Common features of Dr Wright’s explanations for the forged documents
I can now return to make some general points about the various explanations put forward by Dr Wright. In general terms, his explanations given for inauthentic or forged documents in his original disclosure largely rested on computing environment(s). By contrast, as can be seen from the Appendix, for most of the allegations of forgery relating to the Additional Documents, the explanation was that he was hacked by various third parties. In this section I concentrate on the explanations for documents in his original disclosure.
A notable feature of Dr Wright’s explanations in response to the allegations of forgery or inauthenticity was that his explanations were only produced after he had been found out. Given Dr Wright’s avowed expertise in forensic document examination and IT more generally, it is surprising that he repeatedly produced key Reliance Documents for a series of important legal cases without noticing serious anomalies in them. Examples of his professed expertise were as follows:
“So I used to work in digital forensics and I have written a textbook on the subject. I taught it with the New South Wales police college, and what I have to say is the KPMG methodology is not replicable. It is not scientific.” (Granath transcript for 14 September 2022, internal p71 {O2/11/19}.)
“As somebody who designed multiple forensic certifications, published several books and founded methodologies used within the industry, I believe that the number of people in the forensic environment who have experience with this type of IT environment and the issues it can give rise to is smaller again.” (Wright10, [6] {E/31/2})
Despite this supposedly unparalleled expertise, his case must be that either (a) he failed to notice any of the myriad problems with his documents pointed out in Madden1, or (b) he noticed some, but chose not to mention them.
In cross-examination, Dr Wright came up with a series of excuses for documents exhibiting signs of forgery. These are addressed in detail in the numbered sections in the Appendix, but the main responses can be classified as follows:
False technical excuses / technobabble – When confronted with signs of forgery revealed by the experts’ analysis, Dr Wright frequently fell back on false technical excuses, notably (a) that use of normal.dotm templates on a shared Citrix environment would cause anachronistic artefacts (such as later-dated Grammarly timestamps, Mathtype references, fonts and MS schemas) to become inserted into files simply as a result of their being opened, without there being any user interaction to cause timestamps to update; (b) that use of a shared Citrix environment, possibly in combination with the XCOPY command, could cause different documents to merge (so accounting, for instance, for hidden remnant text showing that material referring to the existing Bitcoin system had been edited out). Dr Wright provided no evidence that the ordinary use of a Citrix environment causes documents to be affected in these ways, and indeed one would expect the many blue-chip companies which use Citrix to be horrified if it did.
Mr Madden gave clear evidence disputing Dr Wright’s points, both in Madden4, [155-162] {G/6/51}-{G/6/55}, and in his oral evidence {see, in particular {Day16/35:19} - {Day16/38:11}; {Day16/125:7} - {Day16/125:18}}. Dr Placks and Mr Lynch agreed with Mr Madden on these issues in their respective joint reports {{Q/4/6} at [8]; {Q/6/3} at [9]}. Even the report of Mr Bryant which Dr Wright applied to adduce at a late stage during trial (before promptly abandoning the attempt) did not support Dr Wright’s account on these matters. Dr Wright’s answers betrayed a consistent effort to “blind with (computer) science”. Many of his answers were extremely fragmented and scattered references to computer systems seemingly at random.
Deliberate forgery by others – There is a long list of those whom Dr Wright blamed for his disclosed documents bearing signs of forgery. In a number of instances he came up with conspiracy theories involving forgery by disgruntled former employees (who had unspecified grudges), Ira Kleiman, Uyen Nguyen, Christen Ager-Hanssen, Bitcoin developers, etc. As set out in the numbered sections below, these theories were uniformly unsupported by any evidence. Many were also implausible and failed to account for the document appearing to support Dr Wright’s case. A few memorable examples are (i) the supposed forgery of the NAB records attached to the email at {ID_003455} by an unnamed Reddit user just after Dr Wright had given interviews saying he had precisely such records; (ii) the supposed forgery of the Kleiman email {ID_000465} in order to add a single paragraph which made no real difference; (iii) somebody supposedly forging a version of the Tominaga Nakamoto article and posting it online by 2016 in order to discredit an account first given by Dr Wright in an interview of 2019.
Accidental alteration by others – A common refrain of Dr Wright’s evidence (both in Wright9, Wright10 and Wright12, and in cross-examination) was that documents could not be treated as reliable because they had been sourced from “staff laptops” and could have been edited by any number of unnamed employees over time. On Day 3, he explained that he was not relying on his Primary Reliance Documents as authentic originals (to prove supposed precursor work to the Bitcoin White Paper, for instance) but as proof of his ingenuity and creativity: {Day3/16:5} and following. Later, he went so far as to say that none of his documents was really from 2008 in a strict sense, “because they have all been accessed and all used” since then: {Day3/53:14} and following. This was a remarkable retreat from his original position that he could prove his claim to be Satoshi by authentic evidence of precursor work, but it does not account for all the signs of deliberate editing and backdating to fake a documentary record to support his claim. Furthermore, for many of the documents, it is not plausible that staff engaged in work in recent years would be making use of Dr Wright’s scrappy notes and postgraduate degree work, by of examples, from 15 years previously.
In a similar vein were his claims that other individuals in his companies will have accessed his documents on networked computers, with the result that the documents will have automatically updated to include what would otherwise be anachronistic metadata features (e.g. Grammarly timestamps). These excuses are comprehensively rejected by his own experts, Mr Lynch {see Lynch1 at [123-128] {I/5/37}; Joint Statement Madden/Lynch at [9] {Q/6/3}}, and Dr Placks {see Joint Statement Madden/Placks at [8] {Q/4/6}}, as well as by Mr Madden {see Madden4 at [155-162] {G/6/51}}.
Not working linearly – Dr Wright repeatedly cited his supposedly “non-linear” working patterns to explain away evidence that documents had been derived from versions later than their supposed dates. For instance, where his supposed precursor work from early 2008 or before was found to contain text from the March 2009 version of the Bitcoin White Paper that did not feature in the August and October 2008 versions, he claimed that this was a result of eccentric “non-linear” writing methods. It is striking that in each case, these signs of backdating (based on the content of the documents) co-existed with entirely distinct forensic signs of backdating (based on expert analysis), requiring Dr Wright to deploy multiple excuses in tandem. See for example the entries in sections 6, 20 & 24 of the Appendix for {ID_000073}, {ID_000536} and {ID_000254}
Despite the length of the statements and the elaborate account of Dr Wright’s past IT systems, I agree this was speculation on effects which might occur, without any supporting technical evidence. In general terms, the experts for both parties disputed that these effects would occur as suggested. If and insofar as Dr Wright wished to establish that features of his IT systems in fact accounted for particular signs of alteration, his Counsel would have needed to have put specific points to Mr Madden (although it is difficult to see this being done with any foundation, given the joint expert evidence). However, even if I assume Dr Wright did work in the way he asserted, I remain of the view that the features of his systems cannot account for all of the many and diverse signs of forgery I discuss in the Appendix. In addition, there are other non-technical indications of forgery which cannot be explained away by reference to Dr Wright’s IT set-up.
The related issue with Dr Wright blaming his system architecture now is that he never mentioned this topic before service of Madden1. This is surprising in view of his vaunted expertise. One would have expected him to say, when serving his list of Primary Reliance Documents, that certain features of his IT systems might give rise to metadata anomalies of particular kinds. He said no such thing. Indeed, when COPA asked in their Consolidated RFI for information on the operating system used for each of the Reliance Documents, part of Dr Wright’s response was that this was “in any event, irrelevant” {RFI Response 66 at {A/13/23}, 11 September 2023}.
That response was given after service of Madden1 and the week before Dr Wright’s supposed search which yielded the BDO Drive. Accordingly, it is apparent that Dr Wright had not at that stage come up with his excuse that his operating systems accounted for the defects identified in Madden1. If Dr Wright really did have the expertise in digital forensics which he claims, then even an initial read of Madden1 and its first few appendices would have alerted him to the findings which he now says are explained away by features of his computing environment. For example, Mr Madden’s first Appendix PM1 {H/1/1} is just 22 pages long and illustrates practically all the types of forensic findings which Dr Wright now seeks to attribute to his operating systems, and others besides.
There is, of course, a very stark contrast between his claim that the operating systems were irrelevant and what became a central theme in his attempts to deflect the allegations of forgery made in October 2023 (and as addressed in Appendix B to Wright11). COPA submitted that, in his oral evidence alone, Dr Wright invoked operating systems on no fewer than 102 occasions (referring variously to Windows, Linux, CentOS, Apple, Citrix, Virtual Machines and other “operating systems” in general), and I have no reason to doubt that submission.
COPA had further objections to Dr Wright’s attempts to attribute signs of document manipulation to the unusual effects of his operating systems.
First, that Dr Wright never adduced any independent expert evidence, or clear documentary evidence, to support his assertions about the effects of his systems. Despite having Madden1 since 1 September 2023, Dr Wright never found a single independent expert to support his position. This cannot be ascribed to a lack of resources of money or expertise, given the lawyers and experts he went on to recruit. Nor can it be ascribed to a reticence about introducing new evidence shortly before trial, given the applications he went on to make. Nor can it be ascribed to a lack of determination on Dr Wright’s part: anyone who could find the time to produce the mammoth Wright11 (as well as 13 other statements since October 2023) had the time to identify experts.
Second, COPA submitted there was no factual basis for his computer environment claims beyond his own unsupported assertions. There is no supporting evidence of the precise set of systems he used, for what periods or the numbers of users. Nor is there any supporting evidence that he used any of the special versions of software that he claimed (such as Grammarly Enterprise {a Slack post he made attaching his forged LLM dissertation proposal in 2019 showed that he was then using the Standard version of Grammarly, not the Enterprise version, as he admitted: {Day3/66:22}} and Dragon Dictate Legal {Dr Wright insisted that he used Dragon Dictate Legal, which he claimed had a different logo from the Dragon Dictate logo shown on the computer screen photographs supposedly sent to him by “Papa Neema”: Wright11 at [278] {CSW/1/51}. But even that was wrong: {P1/20/13} and {G/9/48}}. Nor is there any evidence of the forms of template supposedly used in his nChain and other computer systems which supposedly accounted for anachronistic artefacts being attached to earlier documents. Again, the absence of such evidence cannot be put down to a lack of will, inventiveness or resources.
Third, COPA pointed out that Dr Wright’s accounts often also involved computing environments being used in very unusual ways. For instance, he sought to account for very long edit times by saying that he would leave Citrix sessions open for extraordinarily long periods, sometimes of more than a year in length. In any event, Mr Madden never used this as a freestanding reason for finding a document inauthentic {see Madden1, Appendix PM24, [35] {H/116/12}; Madden2, [47b] {G/3/19}}. Dr Wright suggested that numerous documents would have been opened by unnamed staff members on shared environments without their editing the documents (or even, on his account, having the ability to do so).
In view of the general unreliability of Dr Wright as a witness, plus the fact that he had no independent expert evidence to support his assertions about the effects of the relevant computer environments, I agree that they carry very little weight. Furthermore, to the extent that any of his assertions had some validity, I am satisfied Mr Madden took account of them.