UPDATE:  I'm glad I copied this when I did.  The site's been taken down now.  The host says it was requested to be taken down by the FBI. 

I've worked on the Internet for almost 15 years now and have come to know that it's pretty hard to fake data posted in the source code on the Internet.  Well here is the top portion of the code associated with a Joe Stack, alleged to be the Austin pilot who crashed a plane into the IRS building this morning. As you will see from scrolling down, it shows this piece was posted today on the Net about 6:42 a.m. (CORRECTION: IT WAS LAST SAVED AT 12:42 A.M. CST–You must subtract six hours for Zulu time.)  The WhoIs registration for this site shows it's been up since Sept. 2006 and it's registered to a Joe Stack with an address in San Marcos, TX.

From the code below, it looks as though he composed the document in MS Word and then saved it as a Web page.  

I'm sure law enforcement is on this, but I wanted to help others understand the significance of this information.

<html xmlns:o="urn:schemas-microsoft-com:office:office

xmlns:w="urn:schemas-microsoft-com:office:word"
xmlns="http://www.w3.org/TR/REC-html40">

<head>
<meta http-equiv=Content-Type content="text/html; charset=windows-1252">
<meta name=ProgId content=Word.Document>
<meta name=Generator content="Microsoft Word 9">
<meta name=Originator content="Microsoft Word 9">
<link rel=File-List href="./default_files/filelist.xml">
<title>Well Mr. Big Brother IRS man... take my pound of flesh and sleep well.</title>
<!--[if gte mso 9]><xml>
<o:DocumentProperties>
<o:Author>Joe Stack</o:Author>
<o:LastAuthor>Joe</o:LastAuthor>
<o:Revision>27</o:Revision>
<o:TotalTime>1848</o:TotalTime>
<o:Created>2010-02-16T19:24:00Z</o:Created>
<o:LastSaved>2010-02-18T06:42:00Z</o:LastSaved>
<o:Pages>3</o:Pages>
<o:Words>2676</o:Words>
<o:Characters>15254</o:Characters>
<o:Company>Embedded Art</o:Company>
<o:Lines>127</o:Lines>
<o:Paragraphs>30</o:Paragraphs>
<o:CharactersWithSpaces>18732</o:CharactersWithSpaces>
<o:Version>9.6926</o:Version>
</o:DocumentProperties>

</xml><![endif]–>

I just made a similar document on my computer and here's the code it generated:

<html
xmlns:o="urn:schemas-microsoft-com:office:office"

xmlns:w="urn:schemas-microsoft-com:office:word"

xmlns="http://www.w3.org/TR/REC-html40">

 <head>

<meta name=Title
content="Jdhsjfhs;DFHDS;FH;DJFH">

<meta name=Keywords content="">

<meta http-equiv=Content-Type content="text/html;
charset=macintosh">

<meta name=ProgId content=Word.Document>

<meta name=Generator content="Microsoft Word
11">

<meta name=Originator content="Microsoft Word
11">

<link rel=File-List href="Jdhsjfhs_files/filelist.xml">

<title>Jdhsjfhs;DFHDS;FH;DJFH</title>

<!–[if gte mso 9]><xml>

 <o:DocumentProperties>

 
<o:Author>Donald Claxton</o:Author>

 
<o:Template>Normal</o:Template>

 
<o:LastAuthor>Donald Claxton</o:LastAuthor>

 
<o:Revision>1</o:Revision>

 
<o:TotalTime>1</o:TotalTime>

 
<o:Created>2010-02-18T19:48:00Z</o:Created>

 
<o:LastSaved>2010-02-18T19:49:00Z</o:LastSaved> (DONE AT 1:49 PM CST)

 
<o:Pages>1</o:Pages>

 
<o:Company>DaddyClaxton.com</o:Company>

 
<o:Lines>1</o:Lines>

 
<o:Paragraphs>1</o:Paragraphs>

  <o:Version>11.1287</o:Version>





  1. Imabug

    The Z at the end of the time stamp is supposed to indicate GMT, isn’t it?. If MS Word respects that timestamp convention, the last save time would actually be 0:42 CST

  2. Donny "Daddy" Claxton

    I wondered about the Zulu stamp as well and assumed that it made the adjustment for when it posted in the time zone. Now my curiosity is raised again as not even the page we’re reading puts a time stamp in it, though it wasn’t constructed in MS Word! More research to be done here.

  3. somedude

    Am I the only one who finds it odd that a “software engineer” would post to the web using MS Word?

  4. Donny "Daddy" Claxton

    Agreed. There are plenty of reasons to believe this could be a hoax, but if it is, it’s a darn good one.

  5. deb@birdonawire

    I found that a little strange too…but the whole thing is strange..and yeah we all revert to comfort zones when we’re traumatized. Not saying he didn’t or did…but the site is registered to him. And he did start the fire in his own home, wife and child inside..its well written, albeit rambling. Just can’t discern the whys and wherefores. Except that posting a ms word doc is quick and dirty..yanno

  6. Bee

    Hard to fake? Are you kidding? It would be as easy as typing the tags in any text editor..

  7. erasmo

    Have anybody noticed the:
    Author Tag: Joe Stack
    and
    LastAuthor Tag: Joe :LastAuthor
    Would this imply there were more than one collaborators in sharing the authorship of the MS Document?
    In your example the last author and the first are the same.
    Help me to understand how could this be changed from “Joe Stack” to “Joe” using Word 9, (of course any text editor could make such a change, but if it was posted directly from Word how could the last author tag be different from the author tag?
    Also the text of the letter affirms:
    “The writing process, started many months ago, was intended to be therapy in the face of the looming realization that there isn’t enough therapy in the world that can fix what is really broken.”
    How can this be squared with the fact that this document was created on February 16, 2010?
    And finally compare this source code with the code of the website embedded art. it is not made in word, one can still find a chached copy from google:
    http://74.125.47.132/search?q=cache:S1hHc5Jp4a0J:embeddedart.com/home.htm+%22the+concept+behind+the+success+of+embedded+art+is%22&cd=11&hl=en&ct=clnk&gl=us
    It is all very suspicious to say the least.

  8. erasmo

    Absolutely!

  9. S H Ring

    Not quite getting your “Zulu” time idea here.
    I create & save a Word doc to html and it is time stamped correctly with the time on my PC.
    So, what is all this about Zulu time ?
    Also, I made my Word user name different from my Word initials to try and see if I could get a different name in created author and last author – to no avail.
    All Word author stamps seem to be as set in Word Options.
    So how do we get a Joe Stack and a Joe ?
    Perhaps, the same file was edited using two different Word programs, one set as Joe Stack and the other set as Joe ?
    That’s the only way I can see it happening.
    I think you might be mistaken about the Zulu time thing, whatever it’s supposed to mean.

  10. Tangle

    This is much more interesting:
    Created: 2010-02-16 19:24:00
    LastSave: 2010-02-18 06:42:00
    That means from creation to last save, the inclusive time is:
    1 day, 11 hours and 19 minutes
    11119 or 11911


  • Pages

  • Subscribe to Blog via Email

    Enter your email address to subscribe to this blog and receive notifications of new posts by email.

  • Categories


Rss Feed Tweeter button Facebook button Technorati button Reddit button Linkedin button Webonews button Delicious button Digg button Flickr button Stumbleupon button Newsvine button Youtube button