The Double X-No-Archive Giveaway

Dick Coward really messed up and left a huge giveaway to his identity in the headers of the sex and pornography posts he forged in my and Richard Turner's names on 8/16/96. (This is in addition to the eyewitnesses at the CDC who saw some of Hillyard's visits to sexually-related internet sites, and the evidence the CDC's packet sniffer turned up—as Hillyard's then-boss testified under oath at his July 1996 trial.)

In those messages, as in many Hillyard/Dick Coward posted in various names, an optional line shows up in the headers of his posts—the X-No-Archive: header. The giveaway is thet unlike everyone else's posts, it shows up twice in his messages.

The X-No-Archive: header was fairly new at the time. The header instructs the various archive sites, like DejaNews, that the poster does not want his messages included in their archives.

Dick Coward used Forte's Agent newsreader program to post most of his messages. Agent didn't offer the ability to automatically add that header until 10/96, so many Agent users had applied an authorized "patch" circulated through the warez newsgroups and similar sources. The patch also removed the X-Newsreader: header. If the patch was applied twice, the X-No-Archive: header would have shown up twice. The posts with the double X-No-Archive: header do not show the X-Newsreader: header, either.

Hillyard had access to multiple computers at the CDC (again, this information is from Jim Seligman's testimony under oath). He (or someone an awful lot like him, with access to those same computers) has been proven to have used various computers when sending messages under different names. Apparently one of workstations had a patched version of Agent installed, and one of the others had the unpatched version installed.

In any case, I have seen no other messages from anyone, anywhere, that have the X-No-Archive: header appearing twice. It appears in too many of Hillyard/Dick Coward's messages in various names to be ignored, though.

Most of these messages were posted through his interamp.com account—including a great many forged cancellations. He was also cancelling a lot of his own messages he'd sent from the CDC as ufgator@interamp.com—covering his tracks for something. In another he's cancelling a message he sent from his inetnow.net account using the name lewis@freemark.com. In another he was cancelling a message he'd posted through interamp.com, but missed a telltale sign that he was at the CDC and his organization: header still says "Internet America." He was also cancelling some of his authority@ncaa.org messages. The final message is from him at the CDC using his acad@usa.net address and his inetnow.net account.

Hillyard—or some user at the CDC—was forge cancelling messages posted by D. Gordon, Richard Turner, and me. He forged messages in my name and Richard Turner's name. Those with a subject line starting "cmsg cancel" indicate a cancel message, following by the message ID of the message being canceled. The message IDs ending in "news.mindspring.com" are from MindSpring users, and are all messages Hillyard forge-canceled. Message IDs containing "airnews.net" indicate that Hillyard is cancelling a message he posted from the CDC's news feed.

Forgeries

Forged Cancellations

Cancelling His Own Messages