January 13, 2005

CBS Report file has been modifed! Cut and Paste now prohibited!

Ernest Miller noticed that he could no longer cut-and-paste from the CBS report, and asked me to investigate. He's right. The report PDF file has been modified since its release. This can be verifed by any tool which will display the internal information of a PDF file.

http://wwwimage.cbsnews.com/htdocs/pdf/complete_report/CBS_Report.pdf

HTTP information (emphasis added below):

HTTP/1.0 200 OK
Server: Apache
Last-Modified: Wed, 12 Jan 2005 21:24:24 GMT
ETag: "b8626f-abd1c-6cea7200"
Accept-Ranges: bytes
Content-Length: 703772
Content-Type: application/pdf
Date: Thu, 13 Jan 2005 19:25:27 GMT

Current CBS Report file, PDF internal information (from the Linux tool "pdfinfo")

Title:          Microsoft Word - DC-685241-v10-Final_CBS_Report__sent_to_Lou_12_20_.DOC
Author:         demartpe
Creator:        PScript5.dll Version 5.2.2
Producer:       Acrobat Distiller 5.0.5 (Windows)
CreationDate:   Wed Jan  5 23:29:52 2005
ModDate:        Wed Jan 12 16:00:24 2005
Tagged:         no
Pages:          234
Encrypted:      yes (print:yes copy:no change:no addNotes:no)
Page size:      612 x 792 pts (letter)
File size:      703772 bytes
Optimized:      yes
PDF version:    1.4

Earlier CBS Report file, PDF internal information (from the Linux tool "pdfinfo")

Title:          Microsoft Word - DC-685241-v10-Final_CBS_Report__sent_to_Lou_12_20_.DOC
Author:         demartpe
Creator:        PScript5.dll Version 5.2.2
Producer:       Acrobat Distiller 5.0.5 (Windows)
CreationDate:   Wed Jan  5 23:29:52 2005
ModDate:        Fri Jan  7 19:17:44 2005
Tagged:         no
Pages:          234
Encrypted:      no
Page size:      612 x 792 pts (letter)
File size:      703330 bytes
Optimized:      yes
PDF version:    1.4

Note the difference in the "Encrypted:" field!

However, the text itself does not seem to have been altered.


Update 4:15 pm EST: Ernest Miller sends that the version of the report on the CBS law firm site has also been modified, confirmed (though the text again does not seem to have been altered).

http://www.klng.com/downloads/CBS_Report.pdf

HTTP information (emphasis added below):

HTTP/1.1 200 OK
Content-Length: 690313
Content-Type: application/pdf
Last-Modified: Tue, 11 Jan 2005 20:16:48 GMT
Accept-Ranges: bytes
ETag: "8564b67a1af8c41:e1b"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Thu, 13 Jan 2005 21:19:25 GMT

PDF internal information (from the Linux tool "pdfinfo")

Title:
Creator:        PScript5.dll Version 5.2.2
Producer:       Acrobat Distiller 5.0.5 (Windows)
CreationDate:   Wed Jan  5 23:29:52 2005
ModDate:        Tue Jan 11 15:14:40 2005
Tagged:         no
Pages:          234
Encrypted:      yes (print:yes copy:no change:no addNotes:no)
Page size:      612 x 792 pts (letter)
File size:      690313 bytes
Optimized:      yes
PDF version:    1.5


Update Fri Jan 14 14:45 EST 2005
Sisyphean Musings has CBS's explanation:

To allow copying of text to applications such as Word would allow anyone to create a modified or falsified report, which we cannot allow. The law firm hired by the Independent Panel insists that the report not be available in a format that can be altered, and we agree with that decision.

This speaks for itself.

By Seth Finkelstein | posted in infothought | on January 13, 2005 02:53 PM (Infothought permalink) | Followups
Seth Finkelstein's Infothought blog (Wikipedia, Google, censorware, and an inside view of net-politics) - Syndicate site (subscribe, RSS)

Subscribe with Bloglines      Subscribe in NewsGator Online  Google Reader or Homepage

Comments

Dunno if it's legal, but this product claims to be able to break such restrictions:

http://www.elcomsoft.com/apdfpr.html

Posted by: Anon at January 13, 2005 07:17 PM

I don't really understand what the point of changing the file is. Anybody with enough time and access to Google can find copies of many programs that will strip the encryption off such as AEBPR. Stupid if you ask me.

Posted by: netwizard at January 13, 2005 07:23 PM

If you drop the original CBS-released PDF of the documents into a graphics editor like Photoshop, and crank up the brightness and contrast, you can see where the documents were crumpled and uncrumpled:

http://littlegreenfootballs.com/weblog/?entry=12612

The copies of the documents released as appendices to the report are different. They don't have the crumple marks, and they are missing certain non-linear distortions that were the obvious intent of the crumpling/uncrumpling process. In fact, if you make an animated GIF of the two, it makes the crumpling even more obvious. See:

http://littlegreenfootballs.com/weblog/?entry=14273#c0131

It appears to me that CBS has either inadvertantly (or out of necessity due to the irreproducability of the crumpled document) just released an intermediate work product of the forgery process -- the document as it existed just prior to the final crumpling and uncrumpling step done before document scanning.

Doesn't CBS news' possession of forgery work product implicate them in the forgery process itself?

At any rate, you can't repeat my experiment with the current file at the CBS web site because now when you drop the PDF into Photoshop, it prompts for a "Master Password" which I don't have.

CBS is apparently interested enough in preventing computer graphical analysis of the new copies of the documents to have taken this action.


Posted by: jms at January 13, 2005 09:53 PM

Thank you for saving the Document Properties views above.

USA Today's set of the fake docs are still here.

Per USA Today, these 6 pages were PERSONALLY obtained by a USA Today reporter from Burkett who was visiting friends in Montana on the night CBS aired the "AWOL/Fortunate Son" story. This is important because it means that set of 6 was not faxed. USA Today got copies closer to the first "draft".

On a laptop (i.e. plasma screen) one can easily see the cut-and-paste crop markings around the text, the signatures and the various square "dots" all over the pages. Move your screen's angle a little back and forth to get darker and lighter versions and you'll see it. It's also visible by simply printing them out on paper.

Reason for the "cut-and-paste crop markings" - my theory is that text sentences were typed on computer, then overlaid on a page where the square "dots" had already been created digitally. Then the signatures were lifted from real military docs and overlaid on the same doc. The sequence of overlaying may be different, but that's the basic process I see when looking at the USA Today set of 6 fake docs.

I have reason to believe it was done using Paul "OETR" Lukasiak's glcq.com and/or Martin Heldt's sites, both of whom had invested a lot of time on their AWOL/Fortunate Son opposition research on their sites and were in contact with Mapes, Boston Globe...

Posted by: BR - visitor from Wizbang at January 13, 2005 11:59 PM

By the way, I believe Burkett was just a conduit patsy (delivery person) to mask the identities of the forgers/fakers/fabricators.

Posted by: BR at January 14, 2005 12:02 AM

JSM - re your animated comparison between the 9/8/04 CBS version and the new CBS version of the 4 May 72 fake doc described in your #131 post at LGF:

Amazing!! Deja vu all over again! How weird can CBSgate get!

The first "now you see it, now you don't" dot that caught my eye in your animated comparison is about half an inch above "George", slightly to the right of the last "e" in George. The crumpled version has that dot, but the newer version does not!

I checked the crumpled versions and each of those 4 pdfs at cbsnews.com still have their 9/8/04 creation and modification dates. Now I'd like to see the newly released version. Can you give me a link to the newly released file "2B.pdf" you used for the comparison?

I've been "reporting on your reporting" at Wizbang, crediting you and linking to your links :))

I'm really tickled about what this means - a crumpled version in Sept. 04 and a non-crumpled version in Jan 05, both issued by CBS? So the question is when and where did the crumpling occur? At Kinko's? At CBS? And when did CBS get the non-crumpled versions? If the Thornburgh law firm got them later directly from Burkett, then it points to CBS doing the crumpling (?) Or if CBS had both versions in their possession in September, it still points to that.

The USA Today 9/9/04 versions were not crumpled, came directly by hand from Burkett to USA Today and have digital crop markings showing - which I do not see on any of the CBS versions, perhaps because they were faxed.

Somewhere in all these details lie the answers, eh!

Posted by: BR at January 14, 2005 02:44 AM

I was able to turn off the restrictions using Adobe Acrobat 6.0. The properties showed it set to password security. I was goofin around and changed it to No Security adn it turned off the security settings. I then saved the pdf and reopened it and the security was gone. I c&p this from it:

KIRKPATRICK & LOCKHART
NICHOLSON GRAHAM LLP
Michael J. Missal, Esq.
Lawrence Coe Lanpher, Esq.
1800 Massachusetts Avenue, N.W.
Washington, D.C. 20036
(202) 778-9000
Counsel to the Independent Review Panel

Apparently forging documents is not all that CBS sucks at.

Posted by: Steve L. at January 14, 2005 07:10 AM

Note that CBS got around to putting a password on their 'password protected' document, and now Steve L.'s process no longer works in Acrobat 6.

Frank Field

Posted by: Frank Field at January 15, 2005 01:17 PM

This can easily be defeated by a four line patch to xpdf. All someone has to do is open XRef.cc and find okToCopy. After that they will see a line that says return ; and all they need to do is change that line to say return gTrue;. That needs to be repeated for the other three okTo functions in the same place. Finally, they can compile xpdf and then use pdf2ps and then ps2pdf to remove the restrictions on the pdf file.

Posted by: Anonymous at January 16, 2005 06:11 PM