April 26, 2012
By Seth Daniel
Mark Spencer, owner of Arsenal Consulting on Admiral’s Hill, played a key part in finding forged documents that were crucial pieces of evidence in a major government trial in Turkey. Here, at his office, he points to several documents he found to be falsified.
When Mark Spencer agreed to get involved in a new case earlier this year which involved a criminal trial in Turkey, he didn’t know what he was getting into.
He was given just three CDs and later a computer hard drive; pretty small potatoes for a computer forensics company located on Commandant’s Way that typically searches through mountains of electronic data to root out corporate fraud.
But the data on the CDs and hard drive was different; it was the key evidence in one of the most important and divisive government corruption trials that Turkey has seen in more than a generation – a trial that has gone on for years and has hinged upon documents contained on the CDs and the hard drive.
And Spencer’s company, Arsenal Consulting, was about to blow that evidence to pieces from his small office in Chelsea; digging deep into the abyss of hidden computer data and coming out with definitive proof that the evidence had been elaborately and carefully forged.
His analysis has rocked the country of Turkey, yet Spencer said he would have never guessed what he was getting into when he first took the case.
“My initial thought was that this case would be pretty small for us in the grand scheme of things,” said Spencer. “When presented with three CDs and a hard drive, I didn’t think it would be a very big deal given what we normally do, which is analyzing volumes of data hundreds if not thousands of times larger than that. I was wrong.”
Through a common acquaintance, Spencer had been contacted by Harvard University professor Dani Rodrik – whose father-in-law is one of more than 300 defendants facing charges in the trial.
Rodrik and his wife – originally from Turkey – felt that the documents, which allegedly detailed a coup attempt in 2003 of the then-newly elected Islamist government, were all fakes.
“This is the most important political trial in Turkey in at least 50 years,” Rodrik told the Record. “More than 300 officers are on trial for allegedly having planned a coup back in 2003 against the newly elected Islamist government.
“Mark’s evidence is important because it comes from an independent American expert, and because it is also so conclusive about the forgery,” continued Rodrik. “It’s also important that some of the evidence of forgery Mark documented is very easy to explain to the general public. For example, documents that are purportedly from 2003 contain references to a font that Microsoft first introduced in 2006. That sort of makes it clear to everyone that the files are bogus and the prosecution malicious.”
Added Spencer, “If I’m left with anything from a forensic perspective, it would be that this wasn’t your typical document forgery. Those responsible for forging these documents went through a significant amount of effort trying to be consistent. It was the consistency that surprised me. We’ve dealt with a lot ot forgeries in the past and I’ve never seen something like this. Basically, I would say ‘they’ were crafty and consistent.”
FINDING THE FONT
Spencer and his company quickly set out to see what they could find, knowing that most forgers aren’t even aware of the depths and levels of computer data that are attached to most files.
Arsenal frequently digs into digital places that few know even exist – even skilled digital forgers.
Using powerful computer forensics tools, Spencer said they were on the lookout for anything – especially dates – that didn’t align with what the government in Turkey said was the official timeline. The documents that supposedly detailed plans by the military to enact the coup on the new government were allegedly saved in 2003.
Spencer said that upon their initial investigation, things looked legitimate, but in hindsight it was only because the forgers had been so thorough.
Upon a deeper analysis of the CDs, Spencer said hidden in the documents were references to the Calibri font – something just about anyone who has used Microsoft Word is familiar with – as well as references to a particular type of ‘XML’ file.
The major problem with that – and a key part of the forgery proof – was that those things weren’t even invented yet in 2003, when the files were supposedly created and last saved.
“When we got a little more aggressive and found the font and XML issues, that’s when we knew something was very, very wrong here,” said Spencer. “Ultimately, we found nine Powerpoint files had references to a particular type of ‘XML’ and 71 Word and Excel documents had references to ClearType fonts like Calibri and Cambria. We talked to the creator of those fonts, and they weren’t available in Microsoft Office until the 2007 version.”
Believing the files were legitimate was becoming more and more of a stretch of the imagination.
“We were getting to the point where there was no legitimate way the files landed on there in 2003 unless we’re going to believe in time machines,” he said. “It’s just simply not possible.”
A similar situation unfolded with the hard drive, which was seized on July 2009 and stored at a Naval base in Turkey, supposedely under tight security.
“We found 120 files and folders on the drive that on first glance appear to have been created April 8, 2004, but we know from digging into the file system that they couldn’t have been created before July 28, 2009,” he said. “Coincidentally, many – if not all – of the incriminating documents are in that batch of 120 files and folders. The most likely scenario is someone attached that drive to a computer which was already backdated and copied those files and folders to the drive, then detached the hard drive and put it back.”
His final analysis was quite an incredible turn of events in Turkey, as well as in his Chelsea office.
In his reports to the Turkish court – submitted in late March – he wrote regarding the CDs, “Arsenal has concluded that dates and times related to at least 76 documents found on CDs 11 and 17 have been forged.”
COURTS NOT PAYING ATTENTION
Such bombshell evidence would be the equivalent of proving Watergate in the United States – proving that the sitting government had forged evidence to convict its political enemies.
It would be the subject of media reports for weeks upon weeks.
However, in Turkey – where Rodrik said many journalists are imprisoned for what they write – the story hasn’t gotten the credit it deserves. Even the courts are refusing to acknowledge the evidence – despite popular uprising and a massive courtroom protest by the attorneys of the accused.
“It is a very big case in Turkey, and it is closely followed,” said Rodrik. “Because the case against the officers is heavily supported by the government, it is also politically a very divisive trial. Pro-government media have been a source of disinformation about the case, and they have not covered the evidence that Mark presents. They have only run stories trying to discredit the findings. Other mainstream media are reluctant to cover the forgery because of strong government pressure to toe the line. Turkey, after all, holds more journalists in prison these days than China and Iran taken together. In a country with a free press, the story would have been front-page news for days on end, and would have resulted in the resignation of at least a couple of government ministers. In Turkey, coverage has been repressed.”
GUILTY VERDICT LIKELY, BUT SEARCH CONTINUES
For those in America who are used to getting action when definitive evidence is presented, such as was done by Arsenal – it might be a surprise that the conclusion of the trial is likely already decided.
Rodrik said that even though the judge knows Spencer’s evidence is solid, and that the documents are fake, he’ll probably render a ‘guilty’ verdict.
“Despite repeated requests from the defense, the judge has refused to follow up and appoint his own experts to verify or challenge Mark’s findings, for the simple reason that the judge is well aware of the forged nature of the evidence,” said Rodrik. “The judge is expected to issue a verdict – almost certainly guilty – in a couple of weeks.”
Spencer said the unique case isn’t over, though, in his mind.
“We’re not convinced there are just 80 forged documents,” he said, noting that this is the first case in three years he’s been able to discuss publicly. “We’ve identified many more documents that have suspicious characteristics, but we’ll only make definitive statements about them when we are absolutely sure.”