2011-01-12 Confusion over WikiLeaks-Tsvangirai Cable Timestamp UPDATED

In response to Glenn Greenwald's coverage of the Wikileaks-Guardian-Tsvangirai controversy and the Guardian's recent retraction, The Atlantic's Max Fisher tweeted an interesting point, which throws into confusion the issue of exactly what time Wikileaks released the 09HARARE1004 cable:

Max Fisher:

@ggreenwald Not trying to start a fight, but WL time stamp looks to be older than Guardian's? http://bit.ly/ghUUKc http://bit.ly/hHtH2u

4:39PM Jan 12th 2011


Max Fisher:

@ggreenwald Correct me if I'm wrong, but from these, it looks like WikiLeaks published 21 minutes before the Guardian.

4:40PM Jan 12th 2011

Fisher is pointing out that the timestamp in the header of the 09HARARE1004 cable released on the Wikileaks website reads "2010-12-08 21:09"

The publication date of The Guardian's version of the cable reads "Wednesday 8 December 2010 21.30 GMT."

This would appear to indicate that Wikileaks published the cable on their website 21 minutes before The Guardian did.

This is an important point, and it raises an issue I have been contacted about recently.

I should state at the outset that I think the exact timestamp of the cables is rather moot, for this reason: David Leigh has clarified the exact procedure as regards publication of the cables. The media partners (in this case, The Guardian) choose which cables to publish from their own cache of the cables, given them by Wikileaks. They research, write their stories, and then inform Wikileaks of their decision to publish, also sending Wikileaks their greenlighted and redacted version of the cable. Wikileaks then publishes this. In light of this, even if Wikileaks technically published the cable a few minutes before the Guardian did on its own website, the decision to publish, and which content within each cable to publish, is carried out by The Guardian. The ultimate responsibility for the decision to publish, therefore, lies with the relevant media partner for each cable. The Guardian's decision to publish their (rather unsatisfactory) retraction represents an apparent acknowledgement of this fact.

Nevertheless, I want to point out a reason why we should regard the timestamp of the 01HARARE1004 cable on the Wikileaks site with suspicion. The matter is rather complicated, and there are two broad points to consider.

A contact got in touch a few weeks ago to point out an interesting bug in the timestamping of the Wikileaks cables, as hosted on their Cablegate site, and its multiple mirrors.

The timestamp for every cable published there, which is written in 24-hour time, always has a minute count equal to the hour count, if you convert the time to the 12-hour clock. So, if a cable is published at 1AM, it will read "1:01." If it is published at 1PM, it will read "13:01." If it is published at 10AM it will read "10:10" and if at 10PM it will read "22:10." Irrespective of how many minutes past the hour the cable was really published, the minute-count will always be the same as the 12-hour version of the hour-count. A cable published at 11:54PM will read as having been published at "23:11."

Not only this, but the "Created" datestamp in the header seems to be doing the same thing. The "Created date" indicates the time at which the cables were originally created and sent from their respective embassies. It is implausible to think that diplomats around the world chose to send their cables only during the precise minute in every hour when the number of minutes past the hour was equal to the number of hours past midday or midnight, but this is what these "Created" datestamps appear to indicate. So, for instance, 09HARARE1004 has a "Created" datestamp of "2009-12-24 08:08" and a "Released" timestamp of "2010-12-08 21:09." And, in fact, if one chooses to glance at the header of the main body of the Wikileaks version of the cable, it gives a time which contradicts the "08:08" time in the metadata header.

Thursday, 24 December 2009, 08:26
C O N F I D E N T I A L SECTION 01 OF 02 HARARE 001004
EO 12958 DECL: 12/24/2019

This anomaly bears out across all of the cables I have checked. To pick a random sampling of cables, 06MOSCOW6545, for instance, has a "Created" datestamp of "2006-05-30 09:09" and a "Released" datestamp of "2010-12-01 23:11." 07KUWAIT808 has a "Created" datestamp of "2007-05-22 09:09" and a "Released" datestamp of "2010-12-05 21:09." And 08BEIRUT586 has a "Created" datestamp of "2008-05-01 12:12" and a "Released" datestamp of "2010-12-05 21:09." In each of these cables, the header in the actual text of the cable contradicts the too-regular timestamp in the metadata header.

This is, obviously, strange. I can only surmise that it is due to some bug in Wikileaks cable publishing system. At the very least, it should incline us to regard with suspicion the minute count in the timestamp as indicated in those cables that are published on the Wikileaks website. The phenomenon appears to have been occurring since Wikileaks began releasing cables on the 27th of November. The fault for this would appear to lie with Wikileaks. If a clarification on this bug could be forthcoming from Wikileaks, it would certainly be good to have it. But it throws some uncertainty on the matter of who published the cable first.

The second point is a point which I suspect can only be confirmed for us by people who host mirrors of Wikileaks' site, but it is argued in this comment under James Richardson's piece for the Guardian, as a response to a discussion on this very topic:

The "release date" of a cable is not the date at which the cable was
published. The Wikileaks site is updated once in a while, not in a
continuous manner.

Take the latest update, which brought the number of released cables from
1947 to 1997. The "release" time stamp on these last 50 cables varies
from "2010-12-28 21:09" to "2011-01-01 21:09", even though these 50
cables were published at once on "2011-01-02 19:15:00"

and this comment, from the same commenter:

Take this cable:

Its "released" time stamp says "2010-12-30 21:09", yet, Wikileaks was updated only on January 2nd, and the prior update was on December 28th. Up to January 2nd, only 1947 cables were available for viewing.

That cable which release date is time-stamp December 30 wasn't available until January 2nd: it was not available for viewing on the site. On January 2nd, the number of cables available for viewing went to 1997.

This account agrees, in essence, with what I've been told by contacts who host mirrors of Wikileaks site. It would, however, be useful if some clarification on this point could be forthcoming, and openly discussed, with specific reference to 09HARARE1004. It appears that cables were released in batches, and that the timestamp on the cables (as indicated on each of the cables as posted on the Wikileaks site) does not normally indicate the time at which Wikileaks uploaded each batch of cables to its site, and to the various mirrors.

All of these observations, I hope, incline readers to judge with caution the exact time indicated as the "Release date" of the cables, on the Wikileaks sites. I will attempt to find out if the exact publication date of the 09HARARE1004 batch of cables can be verified and corroborated by independent and checkable sources. Until then, I leave readers with the statement from a contact, which I posted in Update 3 on my first post on this issue. This statement confirms the release time of the torrent in which the batch of cables containing 09HARARE1004 was released, and the datestamp appears to be reliable and independently verifiable. Nevertheless, it has to be noted, that this does not necessarily give us any insight into the time at which the cables might have been uploaded to the Wikileaks website, information which I hope will be forthcoming soon:

I can confirm that the 09HARARE1004 cable was released in a torrent (which I still have) time-stamped 8 December 2010 22.31 UTC (while the Guardian's article is time-stamped 8 December 2010 21.30 GMT (aka UTC)... [T]he torrent was named "cablegate-201012082231.7z". If you [search for] it, it still can be found some places.

ADDENDUM: As I've already stated, I believe that in the light of David Leigh's statement on the publication arrangement between Wikileaks and the media partners to Journalisten, and reported in English by Nina Berglund, this matter is largely academic. If David Leigh accurately portrayed the publication procedure, Wikileaks role in the publication of this cable will have been automatic, upon receipt of the modified and cleared batch of cables from The Guardian. The decision to publish the 09HARARE1004 cable, and the failure to redact the content dealing with sanctions, lay with The Guardian.

(2010-01-13, 04:47 GMT) Update 1: Wikileaks began releasing cables again, for the first time since January 5th, between 23:00 GMT on Jan 12th, and 02:00 GMT on Jan 13th.

It is important to note the pattern of the release. Prior to recommencing releases, the last cable releases on the Wikileaks site were those in the category Browse by 2011/01/05.

Since that day, no new releases appeared. As of the time of this update, there are 8 new cables. Five of these are in the category Browse by 2011/01/07. One each is in the categories Browse by 2011/01/09, Browse by 2011/01/10 and Browse by 2011/01/11.

The cables are still being uploaded to the various mirrors, as LeakyLinks will verify, while the process is ongoing. Here is a screengrab from 5AM GMT of the divide on LeakyLinks between "Up" and "Outdated" mirrors. Here, also, is a screenshot, showing CablegateSearch, which is not at this moment yet updated, showing the latest cables as having been from 7 days ago. Likewise, here is a screengrab from CableSearchBETA displaying, on the right, the most recent update ("2011-01-13 03:07") and in the list in the main portion of the screen, that most recent cable, marked as having been uploaded "2 h ago" but as having been "leaked 2011-01-07 21:09." Other cables with similarly disparate statuses are visible on the screen too.

I think this is proof positive that the "Released" datestamps in the metadata header of the cables, and date categories under which Wikileaks lists its cables, should not be interpreted as indicating the moment they were first uploaded to the Wikileaks website, nor to any of the mirrors. These cables, datestamped in the header as having been "released" on the 7th, the 9th, the 10th and the 11th of January, did not appear on those days on the Wikileaks site, but only in the last few hours. Nevertheless, having appeared, they present themselves in release batch categories according to those dates.

This does not confirm for us that the 09HARARE1004 cable was definitely "published" by Wikileaks after 21:30 GMT on December 8th - the time the Guardian's datestamp displays. Nevertheless, it does undermine the notion, if that needed any more undermining, that we should regard with certainty the time of "21:09" - on that cable's datestamp - as being the moment that Wikileaks released it on their website.

(2011-01-13, 20:35) Update 2: The Guardian this afternoon published an article by Ian Katz which acknowledges the worries I outlined in this post, and proceeds to outline a balanced appraisal of the situation. The piece represents a public notice of the mistake in the Richardson article, and an attempt by The Guardian to address its own unfair practices. It puts to bed the notion that Wikileaks bears the sole responsibility for the publication of 09HARARE1004. There can remain difference of opinion about who bears more blame, whether that blame is justifiably apportioned, but The Guardian's move here ensures that those debates will occur with reference to the facts about how the cables are published. This can only be described as commendable. The clarification also conclusively renders academic the issue of the above post, although I will continue to track down the detail I've been looking for, merely in the interests of completeness, or lest the data here become relevant again.

(2011-01-13, 21:14) Update 3: In a conversation with some of the community, I've managed to clarify the procedure by which Wikileaks uploads cables to its website, and to the mass mirrors. This information will be relevant to determining the exact time of the release of a cable by Wikileaks.

The procedure, roughly, follows this pattern.

  1. After a) deciding to publish a specific cable, b) prepararing, c) editing and d) reporting on that cable, and e) redacting it, the media partner f) shares that redacted version of the cable with Wikileaks. (Taking into account the minute-count issue noted above, I believe, but have not been able to verify, that the "Released" datestamp in the metadata of the cables on Wikileaks site in fact reflects the time that Wikileaks received that cable from one of its media partners. I will post more on this, if I find whether this is true or not.)
  2. Having received the redacted cable from the media partner, Wikileaks adds this to the batch of cables that has been accruing since it last made an upload.
  3. At regular intervals, Wikileaks uploads a batch to one of its main servers, and then begins accruing a new batch.
  4. The uploaded batch is then synced to the other main servers.
  5. A .7z archive is automatically generated, comprising all of the old cables and the new ones, and the mktorrent script is then run, which generates a torrent file. This is then logged in the http://wikileaks.ch/magnet.txt file, and can be downloaded automatically. The name of the torrent which first included the batch in which 09HARARE1004 released is "cablegate-201012082231.7z" - readers will see that it is in the magnet.txt file. Here is a backup of the magnet.txt file at the date I accessed it for this update.
  6. Perhaps simultaneously, perhaps slightly before or slightly after the generation of the torrent file, the new batch of cables begins to be pushed out to the mass mirrors. The mass mirrors are the vast number of private servers that have signed up to the Cablegate Mass Mirroring list, in order to ensure that Wikileaks is not taken off the internet. The cables are not updated on every mirror at the same time - rather the cables are uploaded to each mirror rather slowly, and in stages. Sometimes it will take hours for a mirror to be brought in sync with the main servers. Sometimes, mirrors never catch up. The asynchronicity involved here can be seen on the LeakyLinks site, which monitors the entire mirror list, and keeps track of which ones have been brought up to date with the main server.

The upshot of the above information is that it is difficult to say at what precise time Wikileaks "released" its cable. The "Released" date on the cable metadata has already been seen to be untrustworthy - or not to represent the date at which Wikileaks actually made a cable available on its websites. But the above information demonstrates that the cable is released quite asynchronously over the mass mirror and torrent systems.

Perhaps the best candidate for an exact release date from Wikileaks of each cable is the exact moment that it was uploaded to the first main server it touched. This data is not yet forthcoming, but I have contacted the administrator of the LeakyLinks site in order to inquire if LeakyLinks has this data, since, by the nature of their work, they are most likely to see that kind of data.

Others have claimed that the release date of the torrent file, cablegate-201012082231.7z, is a good indicator. The torrent file is indeed datestamped, on the various torrent trackers, as having been released at 22:31, as I outlined above. But on the basis of the above procedure, it is difficult to say whether the torrent is released before or after the files are pushed onto the mass mirrors. The torrent might have been generated and released immediately after the files were uploaded to the first main server, or several hours later, during or after the push of the newest batch to the mass mirrors. So a time of 22:31 does not prove that 09HARARE1004 was published after The Guardian published it (at 21:30). So no certainty is forthcoming here. I feel as if it would make procedural sense for the torrent to be generated and released as soon after the initial upload to the main server as possible, but that's just a personal organizational sense, and nothing to go by.

I was advised by one of the community I was discussing this with to download the cablegate-201012082231.7z torrent, unzip it, and check the properties of the 09HARARE1004 cable's html file, looking for the "Last Modified" date. I have done this. Sadly, it casts no light on the proceedings: the last modified date is 22:39 on December 8th. This appears to be after the
torrent was released, at 22:31. The anomaly is explainable if the system clock on the system which last modified this html file is fast by 8 minutes. But we do not, alas, discover anything of importance.

I will update this post again if I hear back from LeakyLinks about the update logs.

Once again, though, I will note, in light of the Guardian's commendable address to this issue, the detail after which this post has been seeking is fast becoming irrelevant.

(2011-01-13, 23:28) Update 4: Further to the above points to consider, I refer the reader to the comment by markw, below, which have regard to the publication date on the Guardian's version of the publication, and its reliability.

Cablegatesearch.png112.32 KB
LeakyLinks.png98.02 KB
CableSearchBETA.png136.17 KB
magnet.txt35.1 KB

great work x7o... your

great work x7o...

your precision and thoughtfulness are appreciated by your readers.



Can we be so sure?

Three questions come to mind re: reliability of date stamps.

1) Were the date stamps created by the same clock? I suspect not. From what I can see, the headers do not reveal the time zone in which each document was published. The only reference I can observe of the Guardian's release is the article's publish date, at the top of the release: Wednesday 8 December 2010 21.30 GMT.

2) The Guardian's time stamp is the time when the author hit "publish". Generally it takes longer than 21 minutes to load / redact / approve an article. Hence Max Fisher's tweet seems baseless, not to mention false. From what I've read, the decision to release a cable by WL is not done independently of the media outlet. Hence time stamp analysis is an exercise of futility.

3) On a more general note when analysing the published time stamps of web articles, The Guardian's time stamp is generated by its Content Management System. As with most Content Management Systems, you can easily change the date or time that appears in the header of an article, even once the article is published. Any author can wind the clock forward or backwards or at any time, and by however much he or she desires. Hence timestamps should not always be taken on face value.

Theme by Danetsoft and Danang Probo Sayekti inspired by Maksimer