Chelsea couldn’t be further from the Turkish capital Istanbul, but a little office on Admiral’s Hill is shaking up the political, military and judicial systems there with a groundbreaking computer investigation that will likely free 230 falsely convicted Turkish military leaders.
“I can’t say I’m totally surprised this is happening now, but I am surprised at how fast things started falling out of the tree,” said Mark Spencer of Chelsea’s Arsenal Consulting.. “I wonder whether this is one of the most important cases ever in the world of digital forensics investigations. This was not peripheral evidence for one defendant. This was ‘the’ evidence used to support the entire case. This dealt with 100s of documents and resulted in 100s of suspects going to jail. I’m not aware of another case like this.”
Some two years ago, Spencer told the Record an incredible story of how he contributed key evidence in the renowned Turkish ‘Sledgehammer’ case.
In short, leaders from the new political power structure were looking to imprison hundreds of military leaders by concocting a story that they had tried to overthrow the government in a 2003 failed coup attempt. Those that were charged – all 237 of them – knew it was a setup, and there were hints that the smoking gun computer evidence used in the trial had been tampered with by expert hackers working for the government.
However, no one could prove it.
Then came Spencer and Arsenal Consulting, who were hired by a family member of one of the accused men to take a run at the computer evidence.
Digging deeper than deep into the metadata of an infamous hard drive known only as “#5,” they found clear signs that the evidence had been created after the fact. While they found numerous concrete technical problems, the one simple thing they found that foiled the whole plot was a font called Calibri in Microsoft Word that was referred to in the metadata. The problem was that the coup was supposed to have happened in 2003, yet Calibri wasn’t unveiled by Microsoft until 2006.
Problem?
Certainly. However, the Turkish courts at the time refused to acknowledge Spencer’s clear-cut evidence and Turkey’s top computer experts also refused to validate his findings. So, all 237 men were imprisoned and most believed there was no hope that they would ever see the light of day ever again.
Then everything changed.
Upheaval in Turkey changed the political spectrum – and those that insisted on keeping the men in prison suddenly had less power. A judge working on a peripheral case took a run at hard drive #5 and felt there were problems with it. In a drastic step (at least for Turkey), he called on Spencer and his firm to submit several questions for the official Turkish computer gurus to answer.
That was the key that unlocked the door, Spencer said.
“There was no way any competent computer forensics expert could walk away from those questions and say this evidence was good,” Spencer said. “I don’t mean that this evidence on the hard drive was tampered with a little here and a little there. I mean that about every piece of evidence that they relied upon had serious problems.”
Early in June, the Turkish experts came back with a finding that hard drive #5 had been tampered with and that Spencer’s firm was correct.
That opened up a huge can of worms and also opened up the Sledgehammer case for review as hard drive #5 was the only piece of evidence that was used to put the 237 men in jail.
“That set off a storm,” he said. “The political situation had already changed over there and when you combined this revelation with the political changes, it was just untenable to keep 237 suspects in jail based on evidence that had been tampered with.”
On June 19, Turkey’s highest court ordered that all the men be released preliminarily based on Spencer’s findings, and that they be retried without the use of hard drive #5. Not only that, but also the court ruled that all the prisoners had their rights violated in the first trial because the court refused to acknowledge what Spencer and Arsenal had done.
Some 236 are now out of jail, though one man did die in May while imprisoned.
Spencer said the family that hired him is happy beyond belief.
“They are ecstatic I believe,” he said. “It was a surprise because in this particular case the defendants had little, if any, hope.”
Spencer’s firm wasn’t the first American company to take a look at the evidence, but his was the first to catch the mistakes. He said two other companies “whiffed” when they examined the evidence, but he doesn’t blame them. He said whoever broke into the evidence room where the hard drive was held and reprogrammed it was skillful.
“Whoever ‘they’ are, they did a relatively good job tampering with this stuff,” he said. “I understand why at first glance these other companies let it get by. The people who did this were not stupid; they just made mistakes. All the dates buried way down deep fit the right timeline. All the documents used were saved carefully with Microsoft Office 2002/2003. Where they screwed up was in the editing stage. Someone saved something with Microsoft Office 2010. That was their one mistake; it was buried deep, but we found it.”
Spencer said there is a great deal of gratification to know that his work was finally acknowledged and used to free so many falsely accused prisoners. It’s especially gratifying because on 99 percent of the cases he deals with, he can’t share what he’s done with anyone.
“We spend a lot of time and a lot of pro bono hours on this, and at first it wasn’t even used,” he said. “It was still important though. If you know there’s something bad going on and you don’t at least try to light it up, then aren’t you kind of contributing to the problem? It’s one thing if you don’t know, but if you know, you have to do something. We had to do this despite all the odds, and I’m glad we did.”
As for the after effects, Spencer said they weren’t sure where the revelations about hard drive #5 might lead, but he has heard that there might be an additional round of questions that his firm might be called upon to submit.
Until that time, the little office on Admiral’s Hill will be waiting and continuing to do what they do best – exposing people who try to use computers to get away with crimes.