Calling All Paranoid Geeks: Were Donald Jr.’s Emails Doctored?

Recently, Donald Trump Jr. got a message from The Failing New York Times. The fake news organization told Donald Trump Jr. they had his real emails and were going to publish them. DJTJ, recognizing this was a rare instance of real news, published his own emails before the FNYT could. Not long after, the FNYT dropped its story. We know the rest.

What I’d like to point out is obvious but has gone largely unsaid: The Failing New York Times didn’t print the original emails. They only printed the content, which they formatted to look cool. If this weren’t the case, I wouldn’t feel very comfortable asking these questions, because I’d sound a little too batshit even to myself. But because we can’t compare DJTJ’s emails to the exact emails the FNYT has, I feel like it’s not too nuts to point out some clear inconsistencies so any IT/email experts who happen to be reading this might be able to prove this really is nothing.

I’m all for Occam: simplest explanation is the most likely. But I noticed obvious contradictions and strange quirks in the formatting, and started looking more closely. Not because I believed they were doctored, but because I couldn’t deny what I could plainly see. Then it occurred to me: this is Trump we’re talking about. Maybe the simplest explanation is that yes, these emails were altered. Not their content, I don’t think, but some other, subtler elements.

I’ve asked a few experts, but they’ve also been stumped, mostly because there’s just too many inconsistencies to compare across all variables. Or maybe because I hadn’t showered in a few weeks and had a weird eye twitch and was talking too fast and spitting bits of my Quizno’s sub all over the place.

Enough tech talk: I just want someone to prove that these things are fine so I can go ahead about believing I’m still relatively sane.

A Shoe Is Afoot

Here are some weird things that a conspiracy theorist (not me!) would point out to you, probably in a hometown bar or on a smoke break outside a sandwich shop, about the emails’ timing and content. The FNYT noted that three hours after DJTJ sent the email to confirm the meeting with the Russian government representative, Mr. Trump “promised to deliver a major address detailing Mrs. Clinton’s ‘corrupt dealings’ to give ‘favorable treatment’ to foreign governments, including ‘the Russians.’”

Further, DJTJ told The New York Crimes that he never told dad about meeting the Russian lawyer. Then, on Wednesday, President Trump said he didn’t know about it himself until that weekend. BUT: he also admitted last week that, “In fact, maybe it was mentioned at some point.” I don’t feel I have to comment here for you to understand what he really meant.

(He’s been lying about his campaign’s connections to Russia, loudly and to everyone’s face, for about a year now.)

Now let’s flip the geek switch.

Going Through The Changes: Why This Is Even Worth Writing About

There are three big things. By “big,” I mean obvious.

1. Header style (from: sent: to:, etc.) shifts inconsistently. Also, “original message” dividers are inconsistent across devices. We don’t know from which account this was printed. Junior redacted the header that would tell us that.

2. Quote levels (explained soon) are also really funky; most notably in the “disclaimer” footer, which only appears once but has an odd quote level.

3. Third, and most importantly, there’s a change once we get to the emails that concern who will attend the meeting. When we get to that specific email, all of the quote levels disappear. The last four emails have no quote level at all.

Also, just in case you’re unsure, here’s a short definition of just what a quote level is. In a normal Gmail thread, you’ll notice a series of bars that indicate when a new email appears in the thread. Those emails are “quoted,” and they’re quoted for every email. Here’s what it looks like on a Gmail on Chrome.

(Fun game: guess what that’s about.)

Same thing on an iPhone, Outlook, etc: bars, bars, bars. But here we have little arrows, called angle brackets, indicating whoever printed the emails removed the formatting. As benign a thing as that is, and formatting might have been removed for any number of reasons, it does mean these emails aren’t completely original.

I’d like to note one more thing. The FNYT report also notes, ”[t]he emails were discovered in recent weeks by Mr. Kushner’s legal team as it reviewed documents and the team amended his clearance forms to disclose it, according to people briefed on the developments.”

This means it’s not unlikely that Kushner leaked the emails, and we all know Kushner loves a good redaction.

Anyway: here are all the emails DJTJ tweeted out, in reverse chronological order. Check the quote levels on the first two pages.

All of the content on those top four emails was somehow not individuated. They were all apparently contained, or maybe pasted, into one email. Note also that the first header is inconsistent in several ways with all other headers. If this were sent from a Trump Organization account, I, a relatively hysterical doofus, would expect the Trump Organization disclaimer to be at the end of the whole chain. At the very least I’d expect it elsewhere in the chain.

And here’s another thing too crazily detailed and most likely inconsequential for any sane man who calls himself a journalist to mention: that disclaimer only shows up once, at the very the end, and the quote level there changes from five arrows down to four. It never appears again. This might mean there’s only one account or device with a disclaimer on it. But DJTJ emails from his company email several times.

Oh well, whatever.

But.

(Sorry.)

DJTJ sent that series of non-quoted emails from what seem to be three separate devices: an iPhone; what’s probably his Trump Org email from a laptop; and, finally, what seems like perhaps a Trump Tower computer (which would maybe explain the header style shift on the last email: he’s back home). He also must have shifted clients a few times.

Rob Goldstone (Steve Bannon’s long lost brother; but that’s another conspiracy theory altogether) never shifts from his iPhone. Unless Goldstone has two iPhones with the same custom signature.

So yeah, it’s a) crazy to get this detailed, but down the rabbit hole I went; and b) for someone who knows basically nothing, it’s a lot of work. You have to check lots of variables and permutations of those variables: client, device, HTML, date, headers, style. Then there are forensics, which I can’t do. And probably all for nothing. Yet I can’t deny my observations.

The only thing keeping me sane is that seemingly sane and intelligent people noticed inconsistencies, too.

For instance, Molly McKew, a pretty well respected writer and foreign policy and strategy consultant, noticed this:

She’s right. Compare DJTJ’s emails above to her notes here.

So my geeks, I put it to you: did the emails change?

The FNYT is almost certainly having forensic specialists examine the emails they received. They’d have good reason not to publish the originals without checking them against DJTJ’s, whom I imagine could have been baited into publishing his early.

So no, bottom line: I wouldn’t say I “suspect” these were edited. But I can’t rule it out based on what I observe here.

That’s why I’m asking you: please prove me insane. Or sane. I can’t tell anymore. Man, I could really go for a Monster. Anyone wanna hang out?