Comment by AaronFriel | Hacker News Reader

Comment by AaronFriel | Hacker News Reader

The central component of the allegation that the DNC leak was an inside job as opposed to a hack has been repeated by writers at Consortium News and by journalist Patrick Lawrence:

> Key among the findings of the independent forensic investigations is the conclusion that the DNC data was copied onto a storage device at a speed that far exceeds an Internet capability for a remote hack.

Here's the article from Patrick Lawrence in 2017 (https://www.thenation.com/article/archive/a-new-report-raise...) and a quote:

> “A speed of 22.7 megabytes is simply unobtainable, especially if we are talking about a transoceanic data transfer,” Folden said. “Based on the data we now have, what we’ve been calling a hack is impossible.” Last week Forensicator reported on a speed test he conducted more recently. It tightens the case considerably. “Transfer rates of 23 MB/s (Mega Bytes per second) are not just highly unlikely, but effectively impossible to accomplish when communicating over the Internet at any significant distance,” he wrote. “Further, local copy speeds are measured, demonstrating that 23 MB/s is a typical transfer rate when using a USB–2 flash device (thumb drive).”

I have two issues here:

1. The basis for this allegation is nonsense. Filesystem timestamps using local clocks are not a reliable indicator of transfer speed.

2. Back in 2017, I lived in Cedar Falls, Iowa. I was fortunate to live in a place with a municipal fiber optic internet connection, and I wrote to The Nation and to Patrick Lawrence and tweeted at them back then. I was able to get far in excess of 23 MB/s using my residential internet connection to servers in Russia, from Iowa. Here's a screenshot I took back then: https://twitter.com/AaronFriel/status/896072426143993856

I raised this with Patrick Lawrence, aka @thefloutist, on Twitter back then and the article in The Nation was never retracted or fact checked, and this absurd claim keeps being repeated.

The argument isn't that 23MB/s is so outrageously fast that it must be from a USB drive and couldn't be from the internet. The argument is that 23 MB/s is a peculiar number because it is so close to USB 2 max throughput (480Mbit in spec, but practically closer to 280Mbit due to bus access overhead and underlying storage limitations.) It's not at all unreasonable to expect that a USB2 mass storage device would cap out around there for write speeds on a larger USB 2 flash drive.

What's more relevant is the jitter on the timestamps. IF it was just an average of 23MB/s, I'd agree with you. But what I suspect is that it's sustained 23MB/s with little variation.

Putting aside wild theories about the timestamps being intentionally modified to represent a USB transfer, a sustained 23MB/s with no variation is awfully characteristic of a USB transfer.

This is again absurd.

You have simply regurgitated a series of numbers without evidence. Meanwhile:

The Mueller report and grand jury indictments against Russian state actors, the intelligence community's public statements, and the bipartisan assessment of the Senate Select Committee on Intelligence all dispute these coincidences.

Your numbers do not make sense. You write 480mbps, then you write 280mbps, but 23MB/s is 183mbps. It's also a perfectly reasonable sustained speed to get for a file transfer over the internet!

As Patrick Lawrence's source described:

> “Transfer rates of 23 MB/s (Mega Bytes per second) are not just highly unlikely, but effectively impossible to accomplish when communicating over the Internet at any significant distance,”

This is obviously false, obviously disinformation, obviously wrong. Anyone could prove it wrong in 2017, I did, and I emailed, wrote, and tweeted at Patrick Lawrence and The Nation in 2017 and it was never retracted. It doesn't belong in any reporting, period, let alone reporting on the hack of the DNC servers.

> Your numbers do not make sense. You write 480mbps, then you write 280mbps, but 23MB/s is 183mbps.

There's a series of bottlenecks. The spec bottleneck is 480mbit, but it's further constrained by bus access to something like 280mbit, which is further constrained by the underlying storage medium to something in the ballpark of 20MB/s to 30MB/s. It depends on the particular flash chip in the device. Try it yourself with a handful of older usb2 drives and see.

> > “Transfer rates of 23 MB/s (Mega Bytes per second) are not just highly unlikely, but effectively impossible to accomplish when communicating over the Internet at any significant distance,”

You're being uncharitable. Maybe what he's saying isn't that the overall transfer rate is impossible over the internet, but he's saying that a sustained unvarying 23MB/s transfer is unlikely over the internet. I think most reasonable techies would agree that the former isn't true (aka: I agree with you), but the latter is a much more interesting claim. It's definitely not total nonsense, as you're making it out to be.

It is absolutely total nonsense and it is the basis for the following proposition:

(The following is not true!) "It is impossible to transfer files at a speed over 23MB/s over the Internet."

If we accept that proposition as true, then yes, there is maybe a world in which we can discredit the DNC hack as an inside job, if we conditionally also believe that the timestamps accurately reflect the transfer speed and not, say, the result of the files being transferred at some point after the hack.

For example, if the hackers transferred the files to a thumb drive. Or to a file server. Or they archived the files then unarchived them with fresh timestamps and the rate of decompression was ~23MB/s. There are many, many different ways to get file timestamps that reflect a transfer speed of 23MB/s at any point after the initial transfer.

These are the two key propositions to believe the inside job argument.

On the other hand, grand juries, the intelligence community, the Mueller report, and the bipartisan consensus of the Senate Select Committee on Intelligence all agree those propositions are nonsense.

It provides some indication that it may have been transferred to USB at some point.

That point could be directly from the server, or from the hacker's computer to a USB drive, or from a USB drive to another computer.

It says nothing about the original hack.

I mean the better question is what speed did the ISP provide at the termination. And if this was moved off-site then uploaded at a higher speed.

27MB/sec is nothing crazy on regular commercial plan.

Now if they have information that they office had a crappy 100/20mb TWC plan... Sure

It's not only the speed. All of the timestamps of the files are even numbers, which is indicative of a FAT file system.

> "The directory entry for the FAT file system only has a 5-bit field for storing the number of seconds in the time. This limits the number stored in the field to the range 0-31, which is multiplied by two to obtain the number of seconds."

The timestamps appear to have been copied to a FAT filesystem (common for USB devices) on May 25, 2016.

https://turcopolier.typepad.com/sic_semper_tyrannis/2019/04/...

I had that speed to the US West Coast over Hyperoptic gigabit in 2017 from London. Very steady. There are qualifiers that are missing from the claim, I agree.

Agreed. A work colleague at Red Hat in the UK back in ~2014/2015 had a FTTH home internet connection, and he could download from public servers at 70MB/s.

So, ~20MB/s isn't "simply unobtainable" though I agree the figure is suspiciously like USB2 speeds for cheapo flash drives. eg the ones with slow write speeds

Reply on news.ycombinator.com