Was Craig Wright’s 2008 Bitcoin Email Just an Elaborate Forgery?

23. Email: “I need your help editing a paper I am going to release” (1) {ID_000465}

423. This document purports to be an email from Dr Wright to Dave Kleiman dated 12 March 2008 and referring in the future tense to Dr Wright’s purported authorship of the Bitcoin White Paper.

(a) COPA’s Reasons for Alleging Forgery

424. The document has been backdated and is inauthentic. [PM18 [54, 57]].

425. In his Defence in these proceedings, in public articles, and subsequently elsewhere, Dr Wright has offered and repeated a false technical explanation for the irregularities within documents connected to {ID_000465}. Dr Wright’s proffered explanation is unsound. Even if it were accurate, the proffered explanation would not explain all of the irregularities discovered within it. [PM18 [69 to 72]].

426. The document is part of a series of manipulated emails, all of which carry similar content on their face, but which have been edited by degrees to display different timestamps, and different sender and recipient information [PM18 [37-40]]. The various documents in the set are inconsistent with each other but are consistent with a pattern of editing beginning with an artificial precursor email, and ending with a document which would be deployed as if it was original and authentic, in connection with Dr Wright’s claim to be Satoshi Nakamoto.

427. The email was purportedly sent by Dr Wright from his email address at the domain “rcjbr.org”. The date of the email is purportedly 12 March 2008. By that date however, the rcjbr.org domain name had not yet been registered by Dr Wright. It would not have been possible to send the forwarded email at the date recorded in the email message. [PM18 [55-57, 84]].

428. {ID_000465} thus shares similar technical inconsistencies to {ID_000464} as regards being sent from a domain name which was not yet registered to Dr Wright. [PM18 [41- 53]].

429. The transmission header of {ID_000465} is identical to that of {ID_000464}, although the documents have different content. The transmission header contains references to the domain rcjbr.org. The purported dates of those emails pre-date the date of registration of the domain name rcjbr.org, but would be contemporary for 2015. [PM18 [55 to 57 and 63-67]].

430. The document purports to be a private exchange between Dr Wright and Mr Dave Kleiman. It is among one of several documents (including {ID_001318}) that Dr Wright purports to have forwarded to Ira Kleiman in apparent support of his claim to be Satoshi.

(b) COPA’s Reasons for Inferring Dr Wright’s Knowledge / Responsibility

431. The effect of the tampering is to make the document appear to be supportive of Dr Wright’s claim to be Satoshi Nakamoto (i.e. to create an email indicating that he was working on Bitcoin prior to the release of the Bitcoin White Paper), contrary to fact.

432. In his Defence in these proceedings, in public articles, and subsequently elsewhere, Dr Wright has offered and repeated a false technical explanation for the irregularities within {ID_000465}. Dr Wright’s proffered explanation is unsound. Even if it were accurate, the proffered explanation would not explain all of the irregularities discovered within it. [PM18 [69 to 72]].

433. The document is written in the first person from the perspective of Dr Wright.

434. The document is an email sent by Dr Wright from his personal email address, [email protected].

435. The document contains content personal to Dr Wright.

436. In his Defence in these proceedings, Dr Wright claimed to have created the content of this document and maintained its authenticity.

437. In his evidence in these proceedings, Dr Wright relies on interactions with Mr Dave Kleiman in relation to his alleged Bitcoin project (including before the release of the Bitcoin White Paper) as part of his claim to be Satoshi Nakamoto. [Wright1 [89]].

438. The document originates from a computer with the name “cwright” and from an IP address of Dr Wright, being the same IP address as is associated with several other documents identified as originating from Dr Wright. [PM18 [10]].

439. The document is part of a connected pattern of documents that have been edited from one another. Although the sender information changes with each edit, in each case Dr Wright is listed as the sender.

(c) Dr Wright’s Explanations and COPA’s Rebuttal

440. This document appears to be an original of the “Kleiman email” addressed in the Particulars of Claim (see above), with the sender identified as [email protected]. Each of the various versions of this email in the disclosure consist of three short paragraphs, which begin respectively (i) “I need your help…”; (ii) “You are always…”; and (iii) “I cannot release it…”

441. In Appendix B to Wright11, Dr Wright accepted that this document is a forgery, and indeed that all other versions of the email in disclosure are likewise forgeries. He evidently made this admission in order to deal with the numerous forensic signs of these emails being subject to editing (referred to above). He now claims to have sent an email to Mr Kleiman on the date given in the email (12 March 2008) and that that genuine email contained the first two paragraphs seen in all the disclosed versions, but that the genuine email did not contain the third paragraph seen in all the disclosed versions. He claims that the real email was tampered with by disgruntled former employees of his companies who were working with Ira Kleiman against him. He claims that the false version(s) came from these disgruntled individuals, and that Mr Kleiman then deployed such version(s) against him in the US proceedings. See: {CSW/2/44} [12.6(1) to (11)]. In his oral evidence, Dr Wright doubled down on that version: {Day4/74:6} to {Day4/83:20}.

442. Dr Wright also maintains his claim from the Defence that the genuine email would have been sent from a different email address (with a Ridges Estate domain). He attributes the change in domain name (to the rcjbr.org address that did not exist in 2008) to the effects of moving the email from one exchange server to another. See {CSW/2/46}, [12.6(12)].

443. COPA submitted that Dr Wright’s explanation should be rejected as dishonest for the following reasons:

443.1. In his Defence (verified with a statement of truth), Dr Wright stated that the content of the email as seen in all the versions in the disclosure (with the three paragraphs identified above) was the same as that of the real email he claimed to have sent to Mr Kleiman on 12 March 2008: see {A/3/17} at [50]. The position he advanced there was that this was a genuine email, sent in this form, but that the email address in the “sent” field had been changed as a result of moves between servers. He took the same position in his fourth statement (also verified with a statement of truth): see {E/4/31} at [93].

443.2. In his eleventh statement, Dr Wright starkly contradicted his previous versions by saying that each and every version of the email in disclosure has been deliberately doctored by his enemies and that the version he sent was not the same in content as the versions in disclosure. When confronted with this point, he said that in his Defence he had meant to say that the body of the email in disclosure is “materially the same” as that of the supposed real email: {Day4/68:25} to {Day4/73:11}. He gave no explanation for advancing a position in his Defence that the email had only undergone accidental change through server moves and not mentioning that it was a fake created by his enemies (something he claims to have known when the Defence was settled).

443.3. On 9 July 2015, Dr Wright forwarded this supposed Kleiman email of 12 March 2008 to Stefan Matthews in an email with the text “More history”: {ID_001711}. The version he sent included the three paragraphs and so was the version which he now claims was a fake produced by his enemies. It is implausible that he would have sent an email he knew to be doctored to his friend Mr Matthews, presenting it as providing real “history”. When confronted with this point in cross-examination, Dr Wright reacted by claiming that the 2015 email to Mr Matthews was not sent by him but by some unidentified enemy from a compromised email address: {Day4/74:21} to {Day4/77:11}. However, in his fourth witness statement, Dr Wright had specifically stated that the email to Mr Matthews at {ID_001711} was one which he had actually sent: {E/44/33}, para. 98 (“This is an email to Stefan Matthews dated 9 July 2015 at (08.46), in which I forward an email from me to David Kleiman…” [emphasis added]). When pressed with that point in cross-examination, Dr Wright sought to deny the plain meaning of his own statement, saying that he only meant that this was an email to Stefan Matthews, not that it was an email genuinely sent to Stefan Matthews by him: {Day4/77:12} to {Day4/79:22}.

443.4. Quite apart from all the internal contradictions in Dr Wright’s story, there is no apparent reason why disgruntled ex-employees and Ira Kleiman would go to great effort to produce and plant fake versions of a real email which, even in those fake versions, still supports Dr Wright’s claim to have authored the Bitcoin White Paper (and to have used David Kleiman for no more than review purposes). No explanation has been given as to why they went to all this effort just to add the short third paragraph (“I cannot release it [the White Paper] as me. GMX, vistomail and Tor. I need your help and I need a version of me to make this work that is better than me…”).

443.5. It is wildly implausible that this cabal of enemies of Dr Wright would not only create fake versions for use in the Kleiman proceedings, but take over his email account in July 2015; find out that he was in discussions with Mr Matthews for a bail-out of his businesses at that time; and trouble to send Mr Matthews this fake email, which could and would easily have been found out (as well as being unlikely to do Dr Wright any harm).

443.6. It also beggars belief that Dr Wright’s enemies should have produced multiple versions of the fake email, which appear in various places in Dr Wright’s disclosure ({ID_001318}; {ID_001288}; {ID_000464}; {ID_000465}; {ID_001711}) but Dr Wright does not have a single copy of the real email as sent to Mr Kleiman.

443.7. In seeking to (i) maintain his story from his Defence that the anachronistic sender address is due to a change of email servers and (ii) come up with the story of his enemies forging the body of the email (in order to account for all the signs of editing in the sequence of documents discussed in PM18), Dr Wright has arrived at a doubly implausible version. He has now to say that the document has been modified from its original form both by his enemies doctoring it and by it undergoing accidental changes of appearance due to server moves.

443.8. Dr Wright’s explanation of the sender address in the email header changing as a result of server moves is rejected by Mr Madden in PM18 [71] {H/83/30}. As Mr Madden explains, the sender email address would not change as a result of such moves. Mr Madden’s evidence on this point has never been contradicted and was not challenged in cross-examination.

(d) Conclusions

444. In relation to ID_000465, I am entirely satisfied the email was forged by Dr Wright. His explanations are absurd.

445. In relation to ID_001318, I am also entirely satisfied the email was forged by Dr Wright. In summary:

445.1. the sender address relates to a domain which had not been created at the time of the email supposedly being sent.

445.2. Dr Wright’s explanation of the sender name changing in the email as a result of moves between servers has been rejected by the forensic documents expert, Mr Madden, whose evidence is the only expert evidence on the point and who was not challenged on this matter in cross-examination.

445.3. Dr Wright’s account of all versions of the Kleiman email in disclosure being fakes produced by others in an attempt to harm him should be rejected. Dr Wright’s account is inconsistent with his own Defence and fourth statement; it lacks any supporting evidence; and it is undermined by a series of other considerations (including that he sent a copy of this email to Stefan Matthews in July 2015, presenting it as genuine).

445.4. Overall and again, his explanations are absurd.