• Great articles on other sites
  • RSS Great articles on other sites

  • Renai's other site: Sci-fi + fantasy book news and reviews
  • RSS Renai LeMay

  • Blog, Enterprise IT - Written by on Friday, December 14, 2012 12:53 - 48 Comments

    Debunking Abbott’s “server timestamp” claims

    Update: The ABC has examined the computer used to send the PDF document, and appears to have verified that there was a time stamp error with the Department of Parliamentary Services. Sortius’ analysis is still useful, but it appears at this stage that Abbott was correct that there was an incorrect timestamp on the computer.

    blog Unless you live in an area of Australia where it’s impossible to get television or radio reception (an idea which has seemed attractive to your writer at times, in the current media environment), it would have been hard to escape the news that a Federal Court judge has thrown out the sexual harassment case against former Federal House of Representatives Speaker Peter Slipper. But it’s one particular comment by Opposition Leader Tony Abbott that has Australia’s IT industry perking up its ears this morning.

    As the Sydney Morning Herald reports here, Abbott claimed that the timestamp on a media release issued by the Coalition regarding the affair was incorrect because of “computer server timestamps” which were wrong in April by up to 10 hours. Unfortunately for Abbott, who admittedly is “no Bill Gates”, the nation’s IT professionals have called bullshit on this one. local IT pro ‘Sortius’ writes on his blog:

    “So Abbott has been caught with his hand in the conspiracy jar & the first place he decided to go was with the IT problem angle. Having worked in the industry for a long time (almost 20 years), I felt it was my duty to explain how Abbott’s line that “during April the computer server timestamps were sometimes out by up to 10 hours” was wrong, & why it was at best improbably, at worse, impossible.”

    Sortius’ investigation of this issue is quite persuasive; Abbott’s comment struck your writer from the start as being wrong … I would find it very hard to believe indeed that a computer server error at Parliament House or elsewhere could cause this kind of datestamp change. Abbott’s explanation might have flown in 1995, but in 2012, with most PCs setting their clocks automatically from Internet-hosted time servers? It seems hard to believe that many PCs could be 10 hours out of date.

    Image credit: Screenshot of Tony Abbott on the 7:30 Report, believed to be OK to use under fair use

    Print Friendly


    You can follow any responses to this entry through the RSS 2.0 feed. Both comments and pings are currently closed.

    1. Sathias
      Posted 14/12/2012 at 12:55 pm | Permalink |

      Surely one of our nations journos have the original press release sitting in their email from when it was first released in April? That would clear things up quick smart.

      • Posted 14/12/2012 at 12:57 pm | Permalink |

        Sortius has just tweeted that he may have just received a “smoking gun”…he may just now have it…

        • Sathias
          Posted 14/12/2012 at 1:01 pm | Permalink |

          It was a PDF by the same author from the day before, without the UTF issue.

    2. Daniel
      Posted 14/12/2012 at 12:57 pm | Permalink |

      Apparently Joe Hockey was in London at the time.

    3. z3n_digital
      Posted 14/12/2012 at 1:00 pm | Permalink |

      Yes Sortius has a PDF created by the same user (mcdulingg) submitted from the day before clearly showing “+10’00′” (AEST) time zone. So that’s that, The date has been modified on the 23/04/12 to attempt to show the time zone as UTC.

      Tampered Time Stamp

    4. Cuppa
      Posted 14/12/2012 at 1:07 pm | Permalink |

      The mainstream media’s coverage of the Ashbygate fallout is subdued compared to the absolute ruckus they made about the allegations against Slipper earlier in the year.

      What explains the difference, of course: this is embarrassing to the Coalition. Potentially very embarrassing indeed.

    5. stoffs
      Posted 14/12/2012 at 1:12 pm | Permalink |

      If their IT systems were 10 hours out … surely someone notified IT ?

      there would be calls … support tickets etc

      i thought it was just normal businesses that automatically blamed IT for their f%^k ups..

      • Marcus
        Posted 14/12/2012 at 4:46 pm | Permalink |

        if they were out by 10 hours there would be all sorts of shit going down.. Authentication, synchronisation etc

        That is _extremely_ unlikely…

        Abbott is using his tried tactic of telling lies loudly and frequently until they have something else to cover with by telling more lies and avoiding having to explain his lies.

    6. Grey Wind
      Posted 14/12/2012 at 1:15 pm | Permalink |

      I cant believe people actually support this idiot and want him to be PM.

    7. z3n_digital
      Posted 14/12/2012 at 1:16 pm | Permalink |

      Cuppa / Stoffs

      Servers can not be more then 5 minutes out before alarm bells start ringing , authentication issues , logins etc… Abbott’s server were never 10 hours out of sync impossible

      • stoffs
        Posted 14/12/2012 at 1:27 pm | Permalink |

        i know .. i was really more piss taking ..

        As soon as even the phones are a few minutes out here – people start bitching.

        I honestly think, the best weapon the ALP has in the next election is Abbott…

    8. z3n_digital
      Posted 14/12/2012 at 1:18 pm | Permalink |

      Oh i should of added Abbott’s servers could of not been out of sync for 10 hours unless he was using Apple Maps ..

      • Simon Reidy
        Posted 14/12/2012 at 3:20 pm | Permalink |

        I don’t think Abbott could even work an iPhone. Too many icons for his poor little brain to comprehend and Siri would just flat out scare him.

    9. Brendan
      Posted 14/12/2012 at 1:43 pm | Permalink |


      “.. obviously, my parties desperate, complicit acts committed in yet another bone-headed, jerk-wad attempt to lie and cheat our way into power by yet again, failing to destabilise the government — was a dicky clock on a com-pute-or.”

    10. Paleoflatus
      Posted 14/12/2012 at 1:58 pm | Permalink |

      Abbott’s veracity is not really important – he could never hope to compete with our incumbent leader in that regard.
      The practical point is that Gillard obviously feels that Slipper is now vindicated and would presumably be an excellent role-model for our children.

    11. NBNAccuracy
      Posted 14/12/2012 at 2:22 pm | Permalink |

      He has had messed up times before.

      Somehow he posted a tweet about his run in the Sydney Marathon the night before the event.




    12. Jo
      Posted 14/12/2012 at 2:29 pm | Permalink |

      Abbott caught lying again? Who would’ve thought….or is it a case of him being passed on shifty and false information from his staffers? The same staffers who may be running our country by the end of next year!!!! Reason to worry.

    13. NBNAlex
      Posted 14/12/2012 at 3:01 pm | Permalink |

      Just left of field, I was reading on facebook, on one of the fanatically pro Tony pages…

      They are saying the judge was shonky :/

    14. Cameron
      Posted 14/12/2012 at 3:15 pm | Permalink |

      Is everyone sure that the timestamp is out by only 10 hours?

      I ask because the coalition NBN policy seems to be 10 hours plus 10 years out of date, the server time difference might explain that.

    15. Ned Kelly
      Posted 14/12/2012 at 3:22 pm | Permalink |

      Will the Coalition’s NBN be 10 hours slow?

      • Goresh
        Posted 14/12/2012 at 5:17 pm | Permalink |

        No, it will have 10 hour latency.

    16. Aaron
      Posted 14/12/2012 at 3:24 pm | Permalink |

      Like i have said many times before. TA is a disgusting human being and zero credability with anything he touches or does.

    17. Posted 14/12/2012 at 3:47 pm | Permalink |

      There’s certainly something weird going on. I asked a friend (who has Microsoft Office Word 2007, the exact same version supposedly used by the Liberals) and they opened up an existing DOC file (old file from years ago) and exported to PDF. Two interesting results:

      [1] You do NOT get the “Zulu” timestamp, you get a +11’00’ timestamp (AEDT).

      [2] Both the “Created On” timestamp and the “Last Modified” timestamp came out EXACTLY THE SAME right down to the second. It does not in any way tell you when the DOC file was really created.

      I checked the Sortius metadata image and [1] and [2] are true for that example as well, either Sortius is a fast typist, or else this metadata does not normally provide any information about when the document was created. So what process actually generates a “Created On” timestamp that is in any way different to the “Last Modified” timestamp?

      Sortius: The last ditch effort for Abbott would be the files being created locally on a computer that’s 10hrs out, then moved to the files to the server. This, however, would still show the actual time of creation according to the server time zone, not the client.

      That sounds like a load of cobblers. I don’t believe there is any fileserver in the world (even from Microsoft) that would reach into a PDF and start rummaging around with the metadata. Yes, the fileserver would update its own filesystem metadata and directory timestamps, but the guts of the PDF are just bytes to store as far as the server is concerned.

      It is just vaguely possible that if the PDF is actually created on the network drive then Microsoft Word might pull back metadata from the server rather than using the local clock, in which case maybe the server works in Zulu time and the client picks that up. I haven’t got the right gear to test this theory, but plenty of sysadmins prefer Zulu time for more reasons than I care to list right now.

      Also, we don’t actually know it was a Microsoft server. So all that Kerberos stuff is speculative.

      Sortius: So that’s that, the date has been modified on the 23/04/12 to attempt to show the time zone as UTC.

      Possible, but highly implausible. Given that the default behaviour is for both dates to be exactly the same (thus not showing the true creation date), why would any bad guy nefariously attempt to set themselves up with a false trail that points to themselves? Doesn’t make any sense whatsoever. Why edit the creation date and deliberately set it back? Nuts! A clever criminal would not make such a stupid mistake, and a stupid criminal would not even get the idea into their head that this was worth doing.

      Yeah, something weird is going on, and none of the theories presented actually fit the evidence.

      • Posted 14/12/2012 at 4:09 pm | Permalink |

        For what it is worth, I just grabbed a random PDF press release from the parlinfo search engine from around the same date, metadata looks a bit different:

        /Creator(Microsoft Office Word 2007)
        /Producer(Microsoft Office Word 2007)

        NB: I removed the magic characters in “Creator” and “Producer” so it would post as plain ASCII, but the timestamps were already in plain ASCII.

        There is no time zone at all on the parlinfo pages, and also note identical creation and modified dates thus, no real data about when it was created. Still no theory that matches the available evidence.

      • z3n_digital
        Posted 14/12/2012 at 4:15 pm | Permalink |

        Tel on my MAC i use Finder and in the window i can click on any doc and it shows me the created , last modified , last opened dates and times …. i use Office for mac 2011 as part of pic say and below i pasted a screen shot minus personal details of a old doc showing dates


        • Posted 14/12/2012 at 4:23 pm | Permalink |

          Sure, but suppose you were sending out a press release, you aren’t going to put your Mac into a post pack and encourage the person at the other side to look at it in finder. You would just send out the PDF, probably either by email, or by uploading to some server right?

          Well, the metadata that gets embedded in the PDF is the important thing here, unless we get hold of the original hard drive to examine (and that’s highly unlikely).

          • z3n_digital
            Posted 14/12/2012 at 4:27 pm | Permalink |

            That is it but i say it was created by his office or pr firm with his knowledge before hand as created date shows … They were just not clued up enough to edit it until later

            • Posted 14/12/2012 at 4:39 pm | Permalink |

              Just try converting your DOC to PDF and emailing it back to yourself, then saving under a different name. You will find the real creation date is gone. At least that’s what I found (not using a Mac).

              • z3n_digital
                Posted 14/12/2012 at 4:47 pm | Permalink |

                yes but seems the date change on orig media PDF was done several days later so was PDF created then ?

                • Posted 14/12/2012 at 5:07 pm | Permalink |

                  What I’m saying is that under a normal export situation (tested under Windows PC), both timestamps would be identical, and both would be the timestamp of the export operation. The real document creation date does not seem to get copied through with the export (not with Word 2007, and not with Word 2010 either).

                  What’s more, on the parlinfo server, the PDF files show the same property — both timestamps are identical to each other.

                  So why would anyone in their right mind go and edit this? For a person trying to hide their tracks, the job requires no effort at all because Microsoft’s PDF export engine already hides the true creation date. Only the original DOC file would keep this metadata. Do you see what I’m getting at?

                  By what process would these two timestamps ever not be identical?

                • Posted 14/12/2012 at 5:11 pm | Permalink |

                  If you are suggesting they did the export to PDF some days ahead of time, and then edited the PDF at the last minute, would they really be so amazingly clueless as to deliberately edit in a bogus timezone on the creation date, but then leave that creation date with bogus timezone rather than just edit BOTH dates?

                  It would require someone deliberately attempting to screw up?!?

                  That or some other process has happened here adjusting PDF timestamps (but I can’t think what that would be).

                  • z3n_digital
                    Posted 14/12/2012 at 5:29 pm | Permalink |

                    PDF are created because generally they cant be edited e.g… final source document ..

                    [quote]It would require someone deliberately attempting to screw up?!?[/quote]

                    Deliberately attempting to do something whether it was in Word or PDF … Abbott’s lie on server time stamp being 10 hours out does not wash in any argument …

                    • Posted 14/12/2012 at 5:51 pm | Permalink |

                      I have not tested how this behaves on a networked drive… and just maybe there is some server process that does legitimately tinker with the PDF metadata (not impossible).

                      The only thing that plausibly makes sense is that Abbott’s office was talking about the 10 hour difference being the Canberra time zone offset, thus the server was not really broken, nor was the time actually wrong, it was just working in either GMT or UTC time. Entirely possible that someone in Tony Abbott’s office gave an off the cuff remark about a 10 hour difference, and by the time it got though the Chinese Whisper process, the newspaper didn’t bother reporting that it was just the normal timezone offset. No conspiracy, just incompetence. Happens all the time.

                      Maybe they have some strange plug-in that changes the PDF export behaviour of Microsoft Office?

                      • NBNAlex
                        Posted 14/12/2012 at 6:37 pm | Permalink |

                        Or maybe he’s lying… no never eh?

      • Mike S
        Posted 14/12/2012 at 4:30 pm | Permalink |

        “So what process actually generates a “Created On” timestamp that is in any way different to the “Last Modified” timestamp?”

        Modifying the PDF itself would do this. He suggest this in one of his edits:

        “have tested to see if a document created within UTC time zone would output with a Z as the time zone code, it will not when exported for MS Word, the time zone code defaults to “+00’00′”, the only time you will get a Z time zone denotation is if you export via Adobe Acrobat itself & not with the Microsoft Word PDF export. ”

        This would indicate that the original DOC was not changed, but the PDF itself was.

        • Posted 14/12/2012 at 5:29 pm | Permalink |

          Yes exactly, it would require the PDF itself to be modified, but who or what would do that?

          What possible motivation would any of Abbott’s staff have to edit in an obviously bogus creation date? Only someone who deliberately wants to make a mess of it would do that. Even if they thought they really were hiding their tracks somehow, why not just edit in a later creation date to match the News Ltd story? Why use the Zulu timezone?

          • z3n_digital
            Posted 14/12/2012 at 5:43 pm | Permalink |

            Because they are not real bright , i say they were trying to cover their tracks but got caught .. If only they had the NBN :)

            • Posted 14/12/2012 at 5:54 pm | Permalink |

              I argue that anyone smart enough to edit a PDF and directly change metadata would also be smart enough to set the creation date AFTER the News Ltd article went to press.

              If they were editing it to cover their tracks, why not at least make a plausible attempt to cover those tracks?

              • z3n_digital
                Posted 14/12/2012 at 6:04 pm | Permalink |

                You would think so but something stinks in this whole Ashby / Slipper thing has from day one

    18. Soth
      Posted 14/12/2012 at 4:11 pm | Permalink |

      Parliments server is a pidgeon with a note around it’s leg. I believe that could have got side tracked by some seed on the ground or courting another bird which could have taken 10 hours…..
      Time to upgrade to Raven’s I think!

    19. Greg
      Posted 14/12/2012 at 4:17 pm | Permalink |

      All interesting but apparently Slipper did send disgusting text messages to the other guy which is supposed to be the crux of the matter not if someone in the Libs knew about it earlier

      • z3n_digital
        Posted 14/12/2012 at 4:25 pm | Permalink |

        Crux of the story is texts were sent both ways , Half the Coalition front bench were meeting with Ashby yet all denied it until pressed .. Why ? … Abbott has lied about his involvement all the way along so the time line is very important as it shows he was aware and involved ahead of a supposedly exclusive article on Ashby …

        How could this happen why and what purpose … That is the questions as it all leads to setting up Slipper who was speaker of the Govt and to setting up Govt itself which is a serious charge

      • NBNAccuracy
        Posted 14/12/2012 at 6:52 pm | Permalink |

        So what? Thjey sent rude text back and fowards to one another. Big deal. People do it every day.
        I think the big deal is why it after all these years became an issue? Why did this guy who had been receiving these texts and sending them suddenly decide sexual harasment now? Why was so much ‘evidence’ brought up at the pre hearing and used by the Coalition in parliment to attack Slipper never actually exist? It was like the whole pre trial was to set up a series of allegations for the Coalition to use. They were pointless for the courtcase as if the evidence isn’t brought foward the judge will ignore it. You don’t bring foward enough and the judge will give you a right bollocking. Have a LOT of accusations you suddenly have not evidence for but have been used to wreck someones political career, you get what happened today. There may be fallout from this for the lawyer at least, Tony may dodge and weave, called on parlimentary privilage, have the story buried by News Ltd, as usual, and survive.

        • z3n_digital
          Posted 14/12/2012 at 7:17 pm | Permalink |

          Ashby & Co brought more smear , innuendo and lies to the court case then they did facts for the sexual harassment case and made this available to the media / LNP for political purposes , The judge saw this and ruled accordingly .. Why bring up allegation and make them to media then retract later on ..

          It was al done to hurt slipper no matter the outcome hence why Steve UTEGATE Lewis was involved

    20. David
      Posted 14/12/2012 at 7:53 pm | Permalink |

      Amazes me after all that has been revealed and a judge has made a damning expose` there are still people trying to cling onto desperate hopes that the Torys are all so blameless and pure as Mother Teresa.
      Today Abbott was caught out as he lied about when he knew about the news release of Ashbys now defeated absurd accusations against Slipper. He blamed a 10 hr fault on the time clocks of the Parliament Bldgs computer system.
      Sick Tony sick. Come home son and face the music, liar
      Greg by the way, there are many of Ashbys text messages not yet released. Social media, who discovered the Abbott lie about his computer are on to that as well.

      • NBNAlex
        Posted 14/12/2012 at 9:23 pm | Permalink |

        Surely you’ve heard the latest David…

        It was a shonky judge… seriously :/

    21. David
      Posted 14/12/2012 at 9:55 pm | Permalink |

      I hope these idiots who are attacking the judge appreciate the consequences of contempt of court. I doubt they do and I gather this Federal Court Judge is not a man to be trifled with. Be it on their heads

    22. Posted 14/12/2012 at 10:09 pm | Permalink |

      Hey everyone,

      apologies, but I’m closing comments here as I’m on vacation from tomorrow and I don’t want to spend a lot of time moderating a hot discussion ;)



  • Get our weekly newsletter

    All our stories, just one email a week.

    Email address:

    Follow us on social media

    Use your RSS reader to subscribe to our articles feed or to our comments feed.

  • Most Popular Content

  • Enterprise IT stories

    • Legacy health software lands SA Govt in court doctor

      In which the South Australian Government comes up with complex legal arguments as to why it should be able to continue to use a 1980’s software package.

    • Microsoft wants to win you back with Windows 10 windows-10

      The latest version of Microsoft’s Windows operating system will begin rolling out from Wednesday (July 29). And remarkably, Windows 10 will be offered as a free upgrade to those users who already have Windows 7 and 8.1 installed.

    • Qld Govt Depts have no disaster recovery plan brisvegas2

      Two sizable Queensland Government departments have no central disaster recovery plan, the state’s Auditor-General has found, despite the region’s ongoing struggles with extreme weather conditions that have previously knocked out telecommunications and data centre infrastructure.

    • ASD releases Windows 8 hardening guide windows-8-1

      The Australian Signals Directorate appears to have released a guide to hardening Microsoft’s Windows 8 operating system, three years after the software was released for use by corporate customers, and as Microsoft is slated to release its next upgrade, Windows 10.

    • ASG picks up $35m CIMIC IT services deal money

      Perth-headquartered IT services group ASG this week revealed it had picked up a deal worth at least $35 million over five years with CIMIC Group — the massive construction and contracting group previously known as Leighton Holdings.

  • Blog, Policy + Politics - Jul 31, 2015 12:43 - 0 Comments

    Google ploughs $1m into Australian tech education

    More In Policy + Politics

    Blog, Enterprise IT - Jul 31, 2015 14:16 - 1 Comment

    Legacy health software lands SA Govt in court

    More In Enterprise IT

    Industry, News - Jul 28, 2015 12:37 - 0 Comments

    ICAC to investigate NSW TAFE ICT manager

    More In Industry

    Consumer Tech, News - Jul 29, 2015 17:14 - 11 Comments

    Telstra integrates Netflix, Stan, Presto into re-badged Roku box

    More In Consumer Tech