Planet Security

February 09, 2010

Network World on SecurityiHound aims to help you find your missing iPhone

If you're outside Moscone Center for this week's Macworld Expo, and someone hands you a "Lost iPhone" sticker, don't toss it away. It could help you track down your phone, should it ever go missing.

Freedom To TinkerWhat Third Parties Know About John Doe

As David mentioned in his previous post, plaintiffs' lawyers in online defamation suits will typically issue a sequence of two "John Doe" subpoenas to try to unmask the identity of anonymous online speakers. The first subpoena goes to the website or content provider where the allegedly defamatory remarks were posted, and the second subpoena is sent to the speaker's ISP. Both entities—the content provider and the ISP—are natural targets for civil discovery. Their logs together will often contain enough information to trace the remarks back to the speaker's real identity. But when this isn't enough to identify the speaker, the discovery process traditionally fails.

Are plaintiffs in these cases out of luck? Not if their lawyers know where else to look.

There are numerous third party web services that may hold just enough clues to reidentify the speaker, even without the help of the content provider or the ISP. The vast majority of websites today depend on third parties to deliver valuable services that would otherwise be too expensive or time-consuming to develop in-house. Services such as online advertising, content distribution and web analytics are almost always handled by specialized servers from third party businesses. As such, a third party can embed its service into a wide variety of sites across the web, allowing it to track users across all the sites where it maintains a presence.

Take for example the popular online blog Boing Boing. Upon loading its main page while recording the HTTP session, I noticed that my browser is automatically redirected to domains owned by no fewer than 17 distinct third party entities: 10 services that engage in advertising or marketing, five that embed media or integrate social networking functionality, and two that provide web analytics. By visiting this single webpage, my digital footprints have been scattered to and collected by at least 17 other online entities that I made no deliberate attempt to contact. And each of these entities will likely have stored a cookie on my web browser, allowing it to identify me uniquely later when I browse to one of its other partner sites. I don't mean to pick on Boing Boing specifically—taking advantage of third party services is a nearly universal practice on the web today, but it's exactly this pervasiveness that makes it so likely, if not probable, that all of my digital footprints together could link much of my online activities back to my actual identity.

To make this point concrete, let's say I post a potentially defamatory remark about someone using a pseudonym in the comments section of a Boing Boing article. It happens that for each article, Boing Boing displays the number of times that the article has been shared on Facebook. In order to fetch the current number, Boing Boing redirects my browser to api.facebook.com to make a real-time query to the Facebook API. Since I happen to be logged in to Facebook at the time of the request, my browser forwards with the query my unique Facebook cookie, which includes information that explicitly identifies me—namely, my e-mail address that doubles as my Facebook username.

In order to integrate a bit of useful social networking functionality, Boing Boing enables Facebook, a third party in this situation, to learn which articles I visit on Boing Boing and the dates and times of my visits. The same is true for Tweetmeme, which can now positively link my Twitter account—which I'm also logged in to—with my Boing Boing visits. Even without an authenticated login, the 15 other third parties present on Boing Boing could track me using any number of different methods, including browser fingerprinting, to build detailed dossiers that slowly begin to piece together who I am.

From the perspective of a plaintiff's lawyer, even if Boing Boing is unwilling or unable to produce any useful information, these third parties might be able to uniquely identify me as the likely defamer, or at least narrow the list of possible speakers down to a handful of users. But tracing speech is not always this easy. Tomorrow, I'll discuss more complicated discovery strategies and the extent to which they are technically feasible.

The Guardin - Hacking RSSPart 11: 'Climategate' was PR disaster that could bring healthy reform of peer review

Peer-review was meant to be a safeguard against the publication of bad science but the balance is shifting towards open access

In a unique experiment, The Guardian has published online the full manuscript of its major investigation into the climate science emails stolen from the University of East Anglia, which revealed apparent attempts to cover up flawed data; moves to prevent access to climate data; and to keep research from climate sceptics out of the scientific literature.

As well as including new information about the emails, we will allow web users to annotate the manuscript to help us in our aim of creating the definitive account of the controversy. This is an attempt at a collaborative route to getting at the truth.

We hope to approach that complete account by harnessing the expertise of people with a special knowledge of, or information about, the emails. We would like the protagonists on all sides of the debate to be involved, as well as people with expertise about the events and the science being described or more generally about the ethics of science. The only conditions are the comments abide by our community guidelines and add to the total knowledge or understanding of the events.

The annotations - and the real name of the commenter - will be added to the manuscript, initially in private. The most insightful comments will then be added to a public version of the manuscript. We hope the process will be a form of peer review. If you have a contribution to make, please email climate.emails@guardian.co.uk.

The anonymous commenting facility under each article will also be switched on so that anyone can contribute to the debate.


The response of the science establishment to the hacking is set to become a case study in public relations disasters. One PR figure from a major environment group said: "Their response will be taught in university communications courses - because I'm going to make sure it is."

The initial response from both the emailers and their employers was to condemn the hackers and ignore what they hacked. Michael Mann at Penn State University called the affair "a high-level orchestrated smear campaign to distract the public about the nature of the climate change problem." Phil Jones, holed up in the Climatic Research Unit at the University of East Anglia, called most of the charges against them "ludicrous". Kevin Trenberth at the National Centre for Atmospheric Research in Boulder, Colorado, and IPCC chairman Rajendra Pachauri both said they saw it as an attempt to undermine the Copenhagen climate conference, that was due to take place two weeks later.

Ben Santer from the Lawrence Livermore National Laboratory in California called Jones "one of the gentlemen of our field". He was standing firm in the face of "the vilest personal attacks" from "powerful forces of unreason." Bob Ward of the Grantham Institute for Climate Change at the London School of Economics said Jones and Mann "have been subjected to a co-ordinated campaign of personal attacks on their reputation." The UEA put out a statement saying that "the selective publication of some stolen emails and other papers taken out of context is mischievous and cannot be considered a genuine attempt to engage with the issues in a responsible way."

But the contents of the emails was not edifying for anyone. And the sceptics were making hay. They gleefully blogged that the emails revealed extensive data manipulation. The Daily Telegraph published a blog by a former news reporter on the paper, James Delingpole, claiming the affair "exposed the conspiracy behind the anthropogenic global warming myth", adding for good measure that "this scandal could well be the greatest in modern science."

The Daily Express ran a long story headlined: "100 reasons why global warming is natural". It said the list came from a "dossier" issued by the European Foundation, a UK-based right-wing group that campaigns mostly against European integration. But two months on, the dossier has not been published. Most of the hundred reasons were either meaningless or scientific nonsense, according to New Scientist magazine, which gave up after debunking the first 50.

In the US, sceptical physicists used the moment to revive a campaign to overturn a 2007 declaration by the American Physical Society that evidence of man-made climate change was "incontrovertible". Their letter began: "By now everyone has heard of... ClimateGate, which was and is an international scientific fraud, the worst any of us have seen."A picket formed outside the offices of NCAR in Boulder, where Tom Wigley, Trenberth and other emailers worked. Wigley was among a number of climate scientists who say they received death threats.

Many who might have been expected to defend Jones and his colleagues were silent. Most environmentalists sat on their hands, awaiting events. An exception was Elizabeth Green, head of the Canadian Green party. She said she had read all the emails and declared: "How dare the world's media fall into the trap set by contrarians without reading the whole set." For her "the enormous volume of emails give a picture of thoroughly decent scientists increasingly finding themselves in a nightmare. They write each other in disbelief, protesting 'I have never been political. I am an honest scientist'." But four days after the leak, the environmental commentator George Monbiot said that Jones should resign.

The mood changed. Even Mann, whose words featured prominently in early soundbites published from the emails, began an op-ed in the Washington Post with the words: "I cannot condone some things that colleagues of mine wrote." The website that Mann co-hosts, RealClimate, offered the half-apologetic insight that the emails offered "a peek into how scientists actually interact and the conflicts show that the community is a far cry from the monolith that is sometimes imagined... For instance, we are sure it comes as no shock to know that many scientists do not hold Steve McIntyre in high regard." The post went on, "Gravity isn't a useful theory because Newton was a nice person."

But such guarded apologies didn't turn the tide of invective. A survey in the US found that 49% of respondents claimed to have followed news of climategate "very closely or somewhat closely", and 59% found it "very likely or somewhat likely" that some scientists have falsified research data in order to support their own theories and beliefs about global warming.

According to American science historian Spencer Weart, the frenzied assaults on climate scientists were unprecedented. "We've never before seen a set of people accuse an entire community of scientists of deliberate deception and other professional malfeasance. Even the tobacco companies never tried to slander legitimate cancer researchers."

One PR operator for a leading environmental organisation in Britain told me: "The emails represented a seminal moment in the climate debate of the last five years, and it was a moment that broke decisively against us. I think the CRU leak is nothing less than catastrophic."

The next recourse was to an investigation. Jones stood down while the University of East Anglia's pro-vicechancellor Trevor Davies, who himself had been director of CRU from 1993 to 1998, launched an independent inquiry to be headed by senior civil servant, Sir Muir Russell. The IPCC's chairman Rajendra Pachauri initially said the affair was "a serious issue and we will look into it in detail". But later made clear he would only be looking for lessons to learn and would not investigate the affair itself separately from the University of East Anglia and the Norfolk constabulary. In January the House of Commons Science and Technology Committee announced its own investigation.

The emails made little impression at the UN climate negotiations in Copenhagen in early December. This was about raw politics and not climate science. A few sceptics such as Senator Inhofe and Danish economist Bjørn Lomborg were present giving media interviews, and others such as Lord Monckton caused offence by declaring that young climate activists were akin to "Hitler youth". Saudi Arabia's lead climate negotiator Mohammed Al-Sabban, claimed on the opening day that "it appears from the details of the scandal that there is no relationship whatsoever between human activities and climate change" — a view that not even the most sceptical scientists would endorse.

But lobbyists were busy organising. In Britain, Lord Lawson launched the Global Warming Policy Foundation (GWPF) four days after the story broke. Lawson had been chancellor of the exchequer in 1989, when Margaret Thatcher assembled her entire cabinet to hear a seminar on climate change at which Tom Wigley, then director of CRU, was the star perfomer. But Lawson now opposes measures to fight climate change.

The GWPF's stated purpose is to "bring reason, integrity and balance to a debate that has become seriously unbalanced, irrationally alarmist, and all too often depressingly intolerant". But its trustees and academic advisers do not reflect that balance. Most have a public record as making sceptical comments about climate science. Lawson appointed as the foundation's director Benny Peiser. He is a social anthropologist, part-time lecturer at the School of Sport and Exercise Sciences at Liverpool's John Moores University, and long-standing co-editor of the journal Energy and Environment. The journal is trashed by Jones in the emails as "the worst journal in the world" for its patronage of what he regarded as poor-quality papers by sceptics. Even Peiser's co-editor Sonja Boehmer-Christiansen, a geographer from the University of Hull, admits that it espouses what she calls a "political agenda" but she has defended the journal, saying that, "it's only we climate sceptics who have to look for little journals and little publishers like mine to even get published." When asked by the Guardian to answer Jones's specific comment she did not respond.

Within hours of his appointment, Peiser had begun what became a frequent media presence on the increasing number of occasions when editors needed a sceptical voice in their climate coverage.

The BBC and the media reponse

One of the most significant outcomes – and perhaps a bellwether of public mood – has been the response of the media. "The CRU hack shifted the balance of legitimacy in newsrooms," says Ben Stewart, media officer at Greenpeace UK. Many newspaper began to probe the sceptics' case more thoroughly. Viewers of the BBC watched a crashing of editorial gears. For several years most of its coverage of climate change has been based on the scientific consensus that warming is real and that mankind is to blame. This had been reinforced by a study for the BBC Trust that concluded in 2007: "The weight of evidence no longer justifies equal space being given to the opponents of the consensus."

But even before "climategate", the BBC had been reviewing both its climate and science coverage. Deputy director-general Mark Byford organised an editorial seminar on climate change in September 2009. Insiders say the seminar followed an in-house trawl to find out how much coverage news bulletins gave to climate sceptics. It had been called after an MP complained that sceptics didn't get a hearing, and it discovered that very often they did not. After the seminar, deputy editor of news Steve Mitchell sent round a memo advising of the "need to reflect deniers in run-up to Copenhagen". One straw in the wind was the awarding of a Leeds-based BBC weather man with mildly sceptical views, Paul Hudson, with the title "climate correspondent" – to the chagrin of news correspondents covering that beat. In October he began posting blogs on the BBC website.

The ripples of the Mitchell memo spread through the BBC. Radio 4's Today raised eyebrows when, days before the climategate emails leaked, it interviewed an Australian climate change denier, geologist Ian Plimer, giving him what one critical insider called "the easiest of rides" for a string of highly contentious claims. And after climategate the change became even more visible to viewers and listeners. Reports say they have been under pressure from editors to "get more sceptics on". One major beneficiary has been Benny Peiser from the Global Warming Policy Foundation, who has made repeated appearances of prime-time BBC news. "We are," one correspondent said privately, "back to the false balance days that chiefs swore had been left behind."

Beyond the two tribes

What about science itself? Science is about producing findings that others can test by trying to replicate or falsify them. That is how theories and bolstered, how bad theories discarded and how knowledge is advanced. Some experiments are easy to replicate. All you need is a lab. Others are more complicated. And few are more complicated than those based on huge amounts of data assembled from all over the world over many decades. Both Jones's temperature data and Mann's proxy data of past temperatures fall into this category. That is one reason why sceptics, rightly or wrongly, have been able to claim that bad science has proliferated in climate research.

That is why the demands for scientists to release their data, even to people outside the research community, have grown. But it is also why researchers who have spent years, sometimes decades, assembling their data, are unwilling to hand it out to the first blogger to ask for it under a Freedom of Information request.

For sceptics like Steve McIntyre, the central issue is the principle that scientific findings are only valid if they can be replicated. And some scientists recognise that. Stephen Schneider of Stanford University in California and editor of the Climate Change journal, said in an email to CRU scientists and others in January 2009: "Our best way of dealing with this issue of replication is to have multiple independent author teams, with their own codes and data sets, publishing independent work on the same topics... That is how credible scientific replication should proceed."

But is it enough to ensure replication among the close network of scientists? Do non-scientists, or amateur scientists, or scientists who run politically charged blogs, have an equal right to share scientific data? Jones believes not. In October 2009 he wrote an email to Graham Haughton, a geographer at the University of Hull, about how "science should be conducted through the peer-review literature, as it has been for over 300 years. The peer-review system is the safeguard science has developed to stop bad science being published."

But many are beginning to disagree. In the world of the internet and freedom of information laws, the balance is shifting towards more open access. Some believe that Jones's cherished peer-review system is itself in jeopardy.

And not before time, says McIntyre. "I don't think there should be any issue of drawing up special rules for outsiders. I simply ask that scientists live up to their own policies," he says.

"There is an unseemliness about scientists willingly providing data to their friends and resisting the provision of data to people who are perceived as critics."

One in the mainstream who agrees is Judy Curry, a climate scientist at the Georgia Institute of Technology. She cut her teeth in public debate after publishing a paper on climate change and hurricanes shortly after Katrina hit New Orleans. She says much greater efforts are needed to open up science to outsiders.

Reviewing the saga of the leaked emails, she said the various datasets connected to Mann's hockey stick studies and Jones's CRU temperature data "stand out as lacking transparency. The raw data behind the key graphs in the climate debate "were not preserved" by the analysts, she said, though it "presumably is available from the original sources". Rather than being stuck in the archives, it needs reprocessing and reanalysing, she believes.

She didn't blame anyone for this state of affairs, but said "given the growing policy relevance of climate data, increasingly higher standards must be applied." In an open letter to young scientists involved in climate research, she said she was "trying to figure out how to engage sceptics effectively... I have received significant heat from some colleagues for doing this (I've been told that I am legitimizing the sceptics and misleading my students)."

Far from it, she said. "Ignoring sceptics from outside the field is inappropriate. Einstein didn't start his career at Princeton, but rather at a post office. Scientists claim they would never get any research done if they had to continuously respond to sceptics. The counter to that argument is to make all of your data, metadata and code openly available. Doing this would keep molehills from growing into mountains."

Curry says climate science has fallen victim to tribalism. "Climate tribes were established in response to the politically motivated climate disinformation machine...The reaction of the climate tribes... has been to circle the wagons and point the guns outward in an attempt to discredit misinformation."

She had found herself in a political storm after publishing a paper on how the number of hurricanes had doubled in 35 years – probably due to rising sea temperatures. By chance, the paper came out days after hurricane Katrina hit New Orleans. "I and my colleagues were totally bewildered and overwhelmed by the assault we found ourselves under" from sceptics, she says. "Associating with a tribe where others were more experienced and savvy about how to deal with this was a relief and very helpful at the time."

Unlike another victim of the hurricanes fracas. Kevin Trenberth, Curry does not appear in the leaked CRU emails. She says that she subsequently fell out with some of her fellow tribes-people after congratulating McIntyre for his work on freeing up data. And the hacked emails, she says, have reinforced her fears about "the systematic and continuing behaviour from scientists that hold editorial positions, serve on important boards and committees and participate in major assessment reports."

Other leading figures are also looking for ways to defuse the tribalism. Hans von Storch, a German meteorologist, often tries to arbitrate between sceptics and mainstream scientists. In December 2009, he wrote in the Wall Street Journal: "We need to repair the damage and heal the public's new mistrust of the workings of climate science.... The core of the knowledge about man-made climate change is simple and hard to contest. [Nonetheless] data must be accessible to adversaries; joint efforts are needed to agree on test procedures to validate, once again, already broadly accepted insights." He denounced the "CRU cartel" for their efforts to suppress open access to data.

Storch advised that "the authors of the damaging emails would be wise to stand back from positions as reviewers and participants in the IPCC process. The journals Nature and Science must review their quality-control measures and selection criteria for papers." Meanwhile, he told the media and politicians: "You have the knowledge you need for the political decisions. Let us [scientists] sit in our studies and discuss the remaining issues... Give us time to consider, to test alternative hypotheses, to falsify theories – to do our work without worrying if the results support our causes. Science is a valuable and unique societal institution, but not if it is consumed by short-sighted political goals."

And one of Jones's former senior colleagues, ex-CRU research scientist Mike Hulme, joined with Oxford science philosopher Jerry Ravetz to write: "Climate scientists will have to work harder to earn the warranted trust of the public – and maybe that is no bad thing." But to do that, they said, science itself might have to change. "This event might signal a crack that allows for processes of restructuring scientific knowledge of climate change. It is possible that some areas of climate science have become sclerotic... too partisan, too centralized. The tribalism that some of the leaked emails display is something more usually associated with...primitive cultures."

Hulme and Ravetz called for a "major change in the relationships between science and the public", with wider public scrutiny of its findings and methods using "the proliferating new communication media...Science is a deeply human activity, and we need to be more honest about what this entails."

Ravetz goes further. He told the Guardian: "In retrospect, it is clear that the Norwich group were practising evangelical science. For them there was a simple truth that would save us, and all naysayers were evil." After the war on drugs and the war on terror, we now had a war on carbon. He called the "extended peer community" on the blogosphere "necessary for the health of science. In spite of all the hazards of any extension of democracy, the rejuvenating effects must be good."

"Climategate" seems set to lead to far greater openness about research data. RealClimate, the climate science blogsite part-run by Mann, is promising to publish more data and relevant computer codes. "We have set up a page of data links to sources of temperature and other climate data, codes to process it, model outputs, model codes, reconstructions, paleo-records, the codes involved in reconstructions etc," it announced within a week of the leak.

"The climate science community fully understands how important it is that data sources are made as open and transparent as possible, for research purposes as well as for other interested parties... The providers of these online resources are very interested in getting feedback on any of these sites and so don't hesitate to contact them if you want to see improvements." That is a sea-change from the days in the CRU bunker.

In response to the saga, Britain's Met Office announced that it was putting into the public domain data on climate change from 1,700 stations round the world. This was not as big a deal as it sounded. Jones had told Nature magazine he was working on this back in July 2009. And, as the Met Office admitted, a lot of it was old data already "publicly available" through the World Meteorological Organization. And, while it might disseminate foreign data, it wants to hang to much of its own data because, according to its spokesman David Britton, "We at the Met Office have to offset our costs for the benefit of the taxpayer, so we have to balance that against freedom of access."

Like other recent battles over access to publicly held information, from lists of paedophiles to school league tables, those demanding freedom of information are winning. But there look like being many battles ahead.

There is a separate question for the scientific journals themselves. How much data should they require that scientists provide when they publish. There seems little agreement on that at present. The big two, Nature and Science, are relatively relaxed and demand little on top of what is required to allow the paper to pass muster with reviewers. Schneider asked his board at Climate Change to consider the matter after McIntyre asked him for personal computer codes. They decided that enough data should be provided to allow others, with the skill to write their own codes to replicate the findings. But no more.

Others are tougher. The Royal Society in London demands full data disclosure from contributors to its Philosophical Transactions.

Schneider told the Guardian there might be some middle ground – especially over researchers' highly prized and personally written computer codes. Maybe, like commercial patents, they should be allowed exclusive use of their own codes, as their own intellectual property, for two or three years. That, he said, would be time enough to "publish the initial papers using their hard work". But after that, the codes should all be disclosed. He added: "This broad discussion about the boundaries of data transparency, personal codes and exclusive rights... may be the only positive that might emerge from this unfortunate incident."

But many sceptics are not satisfied with such half-way houses. Many sceptic bloggers are in full cry against the entire peer review process. They talk about "peer-to-peer" review. Meaning an end to centralised control through journals and a free for all in which everything is published and anyone can comment on anything. A journalist active in this movement, the West Coast former street artist and radical arts critic Patrick Courrielche, claims: "Climategate... triggered the death of unconditional trust in the scientific peer-review process, and the maturing of a new movement of peer-to-peer review."

Can an entirely free intellectual market deliver better science? Can the pioneers of scientific review on the blogosphere do better than the journals? Would this ensure quality control or shatter it? Should the Jeffrey Archers of the scientific world have as much access to the journals as the Nobel laureates? They may shudder in the labs, but we may one day find out.


guardian.co.uk © Guardian News & Media Limited 2010 | Use of this content is subject to our Terms & Conditions | More Feeds

Tao SecurityMaking Progress Matters Most

I found this article by John M. Kamensky to be interesting:

Teresa Amabile and Steven Kramer, in a recent Harvard Business Review article called “What Really Motivates Workers,” tell managers: “The key to motivation turns out to be largely within your control.”

Their advice? “Scrupulously avoid impeding progress.”

Amabile and Kramer surveyed more than 600 managers and then conducted a multiyear study of hundreds of knowledge workers, asking them to keep daily diaries to discover the top motivator of performance. Not surprisingly, managers and workers came to different conclusions.

Managers were asked to rank the impact of five workplace factors commonly considered significant motivators: recognition, incentives, interpersonal support, support for making progress and clear goals. “Recognition for good work” topped their list.

However, the recognition factor was ranked dead last by workers. The researchers found that workers ranked “support for making progress” as their No. 1 motivator...

Amabile and Kramer found that “making progress” was linked to 76 percent of employees’ reported “best days.”


I agree with this sentiment. I am most motivated when I can make progress. What do you think?

The Guardin - Hacking RSSPart three: Hockey stick graph took pride of place in IPCC report, despite doubts

Emails expose tension between desire for scrupulous honesty, and desire to tell simple story to tell the policymakers

In a unique experiment, The Guardian has published online the full manuscript of its major investigation into the climate science emails stolen from the University of East Anglia, which revealed apparent attempts to cover up flawed data; moves to prevent access to climate data; and to keep research from climate sceptics out of the scientific literature.

As well as including new information about the emails, we will allow web users to annotate the manuscript to help us in our aim of creating the definitive account of the controversy. This is an attempt at a collaborative route to getting at the truth.

We hope to approach that complete account by harnessing the expertise of people with a special knowledge of, or information about, the emails. We would like the protagonists on all sides of the debate to be involved, as well as people with expertise about the events and the science being described or more generally about the ethics of science. The only conditions are the comments abide by our community guidelines and add to the total knowledge or understanding of the events.

The annotations - and the real name of the commenter - will be added to the manuscript, initially in private. The most insightful comments will then be added to a public version of the manuscript. We hope the process will be a form of peer review. If you have a contribution to make, please email climate.emails@guardian.co.uk.

The anonymous commenting facility under each article will also be switched on so that anyone can contribute to the debate.


It is a persuasive image. The "hockey stick" graph shows the average global temperature over the past 1,000 years. For the first 900 years there is little variation, like the shaft of an ice-hockey stick. Then, in the 20th century, comes a sharp rise like the stick's blade.

The IPCC put the graph in the summary of its 2001 assessment reports. Although it was intended as an icon of global warming, the hockey stick has become something else – a symbol of the conflict between mainstream climate scientists and their critics. The contrarians have made it the focus of their attacks for a decade, hoping that by demolishing the hockey stick graph they can destroy the credibility of climate scientists. And in the man who first drew the hockey stick, a young paleoclimatologist called Professor Michael Mann of Penn State University, they have found an angry, outspoken and sometimes vulnerable foe.

Damagingly for the mainstreamers, the Guardian has discovered that there was a vitriolic debate within the mainstream science community in 1999, during preparation of the IPCC report, about the validity of the graph. Mann and CRU's tree-ring specialist Dr Keith Briffa are often portrayed by their enemies as co-conspirators, but the CRU emails reveal that back then they were actually in competing camps. Mann promoted his hockey stick. Briffa was very dubious, especially about the prominence the IPCC wanted to give it.

The stakes were high. In the late 1990s, the heat was on to demonstrate the level of natural variability in climate change. In 1996, I visited Briffa at his lab at the CRU. He told me: "Five years ago, the climate modellers wanted nothing to do with the paleo community [scientist studying past climate]. But now they realise they need our data. We can help them define natural variability."

For many years, scientists like Briffa had been analysing the annual growth rings in ancient trees. It was an arcane discipline. They knew that in hot summers, trees grew more, leaving wider and denser growth rings that could be dated by simply counting backwards from the bark. All sorts of data began to emerge. They saw thin rings in trees around the world after major volcanic eruptions, but also longer-term trends visible only by assembling and averaging different data sets from tree ring studies round the word.

At the same time other analysts were producing other kinds of proxy climate data, from the size of glaciers and air bubbles trapped in ice, to the temperature imprint left in coral reefs and sediments in lakes and the temperature of water at different depths in deep boreholes.

Tim Barnett, then of the Scripps Institution of Oceanography, part of the University of California, San Diego, joined Jones to form a small group within the IPCC to mine this data for signs of global warming, ready to report in the next assessment due in 2001. "What we hope is that the current patterns of temperature change prove distinctive, quite different from the patterns of natural variability in the past," Barnett told me in 1996. Even then they were looking for a hockey stick.

Up stepped Mann, then at the University of Virginia. He and colleagues Ray Bradley and Malcolm Hughes began one of the first serious attempts to work out the average global temperature over the past millennium. Most tree-ring records were from Europe and North America. So Mann's team tried to build a more global picture by including proxies of different sorts from as many different regions as possible.

It was pioneering work, assembling and collating data that had never been put together before and aiming for a single graph of global temperature. They published their first graph, showing average temperatures in the northern hemisphere going back to AD 1400 in Nature in 1998. The following year the team extended the reconstruction back to AD 1000, relying on the few proxy records that go back this far. This 1999 version, published in the journal Geophysical Research Letters, was dubbed the "hockey stick" not by Mann but by Jerry Mahlman of the National Centre for Atmospheric Research in Boulder, Colorado.

The long straight shaft of the hockey stick was a surprise. Conventional climate histories recorded a much more wavey line, with a warm period in the medieval period around AD 1000, followed by a little ice age. Mann's explanation has always been that these phenomena were largely European and North Atlantic phenomena. They were not global. Indeed it was likely that if it was warmer in some places back then, it would be cooler in others.

But many tree ring researchers in particular doubted whether the graph had got it right. Initially Mann shared such concerns. The title of their 1999 paper, "Northern hemisphere temperature during the past millennium: inferences, uncertainties and limitations" was hardly bombastic.

Reconstructing past temperatures from proxy data is fraught with danger. Tree ring records, the biggest component of the hockey stick record, sometimes reflect rain or drought rather than temperature. When I investigated the continuing row surrounding the graph in 2006, Gordon Jacoby of Columbia University in New York, said: "Mann has a series from central China that we believe is more a moisture signal than a temperature signal... He included it because he had a gap. That was a mistake and it made tree-ring people angry." A large data set he used from bristlecone pines in the American west has attracted similar concern.

Deciding which data sets to include in such reconstructions was, if not arbitrary, then open to dispute. And dispute there was. In the late 1990s, the researchers in heated debate about what they could and could not reliably show about past temperatures, and how to represent their findings. And they were under pressure to "deliver" for the IPCC.

Decade that just got hotter

As the hockey stick began to appear in the scientific literature, it emerged that 1998 was the warmest year in Phil Jones's 150-year record of thermometer data. The length of the hockey stick blade just grew. Those in charge of publicising the work of climate scientists and making the case for man-made climate change were understandably excited. Controversial science swiftly morphed into a propaganda tool.

The World Meteorological Organization put the hockey stick on the cover of its 1999 report on climate change. Then IPCC chiefs decided to give it pride of place in their 2001 IPCC report. Moreover, based on the hockey stick, they stated that "it is likely that the 1990s was the warmest decade and 1998 the warmest year during the past thousand years". That attracted attention — and trouble. The doubts expressed in that paper title about "uncertainties and limitations" were melting away.

Emails exchanged in September 1999 reveal intense disagreement about whether Mann's hockey stick should go into the IPCC summary for policymakers – the only bit of the report that usually gets read outside the scientific community – or whether other reconstructions using tree ring data alone should get priority. One of the main tree-ring constructions was by Briffa. The emails also expose major tensions between a desire for scrupulous honesty about uncertainties, and the desire for a simple story to tell the policymakers. The IPCC's core job is to present a "consensus" on the science, but in this critical case there was no easy consensus.

The tensions were summed up in an email sent on 22 September 1999 by Met Office scientist Chris Folland, in which he alerted key researchers that a diagram of temperature change over the past thousand years "is a clear favourite for the policy makers' summary"

But there were two competing graphs – Mann's hockey stick and another, by Jones, Briffa and others. Mann's graph was clearly the more compelling image of man-made climate change. The other "dilutes the message rather significantly," said Folland. "We want the truth. Mike [Mann] thinks it lies nearer his result." Folland noted that "this is probably the most important issue to resolve in chapter 2 at present."

Three hours after receiving Folland's response, Briffa sent a long and passionate email demanding caution over the use of Mann's hockey stick. "It should not be taken as read that Mike's series is THE CORRECT ONE," he warned. "I know there is pressure to present a nice tidy story as regards 'apparent unprecedented warming in a thousand years or more in the proxy data', but in reality the situation is not quite so simple... For the record, I believe that the recent warmth was probably matched about 1000 years ago... and that there is strong evidence for major changes in climate over the Holocene that require explanation and that could represent part of the current or future background variability of our climate." This last point is important. Briffa was saying not only that the hockey stick might not be right, but that any graph of the last thousand years could not be taken to represent the limits of natural variability.

The September spat was the last in a simmering row. Only hints appear in the published emails. But they underline the anger behind the scenes. In April 1999, Ray Bradley of the University of Massachusetts, a co-author of Mann on the hockey stick papers, was apologising for Mann's stance. "I would like to dissociate myself from Mike Mann's view...I find this notion quite absurd. I have worked with the UEA group for 20+ years and have great respect for them. As for thinking that is it 'better that nothing appear, than something unacceptable to us'... as though we are the gatekeepers of all that is acceptable in the world of paleoclimatology seems amazingly arrogant." The row concerned an article Briffa and colleague Tim Osborn were writing for Science magazine.

Days later, back from holiday, Jones laid into Mann: "You seem quite pissed off with us all in CRU... It is clear from the emails that this relates to the emphasis placed on a few words/phrases in Keith/Tim's Science piece. I've not seen the censored email that Ray has mentioned, but this doesn't seem to me the way you should be responding. We have disagreements, but we have never resorted to slanging one another off to a journal (as in this case)."

Mann, Jones and Briffa eventually settled their differences. And the hockey stick was given pride of place in the IPCC report. Folland says: "My recollection is that the final version [of the IPCC summary], which contains the hockey stick, satisfied Keith and everyone else in the end — after the usual vigorous scientific debate." And after the three came under attack from climate sceptics, all reference to these past spats disappeared from the emails as they faced a common foe.HIc


guardian.co.uk © Guardian News & Media Limited 2010 | Use of this content is subject to our Terms & Conditions | More Feeds

The Guardin - Hacking RSSPart two: How the 'climategate' scandal is bogus and based on climate sceptics' lies

Claims based on email soundbites are demonstrably false – there is manifestly no evidence of clandestine data manipulation

In a unique experiment, The Guardian has published online the full manuscript of its major investigation into the climate science emails stolen from the University of East Anglia, which revealed apparent attempts to cover up flawed data; moves to prevent access to climate data; and to keep research from climate sceptics out of the scientific literature.

As well as including new information about the emails, we will allow web users to annotate the manuscript to help us in our aim of creating the definitive account of the controversy. This is an attempt at a collaborative route to getting at the truth.

We hope to approach that complete account by harnessing the expertise of people with a special knowledge of, or information about, the emails. We would like the protagonists on all sides of the debate to be involved, as well as people with expertise about the events and the science being described or more generally about the ethics of science. The only conditions are the comments abide by our community guidelines and add to the total knowledge or understanding of the events.

The annotations - and the real name of the commenter - will be added to the manuscript, initially in private. The most insightful comments will then be added to a public version of the manuscript. We hope the process will be a form of peer review. If you have a contribution to make, please email climate.emails@guardian.co.uk.

The anonymous commenting facility under each article will also be switched on so that anyone can contribute to the debate.


Almost all the media and political discussion about the hacked climate emails has been based on soundbites publicised by professional sceptics and their blogs. In many cases, these have been taken out of ­context and twisted to mean something they were never intended to.

Elizabeth Green, veteran head of the Canadian Green party, claims to have read all the emails and declared: "How dare the world's media fall into the trap set by ­contrarian propagandists without reading the whole set?"

If those journalists had read even a few words beyond the soundbites, they would have realised that they were often being fed lies. Here are a few examples.

The most quoted soundbite in the affair comes from an email from Prof Phil Jones, director of the Climatic Research Unit at the University of East Anglia, to Prof Mike Mann of the University of Virginia in 1999, in which he discussed using "Mike's Nature trick" to "hide the decline". The phrase has been widely spun as an effort to prevent the truth getting out that global temperatures had stopped rising.

The Alaska governor Sarah Palin, in the Washington Post on 9 December, attacked the emailers as a "highly politicised scientific circle" who "manipulated data to 'hide the decline' in global temperatures". She was joined by the Republican senator James Inhofe of Oklahoma – who has for years used his chairmanship of the Environment and Public Works Committee to campaign against climate scientists and to dismiss anthropogenic global warming as "the greatest hoax ever perpetrated on the American people". During the Copenhagen climate conference, which he attended on a Senate delegation, he referred to Jones's "hide the decline" quote and said: "Of course, he means hide the decline in temperatures."

This is nonsense. Given the year the email was written, 1999, it cannot be anything of the sort. At that time there was no suggestion of a decline in temperatures. The previous year was the warmest on record. The full email from Jones says: "I've just completed Mike's Nature trick of adding in the real temps to each series for the last 20 years (ie from 1981 onwards) and from 1961 for Keith [Briffa]'s, to hide the decline."The decline being referred to was an apparent decline in temperatures shown in analysis of tree rings, which have historically correlated well with changes in temperature. That relationship has broken down in the past half century. The reasons are still debated.

The "trick" was a graphic device used by Mann in a 1998 paper in Nature to merge tree ring data from earlier times with thermometer data for recent decades. He explained it in the paper. Jones was repeating it in another paper. "This is a trick only in the sense of being a good way to deal with a vexing problem," Mann told the Guardian. Clearly, this problem with modern tree data raises questions about older data – at least until the reason for the divergence is nailed down. But it is not clandestine data ­manipulation, or, as claimed by Palin and Inhofe, a trick to hide global cooling. That charge is a lie.

While he was in Copenhagen, Inhofe made a link between the "trick" to "hide the decline" and the second most popular soundbite. He said that "of course [Jones] meant hide the decline in temperatures, which caused another scientist, Kevin Trenberth of the National Centre for Atmospheric Research in Boulder, Colorado, to write: 'The fact is we can't account for the lack of warming at the moment and it is a travesty that we can't.'"

The link is bogus. The two emails were 10 years apart. Unlike Jones, Trenberth's remark from October 2009 was indeed about the slackening of the warming trend that some like to interpret as cooling. That much is agreed. But Inhofe and other sceptics latched on to Trenberth's "travesty" phrase as a revelation that scientists were trying to keep cooling secret because it undermined their arguments about global warming.

Again this is demonstrably false. Nothing was hidden. For months, Trenberth had been discussing publicly his concerns about the inability of scientists to pin down the precise reason for the "absence of warming" since 1998. He had argued in the journal Current Opinion in Environmental Stability in early 2009 that "it is not a sufficient explanation to say that a cool year [he had 2008 in mind] is due to natural variability (pdf)". Such explanations "do not provide the physical mechanisms involved". This was the "travesty" he was referring to in his email. He wanted scientists to do better.He said the best way to improve the explanation and make it more specific was to make better measurements of the planet's energy budget. This would allow scientists to distinguish between any changes in the greenhouse effect, which would result in more or less heat overall in the atmosphere and oceans, and short-term natural cycles of variability, which merely redistribute heat. He was debating this with the former head of the Climatic Research Unit Tom Wigley, who took a different view. But their genuine scientific discussion has, since the publication of the emails online, been hijacked by ignorant or malicious invective.

Several other soundbites were subject to perverse or dishonest interpretations by commentators. Patrick Michaels, the climatologist and polemicist for the rightwing Cato Institute, published a long op-ed piece in the DC Examiner, slamming Mann for an email quote about keeping sceptics' papers out of the IPCC report "even if we have to redefine what the peer-reviewed literature is".

Michaels is an old foe of Mann's, but this genuinely damaging statement was actually made by Jones.

In another case George Will, celebrated in some circles as an intellectual, told ABC's This Week programme that Mann had said in an email that he wished to "delete, get rid of, the medieval warming period". No such words appear anywhere in the emails. What Mann said was that "it would be nice to try to 'contain' the putative 'MWP'". And an intellectual like Will should have known that, in this context, "contain" means to understand its dimensions – how warm it was and how long it was. Mann explained as much to anyone who asked. Verdict: not guilty.


guardian.co.uk © Guardian News & Media Limited 2010 | Use of this content is subject to our Terms & Conditions | More Feeds

The Guardin - Hacking RSSPart four: Climate change debate overheated after sceptics grasped 'hockey stick'

Steve McIntyre pursued graph's creator Michael Mann, but replication of his temperature spike has earned him credibility

In a unique experiment, The Guardian has published online the full manuscript of its major investigation into the climate science emails stolen from the University of East Anglia, which revealed apparent attempts to cover up flawed data; moves to prevent access to climate data; and to keep research from climate sceptics out of the scientific literature.

As well as including new information about the emails, we will allow web users to annotate the manuscript to help us in our aim of creating the definitive account of the controversy. This is an attempt at a collaborative route to getting at the truth.

We hope to approach that complete account by harnessing the expertise of people with a special knowledge of, or information about, the emails. We would like the protagonists on all sides of the debate to be involved, as well as people with expertise about the events and the science being described or more generally about the ethics of science. The only conditions are the comments abide by our community guidelines and add to the total knowledge or understanding of the events.

The annotations - and the real name of the commenter - will be added to the manuscript, initially in private. The most insightful comments will then be added to a public version of the manuscript. We hope the process will be a form of peer review. If you have a contribution to make, please email climate.emails@guardian.co.uk.

The anonymous commenting facility under each article will also be switched on so that anyone can contribute to the debate.


After the publication of the IPCC report in 2001, the controversy about the hockey stick spread beyond the science community. Political opponents of climate scientists cried foul, and they have stayed on Michael Mann's trail for years.

Republican senator James Inhofe of Oklahoma, who calls global warming a "hoax", repeatedly attacked the Penn State University professor's hockey stick graph. In 2005, Congressman Joe Barton of Texas ordered Mann to provide the House Committee on Energy and Commerce, which he chaired, with extensive details of his working procedures, computer programs and past funding. "There are people who believe that if they bring down Mike Mann, they can bring down the IPCC," Ben Santer of the Lawrence Livermore Laboratory in California told me at the time.

Mann's voluble, self-confident style did not help matters. "The goddam guy is a slick talker and super-confident. He won't listen to anyone else," one of climate science's most senior figures, Wally Broecker of the Lamont-Doherty Earth Observatory at Columbia University in New York, told me. "I don't trust people like that. A lot of the data sets he uses are shitty, you know. They are just not up to what he is trying to do.... If anyone deserves to get hit it is goddam Mann."

It should be said that Broecker has a reputation among some scientists for bad-mouthing young researchers.

The temperature of the debate soared in 2003 with the intervention of Canadian sceptic Steve McIntyre and his economist co-author Ross McKitrick of the University of Guelph. In a paper published in what was becoming the house journal of the sceptics, Energy and Environment, McIntyre and McKitrick widened the attack on the hockey stick by calling into question the statistical methods employed by Mann to amalgamate his different data sets. They even suggested that the hockey stick was entirely an artefact of those methods.

Mann replied in kind. The emails reveal that he heard about the "M&M" paper for the first time the day before it was published. He was angry that the journal had not asked him to review the paper, or at least comment on it, before publication. He put his friends on attack alert. "My suggested response is to dismiss this as a stunt appearing in a 'journal' already known to have defied standard practices of peer-review. It is clear, for example, that nobody we know has been asked to 'review' this so-called paper... the claim is nonsense."

He went on: "Who knows what sleight of hand the authors have pulled. Of course the usual suspects are going to try to peddle this crap. The important thing is to deny that this has any intellectual credibility whatsoever."

In an ironic twist, he appended the anonymous note that had alerted him to the paper, apparently after being distributed among several scientists. It said that, far from being nonsense, the M&M paper reveals what "was known by most people who understand Mann's methodology [that] it can be quite sensitive to the input data in the early centuries." It went on: "There's going to be a lot of noise about this one, and knowing Mann's very thin skin, I am afraid he will react strongly, unless he has learned (as I hope he has) from the past..."

M&M's statistical complaint was that the analysis Mann pioneered, in which different proxy records are merged, involved sorting and aggregating these signals and smoothing the result. It had the effect of flattening the hockey stick shaft. Any graph of real temperatures would have been much less smooth. That was reasonable when all the data used along the graph had been subjected to the same smoothing. But, they complained, if you then added a graph of real temperatures onto the end, to cover the final decades, it gave a misleading impression. Because there was no smoothing in this real data. Their point was that the shaft had been smoothed, but the blade had not. If a few decades of unusually warm temperature had showed up in, say, the 11th century they might have been smoothed away to nothing.

Mann didn't try to hide this in his papers. He put in error bars above and below the main line on his graph, showing how much temperature change the smoothing might have removed. He was among the first paleoclimatologists to do this. What is noticeable is that the error bars are huge. Most of the "blade" of 20th century warming would have fitted within the errors. It wasn't his fault that in future renditions, those very wide error bars sometimes disappeared.

Another criticism was that Mann analysed temperatures in terms of their divergence from the 20th-century mean. Mann agrees this would have highlighted differences from that period and accentuated any hockey stick shape. When M&M repeated Mann's analysis using different statical methods they said they found a big rise in temperatures in the middle ages.

Finally, and perhaps most troublingly, M&M raised questions about the reliability of tree rings as a measure of temperature at all. Tree ring analysts are pretty sure that from the mid-19th century, when we have useable thermometer data, through to the mid-20th century, the width of rings faithfully represents real temperatures. Some detail is lost but the overall measure is good. But since around 1960, a "divergence" problem has emerged. Most tree ring data sets do not reflect the warming seen in thermometer readings (and indeed in nature, as glaciers melt, sea ice disappears, springs come earlier and so on).

Most scientists believe this divergence is a result of some other human-caused factor, but nobody is sure what. And until that is clear, there must be a question mark over the reliability of tree ring data for eras before we have thermometers. In fact this criticism ought to make Mann's hockey stick, which uses a range of different proxies, more reliable than temperature reconstructions based solely on tree rings. And, while the emphasis has mostly been on the probity of Mann's hockey stick, most researchers I have spoken to regard the M&M study as far more deeply flawed. They say it also includes subjective decisions about choice of data sets that seem hard to explain.

There are two take-home questions from this complex saga. Was Mann wrong to do as he did? And did it make any difference to his findings? In the aftermath of the M&M attack on Mann, a number of groups of researchers scrutinised the competing claims.

Hans von Storch of the GKSS Research Centre in Geesthacht, Germany, concluded that M&M were right to say that temperatures should be analysed relative to the 1,000-year mean, not the 20th-century mean. But he also found that even when this was done, it did not have much effect on the result. This didn't stop Mann bad-mouthing von Storch's work in a succession of emails through 2005.

Meanwhile, two people closer to Mann — Caspar Ammann of the National Centre for Atmospheric Research in Boulder, Colorado and Eugene Wahl of Alfred University, New York — claimed that most of the difference between the findings of Mann and M&M had nothing to do with statistical methods. M&M had not "repeated" Mann's study as they claimed. In fact they had done a different study, leaving out some of the sets of tree-ring data that Mann included. In particular, they had excluded tree-ring studies based on ancient bristlecone pines in the south-west of the US. "Basically, the M&M case boiled down to whether selected North American tree rings should have been included, and not that there was a mathematical flaw in Mann's analysis," Ammann told me in 2006.

Interestingly, McKitrick now says he partially agrees. In a newspaper article in the Canadian Financial Post in October 2009, while still complaining that Mann's statistical methods skewed the data, he said of the hockey stick "its shape was determined by suspect bristlecone tree ring data."

Mann has always accepted that his graph was work in progress, and most researchers in the field accept that he is honest if hot-headed. "I'm not slamming what he did overall. It was a great effort, a great step," Jacoby told me in 2005. "But he got into hot water by defending it too hard in places where he shouldn't." But there is a troublingly arbitrary nature about temperature reconstructions when the choices made about which data to include and which not seem often to be based on researchers' hunches. However honest, they are open to the charge of cherry-picking their data. That applies as much to M&M as to Mann.

What counts in science, however, is not a single study. It is whether its finding can be replicated by others. Here Mann has been on a winning streak. Upwards of a dozen studies, using different statistical techniques or different combinations of proxy records, have produced reconstructions broadly similar to the original hockey stick. These reconstructions all have a hockey stick shaft and blade. While the shaft is not always as flat as Mann's version, it is present. Almost all support the main claim in the IPCC summary: that the 1990s was then probably the warmest decade for 1000 years.

A decade on, Mann's original work emerges remarkably unscathed. Briffa's more recent reconstructions are closer to Mann's than those he had in the late 1990s. Folland says: "The Mann work still stands."

McIntyre remains unimpressed. "There is a distinct possibility that researchers have either purposefully or subconsciously selected series with the hockey stick shape," he says.

McKitrick similarly insists that there is a cabal of paleoclimatologists who have their favourite data sets that produce the required shape. In the Financial Post he singled out dodgy data from the US bristlecone pines and another set of tree rings from the remote Yamal peninsula in Siberia. He said they occurred in so many studies that they skewed the lot.

This is not so. The Yamal tree rings were not in the famous hockey sticks of the late 1990s. They were not even published then. According to Jones, of the 12 reconstructions of temperature over the past thousand years used in the last IPCC assessment, only three contained Yamal data.

In 2006, the US National Academy of Sciences published the results of a long inquiry into Mann's findings, triggered by a request from Congress. It upheld most of Mann's findings, albeit with some caveats. "There is sufficient evidence... of past surface temperatures to say with a high level of confidence that the last few decades of the 20th century were warmer than any comparable period in the last 400 years. Less confidence can be placed in proxy-based reconstructions of surface temperatures for AD 900 to 1600, although the available proxy evidence does indicate that many locations were warmer during the past 25 years than during any other 25-year period since 900."

It agreed that there were statistical failings of the kind highlighted by M&M, but like von Storch it found that they had little effect on the overall result. One panel member, Kurt Cuffey of the University of California at Berkeley, reserved his criticism for the way the graph had been used by the IPCC. "I think that sent a very misleading message about how resolved this part of the scientific research was," he said. In retrospect, Mann rather agrees. "Given its place in the IPCC summary with the uncertainties not even shown, we were a target from the beginning," he admitted to me later.

The hockey stick, a pioneering piece of work in progress, became victim of the notoriety it gained from being included in the IPCC summary. And of course its catchy title.

"The label was always a caricature and it became a stick to beat us with," Mann said later. Was it flawed research? Yes. Was it hyped by the IPCC? Yes. Has it been disproved? Despite all the efforts, no. So far, it has survived the ultimate scientific test of repeated replication.


guardian.co.uk © Guardian News & Media Limited 2010 | Use of this content is subject to our Terms & Conditions | More Feeds

The Guardin - Hacking RSSPart nine: Climate scientists withheld Yamal data despite warnings from senior colleagues

Ancient trees dragged from frozen Siberian bogs do not undermine climate science, despite what the sceptics say

In a unique experiment, The Guardian has published online the full manuscript of its major investigation into the climate science emails stolen from the University of East Anglia, which revealed apparent attempts to cover up flawed data; moves to prevent access to climate data; and to keep research from climate sceptics out of the scientific literature.

As well as including new information about the emails, we will allow web users to annotate the manuscript to help us in our aim of creating the definitive account of the controversy. This is an attempt at a collaborative route to getting at the truth.

We hope to approach that complete account by harnessing the expertise of people with a special knowledge of, or information about, the emails. We would like the protagonists on all sides of the debate to be involved, as well as people with expertise about the events and the science being described or more generally about the ethics of science. The only conditions are the comments abide by our community guidelines and add to the total knowledge or understanding of the events.

The annotations - and the real name of the commenter - will be added to the manuscript, initially in private. The most insightful comments will then be added to a public version of the manuscript. We hope the process will be a form of peer review. If you have a contribution to make, please email climate.emails@guardian.co.uk.

The anonymous commenting facility under each article will also be switched on so that anyone can contribute to the debate.


It is hard to believe that tree trunks dragged from frozen bogs in Siberia could undermine the argument about man-made climate change. But that is the claim that has been made by sceptics in recent months.

The claim is wide of the mark, but in the 1,073 emails stolen from the University of East Anglia last November the row over what the trees tell us about climate change is played out in detail. The scientists are shown clinging to their data to prevent it getting into the hands of sceptics even as at least one colleague advised openness to avoid the charge that "bogus science" was being hidden.

Measuring the width of annual growth rings in trees is a sensitive measure of temperatures. And the secrets of those Siberian trees, some of them thousands of years old, have assumed an important place in the reconstruction of past temperatures for the whole planet.

Steve McIntyre, a Canadian former minerals prospector and climate sceptic who has analysed the data, suggests that one tree, known as YAD06, could be "the most influential tree in the world".

In the hacked emails from the Climatic Research Unit at UEA, one word looms large: Yamal. The first and last emails and more than a hundred in between include it. When I phoned Prof Phil Jones, the director of CRU, on the day the emails were published online, he said: "It's about Yamal, I think."

On 6 March 1996, a Russian scientist, Stepan Shiyatov, contacted Dr Keith Briffa, CRU's top tree-ring researcher. Shiyatov wanted money to take a helicopter to measure tree rings in timber hauled from the permafrost of the Yamal peninsula on the Arctic ocean's shores.

Briffa was keen, and he published papers on what those tree rings showed. But by late last year, in the final emails, he is mired in allegations of fraud, and the Yamal data had become a virus infecting past climate reconstructions.

The Yamal data turned up in many studies of global temperature that were cited by the UN's top climate science body, the Intergovernmental Panel on Climate Change, in a report published in 2007, where the relevant section was authored by Briffa. It supported the conclusion that temperatures followed a "hockey stick" shape, with stable temperatures for a thousand years, then sharp 20th-century warming.

By then, McIntyre was on the trail. He claimed that Briffa had not used all the tree ring data available, only a subset. Briffa said there were technical reasons for that. But McIntyre complained Briffa hadn't spelled out those reasons clearly.

In 2008, when Briffa published some data after a long delay, McIntyre charged that Briffa's analysis of the most recent warming was based on just 12 trees: the "Yamal-12". McIntyre said this was too small a sample to draw any conclusions, and claimed if the analysis was redone with other tree ring data from the region, the hockey stick shape disappeared.

It looked like a stalemate. But last year the bloggers moved in. Ross Kaminsky, a columnist on American Spectator, claimed: "One implication, supported by Briffa's near decade-long refusal to share his data, is that he cherry-picked the dataset that supported the conclusion he wanted to find."

Worse was the charge that other scientists had used the suspect Yamal data in their reconstructions of past climate. Ross McKitrick, a climate sceptic and environmental economist at Canada's University of Guelph, wrote that they are "the key ingredient in most of the studies that have been invoked to support the hockey stick". The Daily Telegraph blogger James Delingpole went even further in an article headlined: "How the global warming industry is based on one MASSIVE lie."

Briffa denies any wrongdoing. He said "we would never select or manipulate data in order to arrive at some preconceived or unrepresentative result". And there is nothing in the emails or anywhere else to suggest that isn't true. In September last year Briffa put out a statement on the CRU website defending his research. "We do not select tree-core samples based on comparison with climate data. Chronologies are constructed independently and are subsequently compared with climate data to measure the association and quantify the reliability of using the tree-ring data as a proxy for temperature variations."

One British colleague of Briffa wrote to me last month: "Why should Briffa – one of the world leaders in this field – have to explain himself to people … who are in fact amateurs?"

But others believe Briffa has a duty to explain himself. In October last year, Briffa's old boss at CRU, Tom Wigley, said in an email to Briffa's current boss, Phil Jones: "Keith does seem to have got himself into a mess." Wigley felt Briffa had not answered McIntyre's charges fully. "How does Keith explain the McIntyre plot that compares Yamal-12 with Yamal-all? And how does he explain the apparent 'selection' of the less well-replicated chronology rather than the later (better replicated) chronology? …

"The trouble is that withholding data looks like hiding something, and hiding something means (in some eyes) that it is bogus science that is being hidden."

The Yamal data has become important for scientists trying to analyse past climates. But it is not true that the Yamal rings are omnipresent in climate reconstructions. They were not in the data that produced the "hockey stick" graphs. According to Jones, of the 12 reconstructions of temperatures over the past 1,000 years used in the last IPCC assessment, only three included Yamal data. Other reconstructions were based on retreating glaciers, or water temperatures in boreholes, or core sunk into ice sheets – but they too reproduce a hockey stick shape.

Even McIntyre denounces the more vocal sceptics with their conspiracy theories. In an apparent response to a challenge from the climate scientists' website RealClimate, he wrote to the American Spectator last October: "While there is much to criticise in the handling of this [Yamal] data, the results do not in any way show that AGW [anthropogenic global warming] is a 'fraud', nor that this particular study was a 'fraud'. There are many serious scientists who are honestly concerned about AGW and your commentary … is unfair to them." Sadly, when checked last week, there was no sign of this comment on the magazine website, though the magazine had found room for another feature on "The great hoax" of climate change.


guardian.co.uk © Guardian News & Media Limited 2010 | Use of this content is subject to our Terms & Conditions | More Feeds

The Guardin - Hacking RSSPart eight: Climate scientists contradicted spirit of openness by rejecting information requests

Hacked emails reveal systematic attempts to block requests from sceptics — and deep frustration at anti-global warming agenda

In a unique experiment, The Guardian has published online the full manuscript of its major investigation into the climate science emails stolen from the University of East Anglia, which revealed apparent attempts to cover up flawed data; moves to prevent access to climate data; and to keep research from climate sceptics out of the scientific literature.

As well as including new information about the emails, we will allow web users to annotate the manuscript to help us in our aim of creating the definitive account of the controversy. This is an attempt at a collaborative route to getting at the truth.

We hope to approach that complete account by harnessing the expertise of people with a special knowledge of, or information about, the emails. We would like the protagonists on all sides of the debate to be involved, as well as people with expertise about the events and the science being described or more generally about the ethics of science. The only conditions are the comments abide by our community guidelines and add to the total knowledge or understanding of the events.

The annotations - and the real name of the commenter - will be added to the manuscript, initially in private. The most insightful comments will then be added to a public version of the manuscript. We hope the process will be a form of peer review. If you have a contribution to make, please email climate.emails@guardian.co.uk.

The anonymous commenting facility under each article will also be switched on so that anyone can contribute to the debate.


Few scientists realised that freedom of ­information laws being introduced in ­Britain, the US and elsewhere would impinge strongly on their work. But one who did was Dr Phil Jones, the man at the centre of the fallout from the emails stolen from the ­University of East Anglia. Thanks to his brushes with climate ­sceptics, he knew that the laws would put new ­powers in their hands.

The emails reveal repeated and ­systematic attempts by him and his ­colleagues to block FoI requests from climate sceptics who wanted access to emails, documents and data. These moves were not only contrary to the spirit of ­scientific openness, but according to the government body that administers the FoI legislation were "not dealt with as they should have been under the legislation".

But the emails also reveal deep and understandable frustration among the scientists at the huge amount of time and energy they were being asked to give up to deal with the requests. This was particularly galling as the sceptics making the requests were, in the scientists' eyes, more interested in picking holes in their analyses to suit an anti-global warming agenda than advancing human knowledge.

Jones foresaw that his arch-inquisitor, the Canadian former minerals ­prospector and editor of the sceptic blog Climate Audit, Steve McIntyre, would be a thorn in his side. As long ago as 2005, before the incoming legislation had been tested in Britain, Jones was laying out his uncompromising views on protecting "his" data. In a note to the prominent US climate scientist Michael Mann in February that year, he noted that "the two MMs", McIntyre and his co-author the Canadian environmental economist Ross McKitrick, "have been after the CRU station data for years. If they ever hear there is a Freedom of Information Act now in the UK, I think I'll delete the file rather than send to anyone."

Later, in 2007, Jones told his Chinese-American colleague Wei-Chyung Wang and Thomas Karl, director of the US government's National Climate Data Centre: "Think I've managed to persuade UEA to ignore all further FoI requests if the people have anything to do with Climate Audit." In December 2008 he wrote in an email to Ben Santer at the Lawrence Livermore National Laboratory in California: "When the FoI requests began here, the FoI person said we had to abide by the requests. It took a couple of half-hour sessions – one at a screen – to convince them otherwise, showing them what CA [Climate Audit, McIntyre's website] was all about. Once they became aware of the type of people we were dealing with, everyone at UEA … became very supportive."

By and large, the records show, these requests were turned down. Of 105 requests concerning the Climatic Research Unit up to December 2009, the university refused 77, accepted six in part, had 11 outstanding, and had only 10 released in full. One was withdrawn.

In May 2008 CRU received an FoI request from David Holland, an electrical engineer from Northampton, for all emails sent and received by its tree-ring specialist, Keith Briffa, relating to the IPCC fourth assessment of climate science (AR4)published the year before. The IPCC archives its formal review exchanges and puts that material online but Holland wanted to see emails between scientists about IPCC text conducted ­outside that process. Subsequent CRU emails discussed ways of avoiding ­complying with the request.

They decided some emails had not come via IPCC and could be ignored as ­outside the terms of the request, for instance. Jones noted: "If only Holland knew how the process really worked!!"

By 2008 the scientists had become used to dealing with, and usually rebuffing, requests for data. But this demand for their emails heightened their alarm. Days after receiving the request, Jones sent one of the most damaging emails to emerge from the leak. He asked Mann: "Can you delete any emails you may have had with Keith [Briffa] re AR4? Keith will do likewise. Can you also email Gene [Eugene Wahl, a paleoclimatologist at the National Centre for Atmospheric Research in Boulder, Colorado] and get him to do the same … we will be getting Caspar [Ammann also from NCAR] to do the same."

This seems to have been the email that persuaded the UK's Information ­Commissioner's Office (ICO) – the body that administers the FoI act – its handling of requests was not correct. The deputy information commissioner, Graham Smith, put out a statement last week which said: "The emails which are now public reveal that Mr Holland's requests under the Freedom of Information Act were not dealt with as they should have been under the legislation. Section 77 of the Freedom of Information Act makes it an offence for public authorities to act so as to prevent intentionally the disclosure of requested information." He said the ICO could not take action over the apparent breach because it occurred more than six months ago.

There was more in a similar vein. That month Jones also wrote to Bradley, saying: "You can delete this attachment [probably Holland's FoI request] if you want. Keep this quiet also but this is the person who is putting FoI requests for all emails Keith and Tim have written and received re Ch 6 of AR4. We think we've found a way around this."

The emailers took the view that, ­whatever the status of data, personal emails were sacrosanct. As Briffa told Ammann a month later: "Our private inter-collegial discussion is just that – PRIVATE … submitting to these demands undermines the wider scientific ­expectation of personal confidentiality … none of us should submit to these requests."

Holland says the emails reveal "a deliberate attempt to destroy info which has been properly requested".

One device for withholding the IPCC emails, revealed in the leaked emails, was to say that IPCC documents were not covered by British law. The University of East Anglia now says that no emails were deleted after this exchange. But seven months later, in December 2008, Jones revealed in an email to Santer discussing McIntyre: "If he pays £10 (which he hasn't yet) I am supposed to go through my emails and he can get anything I've written about him. About two months ago I deleted loads of emails, so have very little – if anything at all."

Mass deletion

It is not clear that this mass deletion (if indeed it happened) was done to avoid FoI requests. Jones has been quoted elsewhere as saying: "We haven't deleted any emails. I delete my own personal emails a year at a time regardless of subject as I have too many, but the university still has the emails." Indeed so, as it transpired.

In any case, the ICO apparently advised UEA that some requests for information did not have to be granted. Jones wrote to the Nasa climatologist Gavin Schmidt in August 2008: "All our FoI officers have been in discussions and are now using the same exceptions not to respond – advice they got from the information commissioner."

During 2008 the debate among the emailers grew about coping with the rising tide of FoI requests. Most saw them as a threat to their work – not because they would uncover fraud, but because they took up their time.

Schmidt, one of the hosts of the RealClimate website, wrote consolingly to Santer in December 2008 about dealing with McIntyre: "There are two very different things going on here. One is technical and related to the actual science … the second is political. The second is the issue here … whatever you say, it will still be presented as you hiding data. The contrarians have found that there is actually no limit to what they can ask people for (raw data, intermediate steps, additional calculations, residuals, sensitivity calculations, all the code, a workable version of the code on any platform etc) and like Somali pirates they have found that once someone has paid up, they can always shake them down again."

Others wanted to give some ground. The Stanford University climatologist Dr Stephen Schneider, who runs the journal Climate Change, wrote a round-robin to scientists in January 2009 in which he agreed that "this continuing pattern of harassment … in the name of due diligence is in my view an attempt to create a fishing expedition to find minor glitches or unexplained bits of code – which exist in nearly all our kinds of complex work – and then assert that the entire result is thus suspect."

But Schneider argued that researchers should give enough data and information on their sources and methods so that those "who are scientifically capable can do their own brand of replication work, but that does not extend to personal computer codes with all their undocumented sub-routines etc."

Even so, he felt "it would be odious requirement [sic] to have scientists document every line of [computer] code so outsiders could just apply them instantly. Not only is this an intellectual property issue, but it would dramatically reduce our productivity since we are not in the business of producing software products for general consumption and have no resources to do so." Presciently, he added: "Good luck with this, and expect more of it as we get closer to international climate policy actions. We are witnessing the 'contrarian battle of the bulge' now and expect that all weapons will be used."

Nightmare prospect

In retrospect, it was clear that things were coming to a head by 2009. Freedom of information requests were piling up. The scientists were increasingly angered at how long it was taking to fend them off. Let alone what they regarded as the nightmare prospect of having to deliver the data being requested. And, no doubt, the further scientific questions that would arise once the sceptics dug their teeth into the data. As the scientists resisted, anger grew among their critics.

At the end of August 2009, an amateur sceptic called Rupert Wyndham spotted that earlier in the year Jones had been made a fellow of the American Geophysical Union, which published many of his papers. He assembled an international group of sceptics from 10 countries and wrote to the AGU's top atmospheric scientist, Alan Robock, to complain. He accused Jones of a range of data crimes. "Honouring a man who consistently breaches the fundamental protocols of scientific method casts a stain on the reputation of the AGU," they wrote. Signatories included Sonja Boehmer-Christiansen, editor of Energy and Environment, Jones's least favourite journal, and Martin Durkin, the British TV producer notorious for his programme The Great Global Warming Swindle.

Meanwhile stories began to circulate outside the university about how CRU was resisting legitimate requests from McIntyre. In early July 2009, when I asked Jones about this, he told me: "McIntyre has no interest in deriving his own global temperature series. He just wants to pick holes in those who do. He wants not only the original station data, but details of all the adjustments we have made over the years. It's just time-wasting." But Jones didn't know what was about to hit him.

The day after the rejection of his demand for the station data, McIntyre announced that a "mole" had sent him a full set of the station data. He published some, from Lund in Sweden between 1753 and 1773 – "sensitive information indeed", he noted on his Climate Audit blog. The following day he claimed on the blog that the mole had been identified. Later McIntyre admitted there was no mole and he had simply found the material. According to a subsequent article in Nature, McIntyre had stumbled on "ftp" files containing station data that was intended to be shared only by CRU's partners at the Met Office. CRU immediately removed the data from its website, leading to charges from McIntyre that they were engaged in a "purge".

Meanwhile, according to Nature's climate blogger Olive Heffernan, "between 24 and 29 July, CRU received 58 FoI requests from McIntyre and people affiliated with Climate Audit … the Met Office, which receives a cleaned-up version of the raw data from CRU, has received 10 requests of its own."

With the threat of a "mole" in their midst, climate scientists outside CRU grew wary that their correspondence was not as secure as they might like. In September 2009 Jonathan Overpeck of Arizona University warned colleagues in an email: "Please write all emails as though they will be made public."

In early July McIntyre appealed against being refused the station data, but was turned down by the university's director of information services, Jonathan Colam-French, in a letter dated 13 November, that McIntyre says he received on the 18th.

McIntyre says the timing may be ­significant here. The first attempt to put online the file containing the CRU emails happened on the morning of Tuesday the 17th. It contained emails up to the 12th. McIntyre says he believes this shows the leak was probably an "inside job" by an aggrieved employee or student angry about the secrecy over CRU's data.

Whoever carried out the hack, there is an irony for Jones and UEA buried in Jones's 2005 correspondence with Mann over the potential for a FoI Act in which he flagged up what a useful tool it would be for the sceptics. Advising Mann on how to avoid a security breach involving sensitive data that was left unprotected on an ftp (file transfer protocol) server, Jones wrote: "Don't leave stuff lying around on ftp sites – you never know who is trawling them."


guardian.co.uk © Guardian News & Media Limited 2010 | Use of this content is subject to our Terms & Conditions | More Feeds

The Guardin - Hacking RSSPart six: Emails reveal strenuous efforts by climate scientists to 'censor' their critics

Peer review has been put under strain by conflicts of interest that would not be allowed in most professions

In a unique experiment, The Guardian has published online the full manuscript of its major investigation into the climate science emails stolen from the University of East Anglia, which revealed apparent attempts to cover up flawed data; moves to prevent access to climate data; and to keep research from climate sceptics out of the scientific literature.

As well as including new information about the emails, we will allow web users to annotate the manuscript to help us in our aim of creating the definitive account of the controversy. This is an attempt at a collaborative route to getting at the truth.

We hope to approach that complete account by harnessing the expertise of people with a special knowledge of, or information about, the emails. We would like the protagonists on all sides of the debate to be involved, as well as people with expertise about the events and the science being described or more generally about the ethics of science. The only conditions are the comments abide by our community guidelines and add to the total knowledge or understanding of the events.

The annotations - and the real name of the commenter - will be added to the manuscript, initially in private. The most insightful comments will then be added to a public version of the manuscript. We hope the process will be a form of peer review. If you have a contribution to make, please email climate.emails@guardian.co.uk.

The anonymous commenting facility under each article will also be switched on so that anyone can contribute to the debate.


Scientists sometimes like to portray what they do as divorced from the everyday jealousies, rivalries and tribalism of human relationships. What makes science special is that data and results that can be replicated are what matters and the scientific truth will out in the end.

But a close reading of the emails hacked from the University of East Anglia in November exposes the real process of everyday science in lurid detail.

Many of the emails reveal strenuous efforts by the mainstream climate scientists to do what outside observers would regard as censoring their critics. And the correspondence raises awkward questions about the effectiveness of peer-review - the supposed gold standard of scientific merit - and the operation of the UN's top climate body, the Intergovernmental Panel on Climate Change (IPCC).

The scientists involved disagree. They say they were engaged not in suppressing dissent but in upholding scientific standards by keeping bad science out of peer-reviewed journals. Either way, when passing judgment on papers that directly attack their own work, they were mired in conflicts of interest that would not be allowed in most professions.

The cornerstone of maintaining the quality of scientific papers is the peer review system. Under this, papers submitted to scientific journals are reviewed anonymously by experts in the field. Conducting reviews is seen as part of the job for academics, who are generally not paid for the work.

The papers are normally sent back to the authors for improvement and only published when the reviewers give their approval. But the system relies on trust, especially if editors send papers to reviewers whose own work in being criticised in the paper. It also relies on anonymity, so reviewers can give candid opinions.

Cracks in the system have been obvious for years. Yesterday it emerged that 14 leading researchers in a different field - stem cell research - have written an open letter to journal editors to highlight their dissatisfaction with the process. They allege that a small scientific clique is using peer review to block papers from other researchers. Many will see a similar pattern in the emails from UEA's Climatic Research Unit, which brutally expose what happens behind the scenes of peer review and how a chance meeting at a barbeque years earlier had led to one journal editor being suspected of being in the "greenhouse sceptics camp".

The head of the CRU, Professor Phil Jones, as a top expert in his field, was regularly asked to review papers and he sometimes wrote critical reviews that might have had the effect of blackballed papers criticising his work. Here is how it worked in one case.

A key component in the story of 20th century warming is data from sparse weather stations in Siberia. This huge area appears to have seen exceptional warming of up to 2C in the past century. But in such a remote region, actual data is sparse. So how reliable is that data, and do scientists interpret it correctly?

In March 2004, Jones wrote to Professor Michael Mann, a leading climate scienitst at Pennsylvania State University saying that he had "recently rejected two papers [one for the Journal of Geophysical Research and one for Geophysical Research Letters] from people saying CRU has it wrong over Siberia. Went to town in both reviews, hopefully successfully. If either appears I will be very surprised." He did not specify which papers he had reviewed, nor what his grounds for rejecting them were. But the Guardian has established that one was probably from Lars Kamel a Swedish astrophysicist formerly of the University of Uppsala. It is the only paper published on the topic in the journal — or indeed anywhere else — that year.

Kamel analysed the temperature records from weather stations in part of southern Siberia, around Lake Baikal. He claimed to find much less warming than Jones, despite analysing much the same data. Kamel told the Guardian: "Siberia is a test case, because it is supposed to be the land area with most warming in the 20th century." The finding sounded important, but his paper was rejected by Geophysical Research Letters (GRL) that year.

Kamel was leaving academic science and never tried to publish it elsewhere. But the draft seen by the Guardian asserts that the difference between his findings on Siberia temperatures and that of Jones is "probably because the CRU compilation contains too little correction for urban warming." He does not, however, justify that conclusion with any detailed analysis.Kamel says he no longer has a copy of the anonymous referee judgments on the paper, so we don't know why it was rejected. The paper could be criticised for being slight and for not revealing details about its methods of analysis. A reviewer such as Jones would certainly have been aware of Kamel's views about mainstream climate research, which he had called "pseudo-science". He would also have known that its publication in a journal like GRL would have attracted the attention of professional climate sceptics. Nonetheless, the paper raised important questions about the quality of CRU's Siberian data, and was a rare example of someone trying to replicate the Jones's analysis On those grounds alone, some would have recommended its publication.

Kamel's paper admits the discrepancy "does not necessarily mean the CRU surface record for the entire globe is in error." But it argues that the result suggests it "should be checked in more regions and even globally." Phil Jones was not able to comment on the incident.

Critics of Jones such as the prominent scpetical Stephen McIntyre, who runs the Climate Audit blog have long accused him of preventing critical research from having an airing. McIntyre wrote on his web site in December: "CRU's policies of obstructing critical articles in the peer-reviewed literature and withholding data from critics have unfortunately placed issues into play that might otherwise have been settled long ago." He also says obstructing publication undermine claims that all is well in scientific peer review.

Dr Myles Allen a climate modeller at the University of Oxford and Prof Hans von Storch, a climate scientist at the Institute for Coastal Research, in Geesthacht, Germany signed a joint column in Nature when the email hacking story broke, in which they said that "no grounds have arisen to doubt the validity of the thermometer-based temperature record since it began in about 1850." But that argument is harder to make if such evidence, flawed though it might be, is actively being kept out of the journals.

In another email exchange CRU scientist Dr Keith Briffa initiates what looks like an attempt to have a paper rejected. In June 2003, as an editor of an unnamed journal, Briffa emailed fellow tree-ring researcher Edward Cook, a researcher at Lamont-Doherty Earth Observatory in New York, saying "Confidentially I now need a hard and if required extensive case for rejecting [an unnamed paper] – to support Dave Stahle's and really as soon as you can. Please." Stahle is a tree-ring professor from the University of Arkansas. This request appears to subvert the convention that reviewers should be both independent and anonymous.

Cook replied later that day: "OK, today. Promise. Now, something to ask from you." The favour was to provide some data to help Cook review a paper that attacked his own tree-ring work. "If published as is, this paper could really do some damage," he said. "It won't be easy to dismiss out of hand as the math appears to be correct theoretically, but it suffers from the classic problem of pointing out theoretical deficiencies, without showing that their improved [inverse regression] method is actually better in a practical sense."

Briffa was unable to comment. Cook told the Guardian: "These emails are from a long time ago and the details are not terribly fresh in my mind."

Jones did not restrict his harsh criticism of papers he saw as flawed to pre-publication reviews. He and Mann also had a reputation for harsh criticism of journals that published papers they disagreed with.

In March 2003, Mann discussed encouraging colleagues to "no longer submit [papers] to, or cite papers in" Climate Research. He was angry about that journal's publication of a series of sceptical papers "that couldn't get published in a reputable journal", according to Mann. His anger at the journal had evidently been building for some time, but was focussed in 2003 on a paper published in January that year and written by Harvard astrophysicists Willie Soon and Sally Balunias. The pair claimed that Mann's famous hockey stick graph of global temperatures over the last thousand years was wrong. After analysing 240 studies of past temperatures from tree rings and other sources, they said "the 20th century is neither the warmest century over the last 1000 years, nor is it the most extreme". It could have been warmer a thousand years before, they suggested.

Harvard press-released the paper under the headline "20th century climate not so hot", which would have pleased lobbyists against the climate change consensus from the American Petroleum Institute and George C Marshall Institute, both of which had helped pay for the research.

Mann told me at the time the paper was "absurd, almost laughable". He said Soon and Balunias made no attempt in the paper to show whether the warmth they found at different places and times round the world in past eras were contemporaneous in the way current global warming is. If they were just one-off scattered warm events they did not demonstrate any kind of warm era at all. Soon did not respond to Guardian Requests to discuss the paper.

The emails show Mann debating with others what he should do. In March 2003, he told Jones: "I believed our only choice was to ignore this paper. They've already achieved what they wanted - the claim of a peer-reviewed paper. There is nothing we can do about that now, but the last thing we want to do is bring attention to this paper."

But Jones told Mann: "I think the skeptics will use this paper to their own ends and it will set [the field of paleoclimate research] back a number of years if it goes unchallenged." He was right. The Soon and Balunias paper was later read into the Senate record and taken up by the Bush administration, which attempted to get it cited in a report from the Environmental Protection Agency against the wishes of the report's authors.

Persuaded that the paper could not be ignored, Mann assembled a group of colleagues to review it. The group included regular CRU emailers Jones, Dr Keith Briffa, Dr Tom Wigley and Dr Kevin Trenberth. They sent their findings to the journal's editorial board, arguing that Soon's study was little more than anecdote. It had cherry-picked data showing warm periods in different places over several centuries and had provided no evidence that they demonstrated any overall warming of the kind seen in the 20th century.

The emails reveal that when the journal failed to disown the paper, the scientists figured a "coup" had taken place, and that one editor in particular, a New Zealander called Chris de Freitas, was fast-tracking sceptical papers onto its pages. Mann saw an irony in what had happened. "This was the danger of always criticising the sceptics for not publishing in the peer-reviewed literature. Obviously, they found a solution to that -- take over a journal!"

But Mann had a solution. "I think we have to stop considering Climate Research as a legitimate peer-reviewed journal. Perhaps we should encourage our colleagues... to no longer submit to, or cite papers in, this journal. We would also need to consider what we tell or request of our more reasonable colleagues who currently sit on the editorial board."

Was this improper pressure? Bloggers responding to the leaking of these emails believe so. Mann denies wanting to "stifle legitimate sceptical views". He maintains that he merely wanted to uphold scientific standards. "Please understand the context of this," he told The Guardian after the scandal broke. "This was in response to a very specific, particularly egregious incident in which one editor of the journal was letting in a paper that clearly did not meet the standards of quality for the journal."

De Freitas defends his actions during the incident. "I was never ever found to have done anything wrong, even in rumpus over the Soon and Balunias paper. All accusations against me were fully investigated and my performance as editor of this journal was shown to be flawless."

But many on the ten-man editorial board agreed with Mann. They concluded that their colleague de Freitas had ignored the anonymous advice of four reviewers to reject the paper. There was a revolt. Their chief editor von Storch wrote an editorial saying the Soon paper shouldn't have appeared because of "severe methodological flaws". After their publisher Otto Kinne refused to publish the editorial, von Storch and four other board members resigned in protest. Subsequently Kinne himself admitted that publication had been an error and promised to strengthen the peer-review process. Mann had won his argument.

Sceptical climatologist and Cato Institute fellow Pat Michaels alleged in the Wall Street Journal in December last year that the resignations by von Storch and his colleagues were a counter-coup initiated by Mann and Jones. This is vehemently denied by von Storch. While one of the editors who resigned was a colleague of Jones at CRU, von Storch had a track record of independence. If anything, he was regarded as a moderate sceptic. Certainly, he had annoyed both mainstream climate scientists and sceptics.

Also writing in the Wall Street Journal in December, he said: "I am in the pocket of neither Exxon nor Greenpeace, and for this I come under fire from both sides – the sceptics and alarmists – who have fiercely opposing views but are otherwise siblings in their methods and contempt.... I left the post [as chief editor of Climate Research] with no outside pressure, because of insufficient quality control on a bad paper – a sceptic's paper, at that."

The bad blood over this paper lingered. A year later in July 2004, Jones wrote an email to Mann about two papers recently published in Climate Research - the Soon and Balunias paper and another he identified as by "MM". This was almost certainly a paper from Canadian economist Ross McKitrick and Michaels that returned to an old sceptics' theme. It claimed to find urbanisation dominating global warming trends on land. Jones called it "garbage". More damagingly, he added in an email to Mann with the subject line "HIGHLY CONFIDENTIAL".

"I can't see either of these papers being in the next IPCC report. Kevin [TRENBERTH] and I will keep them out somehow - even if we have to redefine what the peer-review literature is!"

This has, rightly, become one of the most famous of the emails. And for once, it means what it seems to mean. Jones and Trenberth, of the National Center for Atmospheric Research in Boulder, Colorado, had recently become joint lead authors for a key chapter in the next IPCC assessment report, called AR4. They had considerable power over what went into those chapters, and to have ruled them out in such a manner would have been a clear abuse of the IPCC process.

Today, neither man attempts to deny that Jones's promise to keep the papers out was a serious error of judgment. Trenberth told the Guardian: "I had no role in this whatsoever. I did not make and was not complicit in that statement of Phil's. I am a veteran of three other IPCC assessments. I am well aware that we do not keep any papers out, and none were kept out. We assessed everything [though] we cannot possibly refer to all literature... Both of the papers referred to were in fact cited and discussed in the IPCC."

In an additional statement agreed with Jones, he said: "AR4 was the first time Jones was on the writing team of an IPCC assessment. The comment was naive and sent before he understood the process." Some will not be content with that. The AR4 was indeed the first in which Jones had been a lead author, responsible for the content of a whole chapter. But Jones had been a contributing author to IPCC assessment reports for more than a decade and should have been aware of the rules.

Climate Research is a fairly minor journal. Not so Geophysical Research Letters, published by the august American Geophysical Union (AGU). But when it began publishing what Mann, Wigley, Jones and others regarded as poor-quality sceptical papers, they again responded angrily. GRL provided a home for one of a series of papers by McIntyre and McKitrick challenging the statistical methods used in the hockey stick analysis. When Mann's complaints to the journal were rebuffed, he wrote to colleagues in January 2005: "Apparently the contrarians now have an 'in' with GRL."

Mann had checked out the editor responsible for overseeing the papers , a Yale chemical engineer called James Saiers, and noted his "prior connection" with the same department at the University of Virginia, where sceptic Pat Michaels worked. He added, "we now know" how various other sceptically tinged papers had got into GRL. Wigley appeared to agree. "This is truly awful," he said, adding that if Mann could find "If you think that Saiers is in the greenhouse skeptics camp, then, if we can find documentary evidence of this, we could go through official AGU channels to get him ousted."

A year after the row erupted, in 2006, Saiers gave up the GRL post. Sceptics have claimed that this was due to pressure from Wigley, Mann and others. Saiers says his three-year term was up. "My departure had nothing to do with attempts by Wigley or anyone else to have me sacked," he told the Guardian. "Nor was I censured, as I have seen suggested on a blog posting written by McKitrick."

As for Mann's allegation, Saiers does not remember ever talking to Michaels "though I did attend a barbecue at his home back in the early 1990s. Wigley and Mann were too keen to conclude that I was in league with the climate-change sceptics. This kerfuffle could have been avoided if the parties involved would have done more to control their imaginations."


guardian.co.uk © Guardian News & Media Limited 2010 | Use of this content is subject to our Terms & Conditions | More Feeds

The Guardin - Hacking RSSPart five: Changing weather posts in China led to accusations of scientific fraud

Climate emails suggest Phil Jones may have attempted to cover up flawed temperature data

In a unique experiment, The Guardian has published online the full manuscript of its major investigation into the climate science emails stolen from the University of East Anglia, which revealed apparent attempts to cover up flawed data; moves to prevent access to climate data; and to keep research from climate sceptics out of the scientific literature.

As well as including new information about the emails, we will allow web users to annotate the manuscript to help us in our aim of creating the definitive account of the controversy. This is an attempt at a collaborative route to getting at the truth.

We hope to approach that complete account by harnessing the expertise of people with a special knowledge of, or information about, the emails. We would like the protagonists on all sides of the debate to be involved, as well as people with expertise about the events and the science being described or more generally about the ethics of science. The only conditions are the comments abide by our community guidelines and add to the total knowledge or understanding of the events.

The annotations - and the real name of the commenter - will be added to the manuscript, initially in private. The most insightful comments will then be added to a public version of the manuscript. We hope the process will be a form of peer review. If you have a contribution to make, please email climate.emails@guardian.co.uk.

The anonymous commenting facility under each article will also be switched on so that anyone can contribute to the debate.


It is difficult to imagine a more bizarre academic dispute. Where exactly are 42 weather monitoring stations in remote parts of rural China?

But the argument over the weather stations, and how it affects an important set of data on global warming, has led to accusations of scientific fraud and may yet result in a significant revision of a scientific paper that is still cited by the UN's top climate science body.

It also further calls into question the integrity of the scientist at the centre of the scandal over hacked climate emails, the director of the University of East Anglia's Climatic Research Unit (CRU), Dr Phil Jones. The emails suggest that he helped to cover up flaws in temperature data from China that underpinned his research on the strength of recent global warming.

The Guardian has learned that crucial data obtained by American scientists from Chinese collaborators cannot be verified because documents containing them no longer exist. And what data is available suggests that the findings are fundamentally flawed.

Jones and his Chinese-American colleague Wei-Chyung Wang, of the University at Albany in New York, are being accused of scientific fraud by an independent British researcher over the contents of a research paper back in 1990.

That paper, which was published in the prestigious journal Nature, claimed to answer an important question in climate change science: how much of the warming seen in recent decades is due to the local effects of spreading cities, rather than global warming?

It is well-known that the concrete, bricks and asphalt of urban areas absorb more heat than the countryside. They result in cities being warmer than the countryside, especially at night.

So the question is whether rising mercury is simply a result of thermometers once in the countryside gradually finding themselves in expanding urban areas.

The pair, with four fellow researchers, concluded that the urban influence was negligible. Some of their most compelling evidence came from a study of temperature data from eastern China, a region urbanising fast even then.

The paper became a key reference source for the conclusions of succeeding reports of the Intergovernmental Panel on Climate Change – including a chapter in the 2007 one co-authored by Jones. It said that globally "the urbanisation influence … is, at most, an order of magnitude less than the warming seen on a century timescale". In other words, it is tiny.

But many climate sceptics did not believe the claim. They were convinced that the urban effect was much bigger, even though it might not change the overall story of global warming too much. After all, two-thirds of the planet is covered by ocean, and the oceans are warming, too.

But when Jones turned down requests from them to reveal details about the location of the 84 Chinese weather stations used in the study, arguing that it would be "unduly burdensome", they concluded that he was covering up the error.

And when, in 2007, Jones finally released what location data he had, British amateur climate analyst and former City banker Doug Keenan accused Jones and Wang of fraud.

He pointed out that the data showed that 49 of the Chinese meteorological stations had no histories of their location or other details. These mysterious stations included 40 of the 42 rural stations. Of the rest, 18 had certainly been moved during the story period, perhaps invalidating their data.

Keenan told the Guardian: "The worst case was a station that moved five times over a distance of 41 kilometres"; hence, for those stations, the claim made in the paper that "there were 'few if any changes' to locations is a fabrication". He demanded that Jones retract his claims about the Chinese data.

The emails, which first emerged online in November last year following a hack of the university's computer systems that is being investigated by police, reveal that Jones was hurt, angry and uncertain about the allegations. "It is all malicious … I seem to be a marked man now," he wrote in April 2007.

Another email from him said: "My problem is I don't know the best course of action … I know I'm on the right side and honest, but I seem to be telling myself this more often recently!"

An American colleague, and frequent contributor to the leaked emails, Professor Michael Mann at Pennsylvania State University, advised him: "This crowd of charlatans … look for one little thing they can say is wrong, and thus generalise that the science is entirely compromised. The last thing you want to do is help them by feeding the fire. Best thing is to ignore them completely."

Another colleague, Kevin Trenberth at the National Centre for Atmospheric Research in Boulder, Colorado, urged a fightback. "The response should try to somehow label these guys and [sic] lazy and incompetent and unable to do the huge amount of work it takes to construct such a database."

In August 2007, Keenan submitted a formal complaint about Wang to his employers. The university launched an inquiry. Reporting in May 2008, it found "no evidence of the alleged fabrication of results" and exonerated him. But it did not publish its detailed findings, and refused to give a copy to Keenan.

By then, Keenan had published his charges in Energy & Environment, a peer-reviewed journal edited by a Hull University geographer, Dr Sonja Boehmer-Christiansen.

The paper was largely ignored at the time, but Guardian investigations of the hacked emails now reveal that there was concern among Jones's colleagues about Wang's missing data — and the apparent efforts by Jones and Wang over several years to cover this up.

Those concerns were most cogently expressed to Jones by his ex-boss, and former head of the CRU, Dr Tom Wigley. In August 2007, Wigley warned Jones by email: "It seems to me that Keenan has a valid point. The statements in the papers that he quotes seem to be incorrect statements, and that someone (W-C W at the very least) must have known at the time that they were incorrect."

Wigley was concerned partly because he had been director of the CRU when the original paper was published in 1990. As he told Jones later, in 2009: "The buck should eventually stop with me."

Wigley put to Jones the allegations made by the sceptics. "Wang had been claiming the existence of such exonerating documents for nearly a year, but he has not been able to produce them. Additionally, there was a report published in 1991 (with a second version in 1997) explicitly stating that no such documents exist."

This is believed to be a report from the US department of energy, which obtained the original Chinese temperature data.

Wang's defence to the university inquiry says that he had got the Chinese temperature data from a Chinese colleague, although she is not an author on the 1990 Nature paper.

Wang's defence explains that the colleague had lost her notes on many station locations during a series of office moves. Nonetheless, "based on her recollections", she could provide information on 41 of the 49 stations.

In all, that meant that no fewer than 51 of the 84 stations had been moved during the 30-year study period, 25 had not moved, and eight she could not recollect.

Wang, however, maintained to the university that the 1990 paper's claim that "the stations were selected on the basis of station history: we chose those with few, if any, changes in instrumentation, location or observation times." The inquiry apparently agreed.

Wigley, in his May 2009 email to Jones, said of Wang: "I have always thought W-C W was a rather sloppy scientist. I would …not be surprised if he screwed up here … Were you taking W-C W on trust? Why, why, why did you and W-C W not simply say this right at the start? Perhaps it's not too late." There is no evidence of any doubts being raised over Wang's previous work.

Jones told the Guardian he was not able to comment on the allegations. Wang said: "I have been exonerated by my university on all the charges. When we started on the paper we had all the station location details in order to identify our network, but we cannot find them any more. Some of the location changes were probably only a few metres, and where they were more we corrected for them."

The story has a startling postscript. In 2008, Jones prepared a paper for the Journal of Geophysical Research re-examining temperatures in eastern China. It found that, far from being negligible, the urban heat phenomenon was responsible for 40% of the warming seen in eastern China between 1951 and 2004.

This does not flatly contradict Jones's 1990 paper. The timeframe for the new analysis is different. But it raises serious new questions about one of the most widely referenced papers on global warming, and about the IPCC's reliance on its conclusions.

It is important to keep this in perspective, however. This dramatic revision of the estimated impact of urbanisation on temperatures in China does not change the global picture of temperature trends. There is plenty of evidence of global warming, not least from oceans far from urban influences. A review of recent studies published online in December by David Parker of the Met Office concludes that, even allowing for Jones's new data, "global near-surface temperature trends have not been greatly affected by urban warming trends."

Keenan accepts that his allegations do not on their own change the global picture. But he told the Guardian: "My interest in all this arises from concern about research integrity, rather than about global warming per se. Jones knew there were serious problems with the Chinese research, yet continued to rely upon the research in his work, including allowing it to be cited in the IPCC report."

Jones on Hughes

One of Jones's earliest detractors was Warwick Hughes. Today Hughes, describes himself as a freelance earth scientist from Perth in Australia, and calls global warming a "fraudulent notion". Back in 1991, he was working for the Tasman Institute, a now defunct free-market thinktank based in Melbourne. He analysed a study of temperature trends in the southern hemisphere published by Jones five years before, and claimed that virtually all the warming found by Jones was a result of growing urban influences. Later, he investigated Jones's South African and Siberian data, claiming of the latter that "cities are the source of the apparent warming, which is not apparent at nearby small town or rural stations."

The leaked emails reveal a civilised correspondence in 2000 between Hughes and Jones. Jones admitted that Hughes had seemingly found significant "anomalies" in his published data and asking for more details about what he had uncovered. But in 2004, when Hughes asked Jones for monthly temperature data from 3,000 weather stations described on the CRU website as "the foundation of Dr Jones' published papers", relations soured. After six months of delay, Jones told Hughes in February 2005 that some of the data was confidential but "even if WMO [the World Meteorological Organization] agrees, we will still not pass on the data. We have 25 or so years invested in the work. Why should I make the data available to you, when your aim is to try and find something wrong with it?"

This was at least honest. In emails to his colleagues, Jones often said confidentiality agreements were a useful excuse. As he told Wigley in January 2005: "Data is covered by all the agreements we sign with people, so I will be hiding behind them." But for Hughes, he didn't bother with the pretence. The statement is damaging nonetheless, because the entire purpose of scientific replication is to try to find something wrong with existing data and theories. That is how science advances.


guardian.co.uk © Guardian News & Media Limited 2010 | Use of this content is subject to our Terms & Conditions | More Feeds

The Guardin - Hacking RSSPart seven: Victory for openness as IPCC climate scientist opens up lab doors

Ben Santer had a change of heart about data transparency despite being hectored and abused by rabid climate sceptics

In a unique experiment, The Guardian has published online the full manuscript of its major investigation into the climate science emails stolen from the University of East Anglia, which revealed apparent attempts to cover up flawed data; moves to prevent access to climate data; and to keep research from climate sceptics out of the scientific literature.

As well as including new information about the emails, we will allow web users to annotate the manuscript to help us in our aim of creating the definitive account of the controversy. This is an attempt at a collaborative route to getting at the truth.

We hope to approach that complete account by harnessing the expertise of people with a special knowledge of, or information about, the emails. We would like the protagonists on all sides of the debate to be involved, as well as people with expertise about the events and the science being described or more generally about the ethics of science. The only conditions are the comments abide by our community guidelines and add to the total knowledge or understanding of the events.

The annotations - and the real name of the commenter - will be added to the manuscript, initially in private. The most insightful comments will then be added to a public version of the manuscript. We hope the process will be a form of peer review. If you have a contribution to make, please email climate.emails@guardian.co.uk.

The anonymous commenting facility under each article will also be switched on so that anyone can contribute to the debate.


One man who has battled against climate sceptics longer than most is the climate modeller Ben Santer, who completed his PhD in climate science at the Climate Research Unit at the University of East Anglia in the 1983 before going to the Lawrence Livermore National Laboratory in California. He helped write the second IPCC assessment report, published in 1995. Most famously, this report claimed to find for the first time that "the balance of evidence suggests a discernible human influence on global climate" – essentially because the geographical pattern of warming across the globe matched that predicted by models. Santer was also lead author of some of the key research behind this claim and of the relevant IPCC chapter.

The main body of the report included lots of cavils about the claim to see the "discernible human influence". As another lead author on the critical chapter, Tim Barnett, then of the Scripps Institution of Oceanography, part of the University of California, San Diego, told me in 1996: "We wrote a long list of caveats in that chapter. We got a lot of static from within IPCC, from people who wanted to water down and delete some of those caveats. We had to work very hard to keep them all in." But many did not make it to the summary for policy-makers, and the New York Times leaked the text with the headline: "Scientists finally confirm human role in global warming." Nothing about the balance of evidence there.

Santer's co-authors on the critical research included Phil Jones at the Climatic Research Unit of the University of East Anglia, Tom Wigley at the National Centre for Atmospheric Research in Boulder, Colorado, and others. But as the main author of the research highlighted in the summary, Santer found himself under instant attack. Remembering all this a decade later, he told me: "I was accused of politically motivated tampering with the IPCC assessment, and of irregularities in my own research. I had, they said, somehow forced Nature to publish [my research] under duress, and had falsified scientific documents. There were calls for my dismissal."

His attackers were heavy hitters. Foremost among them was Pat Michaels of the University of Virginia, who kept a second office off-campus where he conducted his lobbying and public relations activities under the name of New Hope Environmental Services, an "advocacy science consulting firm". He has never disclosed who his clients are.

Michaels claimed that Santer had manipulated data in his critical paper. In particular, that he had ended his analysis of global warming patterns in 1987, just before a long surge in warming in the southern hemisphere, relative to the northern hemisphere, went into reverse. He claimed that this was contrary to model forecasts. He said that if Santer had included data from the next couple of years, which were available, it would have undermined the "discernible human influence".

Santer told me later that "Michaels had a legitimate scientific concern about the sensitivity of our results to the choice of data period". But he denied any "sinister purpose" and said that when he redid the analysis using the later data it "strengthened the original conclusions".

Others weighed in. Arthur B Robinson, a biochemist from Oregon, claimed that in the controversial paper, Santer and his co-authors had "deliberately omitted data points to create the trend that they reported... So Santer clearly faked the result, circulated it during IPCC proceedings in order to influence world global climate policy. They should never be permitted to work in science again." Robinson is an odd-ball. He is also a sceptic about Darwinian natural selection and has written a book about how to survive a nuclear war.

Wearing his other hat as IPCC author, Santer was also widely accused of being the man who added the key words "discernible human influence" to the body of the IPCC report, and of doing it very late in the day. True enough. This was messy and does not reflect well on the IPCC. Those words were agreed at a main session of the IPCC in late 1995, attended by politicians. They wanted them included in the report's summary for policy-makers. But they went beyond what was said in the chapter from which the summary was supposedly drawn.

Yet IPCC procedure required that the chapters had to be made consistent with the summary, rather than vice versa. This is because the ultimate authors of the "intergovernmental" reports are the governments that approve the summary for policy makers. But such a rule puts the scientists in a difficult position, and Santer had the unenviable job of rewording his chapter to reflect the wording of the political summary. And of ensuring that all the authors were in agreement.

Santer told me the words were added to his chapter late, and without full consultation. But he said it was "essentially the same conclusion we [the authors of the chapter] had reached months earlier".

Critics point to a section of an earlier draft of the chapter that was deleted by Santer at this stage. It asked: "When will the detection and unambiguous attribution of human-induced climate change occur?" and answered "We do not know." But the contradiction is more apparent than real. Showing an "unambiguous" human impact is a much harder task than assessing the "balance of evidence". It was the assertion of a "balance of evidence" that Santer added.

The affair sounds like a semantic storm in a teacup. But it was exploited by political outsiders manoeuvring against the IPCC. Writing in the Wall Street Journal, Frederick Seitz, a physicist who headed the US National Academy of Sciences backed in the 1960s and later chaired the right-wing George C Marshall Institute, accused Santer of "the most disturbing corruption of the peer-review process" in 60 years.

The most unpleasant – and certainly for Santer most disturbing – language came from the Global Climate Coalition, a body representing the interests of the American oil and automobile industries. It accused Santer of "scientific cleansing" — a reference to the ethnic cleansing then going on in the Balkans. And for Santer, a Jew, it had another connotation. He told me in 2000: "My grandparents were subjected to ethnic cleansing. They died in a concentration camp in the second world war."

Santer spent months attempting to defend his reputation. He said later: "Nothing in your training prepares you for it. We are prepared for explaining our science, defending our science, and having scientists try to take your arguments apart. But we are not prepared for having our motives questioned and being accused of falsifying data. I think it is unproductive to engage with them directly. For many of them it is religious in a way. They are not rational. Don't waste our time; they don't have the same value system." This experience has coloured Santer's world ever since. It contributed to the break up of his marriage.

And in the leaked emails, he is seen sharing those experiences with other victims of hectoring and abuse by the more rabid climate sceptics. Others had their own horror stories, including Mike Mann over his hockey stick graph, Kevin Trenberth over his analysis of hurricanes and warming in the aftermath of Katrina, and later Jones over his escalating data wars. In each case, they argue, legitimate debates about scientific analysis and access to researchers' data have been turned into vindictive character assassination. A recurring theme of the CRU emails is how the researchers sought to avoid falling victims again.

Santer fights freedom of information request

In November 2008, Santer believed he was being dragged back into the front line, when he received an freedom of information request from sceptic Stephen McIntyre. At least one senior colleague and co-author on the paper in question thought Santer would be best advised to hand over the data. But Santer decided to fight the request.

Santer's new paper was a major climate modelling study, published in the International Journal of Climatology in October 2008. It was titled Consistency of modelled and observed temperature trends in the tropical troposphere.

It reconciled an apparent contradiction between surface temperatures as measured by Jones's thermometer network and satellite estimates of temperatures in the troposphere. While surface thermometers showed consistent warming, satellite and weather-balloon data suggested the warming did not extent up into the atmosphere. This was unexpected, since climate models suggested the opposite should be the case, especially in the tropics. It threatened to undermine Santer's "discernible human influence".

There were 17 authors involved in the paper in all, including Jones and Wigley. And the results mattered because a report for the US government published in April 2006 had highlighted the contradictory data as a "potentially serious inconsistency" in the science of climate change. The authors of had included many of the authors of the new paper, but also some of their arch foes.

But while Santer's team were assembling their paper, Santer received a copy of a rival paper from the journal Geophysical Research Letters, written by from David Douglass, an astrophysicist at the University of Rochester, New York, John Christy of the University of Alabama in Huntsville, and others. It highlighted the contrast between model findings and observational data in a way that suggested the models were wrong. Santer says he saw "serious scientific flaws" in the paper and recommended that the journal reject it. Which it did in September 2006.

Douglass persisted and produced a new version of his findings, published online at the International Journal of Climatology just over a year later in December 2007. It was widely publicised. Fox News reported it. Douglass told the National Press Club in Washington DC that it was "an inconvenient truth" about climate change, which proved that "nature rules the climate. Human-produced greenhouse gases are not responsible for global warming." The right-wing Heartland Institute took up the argument.

Santer regarded the paper as statistically flawed. Jones agreed. In an April 2007 email he wrote, "I know editors have difficulty finding reviewers, but letting this one pass is awful," said Jones. They went to war. Santer buttonholed Jones's colleague at CRU, Tim Osborn, a member of the editorial board of the journal. The authors were guilty of "intellectual dishonesty", he claimed in an email in January 2008. But he said a "quick publication of a response... would go some way to setting the record straight. I am troubled, however, by the very real possibility that Douglass et al will have the last word." To avoid that, he suggested that "our paper should be regarded as an independent contribution." They decided to redo much of Douglass's analysis.

Osborn contacted the journal editor, Glenn McGregor, a climatologist at the University of Auckland. Osborn later told Santer "he may be able to hold back the [print version] of Douglass et al, possibly so that any accepted Santer et al comment could appear alongside it." Osborn noted to Santer of their discussion the next day: "The only thing I didn't want to make more generally known was the suggestion that print publication of Douglass et al. might be delayed."

McGregor was probably somewhat nonplussed by all this. One of the people copied into the conspirators' emails had reviewed the Douglass paper for him, and had failed to raise any objection. Nonetheless, he agreed to a plan in which Santer et al produce their response as a paper, while the print version of Douglass et al was held back.

Santer's paper was published online, with 16 co-authors, in October 2008. And the two papers appeared together in the same print edition the following month. So, though both papers took about four months from submission to publication online, Douglass's paper took 11 months to get from online to print publication, while Santer's paper managed it in 36 days.

Nobody told Douglass and his colleagues about any of this. When the emails were published in November 2009, Douglass and Christy reacted angrily. They complained in the American Thinker in December 2009 about a surreptitious strategy involving the authors of the paper and the editors of the journal of "delaying [our paper] and not allowing [us] to have a simultaneous response to Santer et al."

At one level this is a matter of publishing etiquette. When is a response a paper? And what rules should govern responses to papers? But at another it is about power over the crucial scientific journals and the wider media.

There is no doubt the Santer and his colleagues sought to use the power they held to the utmost, albeit in a cause they regarded as in defence of good science. On the other hand, whatever the attempts to stage-manage publication, it was nothing compared to the stage-management of Douglass's paper in the media. It gained far more, and far more prominent, coverage than Santer's paper. In the world of science, Santer's team had the last word. Their charge that the statistical analysis in Douglass's paper was badly flawed and led to incorrect conclusions has, so far as the Guardian can establish, not been refuted. But Douglass got the publicity.

Or that is where the story stands now. For the affair lives on. With the Santer paper published, McIntyre weighed in. He asked for data from the 49 computer model runs conducted for the paper. Santer turned down McIntyre's request in an email on 10 November 2008. McIntyre responded with formal requests to Tom Karl at the National Climate Data Centre, where he guessed the data would have been held, and to the journal, saying Santer's response had been "discourteous".

The subsequent emails show Santer's rising concern that he faced a return to the nightmare of 1996. On 11 November he told Karl, who was one of the 16 authors: "I believe McIntyre is pursuing a calculated strategy to divert my attention and focus away from research... I believe that our community should no longer tolerate the behaviour of Mr McIntyre and his cronies." He called McIntyre the "self-appointed Joe McCarthy of climate science", adding: "We should be able to conduct our scientific research without constant fear of an 'audit' by Steven McIntyre; without having to weigh every word we write in every email we send to our scientific colleagues."

Many would see this as somewhat over the top, but given Santer's past experiences, it is at least understandable. And of course the reference to weighing every word in emails was rather prescient.

Santer wrote in an email on 3 December 2008 to Tom Wigley: "I'm damned and publicly vilified because I refused to provide McIntyre with the data he requested.... Had I acceded, I am convinced I would have spent years of my scientific career dealing with demands for further explanations, additional data, Fortran codes [a programming language] etc... For the remainder of my scientific career I'd like to dictate my own research agenda."

But after a further two weeks he had changed his mind, notifying the co-authors that he had decided to published online much of the data requested by McIntyre. He now reasoned: "This will make it difficult for McIntyre to continue making the bogus claim that he is being denied access to the climate model data necessary to evaluate the validity of our findings." Essentially he concluded that this was the path of least resistance, telling colleagues in January 2009 that "I agreed to this publication process primarily because I want to spend the next few years of my career doing research. I have no desire to be 'taken out' as scientist, and to be involved in years of litigation."

His change of mind brought a resounding slap on the back from Wigley, who had been working behind the scenes to persuade Santer, Jones and others to start releasing data, arguing that a spirit of openness would be beneficial all round. "Dear Ben," Wigley wrote a week before Christmas 2008. "This is a good idea. However will you give only tropical...results? I urge you to give data for other zones as well...To have these numbers on line would be a great benefit to the community. In other words, although prompted by McIntyre's request, you will actually be giving something to everyone."

He went on to ask "what period will you cover? Although for our paper we only give data from 1979 onwards, to give data for the full 20th century runs would be of great benefit to all... This is a lot of work — but the benefits to the community should be truly immense."

Keeping the public in the dark

Sometimes the scientists are exposed apparently trying to suppress inconvenient data from public attention in more popular presentations of their work. In 2008, Mick Kelly, a visiting fellow of CRU who is now based in New Zealand, discussed how to present that lack of recent warming to the public. In an email to Jones he discussed how he had "just updated my global temperature trend graphic for a public talk and noted that the level has really been quite stable since 2000 or so and 2008 doesn't look too hot." He said he anticipated that the sceptics will latch onto this quite soon" and suggested: "Maybe I'll cut the last few points off the filtered curve before I give the talk again."

Asked about this in December Kelly said "I didn't, of course, cut the points out... It was a joke, for God's sake. In future, I'll insert a smiley face to flag up humour."

Another email from the environment group WWF's Adam Markham in 1999 discussed fact sheets on climate impact risks in different countries being written by CRU for the environmental organisation. Markham suggested that the data on Australia was "slightly more conservative" than that coming from local scientists, and asked that it be "beefed up if possible". There is no record in the emails of whether Jones obliged, and Markham told the Guardian he cannot remember.


guardian.co.uk © Guardian News & Media Limited 2010 | Use of this content is subject to our Terms & Conditions | More Feeds

The Guardin - Hacking RSSPart 10: Search for hacker may lead police back to East Anglia's climate research unit

Truth could turn out more embarrassing for university, but CRU 'dissidents', a corporate leak ahead of Copenhagen or bloggers intent on data 'liberation' are all still in the frame.

In a unique experiment, The Guardian has published online the full manuscript of its major investigation into the climate science emails stolen from the University of East Anglia, which revealed apparent attempts to cover up flawed data; moves to prevent access to climate data; and to keep research from climate sceptics out of the scientific literature.

As well as including new information about the emails, we will allow web users to annotate the manuscript to help us in our aim of creating the definitive account of the controversy. This is an attempt at a collaborative route to getting at the truth.

We hope to approach that complete account by harnessing the expertise of people with a special knowledge of, or information about, the emails. We would like the protagonists on all sides of the debate to be involved, as well as people with expertise about the events and the science being described or more generally about the ethics of science. The only conditions are the comments abide by our community guidelines and add to the total knowledge or understanding of the events.

The annotations - and the real name of the commenter - will be added to the manuscript, initially in private. The most insightful comments will then be added to a public version of the manuscript. We hope the process will be a form of peer review. If you have a contribution to make, please email climate.emails@guardian.co.uk.

The anonymous commenting facility under each article will also be switched on so that anyone can contribute to the debate.


Last November, the University of East Anglia called in the police to investigate what it said was a criminal theft of data. Under Superintendent Julian Gregory, a group of officers from the counter-terrorism squad and Scotland Yard's electronic crimes unit set to work. But it remains unclear if a crime was committed at all.

Who are the likely hackers, or liberators, of the emails and other data, and how was it done? There were three stages to the release, and each may have been done by someone different.

There was the assembly of the material. There were 4,660 files, including documents, raw data and computer code. Some of the data, for instance on tree rings, dates back to 1991. The 1,073 files containing emails (often several in a string) began in 1996 and ended on 12 November 2009. This can only be a small subset of the emails sent and received by CRU staff during that time. They mostly discuss work (no social memos or invitations to eat birthday cake in the lab) and they cover many scientific issues, mostly without rancour or hint of conspiracy. Most involve a handful of individuals at CRU: Phil Jones, Keith Briffa, Tim Osborn and Mike Hulme. Only 66 did not involve these four people. Also, most but not all were in discussion with foreign collaborators, particularly in the US.

At first sight it looks like someone, probably with some knowledge of the issues and within CRU, collected the files for purposes unknown. Equally, the subset may be a result of some fairly crude sifting using a search routine, either before or after their release. But the university has confirmed that all the material was simply sitting in an archive on a single back-up CRU server, when it was copied.

There was the release itself, either a deliberate leak from within the system, a hack from outside or a chance find, in which a file containing the material was retrieved from a part of the CRU server available (deliberately or inadvertently) to outsiders. At this point the distinction between a hack and happenstance may become blurred. The material may simply have been sitting in cyberspace. Likewise, the distinction between outside and inside release becomes blurred, since someone within might have directed an outsider to where the files lay.

Finally there was the distribution. We know a CD of the files existed prior to its widespread release. But also that it was loaded remotely onto websites. In the latter case, we know it was done in a reasonably sophisticated manner, using one of the "open proxies" favoured by hackers to cover their traces, at various points using servers in Turkey, Russia, Malaysia and Saudi Arabia. The location of these servers is probably entirely opportunistic. Hackers can go online and choose from a range of open proxies round the world.

Who might have been involved? Three groups of people have been suggested.

• UEA dissidents. Disaffected people at the University of East Anglia, potentially with routine access to internal servers. Probably because they would be aware of the climate issues and might have clashed with Jones and colleagues, in either CRU or the university's environment department. People in the environment department said there were some grumblings and jealousies about CRU, but no outright hostility.

Another possible source within UEA would be the Freedom of Information office, which administered requests under the Freedom of Information Act. There is no hint in the emails that the officials there were anything other than friends, nor any hints or concerns about leaks from there. But they were turning down the majority of the applications and and individual there may have felt this was inappropriate.

Superficially there is a case that the hack must have been an "inside job", say computer experts. Charles Rotter, the moderator of the sceptic website WattsUpWithThat which "broke" the story by putting up the link to the emails on a Russian server, says: "It would take a hacker massive amounts of work to parse through decades of emails and files, but stealing or acquiring a single file is distinct possibility and does not require massive conspiracy... An ongoing process of internally collating this information for an FoI response is entirely consistent with what we find in the file."

• A corporation or shadowy state entity perhaps anxious to disrupt the climate negotiations in Copenhagen. Here, the main evidence is the sophisticated of the hack and release, leaving no known traces. And the timing. While "climategate" did not have a direct effect on the Copenhagen negotiations, its timing just before that event ensured maximum publicity. And was also well-timed to influence discussions in the US Senate on a climate change bill. It would be consistent with the "stealth" agenda of using citizens groups to spearhead opposition to both healthcare reform and climate legislation during 2009. But I have seen nothing specifically linking corporate America to the hack.

• Bloggers. Maybe those citizens groups hostile to climate change science acted alone. The first releases of the emails all involve the west coast group of bloggers. They included Steve Mosher, an "open-source software developer", Lucia Liljegren's blog The Blackboard, Jeff "id" Condon's The Air Vent and Warren Meyer's blog Much the biggest though was, Anthony Watts' WattsUpWithThat (WUWT), often run by its moderator, Charles Rotter. He is Mosher's San Francisco flatmate and a frequent figure in the story, usually known online as "Charles the moderator".

Here is what is known about how it happened. Over the weekend beginning Friday 13 November, someone copied files from a back-up server at the university's Climatic Research Unit, which were then posted anonymously on the internet and various bloggers were alerted.

On 17 November at 6.20am EST, someone tried to upload the zip file containing the CRU emails onto the RealClimate website via a Turkish server. They then created a draft post that read: "We feel the climate science is, in the current situation, too important to be kept under wraps. We hereby release a random selection of correspondence, codes and documents. Hopefully, it will give some insight into the science and the people behind it." It gave 20 samples from the emails and a link to download more.

Gavin Schmidt, the Nasa scientist running the site, swiftly spotted it and took it down. Having read the files he alerted CRU. But even as he did that, a cryptic comment appeared on McIntyre's ClimateAudit site at 7.24am. "A miracle has happened," it said, providing a link via the RealCimate website. Nobody noticed this initially or tried to use the link, which in any case would not have worked.

Meanwhile as dawn broke in California, a link to a Russian server holding the FOA2009.zip file was posted to WUWT, where Charles the moderator held it and alerted his boss the California weatherman Anthony Watts, awaiting approval to put it on the site. By that evening links were also posted to Jeff id's Air Vent blog and to a blog site called Climate Skeptic, run by Warren Meyer out of Phoenix, Arizona. Online journalist Patrick Courrielche, who has investigated the affair, says Jeff id, an aeronautical engineer, was out deer-hunting and didn't notice the upload till he got an email from Mosher pointing it out.

McIntyre says Charles the moderator made backup CD copies of the file and gave one to his flatmate Mosher, who began poring over its contents. McIntyre says Mosher then called him. "I couldn't believe my ears. Mosh...asked me to confirm emails attributed to me - which I did. They didn't give me the email link." This version of events is consistent with Mosher's claim, in a blog last week (12th) that "on the morning of Nov 19th two people held the file (that I know of). Me on a CD and a blog moderator who was holding the FOIA comment. Embargoed at the request of the blog owner... Did I download the files? No. How did you [I] get them? On a CD. Who gave them to you? Can't say."

On 19 November McIntyre received an email from a regular correspondent to his blog site from the University of East Anglia. This was the head of the university isotope analysis unit, Paul Dennis, a public advocate of greater data freedom whose own researches on ice core data leave him unimpressed by more alarming speculation about climate change. Dennis has since been interviewed by police in connection with the alleged hack.

On the same day, Dennis told McIntyre that CRU people were trying to secure their servers, following the discovery of a leak. This gave the bloggers the evidence they needed that the material they had was genuine.

Mosher says that he independently got confirmation. "I called people mentioned in the mails. I read them mails. The actual person inside CRU had no clue what this message meant to me. He passed me no information, just told me what I needed to know." Whatever that was, it proved they were genuine.

Courrielche writes: "Shortly after confirming the authenticity of the Climategate files, Mosher says he saw a link to the files on the [Jeff id's] Air Vent site. 'My first reaction was relief. I didn't want to be the only person who had those files.'" Nobody else seems to have noticed. But having certified the veracity of the file, Mosher got to work.

He posted a comment to Lucia's blog, the Blackboard, pointing to the Air Vent site. Lucia then downloaded the files, and Mosher started posting emails on her site, one by one. Within minutes Gavin Schmidt was sending Lucia emails warming that this could be illegal. But by now Mosher was posting emails one by one onto McIntyre's ClimateAudit site, too. And half an hour later Watts, who was on his way back from Europe, gave Charles the administrator permission to release the material onto his site. Since WUWT gets much more traffic than the others, this "broke" the story.

McIntyre says: "To the best of my knowledge, neither Mosh nor CTM [Charles the moderator] had (or has) the faintest idea of who assembled and released the dossier – other than speculations from their experience with computers. Nor do I. I talked to both Mosh and CTM on the late evening of 17th, when they were in the first throes of reading the emails. There is no doubt in my mind that they knew nothing of the source other than CTM knowing the Russian link."

McIntyre insists he had no role in the hack. "Like many other readers of the various sites, I followed the pointers to Jeff id's site and downloaded the files on the afternoon of Nov 19. I was unprepared for what I encountered. Because I was intimately familiar with the context of so many of the emails, they were that much more shocking to me." After browsing, he says, he went off to play squash.

Is it that simple? Some point to a previous pattern that is strikingly similar to what happened in November. On 24 July, McIntyre says he received a big FOI refusal from CRU. He announced it on his web site that day. The next day McIntyre announced that he had got a mass of data. In November, there was a big FOI refusal, and again within days the "FOIA2009.zip" files was all over the web.

McIntyre was behind the first leak, though he initially was coy about it, talking about a "mole". But he emphatically denies being behind the second.

McIntyre is generally meticulous, straightforward and consistent in what he says. But over the July incident, his description of events is opaque. He headlined his short article "A mole". And said: "Folks, guess what. I'm now in possession of a CRU version giving data for every station in their station list." But he said no more about a source in the item. The next day, the 28th, he announced the mole had been found. Well, not quite. He said that "Late yesterday I learned that the Met Office/CRU had identified the mole. They are now aware that there has in fact been a breach of security. They have confirmed that I am in fact in possession of CRU temperature data..." He did now say who his source of information was.

Then he added "Thus far, the only actions by either the Met Office or CRU appear to have been a concerted and prompt effort to cover up the breach of security by attempting to eradicate all traces of the mole's activities. My guess is that they will not make the slightest effort to discipline the mole."

This was a tease. There was no human "mole" in the sense of someone deliberately leaking material. Just a security breach. The "mole", he now says, was simply the person who "put the station on the CRU server." Some bloggers have mischievously claimed that the mole must have been Jones himself.

McIntyre later said that "I downloaded from the public CRU ftp site... No hacking was involved." Nature magazine in August described what happened thus. "A couple of weeks ago it became clear that McIntyre had retrieved some of the HadCRU data from a server on the CRU website. On realizing this, CRU immediately removed the data... it transpired that these data were on an anonymous ftp server intended for the Met Office Hadley Centre project partners only, and were not for public use."

A number of people claim to have stumbled on non-public files on the UEA server in the months before the hack. David Holland, a British engineer and amateur climate sceptic, in December 2008 notified the university that "the search engine on your home page is broken and falling through to a directory." The university thanked him for letting them know and said it was caused by a "misconfiguration of the webserver". Holland says he didn't download or alter anything since he knew it could be traced back to his computer.

Others were not so fastidious. In November 2009, Charles the moderator blogged that "one day in late July I discovered they had left station data versions from 2003 and 1996 on their server — without web page links but accessible all the same. They were stale versions of the requested data... just sitting in cyberspace waiting for someone to download."

After the July incident, CRU clearly tried to batten down the hatches. But perhaps they failed, either through technical failings or because someone inside was subverting the efforts.

So what actually happened in November? Charles the moderator seems to have been closer to the perpetrator than anyone. Four days after the hack went public, he advanced his theory. "In the past I have worked at organizations where the computer network grew organically in a disorganized fashion. Security policies often fail as users take advantage of shortcuts... one of these is to share files using an ftp server.... This can lead to unintentional sharing with the rest of the Internet as noted in the [July] Phil Jones, CRU mole, example. Often the ftp server may also be the organization's external web server. When this occurs, if the organization does not lock down their network thoroughly, the security breaches which could happen by accident are far more likely to occur."

So, he argues, "they shared [the file] with others by putting it in an ftp directory which was on the same CPU as the external webserver, or even worse, was on a shared driver somewhere to which the webserver had permissions to access. In other words, if you knew where to look, it was publicly available. Then along come our 'hackers' who happen to find it, download it, and the rest is history."

Charles the moderator insists this is just a theory. But he is one of the few people who might be in a position to know if it is the truth of what happened. And if his theory is true, then the university will be left looking rather foolish. There will be no one to arrest.


guardian.co.uk © Guardian News & Media Limited 2010 | Use of this content is subject to our Terms & Conditions | More Feeds

The Guardin - Hacking RSSPart 12: Climate science emails cannot destroy argument that world is warming, and humans are responsible

Climate science can no longer afford to be a closed shop or over-simplify the complexities of a changing climate if it is to reclaim credibility

In a unique experiment, The Guardian has published online the full manuscript of its major investigation into the climate science emails stolen from the University of East Anglia, which revealed apparent attempts to cover up flawed data; moves to prevent access to climate data; and to keep research from climate sceptics out of the scientific literature.

As well as including new information about the emails, we will allow web users to annotate the manuscript to help us in our aim of creating the definitive account of the controversy. This is an attempt at a collaborative route to getting at the truth.

We hope to approach that complete account by harnessing the expertise of people with a special knowledge of, or information about, the emails. We would like the protagonists on all sides of the debate to be involved, as well as people with expertise about the events and the science being described or more generally about the ethics of science. The only conditions are the comments abide by our community guidelines and add to the total knowledge or understanding of the events.

The annotations - and the real name of the commenter - will be added to the manuscript, initially in private. The most insightful comments will then be added to a public version of the manuscript. We hope the process will be a form of peer review. If you have a contribution to make, please email climate.emails@guardian.co.uk.

The anonymous commenting facility under each article will also be switched on so that anyone can contribute to the debate.


Is the science of climate change fatally flawed by the climategate revelations? Absolutely not. Nothing uncovered in the emails destroys the argument that humans are warming the planet.

None of the 1,073 emails plus 3,587 files containing documents, raw data and ­computer code upsets the 200-year-old science behind the "greenhouse effect" of gases such as carbon dioxide, which traps solar heat and warms the atmosphere. Nothing changes the fact that carbon dioxide is accumulating in the atmosphere thanks to human emissions from burning carbon-based fuels such as coal and oil. Nor the calculations by physicists that for every square metre of the Earth's surface, 1.6 watts more energy enters the atmosphere than leaves it.

And we know the world is warming as a result. Thousands of thermometers in areas remote from any conceivable local urban influences tell us that. The oceans are warming too. The great majority of the world's glaciers are retreating, Arctic sea ice is disappearing, sea levels are rising ever faster, trees are climbing up hillsides and permafrost is melting.

These are not statistical artefacts or the result of scientists cherry-picking data. Equally, many of the most widely ­publicised claims from sceptics about the emails are demonstrably unfounded. There is no conspiracy to "hide the decline" in temperatures. Nor that a lack of warming in the data is a "travesty" – still less of attempts to fix the data.

But, within the narrower confines of assembling a reliable history of global ­temperature, the emails have done significant damage to the credibility of scientists. They show that in their desire to give the world a clear message that humans are ­heating the planet, a group of scientists cut corners and played down uncertainties in their calculations. Their opponents charge that they then covered their tracks by being secretive with data and suppressing dissent.

The long-standing critic of the IPCC process Roger Pielke Snr insists: "There are major problems with the accuracy of the surface temperature data." Jones and his colleagues know about the problems, he says. They make numerous adjustments to cope with them. "I do not question their sincerity," says Pielke. But "where they have failed is in preventing, in their leadership position, a proper scientific debate of the issues that we and others have raised." Such views were only heard on the scientific fringe before last November. They are more prominent today.

Taken with the recent revelation that the Intergovernmental Panel on Climate Change (IPCC) had included an incorrect claim about when Himalayan glaciers would melt, this suggests a wider problem of scientific sloppiness, but not of outright fraud. Many scientists believe their community has to own up to that, and put its house in order.

Part of the problem is secrecy in ­science. Judy Curry, a climatologist at the Georgia Institute of Technology who has been ­trying to make peace between her ­colleagues and the sceptics, says the various data sets connected to the famous "hockey stick" temperature graph and Phil Jones's thermometer data sets "stand out as lacking transparency".

Science is too much of a closed shop, she says. Outsiders need to be let into the ivory towers for the good of science itself. "Einstein didn't start his career at Princeton, but rather at a post office." Bring on the bloggers. Maybe there's an Einstein among them.

The doors of labs are being opened whether scientists like it or not. The Information Commissioner's office last month released a statement saying that the University of East Anglia had "not dealt with [FoI requests] as they should have been under the legislation".

There is evidence in the emails that some at the Climatic Research Unit wanted to delete files rather than hand them over – though it is not clear if there were any deliberate deletions.

Probably no one anticipated that a law intended to unwrap state secrets might end up freeing data from scientists' computers. But the science community now urgently needs to figure out how to respond to this altered landscape.

The need to open up science is made all the greater by the question raised in the emails about the "gold standard", the peer review system. In many fields of research, peer review creates serious conflicts of interest in which, as the emails have revealed, senior researchers can act in a way that could have the effect of blackballing the research papers of their critics. The dangers are all the greater when, again as the emails show, the conventions of anonymity in peer review are not rigorously upheld.

Finally, "climategate" raises questions about the IPCC report-writing process, in which many of the emailers have been involved. Governments set up the IPCC 20 years ago to get scientists to speak with one voice on climate change. But often there is no clear consensus. Scientists are trained to disagree

The drive for consensus at the IPCC has created pressure to keep the message simple and for scientists who had a problem with that to keep quiet. Some shut up. Others bend their results or curtailed their researches to fit the prevailing view, arguably slowing down the process of scientific discovery. Others still react with anger to such requests and ended up among the outright sceptics. Such tensions are clear in dozens of the CRU emails.

Healing those divides may require an end to the IPCC in its present form. Jones's colleague at CRU Dr Mike Hulme is among those who suggests that the IPCC "has run its course". He says that "through its structural tendency to politicise climate change science [it] has perhaps helped to foster a more authoritarian and exclusive form of knowledge production – just at a time when globalising and wired cosmopolitan culture is demanding of science something much more open and inclusive."

Pielke in December criticised the "broad goal of the leadership of the IPCC process to control what science the policymakers receive." The emails expose that tendency. But the trouble is that the IPCC was set up by governments to do precisely that. The email hacking saga is a crisis for the IPCC process as a whole. But it also raises important questions about what we want of our scientists.

"Climate scientists will have to work harder to earn the warranted trust of the public – and maybe that is no bad thing," says Hulme. While science gets its house in order, we need some perspective. In the midst of a cold winter it may be hard to convince ourselves, but the world is still warming. Humanity is still to blame. And we still, urgently, need to do something about it.


guardian.co.uk © Guardian News & Media Limited 2010 | Use of this content is subject to our Terms & Conditions | More Feeds

The Guardin - Hacking RSSPart one: Battle over climate data turned into war between scientists and sceptics | Fred Pearce

Whether it was democracy in action, or defence against malicious attempts to disrupt research, climate scientists were driven to siege mentality by persistence of sceptics

In a unique experiment, The Guardian has published online the full manuscript of its major investigation into the climate science emails stolen from the University of East Anglia, which revealed apparent attempts to cover up flawed data; moves to prevent access to climate data; and to keep research from climate sceptics out of the scientific literature.

As well as including new information about the emails, we will allow web users to annotate the manuscript to help us in our aim of creating the definitive account of the controversy. This is an attempt at a collaborative route to getting at the truth.

We hope to approach that complete account by harnessing the expertise of people with a special knowledge of, or information about, the emails. We would like the protagonists on all sides of the debate to be involved, as well as people with expertise about the events and the science being described or more generally about the ethics of science. The only conditions are the comments abide by our community guidelines and add to the total knowledge or understanding of the events.

The annotations - and the real name of the commenter - will be added to the manuscript, initially in private. The most insightful comments will then be added to a public version of the manuscript. We hope the process will be a form of peer review. If you have a contribution to make, please email climate.emails@guardian.co.uk.

The anonymous commenting facility under each article will also be switched on so that anyone can contribute to the debate.


This story is dark; there are no heroes. Environmentalists will be distressed at what happens in the labs; many may think we should not publish for fear of wrecking the already battered cause of fighting climate change. But some of it, according to the British government's Information Commissioner, may have been illegal.

Remember two other things. First, this was war. The scientists were under intense and prolonged attack, they believed, from politically and commercially motivated people who wanted to prevent them from doing their science and trash their work. And they had, as their most vocal protagonist Professor Michael Mann puts it in one email, "dirty laundry one doesn't want to fall into the hands of those who might potentially try to distort things ..."

Meanwhile, their attackers came to believe that the scientists were fraudsters. In many ways, what follows is a Shakespearean tragedy of misunderstood motives.

There are two competing analyses of what "climategate" means. One sees it as the mob entering the lab – the story of a malicious attempt to disrupt, cross-question, belittle and trash the work of mainstream scientists. This may or may not have been the motivation for the original hack, but it has certainly been the motive of some who have driven the news agenda since.

The second analysis sees it as democracy in action – the outcome of an entirely laudable effort by amateur scientists and others outside the scientific mainstream, headed by Canadian mathematician Steve McIntyre, to gain access to the complex data sets behind some of the climate scientists' conclusions, and to subject them to their own analysis.

The interweaving of these two narratives has created the tragedy of climategate. The bunker mentality of climate scientists such as the key email correspondents – headed by the director of the Climatic Research Unit (CRU) at the University of East Anglia, Phil Jones – is exposed in the emails. But so too is the chaos caused in the labs by the efforts of outsiders to question what was going on, without using the established rules of science, like working through publication in peer-reviewed literature. The clash of cultures between the blogosphere and the pages of august journals such as Nature could not be greater.

All this happened against the backdrop of a long-term assault by politically motivated, and commercially funded, climate-change deniers against the activities of many of the key scientists featuring in the emails. Indeed it is striking that people with a limited scientific involvement with CRU who have been victims of past attacks – such as Kevin Trenberth of the US government's National Centre for Atmospheric Research (NCAR) and Ben Santer of the Lawrence Livermore National Laboratory – became regular email correspondents with Jones and his colleagues. They were huddling together in the storm.

Through the emails we also see that some insiders were always demanding more openness from their colleagues and providing candid criticism of shoddy or mistaken work. One person stands out in this: Tom Wigley. He was Jones's former boss, having preceded him as head of CRU. Now based at the University Corporation for Atmospheric Research, in Boulder, Colorado, Wigley kept up a vigil for honesty and integrity in emails over many years. If there is a hero in this sorry tale, perhaps it is Wigley.

The science discussed in the emails is mostly from one small area of climate research — the taking of raw temperature data from thermometers, satellites and proxy measures of historical temperatures such as tree rings and turning it into useable information on temperature trends. The result being iconic graphs like the famous "hockey stick", first published 12 years ago and one of climate science's most famous and controversial products. It shows a long period of natural stable temperatures followed by a sharp, exceptional warming in the late 20th century.

In this area of work, CRU has been crucial. Under Jones's management, it has assembled the most comprehensive thermometer data record in the world, much of it under contract to the US Department of Energy. It is also home to some leading tree-ring researchers like the deputy head of the CRU, Dr Keith Briffa. The acerbic correspondence of Jones and Briffa with Michael Mann of Penn State University, the chief creator of the hockey stick graph, is a central feature of the emails.

CRU's work is the prime (though not the only) basis for the claim that man-made global warming is happening now and is exceptional in history. But as it comes under assault, it is worth remembering that it does not directly touch on other key issues like the physics of climate change, forecasts of future climate change and so on. Even if all the work of CRU were revealed as entirely phoney, which is far from being true, it would not demonstrate climate change was a hoax, or even much alter predictions of future climate.

The emails reveal that Jones, Briffa, Mann and other emailers were the gatekeepers of the science on which they worked. These men (there are virtually no women in the emails) reviewed papers by colleagues and rivals. They held key writing positions with the Intergovernmental Panel on Climate Change (IPCC) in its assessments of the science of climate change. So if they are damaged, then so is the IPCC.

Their correspondence reveals that there is some basis to the charge, made in October 2009 by climate contrarian Ross McKitrick, an environmental economist at the University of Guelph in Canada, that that "the IPCC review process is nothing at all like what the public has been told. Conflicts of interest are endemic, critical evidence is systematically ignored and there are no effective checks and balances against bias or distortion." There are more than a thousand leaked files of emails to and from scientists and CRU. The emails are clearly a small subset of all the emails that would have been sent and received by CRU scientists since the first one in 1996. Nobody is yet clear why this set made it into the public domain, but they are overwhelming between CRU scientists and foreign compatriots. They include technical discussions about tree ring chronologies and data analysis, scheming about how to repel Freedom of Information (FoI) requests, and bitching about their enemies among the sceptics – the group the scientists referred to as "the contrarians".

Our analysis finds previously undisclosed evidence of slipshod use of data and apparent efforts to cover that up. It also finds persistent efforts to censor work by climatic sceptics regarded as hostile – especially those outside the scientific priesthood of peer review – or those able to generate headlines in media outlets thought unfriendly, like Fox News.

We would agree with Judy Curry of the Georgia Institute of Technology, a leading climate scientist who maintains contacts with both camps, who says: "There are two broad issues raised by these emails ... lack of transparency in climate data, and 'tribalism' in some segments of the climate research community."

McIntyre's war

Climategate would not have happened without one man: a Canadian squash-playing blogger and data obsessive in his 60s called Steve McIntyre. Hero or villain, his data wars with Mann, Jones, Briffa and Santer largely created the siege mentality among the scientists, set them on a path of opposition to freedom of information, and by drawing in scores of data liberationists inside and outside the science community, almost certainly inspired whoever stole and released the emails.

McIntyre, a trained mathematician, had a successful career heading small Canadian minerals companies, often using his statistical prowess to analyse mineral prospecting data and out-bet his rivals. In 2002, he took up a new hobby – investigating climate change science. It started with an email from his home in Toronto to Jones at CRU asking for some weather station data. Initially the exchanges, as revealed on McIntyre's website ClimateAudit, were civilised. But as the years passed, and his data demands grew greater, relations soured.

From the start, McIntyre deconstructed studies that claim to show evidence of large-scale warming of the planet and of the human fingerprint in that warming. He pioneered the use of freedom of information legislation in the US and UK to demand the raw data behind the studies. It was not normal practice for scientists to publish this full data, nor the computer programmes they devised to analyse it.

McIntyre clearly doubted the statistical techniques being employed by the climatologists, and felt that, as a trained mathematician, he could do better despite his ignorance of climate science. And, as he grew more suspicious, he suspected them of cherry-picking data. He wondered exactly how Mann turned dozens of studies on the past climate, including a series of tree rings studies managed by Briffa at CRU, into his neat hockey stick graph. And he questioned the reliability of the thermometer data used by Jones to produce his graphs of warming over the past 160 years.

He found that no independent researchers had seriously tried to replicate the findings – a cornerstone of scientific inquiry. "Nobody's ever checked this stuff with any sort of due diligence," he said recently. He says too much is taken on trust in the cosy, collegiate world of science.

The climate scientists came to regard him as a meddling, time-wasting and probably politically motivated wrecker, who rarely published his own papers and devoted his retirement to trashing theirs. So when he tried to access their raw data and computer programmes, they resisted. The emails reveal that the researchers shared tactics, encouraged each other and competed for the rudest invective against McIntyre. And they grew even angrier as other wannabe investigators joined the data hunt. Men such as Doug Keenan, a former financial trader on Wall Street and the City of London, and a retired electrical engineer from Northampton called David Holland.

Many have accused McIntyre, Keenan and others of being hired hands of corporations out to fight climate change legislation. The Guardian has found no evidence of that. Instead, they appear to be an unanticipated outpost of the rise of "grey power", retired numerate professionals with time on their hands, an obsessive streak in their heads and a cause to pursue. The story of the battles of McIntyre and his acolytes to access the raw data, and the protracted and generally failed attempts by the scientists to repel him, is the central story of the leaked emails from 2003 onwards.

At first McIntyre published regular peer-reviewed scientific papers, co-authoring a couple with Ross McKitrick. The mainstream climate scientists responded angrily to them. They often used their influence to exclude what they regarded as substandard papers from major journals. So McIntyre, McKitrick and other sceptical authors, like Patrick Michaels of the University of Virginia and the Cato Institute and later Keenan, increasingly used Climate Research and Energy and Environment – two peer-reviewed journals widely disliked by mainstream climate scientists.

Tensions were strained further when McIntyre published more of his deconstructions of published papers on his website, but without scientific peer review.

Strident though his website often is, McIntyre has usually avoided outright personal abuse. The abuse was usually only a link away on other sites, however. And few of McIntyre's targets distinguished him from more politically motivated foes. Santer, for instance, concluded in one email in 2008 that McIntyre "has no interest in rational scientific discourse. He deals in the currency of threats and intimidation." He believes McIntyre saw himself as the "self-appointed Joe McCarthy of climate science".

Last September, RealClimate, a website run by Mann and other climate scientists, summed up how mainstream scientists felt about this kind of scientific discourse. "The timeline for these mini-blogstorms is always similar. An unverified accusation of malfeasance is based on nothing, and it is instantly telegraphed across the denial-o-sphere while being embellished along the way to apply to anything hockey-stick shaped and any and all scientists. The usual suspects become hysterical with glee that finally the 'hoax' has been revealed ... After a while it is clear that no scientific edifice has collapsed and the search goes on ... Net effect on lay people? Confusion. Net effect on science. Zip."

McIntyre, they complained, kept his hands relatively clean. He never talked about a hoax being exposed, and rarely questioned the "edifice" of climate science. He just picked away, providing fodder for his more excitable and less fastidious fans. As the RealClimate post went on: "Science is made up of people challenging assumptions and other people's results ... What is objectionable is the conflation of technical criticism with unsupported, unjustified and unverified accusations of scientific mal-conduct." McIntyre rarely makes such charges personally but, they complained, he "continues to take absolutely no responsibility for the ridiculous fantasies and exaggerations that his supporters broadcast".

There was a clash of cultures, too, between the ways of Canadian mining prospectors and those of academia. As one academic put it to me: "I think McIntyre confuses the more aggressive and confrontational style of business he used as a geophysical consultant with the more even responses in scholarship exchanges." On the other hand, the CRU emails hardly suggest that the scientists are shrinking violets. When Australian climate sceptic John Daly died, Jones commented, "In an odd way this is cheering news."

In the final months before climategate, the battle was not a cultural one, or even really about climate change. It was about data pure and simple. McIntyre wanted the scientists' data. In one week in the summer of 2009, he showered CRU with 58 freedom of information requests. He often made it clear that he did not have any particular reason for requiring the data. He just wanted to liberate it. It was a battle to break down the walls of the ivory towers, to blow apart the cosy world of peer review. It was a battle for the heart and soul of science, and for its lifeblood: data.

Then came the stolen emails. Whether hacked from outside or leaked from inside, the emails lit a fuse, but the fuel of mistrust had been piling up for years. As a result, the bonfire has been spectacular.

Scientists in the firing line

Many of the researchers caught up in the "climategate" saga have spent years in the firing line of sceptics. And they have felt the heat.

In late 2006, I interviewed a number of them for an article in New Scientist magazine, which focused on how the propaganda war was shaping up prior to the publication of the next Intergovernmental Panel on Climate Change (IPCC) assessment the following year.

Kevin Trenberth had suffered abuse for publicly linking global warming to the exceptional 2005 Atlantic hurricane season, which culminated in hurricane Katrina. He told me: "The attacks on me are clearly designed to get me fired or to resign."

Ben Santer of the Lawrence Livermore laboratory in California, and formerly of the Climatic Research Unit at the University of East Anglia, was attacked for his role in writing the 1995 IPCC report, which claimed to see the hand of man in climate change. He said: "There is a strategy to single out individuals, tarnish them and try to bring the whole of science into disrepute."

Prof Mike Mann of Pennsylvania State University, fresh from his battle over the hockey stick in 2001, said: "There is an orchestrated campaign against the IPCC."

Funding trails to some of the more prominent sceptics also emerged at that time. Steve McIntyre, who runs the influential sceptic blog Climate Audit was free of financial conflicts of interest, but it emerged that prominent sceptic Patrick Michaels received hundreds of thousands of dollars in "consultancy" fees from the Intermountain Rural Electric Association, a coal-burning electric company based in Colorado. A leaked letter from the company's general manager, Stanley Lewandowski, said: "We believe it is necessary to support the scientific community that is willing to stand up against the alarmists."

The funding of climate sceptics has a long and probably ongoing history. In 1998, I revealed in the Guardian leaked documents showing that the powerful American Petroleum Institute (API) was planning to recruit a team of "independent scientists" to do battle against climatologists on global warming. The aim was to bolster a campaign to prevent the US government ratifying the Kyoto protocol.

The API's eight-page Global Climate Science Communications Plan said it aimed to change the US political climate so that "those promoting the Kyoto treaty on the basis of extant science appear to be out of touch with reality".

The leaked document said: "If we can show that science does not support the Kyoto treaty … this puts the US in a stronger moral position and frees its negotiators from the need to make concessions as a defence against perceived selfish economic concerns."

Its first task was to "identify, recruit and train a team of five independent scientists to participate in media outreach". It is not clear if the plan went ahead, but the policy objective was achieved.


guardian.co.uk © Guardian News & Media Limited 2010 | Use of this content is subject to our Terms & Conditions | More Feeds

The Register - Security Global gov's shrugging lets cybercrims frolic

Sex and drugs and Rickrolling in Madrid

Comment  Someone will have to die before governments take cybercrime as seriously as they take digital piracy, a panel on cybercrime and internet security was told last week.…

infosecurity.usLisa Benson: Jobs

infosecurity.usFinal Apache HTTP Server 1.3 Series Release

Apache Foundation Feather

The Apache Foundation, authors of the most popular web server product in existence – Apache HTTP Server – has released the final code update to the OpenSource groups highly respected web daemon. More information, with links,  appears after the page break.

Apache HTTP Server 1.3.42 Released

   The Apache Software Foundation and the Apache HTTP Server Project are
   pleased to announce the release of version 1.3.42 of the Apache HTTP
   Server ("Apache"). This release is intended as the final release of
   version 1.3 of the Apache HTTP Server, which has reached end of life
   status.

   There will be no more full releases of Apache HTTP Server 1.3.
   However, critical security updates may be made available from the
   following website:

http://www.apache.org/dist/httpd/patches/

   Our thanks go to everyone who has helped make Apache HTTP Server 1.3
   the most successful, and most used, webserver software on the planet!

   This Announcement notes the significant changes in
   1.3.42 as compared to 1.3.41.

   This version of Apache is is principally a bug and security fix release.
   The following moderate security flaw has been addressed:

     * CVE-2010-0010 (cve.mitre.org)
       mod_proxy: Prevent chunk-size integer overflow on platforms
       where sizeof(int) < sizeof(long). Reported by Adam Zabrocki.

   Please see the CHANGES_1.3.42 file in this directory for a full list
   of changes for this version.

   Apache 1.3.42 is the final stable release of the Apache 1.3 family. We
   strongly recommend that users of all earlier versions, including 1.3
   family releases, upgrade to to the current 2.2 version as soon as possible.
   For information about how to upgrade, please see the documentation:

http://httpd.apache.org/docs/2.2/upgrading.html

   Apache 1.3.42 is available for download from

http://httpd.apache.org/download.cgi

   This service utilizes the network of mirrors listed at:

http://www.apache.org/mirrors/

   Binary distributions may be available for your specific platform from

http://www.apache.org/dist/httpd/binaries/

   Binaries distributed by the Apache HTTP Server Project are provided as a
   courtesy by individual project contributors. The project makes no
   commitment to release the Apache HTTP Server in binary form for any
   particular platform, nor on any particular schedule.

   IMPORTANT NOTE FOR APACHE USERS: Apache 1.3 was designed for Unix OS
   variants. While the ports to non-Unix platforms (such as Win32, Netware or
   OS2) will function for some applications, Apache 1.3 is not designed for
   these platforms. Apache 2 was designed from the ground up for security,
   stability, or performance issues across all modern operating systems.
   Users of any non-Unix ports are strongly cautioned to move to Apache 2.

   The Apache project no longer distributes non-Unix platform binaries from
   the main download pages for Apache 1.3. If absolutely necessary, a binary
   may be available at http://archive.apache.org/dist/httpd/.

Apache 1.3.42 Major changes

  Security vulnerabilities

   The main security vulnerabilities addressed in 1.3.42 are:

  *) SECURITY: CVE-2010-0010 (cve.mitre.org)
     mod_proxy: Prevent chunk-size integer overflow on platforms
     where sizeof(int) < sizeof(long). Reported by Adam Zabrocki.

  Bugfixes addressed in 1.3.42 are:

  *) Protect logresolve from mismanaged DNS records that return
     blank/null hostnames. 

--
Colm MacC�rthaigh

infosecurity.usSherffius: The Moon

infosecurity.usNSA To Aid Google In Chinese State Sponsored Intrusion Investigation

prc

News, via Wired’s ThreatLevel blogger Kim Zetter, of a Freedom of Information Act request by EPIC [Electronic Privacy Information Center] pursuing information regarding the apparent assistance being rendered by the United States National Security Agency to Google Inc. (NasdaqGS: GOOG). Contrary to many pundits’ viewpoints, we applaud Google’s efforts to work with the NSA in an effort to protect the company’s and our information infrastructure. Specifically in response to the alleged Chinese state-sponsored cyberterrorism activities targeting the search giants internal networks (and in fact, hundreds of other businesses, agencies and institutions have also, suffered intrusions from Chinese based IP addresses] . More information, inclusive of linkage, appears after the jump.

From Wired’s ThreatLevel blogger Kim Zetter: “Google Asks NSA to Help Secure Its Network”

Google is teaming up with the National Security Agency to investigate the recent hack attack against its network in a bid to prevent another assault, according to The Washington Post. The internet search giant is working on an agreement with the controversial agency to determine the attacker’s methods and what Google can do to shore up its network. Sources assured the Post that the deal does not mean the NSA will have access to users’ searches or e-mail communications and accounts. Nor will Google share proprietary data with the agency. But the move is raising concerns among privacy and civil rights advocates. The Electronic Privacy Information Center filed a Freedom of Information Act request on Thursday, shortly after the agreement was made public, seeking more information about the arrangement (.pdf). Executive Director Marc Rotenberg believes the agreement covers much more than the Google hack and that the search giant and intelligence agency were in talks prior to Google discovering that it had been hacked. “What they’ve told you is that this is about an investigation of a hack involving China,” he told Threat Level in a phone interview. “I think and have good reason to believe that there’s a lot more going on.” Google declined to comment…”

SANS Internet Storm CenterMandiant Mtrends Report, (Sun, Feb 7th)

Once again a lazy weekend to catch up on some reading. One of the items that came across my email in the last week is the Mandiant Mtrends report.
Mtrends is a fairly concise report on Mandiant's view of the Advanced Persistent Threat (APT). If you are not familiar with the term, APTrefers to organized groups of professional hackers who have been targeting corporations and governments around the world. Mandiant has a unique perspective into this issue as one of few incident handling companies who have been on the front lines of the fight against the APT.
It does require registration to get your copy, but it is a good read.
I have my views on this report, but for those of you who take the time to read this report I would be very interested in your view of this threat, and Mandiant's report. In your view is this a realistic appraisal of the situation, or just more FUD (Fear, Uncertainty, and Doubt) added to the pile? Please provide your feedback via commenting to this diary or through our contact page.
-- Rick Wanner - rwanner at isc dot sans dot org

McAfeee Avert Labs BlogMcAfee Labs Q4 Threat Report

Today we unveiled our Q4 Threats Report, which highlights the most significant spam-generating stories in 2009 as well as the rise of political hacktivism in countries like Poland, Latvia, Denmark and Switzerland. The report’s findings also reveal that 2009 averaged approximately 135.5 billion spam messages per day, yet spam volume decreased by 24 percent in Q4 compared to Q3.

Spammers utilized headlines heavily in 2009, taking advantage of breaking news stories, global tragedies and timely events. The Air France plane crash and Michael Jackson’s death were among the top tragedies exploited by spammers last year. McAfee researchers also noted a significant number of 2010 FIFA World Cup-themed phishing scams, Zeus Trojans masked as the CDC, referencing the H1N1 vaccine program, and “get-rich-quick” scams due to the rise of U.S. unemployment levels.

Politically-motivated attacks are on the rise around the world, targeting popular social networking destinations, as seen recently with the Iranian Cyber Army’s political attack aimed at Twitter. The report confirms that the United States is not the sole target, nor is China the sole origin for these types of attacks with recent political attacks targeting the Polish government, the Copenhagen Climate Conference and Latvia’s Independence Day.
Malware including fake security software, attacks on social networks, and Auto-Run USB infections, continued to rise significantly last year. Internet-based, Web 2.0-centric attacks and threats on portable storage devices played a huge role in 2009, contributing greatly to the sheer increase in threats and demonstrating how the nature of computer threats are evolving over time. Cybercriminals used social networking sites to target a new generation of victims, with Koobface activity increasing considerably during the latter part of 2009. Koobface is now hosted by servers in 46 different countries, with the U.S., Germany and Denmark making up the top three hosting locations.

China Overtakes the U.S. as No. 1 Country Producing Zombies

Zombie production in the U.S. dropped significantly from 13.1 percent in Q3 to 9.5 percent in Q4, making China the top of Zombie-producing country at 12 percent. Brazil ranked third, with Russia and Germany rounding out the top five countries. The U.S. still remains the number one country in terms of spam production, with Brazil and India taking the number two and three spots. Ukraine and Germany joined the list of top 10 countries producing spam for the first time in 2009.

The Geographic Distribution of Web Threats

North America is the worldwide leader in hosting malicious content, with EMEA in second, followed by Asia/Pacific. In Europe, Germany holds the number one spot, followed by the Netherlands and Italy. China is the chief host for malicious content in Asia, followed by Russia and South Korea. South America is beginning to play a larger role, with Brazil as the top hosting country in that region.

China is the Worldwide Leader in SQL Injection Attacks

Although SQL-injection attacks originate from a number of countries across the globe, China was by far the number one country hosting these assaults at 54.4 percent. Due to the growing popularity of Adobe applications, McAfee Labs saw a number of client-targeted attack attempts to exploit Flash and Acrobat reader.

A full copy of the Q4 2009 Threats Report is available here.

Heise SecurityAdobe apologises for unpatched Flash vulnerability

Adobe has taken the bull by the horns and officially apologised for not fixing a flaw in the Flash plug-in which has been known since 2008. The delay was said to be caused by internal procedural problems

hackaday‘tiny’ power supply monitor


[Manekinen] built a power supply monitor based around an AVR ATtiny13. Voltage and amperage are displayed on a 16×2 LCD character display (we’re not sure what the third number is… samples per second?). This is no small feat considering that the tiny13 is an 8-pin chip. He makes it happen by using the pins for both LCD control and ADC input. To make this happen the HD44780 compliant display is used in 4-bit mode. Check out the video after the break and hit up the non-translated page if you want to download the source code and PCB artwork. A note of warning, he’s using the RESET pin for I/O which means once you burn the fuses you’ll need a programmer that has High Voltage Serial Programming capabilities if you want to reprogram the chip.

[Thanks RicoElectrico]

Heise SecurityCritical vulnerability in Novell's NetStorage

Novell is reporting a critical security vulnerability in NetStorage which can be exploited by a remote attacker to compromise a system. A patch is available to fix the vulnerability

Heise SecurityEU security agency advises caution when using social networks

The European Network and Information Security Agency has published a report that warns of the risks and threats of using mobile social networking services and also provides a list of "17 golden rules for mobile social networks"

Schneier on SecurityOutguessing the Terrorists

Isn't it a bit embarrassing for an "expert on counter-terrorism" to be quoted as saying this?

Bill Tupman, an expert on counter-terrorism from Exeter University, told BBC News: "The problem is trying to predict the mind of the al-Qaeda planner; there are so many things they might do.

"And it is also necessary to reassure the public that we are trying to outguess the al-Qaeda planner and we are in the process of protecting them from any threat."

I think it's necessary to convince the public to refuse to be terrorized. What frustrates me most about Abdulmutallab is that he caused terror even though his plot failed. I want us to be indomitable enough for the next attack to fail to cause terror, even if it succeeds. Remember: terrorism can't destroy our country's way of life; only our reaction to terrorism can.

CNET News.com - SecurityMicrosoft, Google split over browser bug bounty

Google follows Mozilla in launching program to pay researchers who find bugs, but critics say it won't necessarily pay off.

The Register - Security Safer Internet Day fights online foolhardiness

Kids get CEOP IE - rest of you can look after yourselves

Young surfers are being encouraged to practise safe computing and use common sense online on Safer Internet Day today.…

Security Circus - RaistlinWho’s Still Excited About the iPad?

Darknet HackersChinese Police Shut Down ‘Black Hawk Safety Net’ Hacking School

There’s been a LOT of news lately about attacks from China, Chinese hackers and sites from China propagating malware. The latest news is that China police have managed to shut down a hacker training operating that was schooling the next generation of Chinese script kiddies. It seems like China is grooming a huge cyberarmy both in the [...]

Read the full post at darknet.org.uk


Hack in the boxSpecial Report: HITB2009 CTF Weapons of Mass Destruction

A true 'hacker's conference' wouldn't be fun without a competition where hackers go head to head, tears are shed, and blood is spilled, and when we say blood we mean points. CTFs have always been about how good and fast you are at reversing and exploiting daemons and binaries. Sure it's fun and all but after a few years of the same thing, it's starts to get boring. Hence we decided to come up with CTF - Weapons of Mass Destruction (say it with me, destruktion!!!). Let's face it, acquiring allies and launching nukes at rival teams is much more fun than just reversing binaries and stealing flags. Strategy is everything! The crew worked hard through out the year, planning the game mechanics, designing the world map, and coming up with complex challenges for the game. Though there were some quirks here and there on game day, miraculously we pulled it off. The nukes weren't the only thing that was different. We also had no prize money for this year's CTF but teams still signed up anyway purely for the bragging rights. You guys are f@#&king awesome! So without further ado, the CTF crew brings you the writeup for Weapons of Mass Destruction 2009. Enjoy! https://www.hackinthebox.org/misc/HITB-CTF2009-Special-Report.pdf

Hack in the boxAdobe apologizes for festering Flash crash bug

An Adobe product manager has apologized for allowing a potentially serious bug in Flash Player to remain unfixed for more than 16 months. The admission, by Emmy Huang, product manager for Flash, came a week after Apple CEO Steve Jobs lambasted Adobe engineers as "lazy" and said when Macs crash, "more often than not it’s because of Flash." Adobe CTO Kevin Lynch struck back, insisting that at Adobe, "we don't ship Flash with any known crash bugs." The crash bug at issue in Huang's blog post published over the weekend was reported in September 2008, but it has yet to be excised from release versions of Flash. She said a beta version of Flash scheduled for official release later this year has fixed the problem.

Hack in the boxConficker outbreak infects Leeds hospital servers

Servers on the network of Leeds Primary Care NHS Trust were struck down by the Conficker worm late last week. The malware infection struck on Friday and forced administrators to take a handful of infected servers offline, in phases, in order to apply deworming tools. Trust PCs were not infected by the attack, which a leaked memo blamed on the connection of an infected laptop onto the network.

Hack in the boxIT hiring jumps in January

U.S. IT employment increased by 12,900 jobs, or 0.3%, in January, one of the best month-to-month gains since the recession hit in late 2008, the TechServe Alliance reported today. The positive news comes after the prolonged recession had reduced overall IT employment by some 200,000 jobs, according to the Alexandria, Va.-based IT services industry group, which tracks monthly changes in IT hiring based on its own analysis of U.S. unemployment data. The alliance's monthly calculations found that tech employment peaked in November, 2008, with some 4 million jobs. But in the first half of last year, IT employment fell off the cliff. The employment picture began stabilizing last summer. The January report lists a total of 3.823 million IT jobs.

Hack in the boxKorean government to spend $341M on IT workforce training

In another bid to enhance the competitiveness of the country’s information and technology sector, the Ministry of Knowledge Economy said yesterday it will spend 400 billion won ($341 million) to fund a four-year program aimed at fostering 41,000 experts in the field. The ministry said in a release that it will provide 401.1 billion won to help train 35,000 basic IT researchers for the corporate world, 4,000 IT workers for government agencies and 2,000 specialists for the IT convergence sector by 2013. The money will be filtered primarily to universities across Korea to develop training programs and provide students with financial support. The ministry said the program will focus on enhancing the skills of workers earning their master’s or doctoral degrees. In the past, most state programs centered on cultivating the country’s IT workforce targeted undergraduate programs.

Hack in the boxIntel, IBM roll out new computer network chips

US technology titans IBM and Intel have rolled out powerful new computer chips designed for businesses continually demanding more from networks and data centers. Intel introduced an Itanium processor 9300 series developed under the code name "Tukwila" that it touts as delivering twice the performance of prior generation chips. The 9300 series features two billion transistors per chip and four "cores," mini-brains that process data. "With the Gartner Group predicting a 650 percent growth in IT data over the next five years, businesses need increasingly powerful and scalable enterprise servers," Intel said in a release. Intel also said the chips are built to improve the ability of computer systems to recover from otherwise fatal errors.

Hack in the boxGoogle warns Chinese copycat Web site

Google Inc. has warned a copycat Chinese Web site to stop using a logo that resembles the U.S. Internet giant's or face possible legal action, state media reported Monday. The warning issued to the "Goojje" Web site comes as Google is contemplating its future in China after saying it would no longer obey government censorship rules and could pull out entirely over alleged cyberattacks. Google accused Goojje of infringing on its trademark rights, saying the logo of the Chinese Web site could make users believe it was authorized by or linked to the U.S. company, the Shenzhen Economic Daily reported. In a letter sent to Goojje by Google's lawyers, the U.S. Internet company demanded the Chinese site stop using the logo by Monday, the report said.

Digital SoapBoxA Quick Word on Security Conferences

Since I started speaking at conferences again just over a year ago I have started to notice a few things:

  • I am seeing the same people over and over
  • These same folks are the ones who already "get it"
  • Attendees vary by region (rarely do people get to travel too far)
  • Those that I can't say get it are -really- clueless
  • Some very basic concepts are still eluding many security conference attendees
  • Attendee counts have dropped drastically
Now, as a quick commentary on what this really means - I thought I would start by saying that I think it's good that we're getting attendees that continue to come out and support the cause.  Even though, predictably, the crowds are smaller it seems like the folks who are coming out are still fighting the good fight in their respective corners of industry.  My one concern is that the newcomers to some of these security conferences are really green.  I'm not talking about being environmentally conscious, I mean clue challenged.

I recently spoke at SANS, and while it was a small niche conference on the left coast I think we had a pretty good turnout.  My topic was pretty high level, speaking of the Web 2.0 dangers ("When Web 2.0 Attacks") and I could tell that some of the folks clearly got it - but what concerned me was that I could tell not everyone did.  Specifically speaking my talk wasn't rocket science and I wasn't releasing any ninja code-fu 0-day, nor was I explaining how to write shellcode for embedded systems ... this was conceptual "Web 2.0" stuff... hrmm.

I also saw some of the same things I'm used to seeing- people falling asleep (seriously, why show up?), people yacking on their cell phones or thundering away on their iPhone or BlackBerry keyboards answering emails (again, why come?), and then there were the glazed-over faces which can only mean one thing: clue challengedness.  I would break down the room like this: 30% got it (or they already knew it), 40% were being successfully woken up to the harsh realities, and the remaining 30% was absolutely lost.  I welcome you to read through the slides, then answer this one question: "Was this something the average person should comprehend?"

If your answer is yes - then you're in my camp.  You're wondering why people aren't getting int.  If you're answer is no - leave me a comment and I want to know where I failed.

Oddly enough, earlier tonight I had a great conversation with Jeremiah Grossman, and he reminded me of something someone had mentioned a while ago... There are no easy entries into web application security.  Think about it.  As Jeremiah put it- "If someone asked you right now what they should do to get into web application security, what would you answer?"  I've been asked that question many, many, many times and I always have a really crappy answer... because I fear there are no good resources for beginners.  I think that's a failure of those of us that get it.  I think we're completely failing to educate others and thus we're causing a serious lack of talent, and thus driving down the overall security posture all around.

Now, I get that some people simply can't travel due to insane budgetary cuts all around every industry but that's really no excuse to be clueless.  We shouldn't be (as Jeremiah put it) "eating our young"... but I'll let him expand on a post of his own.

I encourage those of you who are out there, and "in the know" to reach out and teach.  Help increase collective IQ of the security fold... the more smart people we have the better we all are.

Hack in the boxMicrosoft's Windows 7 chief: It's not us; it's your batteries

Microsoft’s President of Windows has weighed in about the reports of alleged problems with PC batteries coming from some Windows 7 users. Steven Sinofsky posted to the Engineering Windows 7 blog about the battery-notification issue on February 8. If you want to know all about battery performance, telemetry data, and more, read the full post. If you don’t have time, here’s the synopsis: It’s not us; it’s your batteries. Sinofsky blogged: “(E)very single indication we have regarding the reports we’ve seen are simply Windows 7 reporting the state of the battery using this new feature and we’re simply seeing batteries that are not performing above the designated threshold.” Sinofsky said that Microsoft and its partners have been investigating the reports, especially over the past few days, and have found the battery-metering feature of Windows 7 to be working fine. Because previous versions of Windows didn’t include this meter, some users may not have been aware their batteries were degrading, he said. But there is no truth to reports that Windows 7 is sapping batteries prematurely or that any drivers or the BIOS in Windows 7 PCs are not functioning correctly, Sinofsky said.

Hack in the boxAMD Reveals Fusion CPU+GPU, To Challege Intel in Laptops

The "Llano" processor that AMD described today in an ISSCC session is not a CPU, and it's not a GPU—instead, it's a hybrid design that the chipmaker is calling an "application processor unit," or APU. Whatever you call it, it could well give Intel a run for its money in the laptop market, by combining a full DX11-compatible GPU with four out-of-order CPU cores on a single, 32nm processor die. Details on the highly parallel vector hardware—the "GPU" part of the device—have yet to be disclosed, but AMD is focusing today's revelations on the CPU part of the design. In a nutshell, AMD has taken the "STARS" core that's used in their current 45nm offerings, shrunk it to a new 32nm SOI high-K process, and added new power gating and dynamic power optimization capabilities to it. Each out-of-order core has a bit under 35 million transistors, and a 1MB L2 cache that's not included in that number. AMD is targeting sub-3GHz operation, and a power consumption range of 2.5 to 25 watts.

Hack in the boxFormer Intel Exec Pleads Guilty in Galleon Insider Case

The tenth person to plead guilty in that Galleon insider trading case was a former treasury department executive at Intel. According to the New York Times, the man has agreed to cooperate with authorities but still faces up to 25 years in prison if convicted. Throughout 2007, the executive, Rajiv Goel, provided Mr. Rajaratnam with details of Intel’s quarterly earnings before they were publicly released. He also tipped Galleon’s founder about a pending joint venture between the Clearwire Corporation and Sprint Nextel, a deal that Intel planned to invest $1 billion in.

Hack in the boxHow to Jailbreak iPhone 3.1.3 IPSW with PwnageTool 3.1.5

With the PwnageTool app now updated for Mac OS X users, most of the iPhone Dev Team’s set of jailbreak and unlock tools now supports iPhone firmware 3.1.3, the latest update from Apple. Although Softpedia does not condone jailbreaking, those who do wish to employ these tools and hack their iPhones should at least follow a few guidelines, so they don’t brick their devices. “If you really truly feel that you need to update, [PwnageTool 3.1.5] creates a custom 3.1.3 IPSW for you to restore to on your iPhone 2G, iPhone 3G, iPhone 3GS with early bootrom, iPod touch 1G, and iPod touch 2G with early bootrom,” the iPhone Dev Team says in its recent blog post. “If you don’t know if you have an early bootrom or not, please avoid updating until you learn more [...] If you have an iPhone 3GS, PwnageTool works if you’re currently at version 3.1.2 or below (down to 3.0). [...] Don’t use PwnageTool on the iPhone 3GS if you’re at 3.1.3, it just won’t work (you will need to downgrade to 3.1.2).” “Also, if you use the blacksn0w unlock (currently at baseband 05.11.07), you will need to stay at 3.1.2,” according to the infamous team of hackers.

Hack in the boxYouTube confirms IPv6 support

YouTube confirmed that it now supports IPv6, the long-anticipated upgrade to the Internet's main communications protocol, in a blog post published Friday. "We're proud to make YouTube available over IPv6 and to begin streaming videos from a select number of sites worldwide to our Google over IPv6 partners," wrote Lorenzo Colitti, a Google network engineer. "With YouTube on board, we now have a significant amount of content delivered on IPv6 and a real audience/traffic for it." Earlier in the week, ISPs guessed that YouTube had begun production-level support for IPv6 because they saw a huge surge of IPv6 traffic leaving YouTube's data centers worldwide. In his blog post, Colitti said support of IPv6 was necessary to allow more people and devices to attach directly to the Internet.

Hack in the boxOpen source means freedom from 'anti-features'

Proprietary vendors are using "anti-features", features that no user would ever want, to protect intellectual property, Benjamin “Mako” Hill, from the Massachusetts Institute of Technology, told the linux.conf.au open source conference last month. But IP protection is only one of several reasons vendors introduce such features into their products. An anti-feature serves the interests of the vendor, he says, not the user. A typical example is the set of limitations placed on the Home Basic version of Microsoft’s Vista operating system; these restricted memory and disk-storage support and limited the user to at most three concurrent applications using the graphical user interface, Hill says. “The aim was to make it so bad that anyone would pay to upgrade to the next version,” he says.

Hack in the box£150m sting to infect computers with porn

A British couple had pornographic images of young children downloaded on to their computer by cyber hackers as part of a £150million international sting. The pensioners were told the conmen would continue to infect their PC unless they paid £20 for a code to crack the virus. They were victims of a Trojan horse virus called ransomware, which kidnaps documents and encrypts them, meaning users can no longer access their files unless they pay the demand by credit card. The scam has already netted the crooks £150million on both sides of the Atlantic according to the FBI. This year that figure is expected to double or even triple. Victims fork out the cash in US dollars through Western Union because they believe there is no other way of releasing their files. However, the problem can be cleared with free anti-virus software.

Hack in the boxCritical infrastructure under constant cyberattack

The coming May 2010 automated election is surrounded by controversy and a number of technological fears. It all started with the defacement of some government websites and now the much talked about importation of 5,000 jamming devices. All these sounded new to the ordinary people, but to those who belong to the I.T. industry - especially those who are involved in security knows that cyber attacks happen everyday, and the impact / cost is staggering. In a report “In the Crossfire: Critical Infrastructure in the Age of Cyberwar”, commissioned by McAfee and authored by the Center for Strategic and International Studies (CSIS) found that the risk of cyberattack is rising. Despite a growing body of legislation and regulation, more than a third of IT executives (37%) said the vulnerability of their sector had increased over the past 12 months and two-fifths expect a major security incident in their sector within the next year. Only 20% think their sector is safe from serious cyberattack over the next five years. A survey of 600 IT security executives from critical infrastructure enterprises worldwide showed that more than half (54%) have already suffered large scale attacks or stealthy infiltrations from organized crime gangs, terrorists or nation-states. The average estimated cost of downtime associated with a major incident is $6.3 million per day.

F-Secure - News from the LabBlack Hawk Down

Kudos to the Chinese authorities for shutting down an online hacker training operation known as the Black Hawk Safety Net.

The Black Hawk operation, which provides Trojan software and lessons in cyberattack techniques, comprises 12,000 paid subscribers and another 120,000 free members.

Three people who run the Black Hawk’s website have been arrested, and the site has now been blocked from access. The police also seized nine servers, five computers and a car during the raid.

For further details, you can read it at Yahoo! News.

On 09/02/10 At 03:59 AM

Hack in the boxHow O2 secured its network for the iPhone

When it comes to Apple’s iPhone, the following clichés must certainly ring true for network operators trying to support the iconic, bandwidth-hungry device: too much of a good thing; the devil is in the details; and perhaps above all: careful what you wish for, you just might get it. Led largely by the iPhone – the first device to make mobile browsing palatable, while also introducing a whole new world of traffic-consuming “apps” – today’s connected devices pose considerable challenges for network operators. Most of the attention goes to the network itself, both the need for upgrades to the radio interfaces that let users jump on the network at 3G and soon 4G speeds, as well as various aspects of the mobile transport network itself, including backhaul to and from cell towers and the emerging converged packet core. Yet such devices present a major challenge in another crucial area as well, one which, if it were to go untended, could result in even more dire consequences than a few dropped calls and a “there’s a map for that” ad campaign – namely, security.

Hack in the boxGermany to purchase stolen Swiss bank data for $3.5 million

German tax authorities are preparing to pay a hefty sum for information on tax evaders with accounts in Switzerland, but the deal looks well worth it. The state is expected to recover as much as 400 million euros in back taxes, a German newspaper reports Friday. The extent of tax evasion by a number of German citizens with Swiss bank accounts appears to be far wider than originally thought. As the German government prepares to fork out a considerable sum for a CD with information about Germans suspected of dodging taxes, a newspaper reports that tax authorities could recover up to €400 million ($500 million) in back taxes. According to a report in Friday's edition of the Süddeutsche Zeitung, German tax officials are basing their assessment on a sample of data relating to around 100 bank accounts that the informant has already provided them with. The German government has been criticized over the fact that it is willing to pay a large sum, thought to be around €2.5 million ($3.4 million), for the stolen data.

Hack in the boxInside CloudLinux's New Linux-Based Cloud OS

For the past 13-years, Igor Seletskiy has developed a series of innovative new products for the hosting industry, including the control panel H-Sphere, container-based virtualization product FreeVPS, single server control panel CP+, Web-based file manager WebShell, and website building tool SiteStudio. Now, Seletskiy is set to launch CloudLinux (www.cloudlinux.com), the first Linux–based, commercially supported operating system optimized for shared hosting providers and data centers, at the upcoming Parallels Summit 2010. The operating system increases server density by improving stability and reliability using isolation technology to create Lightweight Virtual Environments.

Hack in the boxIT Outsourcing: Why It Pays to Appraise Your Contract

Everyone knows a good outsourcing relationship needs to be actively managed. So does a good IT outsourcing contract. Most contain what Marc Tanowitz, principal of outsourcing consultancy Pace Harmon, calls "active obligations"-provisions to be completed post contract-execution that require periodic review or that may vary over time. Many of them can have a significant impact on performance and cost if neglected. Even a seemingly healthy IT outsourcing arrangement can benefit from an annual check-up to ensure that metrics are providing meaningful insight into performance, get an updated understanding of outsourced operations and how well they're running, and ensure that you're getting what you've paid for per the contract. If things aren't going smoothly, such a review can provide a platform for productive discussions with the outsourcer about why the relationship is faltering. And, in the worst case scenario, it can minimize the risks of transition for buyers thinking about walking away from a deal.

Hack in the box95% of user-generated content was malicious in 2H 2009

Wow. Security firm Websense just released a report on the cyber-threat landscape during the second half of 2009 and, I have to say, some of the findings were jaw dropping. I'll go through some of the highlights. First off: the firm, which scans millions of Web sites and e-mails a day looking for malicious content, found that 95 percent of all user-generated content came laced with some kind of spam or malicious link. "The notion that the Internet could be the great equalizer turned out to be true after all; unfortunately, it's mostly making suckers out of all of us," said the wonderful tech Web site Ars Technica on the matter.

Hack in the boxHackers training website shut down by China government

The latest happening in the internet world was China’s strict internet censorship and the country continues to stand firm as it has reportedly closed down the country’s supposedly largest training website for hackers. According to the government, the website called Black Hawk Safety Net, provided hacking lessons and sold malicious software. In addition, this has led to arrests of three people suspected of operating the website. Ever since the issue of Google threatening to leave the country, hacking has been a sensitive topic in China. Google reported that China-based hackers attacked its operations in which the Chinese government has denied anything to do with it.

CIO News AlertsCisco Picks Up Where Starent Left Off

Cisco on Tuesday will show just how serious it is about mobile data with the introduction of its first product derived from its Starent acquisition, the ASR 5000.

CIO News AlertsLondon Stock Exchange Appoints New CIO

The London Stock Exchange has appointed Antoine Shagoury as chief information officer.

CIO News AlertsRiverbed Releases Gigabit-Speed WAN Optimizer

Riverbed Technology announced new models of its network accelerator appliance, increasing the throughput for on-site and off-site backups to 1Gbit/sec.

CIO News AlertsMicrosoft, Google Team with MediaTek in Smartphone Push

Microsoft and Google have turned to Taiwanese chipset vendor MediaTek to boost their traction in smartphones aimed at China and other emerging markets.

CIO News Alerts2010: Finally the Year of the Mac?

Apple was a bright spot in 2009 in terms of PC sales, but the signals are mixed as to whether the Mac can grow beyond its niche

CIO News AlertsUsers Dispute Microsoft's Explanation of Windows 7 Battery Problems

Windows 7 does not ruin notebook batteries or issue premature warnings that the power is exhausted, Microsoft's head of Windows said in response to customer complaints.