Alleged problems with Mr Madden’s reliability as an expert witness
Counsel for Dr Wright submitted there were two main problems with Mr Madden’s reliability as an expert witness which they suggested may have been the cause of three fundamental flaws in his analysis.
The first main suggested problem was that, although acknowledging that Mr Madden has worked as a computer forensic examiner for some years, it is suggested that he is not suitably qualified, on the basis it was alleged he had only a single formal relevant qualification (as an EnCase Certified Examiner) and no specific formal qualifications relevant to Citrix networks, VMware virtual machines or SANs, all of which are said to be particularly relevant.
I reject this suggestion. I very much doubt that formal qualifications are an adequate substitute for years of practical experience in forensic analysis, which Mr Madden undoubtedly has. So I was entirely satisfied that Mr Madden was suitably qualified to make the findings which he did in his various reports. As I said above, I formed the view he was a precise and careful witness and one who did not stray outside his area of expertise. Above all, this submission fails to recognise that most of Mr Madden’s findings were agreed to by the experts instructed on behalf of Dr Wright. As for Dr Wright’s contention that none of the experts were properly qualified (and only he was), it is notable that neither he in his evidence nor his Counsel in any submission provided any concrete example to substantiate this.
The second main problem was said to be more important: it was that Mr Madden’s independence was undermined due to the way in which his expert reports were prepared. On this point, I have already set out, in paragraph 121 above, the applicable legal principles.
Lord Grabiner KC pointed to Mr Madden’s explanation of the process (e.g. Madden1 at [33]) but submitted that under cross-examination, a rather different picture emerged. He drew attention to the following points:
That there had been at least 6-8 meetings between him and Bird & Bird.
That the drafting assistance appeared to have been extensive: see {Day 16.121/5-22}.
That he had not adopted the same approach when preparing his expert evidence in other matters.
That he failed to provide any coherent explanation as to why such an approach was necessary in the present case or why he could not have engaged a suitably qualified and independent assistant.
As I think Dr Wright’s submissions on these points acknowledged, their validity is closely entwined with the alleged three fundamental flaws in his analysis. Before I address these alleged fundamental flaws, I should say something about the allegation that there was something inappropriate in the way Mr Madden’s reports were prepared.
Based on my experience in Patent cases (conducting and trying them) and in view of the scale of the work required of Mr Madden (particular in preparing his enormous first report), I saw nothing at all wrong in the way his reports were prepared. Experts in Patent cases often work closely with solicitors, who guide and assist the expert, based on a recognition that, without such guidance and assistance, a suitable report would either not get written or would take an inordinate amount of effort and time. In particular, having a solicitor prepare a first draft of a section is not considered objectionable provided, of course, (a) it is based on matters already expressed by the expert (usually in a meeting) and (b) the expert reviews the wording carefully and makes any changes necessary so that it properly represents his considered evidence and opinion in the text adopted in the report which is served. Depending on the complexity of the technology and the issues, the preparation of a long expert report (albeit not as long as Madden1) may well involve more meetings than Mr Madden was involved in.
Having made those observations, I reserve my conclusion until after I have considered the three fundamental flaws alleged by Counsel for Dr Wright. These were explained as follows, and I identify them as the ‘unjustified haste’, the ‘content’ and the ‘gap’ allegations:
First, that on multiple occasions, Mr Madden had concluded with unjustified haste that a document has been dishonestly tampered with or altered, when other explanations were equally plausible from a technical perspective. It was submitted that this was clearly illustrated when he was cross-examined in relation to the following documents in COPA’s list of 20 core forgeries: (a) {ID_004013} Handwritten BDO minutes {L2/159}; (b) {ID_004019} JSTOR Article – Tominaga Nakamoto {L2/245}; and (c) {ID_000073} Statistics assessment homework. The relevant details were said to be set out in Appendix 1.
Second, in reaching his conclusions Mr Madden has on several occasions relied heavily on his analysis of the contents of particular documents, and in particular on what he considers to be anomalous or incongruous content. Mr Madden is not an expert (and COPA does not have permission to rely on expert evidence) in any of the multiple academic fields covered by Dr Wright’s disclosed documents. Such evidence is therefore inadmissible. Alternatively, it should be given little weight.
Third, and most importantly, Mr Madden seems to have been unwilling to grapple properly with Dr Wright’s complex IT environment, or with how that environment might have caused some of the digital anomalies on which he relied to reach his conclusions. In this respect, Mr Madden’s analysis lacked rigour and was unconvincing.
On the first point ‘unjustified haste’, I will deal first with the three specific examples cited and then make some more general observations.
In relation to the BDO Minutes {ID_004013}, his 10-page analysis of the document is in PM5 {H/31/1-10}. From that analysis it is clear that Mr Madden reached his finding of manipulation in relation to this supposedly 2007 handwritten document after:
Receiving evidence from the manufacturer of the pad that the proof (in MS1 to the confirmation of Michael Stathakis & Lee Li dated 10 July 2023) from which the pad was created had first been created in 2009 and first shipped in 2012;
Putting to one side exhibit MS2 as dated from 2014.
Carefully inspecting the PDF file of the proof and checking its metadata in order to satisfy himself that the proof is an authentic document dating from 9 November 2009; and
He had carried out a painstaking examination of the proof against the document.
There are two further points to note:
First, Mr Madden clearly stated in paragraph 25 of Appendix PM5 various points on which he had not been able to form an opinion.
Second, Dr Placks agreed that the BDO Minutes had been manipulated {Q/2/9}. Mr Madden and Dr Placks agreed that their opinion about the authenticity of the document depended on whether Exhibit MS1 was the first ever proof of the notepad. Both experts agreed that there was no reason to doubt the authenticity of exhibit MS1.
The second example is the JSTOR article {ID_004019}, analysed with {ID_003830}, in Appendix PM6, {H/40/1-31}}. Mr Madden only made his finding of manipulation after:
First, he had found visible signs of document alteration: misalignment of the key date figures which dated it to 2008.
Second, he had found an authentic version online which dated to 2015, which was otherwise identical and in which the figures aligned perfectly.
Third, he had exhaustively reviewed over 180 JSTOR documents, spot testing a sample (around 10%) of those for authenticity, and established that the footers used at different times had a consistent pattern and showed that the footer shown in {ID_004019} did not date from 2008.
A review of PM6 shows a painstaking analysis, all very clearly explained in minute detail.
In their Second Joint Statement, Dr Placks agreed that {ID_004019} was unreliable but did not go as far as to agree it was manipulated because (it seems) he thought the footer style in use in 2008 should be verified with JSTOR.
The third example is Dr Wright’s MSTAT assignment {ID_000073}, which Mr Madden analysed in his Appendix PM38 {H/145/1-17}. As I found in section 6 of the Appendix, I found Mr Madden’s analysis of this document entirely convincing. Furthermore I found no indication that it was done hastily or without due care.
On top of my consideration of these three examples, I add my consideration of the entirety of Mr Madden’s work, explained in his six reports. I acknowledge that Mr Madden was put under time pressure to prepare his later reports, his Sixth Report in particular, and I noticed a slight unease on his part giving evidence about the MYOB Ontier Email allegations because there were indications he did not feel entirely on top of all the detail. Having said that, I concluded that his unease was not a reflection that his evidence was flawed in any respect, but a reflection of the care he wishes to take when presenting his analysis and when answering questions about it in the witness box.
Overall, I find the accusation levelled against Mr Madden that he reached conclusions with ‘unjustified haste’ to be absurd. I reject the first point.
The second point, regarding ‘content’, is, in my view, misplaced. Mr Madden did not need to be an expert in ‘any of the multiple academic fields covered by Dr Wright’s disclosed documents’. As a forensic document expert, he was and is entitled to rely on passages of identical text and/or evidence of text edited away from the apparent original. I saw nothing inappropriate in his analysis of text/content.
The third ‘gap’ point was developed further and requires further discussion:
First, it was suggested that ‘this gap’ in COPA’s evidence ‘may be the inevitable result of the unorthodox sequence and timing of the expert and factual evidence in this case’.
Second, that whatever the reason for ‘this gap’, ‘the fact remains that none of the documents considered by Mr Madden was analysed on the machines or within the environments from which it was collected and no exercise was undertaken by Mr Madden to recreate the relevant IT environment (or parts of it)’.
Third, it was said that this matters because, as Mr Madden himself accepted, where the authenticity of documents is in question, it is prudent to analyse not just the documents themselves, but the environments in which they were authored and thereafter stored, as this can throw important light on their forensic analysis {fn: {Day 16/11:15} to {Day 16/11:23}}.
Fourth, that this would have assisted, in particular, in the interpretation of timestamps, which Mr Madden agreed is inherently prone to difficulties that are well recognised by digital forensic professionals, such that relying on them to prove that a particular event occurred is not a sound approach. {fn: {Day 16/12:11} to {Day 16/13:8}. See, for example, Chow et al, The Rules of Time on the NTFS File System, at {X/50}, in which the authors explain that “Temporal analysis on individual digital file[s] has been adopted since the evolvement of computer forensics. However, it is not evidentially secure to rely on the timestamps of a particular file to prove a particular event occurred at the corresponding MAC times” (p1, LH column), and (at p1, RH column) that “since file timestamps can be altered inherently by batch operations such as automated tools scanning, previewing activities, etc, it is difficult to determine whether a particular file was accessed or opened explicitly by the user.”
Fifth, that Mr Madden accepted that metadata timestamps can be interpreted in different ways, such that, for example:
A Creation Date may indicate that a document has been copied, or even “unzipped” from a zip file {accepted by Mr Madden at {Day16/51:2}.
A Last Accessed date could report access by a computer and not a user (e.g. through a virus check); and
A Document Modified date may not necessarily mean that any changes were made to the visual contents of a document.
Sixth, that the importance of analysing the authenticity of documents in the context of the environments in which they were created and stored must, as a matter of common sense and logic, be a fortiori where the relevant environment is a complex one, far removed from that of a standard home user or single machine.
The first and second submissions presuppose that there was a relevant ‘gap’ in COPA’s evidence. For the reasons explained in this Judgment, I do not believe there was.
The second submission arises out of a point put to Mr Madden at the very start of his cross-examination to the effect that he would have been able to produce more extensive or decisive conclusions if he had had access to the computing environment on which electronic documents were produced (as well as the documents themselves). There are three main points to make in response:
First, of course this point was true but the attack was highly hypocritical. From the time he began his work, Mr Madden began asking, through Bird & Bird, for such access. His request was made by letter of 18 May 2023 {M/1/805} at para. 11.6 {M/1/810}. This was refused in Travers Smith’s letter of 12 July 2023 {M/1/951} at paras. 23ff {M/1/956}, and that position was maintained thereafter, notwithstanding further mentions of this point in Mr Madden’s reports. The fact remains that it was Dr Wright who could have supplied forensic images but he chose not to do so. It is also relevant to note that when Dr Wright was forced (by my PTR Order) to provide more data (in relation to the LaTeX files), they provided very strong support for the allegations already made. Accordingly, there is no basis at all for Dr Wright to complain that Mr Madden’s work was done without access to the original forensic images which he refused to provide when requested.
Second, in any event, the point was misplaced because, as Mr Madden had said in his reports and confirmed in re-examination, he only made the findings of inauthenticity which he could safely make on the material he had. It seems likely that access to the computing environments would only have helped him make further findings of anomalies (as his work on the BDO Drive showed).
Third, in the absence of Dr Wright supplying forensic images, it seems to me to be very clear that, as a practical matter, it would have been impossible for Mr Madden to have recreated Dr Wright’s relevant IT environment. Furthermore, I am certain that any attempt to do so would have been a fool’s errand – Dr Wright would always have been able to point out and would have pointed out some respect in which he asserted (whether truthfully or not) the attempt was deficient.
However, all these points beg the question as to whether the complexity of Dr Wright’s IT environment is capable of explaining all of the apparent anomalies of any or all of the documents considered either in the body of this Judgment or in the Appendix.
To address this question, I must first set out the most important complexities relied upon. Although there is much more detail set out in Dr Wright’s witness statements, the key elements were conveniently summarised in his Written Closing as follows (and I quote):
‘Rocks Clusters: Dr Wright stated that he has been running Rocks Linux (an open-source distribution designed for building high-performance computing clusters) as a base system since 2002/2003. Dr Wright explained that “A cluster is a group of linked computers that work together closely, making them appear as a single system. Rocks Linux is a specialized Linux distribution for building and managing high-performance clusters. A key feature of Rocks Linux is its ability to aggregate the resources of multiple physical servers into a unified, virtualised environment.” {Wright 10, paras 11 & 12 {E/31/4}.
Virtual Machines: The above cluster system was used to host a series of virtualised machines, essentially separate computers running within a single physical machine, each with its own operating system and applications. {ibid. paras 13-14}. As part of this, Dr Wright used VMware and Xen hypervisor, the latter being “a process that manages the creation and operation of a virtual machine” {Wright 10, para 18 {E/31/5}; Meiklejohn 1 para 120(d) {G/2/50}; Wright 9, App A para 2.2(4) {E/26/35}}.
Citrix: In addition to using virtual machines, Dr Wright stated that he accessed servers remotely using Citrix {See e.g. Wright 9, App A para 2.2(4) {E/26/35}; Wright 8 para 3 {E/23/3}}. Citrix is software that enables users to work from remote locations using computer virtualisation {Wright 9, App A para 2.2(4) {E/26/35}}. Dr Wright also explains that he used Storage Area Network systems alongside Citrix, and that these “offer high performance and flexibility in handling large volumes of data, which is accessible to various users across the network” {Wright 10, paras 84, 86}.
Access Times: Dr Wright explained that in his SAN and Citrix virtual environments, access times on files were often not updated as a deliberate performance optimisation strategy {ibid, para 142}.
Symbolic Links: Dr Wright stated that he made use of symbolic links, which act as a window or portal to a folder somewhere else on an IT system. Dr Wright said that he used symbolic linking to connect areas in his Windows systems to areas in his Linux systems, to enable him to manage and access his files across those systems {ibid, paras 35, 37, 38}.
Group Policies: Dr Wright explained that organisations in which he worked enforced various group policies throughout their IT systems, and in particular that nChain applied a policy that enforced the use of a standard ‘normal’ Microsoft Word template and specified applications that were to be deployed throughout the network {Wright 9, App A paras 2.17-2.20 {E/26/43}; and Wright 9, App A para 2.37-2.38 {E/26/47-48}}. Such applications included both Grammarly and Math Type {Wright 9, App A para 2.38 {E/26/48} and 2.57, last sentence {E/26/53}}. Dr Wright added that the relevant group policy was implemented by using the Group Policy Management Console on windows systems {Wright 9, App A paras 2.19-2.20 {E/26/43}}.
Collaborative Working: Finally, Dr Wright explained in his witness statements, and in oral evidence, that staff in the organisations with which he has been involved worked collaboratively and shared documents, and that hundreds of those staff members had accessed and used his documents over many years {See e.g. Wright 9, para 2.55 {E/26/52}; Wright 4, para 6(c)(iii) {E/4/5}. See also {Day 2/136/4}; {Day 2/140/4}; {Day 3/19/11}; {Day 4/35/11}; and {Day 4/43/1}}.’
Counsel for Dr Wright stressed that there was no challenge to his evidence on these points and that Mr Madden accepted they were technically plausible arrangements. This was said to be important ‘because, as Mr Madden also accepted, many of the alleged indicia of forgery that he and COPA have relied on in this case could just as readily have been caused by that environment, or those working practices (or a combination of both).’ (my emphasis – ‘many’ is an exaggeration, ‘one or two’ is nearer the mark).
Furthermore, Counsel for Dr Wright stressed that Mr Madden had accepted the following technical propositions. Here I quote the submissions made, with the footnote references inserted:
‘It is possible for an organisation to engineer the Normal.dotm template “to contain…pretty much anything you want” {Day 16/31/25}, including matters such as the use of specific fonts and the automatic running of certain functionalities or add-ins, such as MathType {Day 16/31/24} and Grammarly {Day 16/40/17} software. Mr Madden also agreed that that it is possible for a system to be configured in such a way that default styles and customisations in the Normal.dotm template are automatically applied to all Microsoft Word documents opened by a user, including pre-existing documents, and for such changes to be retained by both new and existing documents once they are saved (whether actively or automatically) {Day 16/35/7} to {Day 16/37/12}.
What may appear to be an anomalously long edit time recorded in a MS Word document’s metadata can have been caused by that document having been accessed by a user on a remote server during a Citrix session, and the relevant Citrix session then being disconnected without the Word document being closed {Day 16/25/21} to {Day 16/31/14}.
If Dr Wright's working practices involved creating and working on multiple files across multiple computers that accessed remote storage devices, that could explain different documents having overlapping edit times {Day 16/48/3} to {Day 16/49/2}.
Where a file is created by copying an existing file, including by using the Windows command XCopy, this will typically cause the Created timestamp recorded in the metadata of the new file to post-date its Last Modified timestamp {Day 16/45/16}. Although this would also typically cause the Last Accessed timestamp of the destination file to be updated alongside the Created timestamp, many program, file system and operating system settings can affect whether the former timestamp will in fact be updated in that way, and indeed it is possible for a system to be configured so as to disable updates to the Last Accessed timestamp {Day 16/45/16} to {Day 16/46/10}. Mr Madden suggested in oral evidence that this would not affect the destination file, but oddly he had not tested this for the purposes of these proceedings, even though COPA knew that the behaviour of the Last Accessed timestamp following a file copy was in issue {Day 16/46/14} to {Day 16/47/13}.
Where multiple symbolic links are created to a single file, it is possible for complications to arise as a result of changes made to the file across a network Wright 10 para 42 {E/31/8-9} and {Day 16/21/16}.’
In relation to these points:
The critical element of the first point is that the file once opened must be saved (either manually or automatically). If the Word document is merely accessed and not saved afresh, this point has no application.
I acknowledge that persistence in Citrix systems is a possible explanation for what appear to be very long edit times.
In relation to the third point, if that is really how Dr Wright worked, then it might explain overlapping edit times alone.
I have taken into account these possible effects of the use of XCOPY.
In Closing, Counsel for the Developers highlighted an example which involved Dr Wright’s allegation that Citrix persistence and his use of XCOPY accounted for (some of) the anomalies relied upon as indicating forgery. The document in question was {ID_000258}, Economic Security.doc which I have addressed in section 31 of the Appendix.
The detailed analysis in Mr Madden’s Appendix PM29 shows that Mr Madden analysed both external OS/file property metadata and the internal metadata. As he pointed out, the total time difference between the indicated Created Date and the Last Modified Date (both in 2008) was 2,594 minutes or 1 day, 19 hours 14 minutes. The MS Word total Edit Time was much longer, recorded as 83,165 minutes or 57 days 18 hours 5 minutes.
As Counsel pointed out:
The use of XCOPY would only affect the external metadata, as the experts agreed (see e.g. Placks2, [8.05] {I/6/13}).
Persistence in a Citrix environment might explain a long time period between the Created and Last Saved Dates but was unlikely to explain the inconsistency between those dates and the edit time.
To establish that persistence was not a valid excuse, Counsel turned to another example document: {ID_004516}, which was in COPA’s original list of additional 50 forgery allegations but which could not be pursued due to my PTR Order. It had been fully analysed by Mr Madden. Its internal metadata showed a difference between Created and Last Saved Dates of 1 day 17 hours, back in November 2002, but it had a recorded edit time encoded in the document. Mr Madden and Dr Placks were able to explain this. If the encoded edit time is treated as a positive number, it is 4,287,839,314 minutes i.e. an impossible edit time of over 8,000 years {H62.1}, whereas if it is treated as a negative number it decodes to -7,127,982 minutes or 13 years, 7 months and 4 days, albeit expressed in the negative indicating an unusual negative time shift {H/62/21}. Dr Placks agreed the ‘two’s complement conversion’ of the edit time {I/6/33}. He also agreed the presence of the Grammarly timestamp from 02.06.2016 identified by Mr Madden in PM9, [79] which was 7,127,922 minutes after the Last Modified Timestamp, an approximately 60-minute difference, which could be accounted for by the time which Dr Wright spent making his edits. Both experts agreed the Last Modified timestamp had been manipulated.
In practical terms, these data can be explained by the fact that the document was created with the computer clock set to 11 November 2002 and saved and closed. It is then opened with the clock set to 2 June 2016 and edits are made using Grammarly, but the user then realises the wrong clock date is in use, so re-sets the clock back to 11 November 2002. That process is responsible for creating the long negative edit time.
To conclude the points on {ID_000258}, the experts agreed the document had been manipulated in their first Joint Statement {Q/2/6} and maintained that view in their second Joint Statement {Q/4/6} on the basis that nothing said by Dr Wright had caused them to change their minds. As I point out in section 31 of the Appendix, there were other clear indicia of forgery, as there were for all the other documents in the Appendix.
Reverting to the submissions made by Counsel for Dr Wright, the ultimate end point of them was the submission that I should not conclude that a document has been forged simply on the basis that it contains timestamps, fonts and/or versions of software that post-date the date on the face of the document.
I have not done so.
Furthermore, if there had been just one or two allegedly forged documents in respect of which these were the only indicia, this case might look very different. However, these are not the only indicia, and furthermore, there are a large number of allegations of forgery. It seems to me that once my findings of forgery attain a critical mass (as I find they have done), those findings provide support for other allegations where there may be fewer indicia. The converse is also true: if I had found a number of Dr Wright’s documents did genuinely date from 2007/2008, his points about his computer environment might well have carried much greater weight. However, if I have found that Dr Wright has clearly forged a large number of documents which are said to pre-date the release of the Bitcoin White Paper in order to support his claim to be Satoshi, why should I be slow to find forgery in relation to other documents which have the same aim and which also share indicia of forgery? As I have said, the evaluation of all these allegations is an iterative process.
On these points, it may be noted that my answer to Dr Wright’s own submission (in paragraph 391 above) provides a negative answer to the question I posed at paragraph 380 above.
I can now return to the challenge made to Mr Madden’s reliability as an expert witness. This challenge was a bold submission in view of the following:
Only a tiny proportion of Mr Madden’s very detailed analysis was challenged in cross-examination. Indeed his cross-examination was considerably shorter than the time estimate provided. I have addressed the more general points taken by Dr Wright (above, in the following sections and in the Appendix) and none of them deflect any of the allegations of forgery.
All or very nearly all of Mr Madden’s conclusions were agreed by Dr Placks and Mr Lynch. In other words, there was effectively no expert evidence to contradict Mr Madden’s conclusions.
The only contrary evidence came from Dr Wright and his points have been considered in the Appendix. Dr Wright was unable to deflect any of the allegations of forgery. Furthermore, far from Mr Madden being an unreliable witness, Dr Wright established himself very firmly as a completely unreliable witness.
In conclusion, I reject any suggestion that Mr Madden was an unreliable witness. In my view, he plainly adhered to his duties as an expert witness and I have full confidence in the evidence he gave. Furthermore (and reverting to the point I discussed in [365] above), due to their extensive experience in Patent litigation, I acquit Bird & Bird of any charge that Mr Madden’s reports were prepared in an inappropriate manner. So too, Mr Madden. I am very grateful to him for all the work he did in this litigation.