence to suggest that anyone working at or associated with UEA was involved in the crime".
Norfolk Police gave a press conference yesterday in which it revealed some more details about the investigation. For example, DCS Gregory said that the hacker(s) had, whilst accessing the university's servers remotely via the internet, breached several passwords in order to gain access to the emails and other documents. He also said that officers had examined CCTV footage at CRU to investigate the possibility – subsequently ruled out - that a member of staff might have been involved.
DCS Gregory confirmed, too, that it was highly unlikely to have been a chance discovery by a hacker. It was a targeted attack. No other university in the UK experienced a similar attack over that same time period, he confirmed. (The hackers breached CRU's servers "certainly more than three times" between September and November 2009.) There was no evidence, he said, that the hack was committed, or commissioned, by a government or an individual/organisation with commercial interests.
He added: "This appears to have been done with the intention of influencing the global debate on climate change and ultimately that affects us all. To not have done the best we could on this investigation would have been neglect."
I was unable to attend the press conference in person. (Norfolk Police has produced a transcript of the press conference as a PDF, as well as broader background information here.) But yesterday afternoon I was able to put some further questions to DCS Gregory over the telephone...
Was the level of expertise required to pull of this kind of hack way beyond the kind of knowledge of, say, someone working in an IT department, or very familiar with computers, might have?
Yes, absolutely.
What is the hard evidence that you actually recovered?
Our technical investigation focused on CRUWEB8 [the web server that was first accessed by the hacker] and CRUBACK3 [a back-up server containing the emails which was accessed via CRUWEB8]. We identified the attacks that came in and their methodologies and some of the activities they undertook. The proxy servers they used either don't have the log switched on, or if they do they are overwritten within 24-48 hours. Hackers tend to choose proxy servers in countries where law enforcement agencies might find it challenging to get co-operation, or to get information. From the outset, you're almost on a hiding to nothing, to be perfectly frank.
So all that early speculation that a Russian server was involved so it must be a Russian, etc, was meaningless speculation?
Absolutely. We're not getting into naming countries, but I think it's fair to say that most continents were involved. As you know, you can be sitting on your computer, and causing something to happen on the other side of the world with a few clicks of the mouse.
Did the hackers try to manipulate the back-up server in anyway – delete any information, change timecodes etc? Or did they just go in, copy what they wanted, and leave?
They certainly tried to alter the web server – the web logs – and try to leave a false trail. They got into certain elements of the log-in system and deleted and created certain commands. That kind of activity.
Did they try to make it look like someone internal had accessed the server?
I'm speculating now, but I don't think they thought we'd get as far as we did in terms of finding out some of the things they'd done. But I think they tried to leave some things that they thought would mislead us or point us in the wrong direction.

In the second release of emails in November 2011, they left a message. Did you interrogate that document?
We did have some conversations with one or two specialists, but, to be honest, we didn't think it was going to take us anywhere productive, partly because if we took it at face value, say, linguistically, it could have been falsified. And even it was accurate, where does that take us? Because in the context of the investigation it wouldn't have helped. We did start to look at the trail in terms of the publishing, but again, you get into jurisdictional issues , different legal systems etc.
Late last year, you seized the computers of Roger Tattersall (aka "Tallbloke"), after a link to the second tranche of emails was posted on his blog. Were you just looking for an IP address?
Yes. Initially, we wanted to make sure he wasn't involved in way, but we wanted to see if we could get anything from his computers which might help.
Was there anything else other than the link being left on his blog that made him a suspect?
No. We were just following that trail. [The police later confirmed that Tattersall was not a suspect and returned his computers following a forensic inspection.]
Was there anything forensically similar between the release in 2009 and 2011?
A similar MO [modus operandi] was employed – hosted then linked to from other places – but in terms of the data it all came from CRUBACK3 and we were satisfied it had all come from the original attack, or same series of attacks.
Is there any advance in knowledge on the encrypted file said to contain the rest of the emails?
No.

Did you ever draw on international expertise, say, a US law enforcement agency?
We used UK-based assets, both police and private sector.
Is there an on-going investigation in the US, say, by the Department of Justice?
I'm a little unclear on that, to be honest.
If a third release occurred, would you reopen the investigation?
No, very unlikely. Not least because, come the autumn, the time limit will have passed for any prosecution. The crime committed was obtaining the data in the first place.
So they have got away with it, haven't they?
Essentially, yes. Much to our disappointment, of course.
It sounds as if much of the activity occurred within the first weeks and months of the investigation. What has happened over the last couple of years in terms of staffing etc? Have you been waiting for a new lead?
The investigation has been active, but in a way when we do some activity we are in the hands of people in other jurisdictions. So there have been some considerable delays. You go through the process and accepted method internationally of getting support for an investigation, but depending on the country in question, it depends upon the speed with which that happens, and effectiveness with which it happens.
Would that process basically involve asking to get hold of an IP address held on a server?
It would include that. But we also took the step where we openly engaged with talking to people in a structured way and see if they had anything to tell us. [It is known that the police interviewed by phone and email a range of people based abroad, such as climate sceptic bloggers and climate scientists.] At the end of the day, we didn't have any clear suspects so we were seeking information.
So, there was never a shortlist of suspects?
No.
So, you never targeted any, say, climate sceptics who were closely involved with the freedom of information requests submitted to CRU and, therefore, might know what was likely to be held on those servers and, therefore, have a possible motivation to get hold of it?
No. The focus of the investigation was let's start where the crime is and work out from there. Ultimately, unless you find that breadcrumb trail that takes you to somebody, you're never going to get a prosecution off the ground in reality. If you're dealing with a property crime and someone had got the stolen property on their premises, then you've got something to go on. But just because someone has a copy of "FOIA2009" or "FOIA2011" [the file names given by the hacker to the email releases in 2009 and 2011] on their computer, it means nothing because it's been mirrored all over the world.
Did you quickly rule out anyone from the university being involved?
It was the focus of the first few months to go through that option. But our primary line of inquiry was always the technology. We did work through everyone at UEA looking for the obvious, but once we'd achieved that that was mothballed.
Did the e-crimes unit say this was routine, run-of-the-mill hacking, or something more specialised or skilled?
Some things you might describe as standard. Using proxy servers, trying to change records on the systems to conceal your tracks – they might be called standard. But because of the varying nature of ICT infrastructure I think it's quite difficult to say that a particular MO stands out, or is distinctly similar to another attack. Most hackers will use the standard techniques we've discussed. I don't think there's anything which would make it similar to anything else. What they did conclude was that the activities that had been carried out indicated a high level of expertise and competence.
Did you interview any students, as opposed to just staff at UEA?
No. As you can imagine, the university is quite significant in size. It goes back to this being a proportionate investigation and finding a line of enquiry most likely to take us somewhere. We didn't engage on that kind of speculation. We dealt with some students within CRU, but we limited it to that.

Have you kept on top of all the internet speculation and commentary surrounding this case?
Firstly, you can't investigate what's said online. Secondly, you look at those blogs and most of it is speculative, uninformed and, occasionally, ridiculous.
But did you keep an eye on it in case someone came up with a possible lead or sensible theory, or did you see it as nonsense and a distraction?
The latter. I think it was Steven Mosher who said he knew who it was, or had a theory, at least. Maybe he does. Maybe he doesn't. Where does that take you? And is he likely to tell the police? The difference between the police and, say, journalists, is that we won't embark on a number of lines of enquiry because, ultimately, you can see that in terms of getting to where we need to get to - which is beyond reasonable doubt - it's not going to get you there. The fact that things are "interesting" is not always enough.
Did you and UEA collaborate in terms of announcing the end of the investigation? [Both put out press statements at the same time which linked to each other.]
We've always had a working relationship, as you would expect because they were the victims of the crime. But we obviously have different perspectives. What we said in our statement was what we wanted to say. The coordination part was along the lines of "you may want to say something and it would be sensible to coordinate that". That's not to say we wouldn't be mindful of their perspective on things, in the same way they'd be mindful of ours, if that makes sense.
Why did you feel that you had to add the statement about it not being the work of a whistleblower, knowing that this was a big question mark hanging over all this?
I always find some of the conspiracy theories mildly amusing, because anyone who knows anything about British policing knows that sort of level of collusion just doesn't happen. The reality is we knew it would be the first question asked. When you put together a press release you try to address the issues that people are going to ask you about so, given that was at the forefront of a number of people's minds, we thought we'd address that. All I can do is say how it is. We've found no evidence to implicate anyone from UEA and the nature of the attack – the level of sophistication – leads me to a hypothesis that it was very unlikely to be someone from UEA. I can't say 100% it wasn't. Of course, I can't. Unless you find the person responsible, and have clear evidence to implicate them, then you can't 100% eliminate other people.
Has it been a deeply frustrating case to work on?
Most investigations I work on are difficult as that's the nature of my business. But this one has been unique, certainly for Norfolk Constabulary, but probably nationally, possibly even internationally. It's been very interesting, but also challenging. And at a personal level I'm deeply disappointed we haven't reached a successful conclusion. The only thing I can say on behalf of myself and the team is that I'm very comfortable that we did everything we reasonably could have done to try and find out who was responsible.
Where you working under a particular budgetary constraint? If you'd thrown, say, 50 officers at this, would it have made much difference?
There are always budgetary considerations in any investigation. It's public money, after all. But were there any unnecessary restrictions that hindered the investigation? Then, no. In fact, quite the contrary. When we started the investigation, it was escalated to the highest level. We deemed it a "Category A" investigation, which is the highest in terms of public-interest resources. It was well supported by our Gold Group, which is strategic oversight and support to an investigation that you don't typically instigate for every case. Their role is to make sure I've got what I need. Throughout, I've felt well-supported. I've not been able to not do something because of money.