Forensic Analysis Reveals Backdating in Craig Wright’s Bitcoin Node Economics Paper

28. Economics of BitCoin Nodes (Reliance Document) {ID_000227} / {L3/219/1}

523. The document purports to contain notes relating to “The Economics of central core BitCoin Nodes” and is dated as if it was created in the period September-October 2008.

(a) COPA’s Reasons for Alleging Forgery

524. The document has been backdated. Within the document are several hidden embedded zip files containing references to Microsoft Schema dating from 2014-2015 which did not exist in 2008. These references are not visible to someone editing the document or reviewing its internal content without forensic analysis. [PM26 [16-17]].

525. Equations within {ID_000227} were created with MathType software v6.9, a version dating from February 2013 which did not exist in 2008. [PM40 [32, 42]].

526. The document contains redundant hidden content of previous edits which do not appear on the face of the document. [PM26 [19-20]].

527. The hidden embedded text within the document includes references to a web page URL which did not exist until on or after 11 April 2019. [PM26 [21]].

528. The reference to the 11 April 2019 URL has been deleted from the face of the document and replaced with a footnote which appears to be a “note to self” about what would need to be added in a future draft (“Note: I will need to link to laws such as the CFAA (USA) – see LLM[…]”). Other footnotes have been introduced or edited to refer to Bitcoin in the future tense. The misleading effect of these edits is to make the document appear as if it was created at a time before Bitcoin was created. In fact, the document was created later, after 11 April 2019, and the anachronistic content was obscured by editing. [PM26 [19-24]].

529. The document was created from a precursor document after 11 April 2019. No precursor document has been disclosed by Dr Wright. [PM26 [23]].

530. The document {ID_000227} has an implausible edit time of 20 days 19 hours and 22 minutes consistent with the use of clock manipulation techniques. [PM26 [6-10]].

531. The document was emailed from Dr Wright to Lynn Wright on 18 January 2020. The email contains several manipulated documents purported to be in the custody of Lynn Wright. The metadata of that zip file is also irregular. [{ID_003937}, PM26 [1, 25-38]].

(b) COPA’s Reasons for Inferring Dr Wright’s Knowledge / Responsibility

532. The effect of the tampering is to make the document appear to be supportive of Dr Wright’s claim to be Satoshi Nakamoto (suggesting work done by him in September / October 2008 which looked ahead to Bitcoin), contrary to fact.

533. Although the document metadata purports Lynn Wright to have been an author, it was actually created by Dr Wright in the name of Lynn Wright after 11 April 2019, and a copy later sent from Dr Wright to Lynn Wright by email long after they were separated, contained in a zip file along with many other files bearing evidence of backdating and tampering including several documents on which Dr Wright primarily relies. The metadata of that zip file is itself also irregular. [{ID_003927}, PM26 [1, 25-38]].

534. Dr Wright shared a document with identical content on social media on 16 January 2020, contemporaneously with the aforesaid email to Lynn Wright. Upon request in these proceedings, Dr Wright has repeatedly declined to disclose a copy of his posts to social media accounts. Since the date of the Request, Dr Wright has claimed to have lost access to the relevant social media account.

535. The content introduced into the document, having the effect of making it appear to date from earlier than its true date, is phrased in the first person as a note from Dr Wright to himself.

536. In his first witness statement in these proceedings, Dr Wright lists this document as a document to which he has been referred when preparing his evidence.

537. Dr Wright is recorded in the metadata as the first author.

538. Dr Wright has not disclosed the precursor documents [PM26 [23]].

(c) Dr Wright’s Explanations and COPA’s Rebuttal

539. Dr Wright sought to explain away the presence of anachronistic references to Mathtype software and Microsoft schemas by referring to the effects of his computing environment in supposedly causing such elements to be inserted into documents merely through a document being opened (without any user interaction): Wright11 Appendix B, [6.3 to 6.4]{CSW/2/20}.

540. Dr Wright sought to explain the presence of remnant text, including the URL in the footnote dating from 2019, by saying that text from another document had become merged with the text of this document as a result of features of his computing environment: Wright11 Appendix B, [6.5 to 6.6] {CSW/2/20}. He also suggested that the article at the URL had limited relevance to the material content of his document.

541. COPA submitted that this explanation should be rejected as dishonest for the following reasons:

541.1. Dr Wright’s explanation is contradicted by the clear expert evidence of Mr Madden, which is that the Mathtype references and schema references could not be inserted without the document being interacted with by a user, which would in turn result in updating of the metadata timestamps of the document. The fact that the metadata timestamps for this document were dated to 2008 but the raw data contained the elements set out above shows that the document has been forged by backdating. See Madden4, [158]; Madden / Placks joint statement2 at [8]; {Day16/35:19} to {Day16/38:11}; {Day16/125:7} to {Day16/125:18}.

541.2. It is wildly implausible that the features of a shared computing environment would cause two documents to become merged, and to do so in a way which resulted in the document not being corrupted and appearing normal on its face. See Madden4, [159]; Madden / Placks joint statement2 at [8].

541.3. In his evidence, Dr Wright tried to justify his position by going so far as to claim implausibly that any digital document more than a few years’ old could be expected to have anomalous features in its raw data. He claimed never to have seen a file older than five years which was pristine in metadata, before being compelled to accept that the Bitcoin White Paper is pristine {Day3/20:5} to {Day3/20:25}.

541.4. In his evidence, Dr Wright attempted to explain that the footnote in the edited version of the document was obviously more apt to the text than the footnote in the remnant text. In doing so, he put forward a bizarre interpretation of the Bitcoin system in which the availability of injunctive relief is supposedly essential to preventing subversion of the system: {Day3/7:18} to {Day3/15:16}.

(d) Conclusion

542. The points on this document gathered in Appendix 1 to Dr Wright’s Closing repeat a number of points I have already found to be unconvincing in relation to {ID_000217} above and they are equally unconvincing here. Furthermore, the argument that this document is the result of text from another document becoming merged into the document is particularly absurd. The argument presupposes disk read errors such that a disk sector containing a portion of another document is merged into the saved version of this document but without any trace of corruption or discontinuity.

543. In short, I found Dr Wright’s explanations wholly unconvincing, especially in the light of the detailed specific points made by Mr Madden. This document was plainly forged, and forged by Dr Wright.