the Mootershead report - ASCII version
marcusw...@hughes.net
Report Submitted to the United States Chess Federation
by Brian Mottershead
1. Background
Starting in June 2005, posts have appeared on Usenet newsgroups under
the aliases of "samsloan", "Ray Gordon", "Jackass Lafferty",
"AndrewZito", and "judgem...@clerk.com", as well as others. The
posts on rec.games.chess.politics alone number in the thousands, and
were cross-posted on several other Usenet newsgroups,
rec.games.chess.misc, other rec.games.chess newsgroups,alt.chess, and
others.
In addition to impersonating Sam Sloan and Ray Gordon (who are real
participants in the newsgroups) as well as others, these posts, which
will be referred to here collectively as the Fake Sam Sloan (FSS)
posts, attacked and/or libelled the USCF, Sam Sloan, Ray Gordon, Brian
Lafferty, Bill Goichberg, Erik Anderson, Beatriz Marinello, Hal
Bogner, Paul Hoffman, Jennifer and Greg Shahade, and numerous other
officials, sponsors, staff, and members of the USCF in language that
was frequently extremely profane, obscene, indecent, racist, and
misogynist.
The participants in the Usenet chess forums have generally considered
one person responsible for these posts, and commonly refer to him as
the "Fake Sam Sloan", even though the poster in question impersonated
others as well, and some of his posts were under identities that were
not impersonations of others, but simply handles. I follow the
convention of referring to this Usenet poster as the "Fake Sam Sloan"
in this report.
In September 2007, while working as a web developer and system
administrator for the United States Chess Federation, a number of
"Fake Sam Sloan" posts came to my attention that were copies of posts
that had been made originally in the USCF Issues forum, but with the
wording changed so as to discredit the original poster. It was
apparent that in order to copy these posts, the "Fake Sam Sloan" had
access to the USCF Issues forum, as this is a forum restricted to USCF
members and is not accessible to the public. It seemed to me that it
was highly objectionable to use the USCF Issues forum in this manner,
and that it was my duty as the Administrator of the forums to stop or
deter that type of usage if I could. At the outset, I was aware that
there had been speculation that Paul Truong was the "Fake Sam Sloan".
Though I had been outspoken in opposition to Paul Truong's candidacy
for Executive Board, I did not give this speculation any great
credence at the beginning.
I wanted to see if I could identify who the Fake Sam Sloan was, using
information in the log files and the forums database. Since the IP
addresses of Usenet posters are public information, and in the USCF
web logs and database I had information as to the IP addresses of USCF
members accessing the forums, it seemed likely that I would be able to
identify the USCF member account that was being used by the Fake Sam
Sloan to mis-appropriate USCF Issues forum posts for his posts on
Usenet. If I could develop any definitive conclusions about the
identity of the Fake Sam Sloan, I planned to bring that information to
the attention of the Executive Director. It did not take very long to
establish that the Fake Sam Sloan is indeed Paul Truong, as others
have suspected. This report recaps the evidence in support of that
conclusion.
2. Executive Summary
My conclusion, based on the evidence available to me, is that one
person was responsible for all of the Fake Sam Sloan identities and
the posts under those identities on Usenet, and that this person was
Paul Truong, now a member of the USCF Executive Board. Many of the
posts were made after December 2006, when Paul Truong became a
candidate in the election for the USCF Executive Board. Some of the
targets of the posts were other candidates in the election. Some of
the posts have been made since August, when Paul Truong and his wife,
Susan Polgar, became members of the USCF Executive Board.
The purpose of this memo is to review the evidence which makes the
conclusion inescapable that Paul Truong was the person making these
posts. It will be left to other documents to discuss the content of
the FSS posts.
I show the following:
a) From March 2006 to July 2006, Truong posted to the USCF Forums
almost exclusively from AOL addresses. These IP addresses were in the
same small address blocks as were used on those dates by the Fake Sam
Sloan identities to post to Usenet.
b) In July 2006, Truong obtained a RoadRunner cable IP address, and he
had this one address persistently assigned to him for over a year,
until August 2007. During this period he was posting mainly from this
RoadRunner address to the USCF Forums. While the Fake Sam Sloan
identities continued to post mainly from AOL addresses, there were
several occasions during this period when one or more of the FSS
identities posted to Usenet from Truong's RoadRunner IP address. When
Truong did post from an AOL address to the USCF Issues forum, the
previous pattern held up, namely that Truong's AOL address was
frequently from the same small block from which one of the Fake Sam
Sloan identities had posted on that same day.
c) In August 2007, Truong moved to Lubbock Texas to take up an
appointment at Texas Tech. He obtained new, somewhat persistent IP
addresses from Suddenlink, the cable broadband provider in Lubbock.
During August and September 2007, he accessed the USCF Forums from two
different Suddenlink IP addresses, one briefly and the other for the
rest of that time. These two Suddenlink IP addresses were both used
multiple times during that period by more than one of the Fake Sam
Sloan identities to post to Usenet, while at the same time Truong was
using the IP to post to the USCF Forums.
In other words, when Truong moved to Lubbock, the Fake Sam Sloan
identities also moved to Lubbock. Indeed they were all using the same
Suddenlink IP address.
d) On September 20, Truong went to Mexico City for the World Chess
Championship. While there, Truong visited the USCF Forums from a
Mexico City IP address. Contemporaneously, one of the FSS identities,
the Fake Ray Gordon, posted to Usenet from the same Mexico City IP
address. Both Truong and Fake Ray Gordon also had the same user agent
string, from a Tablet PC 2.0 while in Mexico City.
e) From September 16 onwards, when we can see what user agent string
Truong's browser was sending to the USCF forums, it is identical to
the user agent string being presented at the time by the Fake Sam
Sloan identities on Usenet. When Truong switched to a Tablet PC 2.0 to
go to Mexico City, the Fake Ray Gordon, one of the FSS identities,
switched to the same Tablet PC 2.0 user agent string, at the same time
switching to the same Mexico City IP address as Truong.
The odds against all of these correlations resulting from chance are
overwhelming, and the almost inescapable conclusion is either that
Paul Truong and the person behind the Fake Sam Sloan posts are one and
the same.
3. Types of Technical Evidence.
There are several sources of technical evidence in this matter.
a) The Usenet Newsgroup Posts.
First, there are the Usenet posts themselves. Usenet posts are
maintained on Network News Transfer Protocol (NNTP) servers, also
referred to as news servers. These servers organize posts into threads
or topics and the topics are grouped into "newsgroups". A "newsgroup"
is much like any other Internet forum. A newsgroup poster makes his
post on one of the news servers, and from there it is sent to other
news servers. A poster can delete his posts from the news server where
he originally made it, and this deletion command is propagated to the
other news servers. However, because of frequent abuse of this
deletion feature, many news servers do not honor deletion commands
from other servers.
The newsgroups in which the Fake Sam Sloan was active were
rec.games.chess.politics, rec.games.chess.misc, alt.chess, as well as
others. Most of the posts were cross-posted in several of these
newsgroups. The news server on which the FSS identities posted was
operated by Google, which provides a web-based news reader interface
at groups.google.com. This is the largest and most popular of the news
servers. A person reading or posting to a newsgroup uses a client
program, called a "news reader". One of the reasons that Google is the
most popular news server is that it has an Usenet archive spanning
decades and provides a convenient web-based news reader.
Posts in a newsgroup are accompanied by a number of so-called header
fields, similar to email headers. Some of these originate from the
news reader; some of them are attached to the post by the news server
where the post is injected. Here is a typical set of headers, from one
of the FSS posts:
Path:g2news2.google.com!postnews.google.com!
n39g2000hsh.googlegroups.com
From: "Ray Gordon, creator of the pivot" <rayg...@seductive.com>
Newsgroups: rec.games.chess.politics,rec.games.chess.misc,
rec.games.chess.computer,rec.games.chess.analysis,alt.chess
Subject:Did Hal Bogner and Brian Mottorshead hack USCF members'
accounts?
Date: Tue, 25 Sep 2007 14:39:29 -0700
Organization:http://groups.google.com
Lines: 7
Message-ID: <1190756369.6...@n39g2000hsh.googlegroups.com>
References: <1190756306....@o80g2000hse.googlegroups.com>
NNTP-Posting-Host: 201.134.236.150
Mime-Version: 1.0 []
Content-Type: text/plain; charset="us-ascii"
X-Trace: posting.google.com 1190756370 17523 127.0.0.1 (25 Sep 2007
21:39:30 GMT)
X-Complaints-To: groups...@google.com
NNTP-Posting-Date: Tue, 25 Sep 2007 21:39:30+0000 (UTC)
In-Reply-To: <1190756306....@o80g2000hse.googlegroups.com>
User-Agent: G2/1.0
X-HTTP-UserAgent: Mozilla/4.0 (compatible; MSIE 7.0; AOL 9.0;
Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET
CLR 3.0.04506; Tablet PC 2.0),gzip(gfe),gzip(gfe)
Complaints-To: groups...@google.com
Injection-Info: n39g2000hsh.googlegroups.com;posting-
host=201.134.236.150;
posting-account=ps2QrAMAAAA6_jCuRt2JEIpn5Otqf_w0
It may be seen that the headers include a lot of information about the
origin, processing, and timing of the Usenet post. Some of these
headers are displayed routinely to readers. The full list, as above,
is displayed upon request. In the example above, note the NNTP-Posting-
Date header and the X-HTTP-UserAgent headers. These are attached to
the post by the news server, and they give the IP address of the user
who made the post, and the User Agent string that was transmitted by
his web browser when he submitted the post. Thus, the NNTP-Posting-
Host for the example was 201.134.236.150. and the browser user agent
string was:
Mozilla/4.0 (compatible; MSIE 7.0; AOL 9.0; Windows NT 6.0;
SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.0.04506;
Tablet PC 2.0),gzip(gfe)
Not all newsgroup servers capture all this information, but most of
them do. The Google news server, which was used by FSS for injecting
his posts into the newsgroups, does capture the NNTP-Posting-Host and
X-HTTP-UserAgent headers, and these headers were captured for all the
FSS posts that I have inspected. This is how we know what IP address
the Fake Sam Sloan identities had for each of their posts, as well as
what browser and type of computer he was using when he made the
various posts.
b) US Chess Forums Database
During much of the period that FSS was making his newsgroup posts,
Paul Truong was a member of the USCF Forums. The USCF Forums run on
the uschess.org website using the "phpBB" bulletin board software.
Paul Truong started posting in the USCF Forums in March 2006. During
most of the time since then, USCF was running phpBB Version 2. The
software was upgraded to phpBB Version 3 on September 14, 2007. Both
versions have a database based on MySQL, which contains all the forum
posts and user records. During the upgrade from Version 2 to Version
3, all the information from Version 2 was transferred and converted to
the format of the Version 3 database.
Paul Truong was active in the USCF Forums under the username
"ChessPromotion" from March, 2006 onwards. That ChessPromotion was
Paul Truong was well known and was no secret. On the USCF Forums, all
posters to the USCF Issues forum must be registered USCF members and
the USCF ID numbers of forum members are displayed in their user
profiles. Thus, anybody can look up a USCFId and learn the name,
state, and USCF tournament and rating history of any poster, even
though he may be posting under a handle. "ChessPromotion" was
completely open that he was Paul Truong.
In the phpBB database, one of the data elements that is captured is
the IP address that the poster had at the time of the post. This
database element is present for all ChessPromotion posts in the
database. This is how we know the IP addresses from which Paul Truong
posted to the USCF Issues forum during 2006 and 2007.
c) Web Traffic Logs
When the new forum version went live on September 14, it included a
"single login" feature. A user logging into the web site is not
required to log in separately to the forums. If he were eligible for
forum access, a user would be logged in automatically to the forums
under the same username for which he had registered on the web site as
a whole. The single login feature is accomplished by a software module
called the "Joomla-phpBB3 Bridge". This is a module which I wrote
specifically for the USCF web implementation. The way the Joomla-
phpBB3 bridge works is that it intercepts every request made on the
forums, looks at the current Joomla and phpBB3 login states of the
user, makes these the same by logging the user into or logging him out
of phpBB, and finally passes the request on to phpBB3. Note that
Joomla and phpBB require all usernames/handles to be unique.
One of the features of the Joomla-phpBB3 bridge is that it keeps a log
of every forum request that it intercepts, and records the date and
time, the IP address, the URL, the user agent string and the cookies
sent by the browser. This log was intended for debugging purposes.
>From these logs, it is possible to determine the IP address and user
agent of particular forum users for each and every request to the
forum system that is intercepted by the Bridge. These logs exist since
September 14 but not all the fields were in the first version of the
log. IP addresses were not captured initially. But IP address logging
was added on September 16, and we know the IP addresses of the
requests through the Bridge from September 16 onwards. The User agent
string was logged from September 17 onwards.
The phpBB software for the USCF Forums runs under an Apache web
server. This web server logs information about each request (or "hit")
made by browsers to the server. USCF's ISP, INebraska, saves these
logs. Each line in the log file records the date and time, the IP
address, the URL that was requested and the user agent string sent by
the browser. For each line in the Bridge logs, there should be a
corresponding line in the Apache logs with the same timestamp
(possibly with a little clock skew and slight delay), IP address, URL,
and user agent string. I have not had access to the Apache web logs.
However, these Apache logs might be used to corroborate the
information in the Joomla-phpBB3 Bridge logs.
d) WHOIS Information
It is easy to determine which ISP owns an IP address via a "WHOIS"
lookup.
4. All the "Fake Sam Sloan" Usenet identities Are One Person
Many participants in the Usenet rec.games.chess.* newsgroups have
asserted that the following posters to those groups are the same
person:
* "Fake Ray Gordon" (rayg...@writeme.com,
rayg...@seductive.com, and others)
* "Fake Sam Sloan" (ismai...@gmail.com, sams...@usa.com,
sl...@whoever.com, sl...@journalist.com, andre...@mail.com, and
others)
* "AndrewZito" (andre...@mail.com)
* "Jackass Lafferty" (bplaf...@lawyer.com)
* judgem...@clerk.com
On rec.games.chess.politics alone, these identities account for 2463
posts since mid 2005, with a similar number on rec.games.chess.misc,
as well other posts on alt.chess and other rec.chess.* newsgroups.
The widespread view that one person is actually responsible for all of
these posts is based on subjective factors, such as the fact that
these identities have the same targets/victims/obsessions, and that
their posts are similarly foul-mouthed, racist, and misogynist. My
analysis of the Usenet posts cements this conclusion through a study
of IP addresses and user agent strings from the Usenet data -- all
objective data.
1. There are numerous cases where one of the "Fake Sam Sloan"
email addresses posted as Ray Gordon, and vice-versa. That is, the
name on the post might be "Ray Gordon", but the email address is given
as one of the samsloan email addresses, and vice versa. This suggests
that the FSS poster was logged in as one of the identities to the
newsgroup but "signed" the post as one of the other identities,
perhaps by mistake. Similarly, andre...@mail.com posted as all three
of "Sam Sloan", "Ray Gordon", and "AndrewZito". This mixing of names
and emails was quite common.
2. All the identities used Google Groups for injecting their
Usenet posts.
3. From July 2005 onwards, the identities all posted
predominantly from AOL IP addresses. The personalities tended to be
alternated, and there would be a run of Ray Gordon posts, followed by
a run of Sam Sloan posts, etc. However, it did happen from time to
time that several of the identities were used on the same day and
within short spans of time, and when this occurred it can be seen that
the identities were all posting from IP addresses within the same
small AOL IP address blocks.
4. The set of user agent strings from the browsers was small. The
identities were using the same computers and had the same small set of
user agent strings. While there was more than one user agent string,
suggesting that the person responsible was using more than one
computer, all of the identities were seen with each of the various
user agent strings. The user agent strings changed over time, and when
a new user agent string appeared for one of the identities, it
generally wasn't too long before the other identities would appear
with that new user agent string also.
There are numerous occasions when IP addresses and user agent strings
were exactly the same on the same day for more than one of the
identities. For example, on 6 Feb 2006, andre...@mail.com and
rayg...@writeme.com both posted within minutes of one another from
152.163.100.6 with the same user agent string. Again, on 17 March
2006, rayg...@seductive.com and sams...@usa.com both posted from
205.188.117.73 with the same user agent string within 10 minutes of
one another. On 11 Nov 2006, both rayg...@seductive.com and
ismai...@gmail.com posted from 64.12.116.67 with the same user
agent string, separated in time by about two hours. On 12 Feb 2007,
both rayg...@seductive.com and judgem...@clerk.com posted from
205.188.116.132 separated in time by 40 minutes, and with the same
user agent string. The same thing happened the following day from
152.163.101.14. If one looks not for exact IP matches between the
various identities, but only for IP addresses within the same small
AOL block, there are many, many, other examples.
On April 15 2007, the person behind these identities acquired or
gained access to a Media Center PC 5.0. At this point in time, he was
posting mainly as rayg...@seductive.com. Late that evening, we see
ismai...@gmail.com posting for the first time from a Media Center
PC 5.0, and the next post from judgem...@clerk.com, on May 8, is
also from a Media Center PC 5.0, the exact same user agent string. All
three identities continue also to post from another computer, a Media
Center PC 4.0, again all with the same user agent string.
On 23 July 2007, both sams...@usa.com and Jackass Lafferty
(bplaf...@lawyer.com) posted from 64.12.116.134 with the exact same
user agent string, a Media Center PC 5.0). This happened again on 26
August 2007, from 75.111.199.177. On 9 Sep 2007, this happened once
more from 75.111.200.21. Note that these last two IP address, unlike
all the others mentioned in this paragraph are Suddenlink IP addresses
in Texas, not AOL IP addresses. 75.111.200.21 address is noteworthy,
because it is from this IP address that Paul Truong first posted on
the USCF Issues forum from a Suddenlink IP address.
The Usenet cast of characters had moved to Texas, and so had Paul
Truong.
On 10 Sep 2007, sams...@usa.com posted from a Suddenlink IP address
for the first time, 75.111.194.9, again with the same User agent
string. sams...@usa.com posted again from this IP on Sep 11.
rayg...@seductive.com posted from this address for the first time on
15 Sep 2007, and then continued to post from it on Sep 16 and Sep 19.
This Suddenlink IP address, 75.111.194.9, is another important one
because it is also definitively tied to Paul Truong.
Finally, after I posted some of my conclusions on the USCF Forums, on
September 25, 2007, both ismai...@gmail.com and
rayg...@seductive.com made posts mocking that case. The two posts
were within 5 minutes of one another and were both from 207.200.116.5,
an AOL address. The user agent string was the same; the same Media
Center PC 5.0 user agent string that had been seen from all of the
identities since April 15, 2007. (Incidentally, as we discuss later,
Paul Truong visited the USCF Forums from this same AOL IP address the
following day.)
There is no doubt that this set of Usenet identities were all the same
person, and at least three of them -- bplaf...@lawyer.com,
sams...@usa.com and rayg...@seductive.com -- are definitely tied to
Paul Truong.
5. Evidence that Paul Truong is the Fake Sam Sloan.
Paul Truong, under the handle ChessPromotion, started participating in
the USCF Forums on March 10, 2006. He continued with regular
participation until May 5, 2007, when he announced that he would stop.
He recommenced on July 28, 2007 and continued with regular
participation until he again announced that he would stop on September
20, 2007.
This participation divides into three periods.
a) From March 2006 until July 2006, Truong accessed the USCF forums
through AOL. This was determined from the IP addresses on posts in the
forum database. During this period, the Fake Sam Sloan identities were
also posting to Usenet via AOL, which can be determined from the NNTP-
Posting-Host on the posts.
AOL assigns users dynamic IP addresses and these change frequently,
often from minute to minute. Because of this, it is difficult to draw
definitive conclusions from AOL IP addresses about the identities of
users. Even if there were a ChessPromotion post in the USCF forum
separated by only minutes in time by a post on Usenet from Fake Sam
Sloan, it would not necessarily follow that the two posters were the
same person.
However, both FSS and Truong were using AOL during this period, and
they were receiving IP address assignments that were very close to one
another. There is a pattern to AOL assignments. A client computer
connected to the AOL network seems to receive address assignments from
a relatively small block of addresses, and when the address changes,
it is to another one from the same small block. From an analysis of
the data, it is clear that Fake Sam Sloan and Truong were frequently
receiving address assignments from the same small AOL block. On almost
every occasion that Truong posted in the USCF Issues forum during this
time frame, there is a Usenet posting close in time from one of the
FSS set of identities and from the same small AOL IP address block as
Truong had used.
b) From July 2006 to September 2007. During this period, which
included a short gap during which he was not posting on the forum,
Truong accessed the forum mainly from one IP address associated with
RoadRunner, Time Warner's cable internet ISP. The RoadRunner address
was probably a dynamic one but, as often happens with cable broadband
IP addresses, Paul had the same one persistently from the time he
first appeared with it in the USCF Forums in July 2006, until August
2007, when he moved to Lubbock. This address was 24.90.223.35. When
addresses are assigned persistently in this manner over long periods,
it becomes like a static IP address, with the assignee controlling it
exclusively until it is lost.
During this period, the Fake Sam Sloan identities continued to post
mainly from AOL. However, there are a number of occasions when the
Fake Sam Sloan identities did post from the RoadRunner IP that was
assigned to Paul Truong persistently. This is extremely significant
because this IP address was not a highly dynamic AOL IP address, but
rather a RoadRunner IP address that was definitively associated with
Paul Truong at the time.
For example, on June 20 2006, rayg...@seductive.com posted from
24.90.223.35. This address was used again by ismai...@gmail.com on
24 Dec 2006, and by rayg...@seductive.com on 15 April 2007. The only
explanation for this is that Truong was taking care after he obtained
his persistent RoadRunner IP not to use it for his Fake Sam Sloan
posts on Usenet, but that he slipped up a few times, perhaps supposing
that nobody would notice. These three slip-ups definitively tie Paul
Truong to the Fake Sam Sloan identities even before he moved to Texas.
>From time to time after getting the RoadRunner address, Truong did
post to the USCF forums as ChessPromotion via AOL, indicating that he
was still using AOL for USCF Forum access occasionally. As before, on
many occasions when he accessed the USCF forums during this period
from AOL, on those same dates one or more Fake Sam Sloan identities
posted from AOL IP addresses from the same small blocks.
c) From the US Open 2007 to September 20, 2007. After the US Open,
Truong posted to the USCF forums from hotels in Lubbock, and from
Texas Tech. He had moved to Lubbock Texas. From September 6 onwards
until September 20, all of his posts to the forums were from 2
Suddenlink IP addresses. He made 3 posts on September 6 from
75.111.199.177, which is a Suddenlink IP address. Suddenlink is a
cable internet ISP, a subsidiary of Cox, which services Lubbock. After
Sep 6, he made 21 posts to the forums from 75.111.194.9, another
Suddenlink IP address.
>From the 16th onward we also have the Bridge log data, and from this
we can see that almost all of his visits to the forum (not just posts)
were from this one Suddenlink address, 75.111.194,9, except for one
quick visit to the forum from a computer at Texas Tech. From this
pattern, we can conclude that 75.111.194.9 was persistently assigned
to the computer that Truong was using for almost all his USCF forum
access. Possibly it was his home computer. Starting on September 16,
when IP addresses started being logged by the Joomla bridge, and
continuing through September 20, there were 958 hits on the USCF
forums by ChessPromotion from 75.111.194.9. All the hits from that
address were by ChessPromotion.
>From the NNTP-Posting-Host headers on the FSS Usenet posts, we know
that Jackass Lafferty posted from 75.111.194.9 on 26 August, 27
August, and 6 September, that Fake Sam Sloan posted from it on
September 10, 11, and 13, and that Fake Ray Gordon posted from it
multiple times on September 15, 16, and 19. These data present a
highly significant correlation that could not have occurred by chance.
Based on the X-HTML-User-Agent headers on the Usenet posts, we know
that the Fake Sam Sloan identities had the following user agent string
during much of September 2007:
Mozilla/4.0 (compatible; MSIE 7.0; AOL 9.0; Windows NT 6.0;
SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.0.04506;
InfoPath.2), gzip(gfe),gzip(gfe)
The user agent string presented by Paul Truong's browser in the USCF
forums during the same period was:
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR
2.0.50727; Media Center PC 5.0; .NET CLR 3.0.04506; InfoPath.2)
The basic elements of these strings are the same. There are two
differences: one of them indicates that AOL 9 was being used. The
other is that in one of them gzip was enabled. The strings are
compatible and one computer would have been able to generate both of
these user agent strings, depending on the situation. In the USCF
Forums, only one other user had a user agent string that was close to
these. These data corroborate the correlation demonstrated above by
the parallel IP-Addresses.
A comprehensive analysis of user agent strings in the Apache web logs
would be interesting. The strings of the Fake Sam Sloan posters have
changed over time. It is possible to identify when those changes
occurred and correlate those times with the times when User Agent
strings presented by Paul Truong's browser changed in the uschess.org
web logs. For example, in both the FSS and Paul Truong user agent
strings above "InfoPath.2" appears. InfoPath.2 is a Microsoft Office
add-on and this indication appeared relatively recently in the User
Agent strings on the FSS posts. It would be interesting to determine
exactly when this appeared on Paul Truong's USCF web log hits.
d) September 20, 2007 to date. On September 20, Truong went to Mexico
City for the World Championship Tournament, accompanying his wife. He
had stopped posting in the forum, but from the Bridge log data, we
know that he continued to access the forums to read posts and personal
messages.
With the exception of one short visit on September 20, when he was
most likely in transit, almost all of his accesses to the forum while
in Mexico City were from 201.134.236.150. This is an IP address of
Uninet SA de C.V., a Mexican ISP.
The first post from Fake Ray Gordon after the ones on September 19
from the Suddenlink address was on September 25, He posted three times
to rec.games.chess.politics from 201.134.236.150, the same address.
When Paul Truong went to Mexico City his user agent string in the USCF
Forums changed to:
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR
2.0.50727; Media Center PC 5.0; .NET CLR 3.0.04506; Tablet PC 2.0)
This is a tablet PC, with software otherwise similar to his other
computer. The user agent string on the November 25 post by the Fake
Ray Gordon was: Mozilla/4.0 (compatible; MSIE 7.0; AOL 9.0; Windows NT
6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR
3.0.04506; Tablet PC 2.0),gzip(gfe),gzip(gfe)
Thus, once again, characteristics of the computer used by the Fake Ray
Gordon also tracked a change in the computer used by Paul Truong, just
as the IP-Address was tracked.
It is inescapable that when Paul Truong moved to Texas and Suddenlink,
the Fake Sam Sloan identities did also. Indeed they moved to the
identical IP address as did Paul. When Paul went to Mexico City, the
Fake Ray Gordon did too. When Paul switched to a Tablet PC 2.0 for his
travel to Mexico City, so did the Fake Ray Gordon.
e) On September 25, I first posted information concerning these
conclusions on the USCF Forums. Almost immediately large numbers of
Fake Sam Sloan (etc) posts were deleted from Usenet, especially from
August and September 2007. From the Bridge logs, it is apparent that
Truong was up during all that night. It can hardly be a coincidence
that the FSS identities were deleting their August and September 2007
posts throughout that night. Despite these deletions the posts still
exist on news servers that don't honor delete commands, and on users'
hard drives, a fact of which Truong may have been unaware.
On Sep 26 at 11:30 pm, the Fake Ray Gordon posted:
Thanks for destroying the first couple for everyone. We can't
allow them to have power, can we? We need to stick together and get
rid of all the freaking foreigners. Saludos!
This was posted from 207.200.116.5, a Netscape/AOL IP address. The
user agent string was the same as the Fake Ray Gordon and Paul Truong
posts from the Mexico City IP address. A few minutes later, the Fake
Sam Sloan also posted from 207.200.116.5. On the following day, Paul
Truong visited the USCF forums from this address, with again the same
Tablet PC 2.0 user agent string.
6. Conclusion
The odds against all of these correlations occurring by chance are
overwhelming. The only reasonable inference that can be drawn from the
evidence is that Paul Truong and the person behind the Fake Sam Sloan
posts on Usenet are one and the same person.
Appendix A. Attachments
1. chesspromotion-uscf-posts.txt. This is a listing of the post
dates and IP addresses of the 668 ChessPromotion posts in the USCF
Forums database from March 2006 to date.
2. chesspromotion-joomla-bridge.log. This is an extract of the
Joomla-phpBB3 Bridge log, showing all requests on the USCF Forums,
through the Bridge, made by "ChessPromotion" from September 16 to
date.
3. fake-sam-sloan.txt. The full text of all 2464 "Fake Sam Sloan"
posts on rec.games.chess.politics, extracted from the
news.giganews.com news server.
4. fake-sam-sloan-hdrs.txt. This is a listing of the NNTP-Posting-
Host header, the From header, the Date header, and the X-HTTP-
UserAgent header, for all 2464 posts made by the Fake Sam Sloan
identities to rec.games.chess.politics, extracted from the
news.giganews.com news server.