How Forensics Claims Facebook Ownership Contract Is ‘Forged’

Hoping to blast away a lawsuit with digital science, Facebook asked a federal judge Monday to dismiss a long-running case brought by New York resident Paul Ceglia who claims he owns half of the social networking site.

Ever since Ceglia filed suit in 2010, Facebook has made it clear it believes the contract and e-mails that Ceglia has produced as evidence are fakes — and it even hired private investigators to dig up dirt on Ceglia‘s none-too-sparkly past.

As we reported Monday, Facebook told a federal judge that its forensic examiners proved that a 9-year-old contract between Ceglia and Facebook chief Mark Zuckerberg was “forged.” The analysis also claims that 27 e-mails between Zuckerberg and Ceglia — some of which mention Facebook — were “fabricated” by Ceglia.

Zuckerberg has said all along that the authentic “Work for Hire” contract involved another project. Ceglia hired Zuckerberg to work on Ceglia’s StreetFax company nearly a decade ago, Zuckerberg claims. Ceglia, however, alleges the contract also included fronting Zuckerberg $2,000 in exchange for half of Facebook when Zuckerberg was a Harvard University computer science student.

The voluminous filings on Monday included e-mails subpoenaed from Zuckerberg’s Harvard e-mail account and a 102-page digital forensics report on evidence found in Ceglia’s computers and e-mail accounts.

We dug into the report by Stroz Freidberg, (.pdf) a New York forensics company, to see how Facebook’s forensic team is arguing that Ceglia is trying to scam Facebook. The analysis was based on Ceglia having turned over hard drives, laptops, desktops and other gear as part of a court order:

Here is a brief sampling of the reports allegations, which have not been proven yet in a court of law.

• Facebook said it had discovered the original “Work for Hire” contract on Ceglia’s computer and one e-mailed in 2004 to a Ceglia lawyer — neither of them mention Facebook, despite allegations from Ceglia that the contract includes Facebook. Ceglia has since claimed these were planted post-facto on his computer and his lawyer’s by Facebook.
• Two TIFF images were discovered by examining Ceglia’s sent mail, which was found by investigators opening a file named “Sent Items.dbx.” on Outlook Express. The examiners found what they say was the original 2003 contract, which does not reference Facebook. The contract was also e-mailed to a Ceglia attorney at the firm Sidney Austin in 2004. The firm produced the e-mail pursuant to a subpoena, which had the same image of the contract attached. An examination of the e-mail metadata shows the e-mail was sent to the attorney on March 3, 2004, six years before the lawsuit was filed.
• Twenty-seven e-mails allegedly between Ceglia and Zuckerberg, some of which reference a Facebook deal, were not discovered on Ceglia’s hard drives. Ceglia said he cut-and-pasted the e-mails into Microsoft Word documents, the text of which a metadata analysis concluded was backdated.”This metadata anomaly constitutes evidence of backdating because a file that was last modified in October 2003 could not contain authentic emails from July 2004,” the forensic report said. What’s more, the e-mail on the Word files contain fudged date lines for the time the e-mail was “purportedly sent.”
  

  At the end of each ‘Date’ line, the time zone that the email was purportedly sent in is indicated with an offset of the format ‘+HHMM’ or ‘-HHMM.’ HHMM indicates hours and minutes from Coordinated Universal Time (‘UTC’); the + or – indicates whether the time zone is before or after Coordinated Universal Time. For example, Eastern Daylight Time is represented as ‘-0400′ and Eastern Standard Time is represented as ‘-0500.’ Standard time was in effect in the United States from late October 2003 to early April 2004.

  Thus, one would expect that authentic e-mails sent during that time period from a location in the Eastern Time Zone would contain the ‘-0500′ stamp, in the absence of an inaccurate system clock. However, all but one of the 27 purported e-mails contain the ‘-0400′ time zone stamp for Eastern Daylight Time, including all of the purported e-mails supposedly sent between Oct. 26, 2003 and Apr. 4, 2004.

• The original, signed “Work for Hire” contract, which was attached to the lawsuit, was not discovered on Ceglia’s computers or the hard drives and USB storage devices Ceglia turned over. The investigators said they found “seven unsigned versions” of the contract “that are very similar but not identical to the Work for Hire Document. All seven of those electronic documents contain metadata anomalies indicative of backdating and document manipulation.” The metadata shows they were backdated to 2003 when Zuckerberg, as a Harvard University student, agreed to perform the contracted work for Ceglia. But the copies of the contract were created in 2011. And they all had “significant” formatting differences. The margin space varies, from 0.32 inches, to 0.03 inches to 0.13 inches.
• Ceglia reinstalled Windows at least twice, including in late December 2010 — months after he’d filed suit against Facebook. While there are many good reasons to reinstall Windows, there are some not-so-legit ones as well. Facebook’s forensic team imaged Ceglia’s hard drive in March 2011, which showed an install date of late December 2010.
  

  The reinstallation of an operating system is a destructive action that may have the effect of overwriting existing data on a hard drive. In Stroz Friedberg’s experience with electronic forgery cases, the reinstallation of an operating system can be done in an effort to destroy or conceal data.

  Stroz Friedberg determined that the Windows operating system on the Seagate Hard Drive and the Forensic Image Created by Plaintiff’s Expert of that drive was reinstalled on at least two occasions.

A hearing on the motion to dismiss is set for Apr. 4 in New York federal court. Ceglia’s attorney, Dean Boland, denies the claims made by Facebook’s experts.