MSNBC’s Rachel Maddow devoted the first 21 minutes of her Thursday night program to what she promoted as an “exclusive” scoop. The cable news host said that someone had sent her a “carefully forged” top-secret NSA document that used a top-secret document The Intercept reported on and published on June 5 as a template. That document — from the June 5 Intercept report — was from an unknown NSA official, and purported to describe Russian attempts to hack election officials and suppliers.
Maddow said her report should serve as a “heads up” to other news organizations that someone is attempting to destroy the credibility of those who report on Trump’s connections to Russia by purposely giving them false information. She suggested, without stating, that this may have been what caused CNN and other outlets recently to publish reports about Trump and/or Russia that ended up being retracted.
The grave tone of cloak-and-daggers mystery Maddow used to tell her story was predicated on her timeline of events. If it were the case that MSNBC had received the purportedly forged version of this document before The Intercept published its own version, that would indeed be a major story. That would mean that the person who sent the forgery to MSNBC was one of a relatively small group of people who would have had access to this top-secret document.
But that’s not what happened. By Maddow’s own telling, MSNBC received the document two days after The Intercept published it for the entire world to see. That means that literally anyone with internet access could have taken the document from The Intercept’s site, altered it, and sent it to Maddow.
Despite the fact that she received the document two days after The Intercept published it, Maddow nonetheless suggested that the document may have been forged before The Intercept’s publication — meaning that the forger had access to the document prior to our publication of it. Her theory, which posits a remarkable scenario, rests exclusively on one claim: that the “creation date” in the metadata of the document precedes The Intercept’s publication by slightly more than three hours.
Even though Maddow acknowledged what is plainly true — that the time stamp could have been easily altered to make it appear that the document was created before The Intercept’s publication — she showed a graphic of the purported timeline of events, which depicted the forged document’s creation as occurring just over three hours prior to The Intercept’s publication (12:17:15 p.m. on June 5):
This seems to be a remarkably thin reed on which to base such an improbable yet consequential theory. To begin with, as Maddow acknowledged, the “creation date” in the document’s metadata could be easily altered. It’s also possible that simple time zones explain the discrepancy: that whoever forged the document was in a time zone several hours behind East Coast time, and June 5, 12:17 p.m., in that time zone is after The Intercept’s publication, not before.
The story is much sexier and more dramatic if the forger had access to the document before The Intercept’s publication — and Maddow does a lot of work to suggest this to viewers — but the far likelier version, based on what Maddow presented, is that someone among the millions of people in the public who read the story and saw the document on The Intercept’s site sent an altered version to Maddow.
But here’s the key point, one that guts MSNBC’s theory completely. If you look at the time stamp on the metadata on the document that The Intercept published, it reads “June 5, 12:17:15 p.m.” — exactly the same time and date, to the second, as the one on the document received by Maddow:
That’s because time stamps on the documents published by The Intercept designate the creation date included in the PDF we publish on DocumentCloud: In this case, that occurred just over three hours prior to publication of our article. Both versions — the one we published and the one Maddow received — reflect the same time to the second: literally the exact moment when we created and uploaded the document.
In other words, anyone who took the document directly from The Intercept’s site would have a document with exactly the same time stamp as the one Maddow showed. Thus, rather than proving that this document was created before The Intercept’s publication, the time stamp featured by Maddow strongly suggests exactly the opposite: that it was taken from The Intercept’s site.
Nobody from Maddow’s show or MSNBC reached out to The Intercept before running this story. This was odd for many reasons, including the fact that Maddow offered several speculative theories about The Intercept’s reporting on the document, including her belief that a crease that appeared on the document sent to her was the same as the crease that the Trump DOJ, in its affidavit, claimed appeared on The Intercept’s document.
Had MSNBC sought comment from The Intercept before broadcasting this story, they would have learned that the sole piece of evidence on which their entire theory was predicated — the time stamp that preceded The Intercept’s publication by a few hours — strongly suggests that whoever sent them the document did not have special, early, pre-publication access to it, but rather took it from The Intercept’s site.
Prior to publication of this article, The Intercept sent a series of questions to Maddow about all of this. She said MSNBC did not contact The Intercept prior to broadcasting her report “because we were really only working on the document you published, not in your reporting on it.”
As for the issues of the timeline, Maddow stressed that “we explicitly *didn’t* say it was sent to us prior to your publication. I said — and we even showed a calendar graphic to illustrate — that it was sent to us *after* you published. No one falsely made it appear that it was sent to us prior to your publication. It came to us afterwards — which is what I said on the air.”
Regarding our inquiries about the possibility that the metadata may have been changed, Maddow said: “yes, like I said on the air, we did look into the possibility of altering the metadata to change the apparent creation date, and, as I said, it could definitely have been altered.”
As for our question that pointed out that the exact same time appears in the metadata on the document sent to her as the one we published, strongly suggesting that whoever sent her the document took it from The Intercept’s site, Maddow said: “We got a document *different* than yours, with no purported connection to yours, except we sussed out that someone appears to have used your doc as a template for ginning up a fake one to sent to us. And yes the timestamp absolutely goes to our whole point — someone used the document sent to you as a template for forging the fake document sent to us.”
One can listen to Maddow’s original report and draw your own conclusions. That she was strongly suggesting that the forger obtained the document prior to The Intercept’s publication — and thus must have had special access to it — was something heard by numerous people. Here, for instance, is Lawfare’s Benjamin Wittes citing Maddow’s report to strongly imply — falsely — that this all happened because of the The Intercept’s poor security and that our servers were “penetrated”: