• Catch issues early, fix them fast – Free trial


    [ad] With GFI Cloud you can easily manage and secure your remote workforce – wherever they are, from wherever you are! The simple IT management platform includes patch management, antivirus, web protection, monitoring and remote control. Get the benefit of endpoint protection with the ease of central management. Start a free trial now.


  • Great articles on other sites
  • RSS Great articles on other sites


  • Blog, Enterprise IT - Written by on Friday, December 14, 2012 12:53 - 48 Comments

    Debunking Abbott’s “server timestamp” claims

    Update: The ABC has examined the computer used to send the PDF document, and appears to have verified that there was a time stamp error with the Department of Parliamentary Services. Sortius’ analysis is still useful, but it appears at this stage that Abbott was correct that there was an incorrect timestamp on the computer.

    blog Unless you live in an area of Australia where it’s impossible to get television or radio reception (an idea which has seemed attractive to your writer at times, in the current media environment), it would have been hard to escape the news that a Federal Court judge has thrown out the sexual harassment case against former Federal House of Representatives Speaker Peter Slipper. But it’s one particular comment by Opposition Leader Tony Abbott that has Australia’s IT industry perking up its ears this morning.

    As the Sydney Morning Herald reports here, Abbott claimed that the timestamp on a media release issued by the Coalition regarding the affair was incorrect because of “computer server timestamps” which were wrong in April by up to 10 hours. Unfortunately for Abbott, who admittedly is “no Bill Gates”, the nation’s IT professionals have called bullshit on this one. local IT pro ‘Sortius’ writes on his blog:

    “So Abbott has been caught with his hand in the conspiracy jar & the first place he decided to go was with the IT problem angle. Having worked in the industry for a long time (almost 20 years), I felt it was my duty to explain how Abbott’s line that “during April the computer server timestamps were sometimes out by up to 10 hours” was wrong, & why it was at best improbably, at worse, impossible.”

    Sortius’ investigation of this issue is quite persuasive; Abbott’s comment struck your writer from the start as being wrong … I would find it very hard to believe indeed that a computer server error at Parliament House or elsewhere could cause this kind of datestamp change. Abbott’s explanation might have flown in 1995, but in 2012, with most PCs setting their clocks automatically from Internet-hosted time servers? It seems hard to believe that many PCs could be 10 hours out of date.

    Image credit: Screenshot of Tony Abbott on the 7:30 Report, believed to be OK to use under fair use

    submit to reddit

    48 Comments

    You can follow any responses to this entry through the RSS 2.0 feed. Both comments and pings are currently closed.

    1. Sathias
      Posted 14/12/2012 at 12:55 pm | Permalink |

      Surely one of our nations journos have the original press release sitting in their email from when it was first released in April? That would clear things up quick smart.

      • Posted 14/12/2012 at 12:57 pm | Permalink |

        Sortius has just tweeted that he may have just received a “smoking gun”…he may just now have it…

        • Sathias
          Posted 14/12/2012 at 1:01 pm | Permalink |

          It was a PDF by the same author from the day before, without the UTF issue.

    2. Daniel
      Posted 14/12/2012 at 12:57 pm | Permalink |

      Apparently Joe Hockey was in London at the time.

    3. z3n_digital
      Posted 14/12/2012 at 1:00 pm | Permalink |

      Yes Sortius has a PDF created by the same user (mcdulingg) submitted from the day before clearly showing “+10’00′” (AEST) time zone. So that’s that, The date has been modified on the 23/04/12 to attempt to show the time zone as UTC.

      Tampered Time Stamp

    4. Cuppa
      Posted 14/12/2012 at 1:07 pm | Permalink |

      The mainstream media’s coverage of the Ashbygate fallout is subdued compared to the absolute ruckus they made about the allegations against Slipper earlier in the year.

      What explains the difference, of course: this is embarrassing to the Coalition. Potentially very embarrassing indeed.

    5. stoffs
      Posted 14/12/2012 at 1:12 pm | Permalink |

      If their IT systems were 10 hours out … surely someone notified IT ?

      there would be calls … support tickets etc

      i thought it was just normal businesses that automatically blamed IT for their f%^k ups..

      • Marcus
        Posted 14/12/2012 at 4:46 pm | Permalink |

        if they were out by 10 hours there would be all sorts of shit going down.. Authentication, synchronisation etc

        That is _extremely_ unlikely…

        Abbott is using his tried tactic of telling lies loudly and frequently until they have something else to cover with by telling more lies and avoiding having to explain his lies.

    6. Grey Wind
      Posted 14/12/2012 at 1:15 pm | Permalink |

      I cant believe people actually support this idiot and want him to be PM.

    7. z3n_digital
      Posted 14/12/2012 at 1:16 pm | Permalink |

      Cuppa / Stoffs

      Servers can not be more then 5 minutes out before alarm bells start ringing , authentication issues , logins etc… Abbott’s server were never 10 hours out of sync impossible

      • stoffs
        Posted 14/12/2012 at 1:27 pm | Permalink |

        i know .. i was really more piss taking ..

        As soon as even the phones are a few minutes out here – people start bitching.

        I honestly think, the best weapon the ALP has in the next election is Abbott…

    8. z3n_digital
      Posted 14/12/2012 at 1:18 pm | Permalink |

      Oh i should of added Abbott’s servers could of not been out of sync for 10 hours unless he was using Apple Maps ..

      • Simon Reidy
        Posted 14/12/2012 at 3:20 pm | Permalink |

        I don’t think Abbott could even work an iPhone. Too many icons for his poor little brain to comprehend and Siri would just flat out scare him.

    9. Brendan
      Posted 14/12/2012 at 1:43 pm | Permalink |

      Really?

      “.. obviously, my parties desperate, complicit acts committed in yet another bone-headed, jerk-wad attempt to lie and cheat our way into power by yet again, failing to destabilise the government — was a dicky clock on a com-pute-or.”

    10. Paleoflatus
      Posted 14/12/2012 at 1:58 pm | Permalink |

      Abbott’s veracity is not really important – he could never hope to compete with our incumbent leader in that regard.
      The practical point is that Gillard obviously feels that Slipper is now vindicated and would presumably be an excellent role-model for our children.

    11. NBNAccuracy
      Posted 14/12/2012 at 2:22 pm | Permalink |

      He has had messed up times before.

      Somehow he posted a tweet about his run in the Sydney Marathon the night before the event.

      https://twitter.com/tonyabbottmhr/status/247196802619682816

      http://tiktok.biz/list/sydneyrunningfestival/2012/42km/

      http://tiktok.biz/sydneyrunningfestival/2012/00089

    12. Jo
      Posted 14/12/2012 at 2:29 pm | Permalink |

      Abbott caught lying again? Who would’ve thought….or is it a case of him being passed on shifty and false information from his staffers? The same staffers who may be running our country by the end of next year!!!! Reason to worry.

    13. NBNAlex
      Posted 14/12/2012 at 3:01 pm | Permalink |

      Just left of field, I was reading on facebook, on one of the fanatically pro Tony pages…

      They are saying the judge was shonky :/

    14. Cameron
      Posted 14/12/2012 at 3:15 pm | Permalink |

      Is everyone sure that the timestamp is out by only 10 hours?

      I ask because the coalition NBN policy seems to be 10 hours plus 10 years out of date, the server time difference might explain that.

    15. Ned Kelly
      Posted 14/12/2012 at 3:22 pm | Permalink |

      Will the Coalition’s NBN be 10 hours slow?

      • Goresh
        Posted 14/12/2012 at 5:17 pm | Permalink |

        No, it will have 10 hour latency.

    16. Aaron
      Posted 14/12/2012 at 3:24 pm | Permalink |

      Like i have said many times before. TA is a disgusting human being and zero credability with anything he touches or does.

    17. Posted 14/12/2012 at 3:47 pm | Permalink |

      There’s certainly something weird going on. I asked a friend (who has Microsoft Office Word 2007, the exact same version supposedly used by the Liberals) and they opened up an existing DOC file (old file from years ago) and exported to PDF. Two interesting results:

      [1] You do NOT get the “Zulu” timestamp, you get a +11’00′ timestamp (AEDT).

      [2] Both the “Created On” timestamp and the “Last Modified” timestamp came out EXACTLY THE SAME right down to the second. It does not in any way tell you when the DOC file was really created.

      I checked the Sortius metadata image and [1] and [2] are true for that example as well, either Sortius is a fast typist, or else this metadata does not normally provide any information about when the document was created. So what process actually generates a “Created On” timestamp that is in any way different to the “Last Modified” timestamp?

      Sortius: The last ditch effort for Abbott would be the files being created locally on a computer that’s 10hrs out, then moved to the files to the server. This, however, would still show the actual time of creation according to the server time zone, not the client.

      That sounds like a load of cobblers. I don’t believe there is any fileserver in the world (even from Microsoft) that would reach into a PDF and start rummaging around with the metadata. Yes, the fileserver would update its own filesystem metadata and directory timestamps, but the guts of the PDF are just bytes to store as far as the server is concerned.

      It is just vaguely possible that if the PDF is actually created on the network drive then Microsoft Word might pull back metadata from the server rather than using the local clock, in which case maybe the server works in Zulu time and the client picks that up. I haven’t got the right gear to test this theory, but plenty of sysadmins prefer Zulu time for more reasons than I care to list right now.

      Also, we don’t actually know it was a Microsoft server. So all that Kerberos stuff is speculative.

      Sortius: So that’s that, the date has been modified on the 23/04/12 to attempt to show the time zone as UTC.

      Possible, but highly implausible. Given that the default behaviour is for both dates to be exactly the same (thus not showing the true creation date), why would any bad guy nefariously attempt to set themselves up with a false trail that points to themselves? Doesn’t make any sense whatsoever. Why edit the creation date and deliberately set it back? Nuts! A clever criminal would not make such a stupid mistake, and a stupid criminal would not even get the idea into their head that this was worth doing.

      Yeah, something weird is going on, and none of the theories presented actually fit the evidence.

      • Posted 14/12/2012 at 4:09 pm | Permalink |

        For what it is worth, I just grabbed a random PDF press release from the parlinfo search engine from around the same date, metadata looks a bit different:

        /Creator(Microsoft Office Word 2007)
        /CreationDate(D:20120423082718)
        /ModDate(D:20120423082718)
        /Producer(Microsoft Office Word 2007)

        NB: I removed the magic characters in “Creator” and “Producer” so it would post as plain ASCII, but the timestamps were already in plain ASCII.

        There is no time zone at all on the parlinfo pages, and also note identical creation and modified dates thus, no real data about when it was created. Still no theory that matches the available evidence.

      • z3n_digital
        Posted 14/12/2012 at 4:15 pm | Permalink |

        Tel on my MAC i use Finder and in the window i can click on any doc and it shows me the created , last modified , last opened dates and times …. i use Office for mac 2011 as part of pic say and below i pasted a screen shot minus personal details of a old doc showing dates

        http://i.imgur.com/CS4Ty.png

        • Posted 14/12/2012 at 4:23 pm | Permalink |

          Sure, but suppose you were sending out a press release, you aren’t going to put your Mac into a post pack and encourage the person at the other side to look at it in finder. You would just send out the PDF, probably either by email, or by uploading to some server right?

          Well, the metadata that gets embedded in the PDF is the important thing here, unless we get hold of the original hard drive to examine (and that’s highly unlikely).

          • z3n_digital
            Posted 14/12/2012 at 4:27 pm | Permalink |

            That is it but i say it was created by his office or pr firm with his knowledge before hand as created date shows … They were just not clued up enough to edit it until later

            • Posted 14/12/2012 at 4:39 pm | Permalink |

              Just try converting your DOC to PDF and emailing it back to yourself, then saving under a different name. You will find the real creation date is gone. At least that’s what I found (not using a Mac).

              • z3n_digital
                Posted 14/12/2012 at 4:47 pm | Permalink |

                yes but seems the date change on orig media PDF was done several days later so was PDF created then ?

                • Posted 14/12/2012 at 5:07 pm | Permalink |

                  What I’m saying is that under a normal export situation (tested under Windows PC), both timestamps would be identical, and both would be the timestamp of the export operation. The real document creation date does not seem to get copied through with the export (not with Word 2007, and not with Word 2010 either).

                  What’s more, on the parlinfo server, the PDF files show the same property — both timestamps are identical to each other.

                  So why would anyone in their right mind go and edit this? For a person trying to hide their tracks, the job requires no effort at all because Microsoft’s PDF export engine already hides the true creation date. Only the original DOC file would keep this metadata. Do you see what I’m getting at?

                  By what process would these two timestamps ever not be identical?

                • Posted 14/12/2012 at 5:11 pm | Permalink |

                  If you are suggesting they did the export to PDF some days ahead of time, and then edited the PDF at the last minute, would they really be so amazingly clueless as to deliberately edit in a bogus timezone on the creation date, but then leave that creation date with bogus timezone rather than just edit BOTH dates?

                  It would require someone deliberately attempting to screw up?!?

                  That or some other process has happened here adjusting PDF timestamps (but I can’t think what that would be).

                  • z3n_digital
                    Posted 14/12/2012 at 5:29 pm | Permalink |

                    PDF are created because generally they cant be edited e.g… final source document ..

                    [quote]It would require someone deliberately attempting to screw up?!?[/quote]

                    Deliberately attempting to do something whether it was in Word or PDF … Abbott’s lie on server time stamp being 10 hours out does not wash in any argument …

                    • Posted 14/12/2012 at 5:51 pm | Permalink |

                      I have not tested how this behaves on a networked drive… and just maybe there is some server process that does legitimately tinker with the PDF metadata (not impossible).

                      The only thing that plausibly makes sense is that Abbott’s office was talking about the 10 hour difference being the Canberra time zone offset, thus the server was not really broken, nor was the time actually wrong, it was just working in either GMT or UTC time. Entirely possible that someone in Tony Abbott’s office gave an off the cuff remark about a 10 hour difference, and by the time it got though the Chinese Whisper process, the newspaper didn’t bother reporting that it was just the normal timezone offset. No conspiracy, just incompetence. Happens all the time.

                      Maybe they have some strange plug-in that changes the PDF export behaviour of Microsoft Office?

                      • NBNAlex
                        Posted 14/12/2012 at 6:37 pm | Permalink |

                        Or maybe he’s lying… no never eh?

      • Mike S
        Posted 14/12/2012 at 4:30 pm | Permalink |

        “So what process actually generates a “Created On” timestamp that is in any way different to the “Last Modified” timestamp?”

        Modifying the PDF itself would do this. He suggest this in one of his edits:

        “have tested to see if a document created within UTC time zone would output with a Z as the time zone code, it will not when exported for MS Word, the time zone code defaults to “+00’00′”, the only time you will get a Z time zone denotation is if you export via Adobe Acrobat itself & not with the Microsoft Word PDF export. ”

        This would indicate that the original DOC was not changed, but the PDF itself was.

        • Posted 14/12/2012 at 5:29 pm | Permalink |

          Yes exactly, it would require the PDF itself to be modified, but who or what would do that?

          What possible motivation would any of Abbott’s staff have to edit in an obviously bogus creation date? Only someone who deliberately wants to make a mess of it would do that. Even if they thought they really were hiding their tracks somehow, why not just edit in a later creation date to match the News Ltd story? Why use the Zulu timezone?

          • z3n_digital
            Posted 14/12/2012 at 5:43 pm | Permalink |

            Because they are not real bright , i say they were trying to cover their tracks but got caught .. If only they had the NBN :)

            • Posted 14/12/2012 at 5:54 pm | Permalink |

              I argue that anyone smart enough to edit a PDF and directly change metadata would also be smart enough to set the creation date AFTER the News Ltd article went to press.

              If they were editing it to cover their tracks, why not at least make a plausible attempt to cover those tracks?

              • z3n_digital
                Posted 14/12/2012 at 6:04 pm | Permalink |

                You would think so but something stinks in this whole Ashby / Slipper thing has from day one

    18. Soth
      Posted 14/12/2012 at 4:11 pm | Permalink |

      Parliments server is a pidgeon with a note around it’s leg. I believe that could have got side tracked by some seed on the ground or courting another bird which could have taken 10 hours…..
      Time to upgrade to Raven’s I think!

    19. Greg
      Posted 14/12/2012 at 4:17 pm | Permalink |

      All interesting but apparently Slipper did send disgusting text messages to the other guy which is supposed to be the crux of the matter not if someone in the Libs knew about it earlier

      • z3n_digital
        Posted 14/12/2012 at 4:25 pm | Permalink |

        Crux of the story is texts were sent both ways , Half the Coalition front bench were meeting with Ashby yet all denied it until pressed .. Why ? … Abbott has lied about his involvement all the way along so the time line is very important as it shows he was aware and involved ahead of a supposedly exclusive article on Ashby …

        How could this happen why and what purpose … That is the questions as it all leads to setting up Slipper who was speaker of the Govt and to setting up Govt itself which is a serious charge

      • NBNAccuracy
        Posted 14/12/2012 at 6:52 pm | Permalink |

        So what? Thjey sent rude text back and fowards to one another. Big deal. People do it every day.
        I think the big deal is why it after all these years became an issue? Why did this guy who had been receiving these texts and sending them suddenly decide sexual harasment now? Why was so much ‘evidence’ brought up at the pre hearing and used by the Coalition in parliment to attack Slipper never actually exist? It was like the whole pre trial was to set up a series of allegations for the Coalition to use. They were pointless for the courtcase as if the evidence isn’t brought foward the judge will ignore it. You don’t bring foward enough and the judge will give you a right bollocking. Have a LOT of accusations you suddenly have not evidence for but have been used to wreck someones political career, you get what happened today. There may be fallout from this for the lawyer at least, Tony may dodge and weave, called on parlimentary privilage, have the story buried by News Ltd, as usual, and survive.

        • z3n_digital
          Posted 14/12/2012 at 7:17 pm | Permalink |

          Ashby & Co brought more smear , innuendo and lies to the court case then they did facts for the sexual harassment case and made this available to the media / LNP for political purposes , The judge saw this and ruled accordingly .. Why bring up allegation and make them to media then retract later on ..

          It was al done to hurt slipper no matter the outcome hence why Steve UTEGATE Lewis was involved

    20. David
      Posted 14/12/2012 at 7:53 pm | Permalink |

      Amazes me after all that has been revealed and a judge has made a damning expose` there are still people trying to cling onto desperate hopes that the Torys are all so blameless and pure as Mother Teresa.
      Today Abbott was caught out as he lied about when he knew about the news release of Ashbys now defeated absurd accusations against Slipper. He blamed a 10 hr fault on the time clocks of the Parliament Bldgs computer system.
      Sick Tony sick. Come home son and face the music, liar
      Greg by the way, there are many of Ashbys text messages not yet released. Social media, who discovered the Abbott lie about his computer are on to that as well.

      • NBNAlex
        Posted 14/12/2012 at 9:23 pm | Permalink |

        Surely you’ve heard the latest David…

        It was a shonky judge… seriously :/

    21. David
      Posted 14/12/2012 at 9:55 pm | Permalink |

      I hope these idiots who are attacking the judge appreciate the consequences of contempt of court. I doubt they do and I gather this Federal Court Judge is not a man to be trifled with. Be it on their heads

    22. Posted 14/12/2012 at 10:09 pm | Permalink |

      Hey everyone,

      apologies, but I’m closing comments here as I’m on vacation from tomorrow and I don’t want to spend a lot of time moderating a hot discussion ;)

      Cheers,

      Renai




    Get our 'Best of the Week' newsletter on Fridays

    Just the most important stories, one email a week.

    Email address:


  • Most Popular Content

  • Enterprise IT stories

    • Super funds close to dumping $250m IT revamp facepalm2

      If you have even a skin deep awareness of the structure of Australia’s superannuation industry, you’ll be aware that much of the underlying infrastructure used by many of the nation’s major funds — AustralianSuper, CBus, HESTA and more — is provided by a centralised group, Superpartners. One of the group’s main projects in recent years has been to dramatically update and modernise its IT platform — its version of a core banking platform overhaul. Unfortunately, as was revealed in November, the $250 million project has not precisely been going well, and the Financial Review last week reported that Superpartners is actually close to turfing it altogether and going back to the drawing board.

    • Qld’s Grant joins analyst firm IBRS peter-grant

      This week it emerged that Peter Grant, the two-time former Queensland Whole of Government CIO (pictured), has joined well-regarded analyst firm Intelligent Business Research Services (IBRS). We’ve long had a high regard for IBRS, and so it’s fantastic to see such an experienced executive join its ranks.

    • Westpac dumps desk phones for Samsung Android mobiles samsung-galaxy-ace-3

      The era of troublesome desk phones tied to physical locations is gradually coming to an end in many workplaces, with mobile phones becoming increasingly popular as organisations’ main method of voice telecommunications. But some groups are more advanced than others when it comes to adoption of the trend. One of those is Westpac.

    • Ministers’ cloud approval lasted just a year reverse

      Remember how twelve months ago, the Federal Government released a new cloud computing security and privacy directive which required departments and agencies to explicitly acquire the approval of the Attorney-General and the relevant portfolio minister before government data containing private information could be stored in offshore facilities? Remember how the policy was strongly criticised by Microsoft, Government CIOs and Delimiter? Well, it looks like the policy is about to be reversed.

    • WA Govt can’t fund school IT upgrades oops key

      In news from The Department of Disturbing Facts, iTNews revealed late last week that Western Australia’s Department of Education has run out of money halfway through the deployment of new fundamental IT infrastructure to the state’s schools.

    • Turnbull outlines Govt ICT vision turnbull-5

      Communications Minister Malcolm Turnbull has published an extensive article arguing that the Federal Government needed to do a better job of connecting with Australians via digital channels and that public sector IT projects needn’t cost the huge amounts that some have in the past.

    • NZ Govt pushes hard into cloud zealand

      New Zealand’s national Government announced a whole of government contract this morning for what it terms ‘Office Productivity as a Service’ services. This includes email and calendaring services, as well as file-sharing, mobility, instant messaging and collaboration services. The contract complements two existing contracts — Desktop as a Service and Enterprise Content Management as a Service.

    • CommBank reveals Harte’s replacement whiteing

      The Commonwealth Bank of Australia has promoted an internal executive who joined the bank in September after a lengthy career at petroleum giant VP and IT services group Accenture to replace its outgoing chief information officer Michael Harte, who announced in early May that he would leave the bank.

    • Jeff Smith quits Suncorp for IBM jeffsmith4

      Second-tier Australian bank and financial services group Suncorp today announced that its long-serving top technology executive Jeff Smith would leave to take up a senior role with IBM in the United States, in an announcement which marks the end of an era for the nation’s banking IT sector.

    • Small business missing the mobile, social, cloud revolution iphone-stock

      Most companies that live and breathe the online revolution are not tech startups, but smart smaller firms that use online tools to run their core business better: to cut costs, reach customers and suppliers, innovate and get more control. Many others, however, are falling behind, according to a new Grattan Institute discussion paper.

  • Blog, Enterprise IT - Jul 5, 2014 13:53 - 0 Comments

    Super funds close to dumping $250m IT revamp

    More In Enterprise IT


    Blog, Telecommunications - Jul 5, 2014 12:12 - 0 Comments

    What should the ACCC’s role be in guiding infrastructure spending?

    More In Telecommunications


    Analysis, Industry, Internet - Jun 23, 2014 10:33 - 0 Comments

    ‘Google Schmoogle’ – how Yellow Pages got it so wrong

    More In Industry


    Blog, Digital Rights - Jun 30, 2014 22:24 - 0 Comments

    Will Netflix launch in Australia, or not?

    More In Digital Rights