UPDATED: Details emerge around Vogel/Reeves email flap

Tom White at VARight has posted his unbiased evaluation of the evidence presented on TBE of the email allegations.

Before you read what Tom White has said below, here are some facts I would also like you to consider:

1 email was sent to 1 SPECIFIC recipient (Travis Witt, a good friend and supporter of Bryce Reeves), by one unknown email originator. It was not addressed to a group, it was not send to a blind copy (Bcc) of unknown people, it was sent to ONE person by name.

That email was then shopped around to every major news outlet in the Commonwealth by none other than Bryce Reeves to try to threaten his opponent into getting out of the race. If it weren’t for Bryce Reeves taking this to every news outlet in the state, no one save Reeves and Travis Witt would have known anything about it.

I ask you; Is this the action of a man who cares about his wife and family?

Below is Tom White’s evaluation, and this is what Steve Albertson posted on the VA Right site comments regarding Tom’s post:

“Thanks, Tom. This is very helpful. I’ll send you unredacted versions. I don’t believe there has been a phone records subpoena, as neither Vogel has been a party to Reeves’ lawsuit, so as far as I know there is not yet any smoking gun one way or the other re the Google verification SMS.”

http://www.varight.com/opinion/my-unbiased-opinion-on-the-vogel-reeves-email-scandal/

Here is Tom White:

My Unbiased Opinion on the Vogel – Reeves Email Scandal

I am not supporting any State Senators in the Lt. Governor’s race this year. Neither Jill Vogel nor Bryce Reeves will see my endorsement for two reasons. First, neither has impressed me with their voting records. But the biggest reason by far is the balance of power in the State Senate. Vogel’s seat may be slightly easier to hold in a special election, but Reeves defeated long time Democrat Senator Edd Houck by a hair. And the last thing Virginia Republicans need is to lose the Senate majority. Terry McAuliffe and the Democrats have left the Commonwealth in a much weaker position and we will need both houses and the Governor’s office to restore the state to prosperity.

Right now, only Rep. Glenn Davis is in a position that will not adversely impact the Republican majority in the Legislature.

But if you have not seen the email story, it is in the Washington Post, and on TBE here and here. The second TBE link has several documents included which I have analyzed.

Just as a side note, I am currently an IT manager and have been in the computer and data communications field for over 30 years and have worked on computers for 44 years. I have been a consultant and have done corporate forensics and data restoration of deleted data. I have worked on military encryption gear and have basically spent my entire career in data and computer jobs.

Here is what happened according to the documents that were released.

On 9/22/2016 at 9:57 AM EDT a GMail account was created using the name Martha McDaniel. The email address was [email protected]. The IP address logged was 72.165.xxx.xxx. TBE redacted the IP address in most, but not all places. (They missed one.) Google requires a phone number or other means to verify the user. The phone number they used was 202-669-XXXX – again redacted by TBE. According to TBE, the cell phone number belongs to Jill Vogel’s husband, Alex. And they have a recording of the voice mail message which they claim has been removed that identifies the number as belonging to Alex.

Update – 1/3/17 3:21 PM

Steve Albertson was kind enough to send me the un-redacted documents and, as I expected, the IP addresses do indeed match. So I can verify that the redactions are not relevant to the story.

Problems I have with this:

We can’t verify the phone number because it is redacted and there is no Subpoena Duces Tecum providing records for the cell phone owner. And there is no way to verify the recording as being from the number that has been redacted. Absent some type of phone verification records, I cannot verify that the phone is actually the one tied to the Google account. But I assume they would be able to produce this verified evidence or open themselves up to a suit.

The next event of note was an email sent from this account on September 30, 2016 at 12:49 PM EDT. The IP Address used to log on and send the email was 2.165.xxx.xxx as redacted by TBE. Again, we have no way of knowing the important last two octets of the address.

Another problem with a potential defamation suit is that the email in question does not actually accuse or claim Reeves is having an affair, only that there are rumors.

So what are the un-redacted IP Addresses? TBE redacted a lot of IP addresses in the various documents, but they failed to redact two of the IP addresses. Jill Vogel’s IP address is 162.72.231.134. At the bottom of the page found here just below the redacted IP address that is circled shows the full IP on the bottom line. This is Vogel’s home IP. Or it was from September 19 – September 22 according to the document. And according to the document from Google, the Vogel household accessed the Gmail account 3 times for about 45 seconds total only on September 22, 2016. NOT the day the email was sent.

The account was accessed a total of 6 other times by IP address 72.165.161.144. (If you look at the top of the Century Link response found here you will find the un-redeacted address.) This is the IP address of Vogel’s neighbor who alleges that they operate an unsecured internet WiFi Connection.

So the Gmail account was created on 9/22/2016 from the Vogel neighbor’s internet for a period of about 40 minutes. 4 minutes later, the Google logs show an access from the Vogel’s internet address a total of 3 times for less than a minute altogether. The account was accessed from the neighbor’s account 8 days later on September 30, 2016 at 16:41 UTC which is 12:41 PM EDT. 5 minutes later, the person logged off at 12:46 PM. The email in question was sent at 12:49 PM on September 30, 3 minutes after the account was logged off. But that 3 minute gap is insignificant and most likely accounted for by clock drift. Then on October 1, 2016 the neighbor’s IP address was used to delete the Gmail account.

But what these documents produced so far show is that the Gmail account was not created using Vogel’s internet service. Rather, it was created using a neighbor’s account. And the email was not sent from Vogel’s account, again, it was sent from the neighbor’s account.

Just after the Google account was created using the neighbor’s internet account it was accessed using Vogel’s internet. Not long enough to do anything other than log on and off.

The bottom line is that the account was created on an open WiFi and the email was written on an open WiFi that does not belong to Jill Vogel. The fact that the account was briefly accessed using the Vogel internet service isn’t proof that she was responsible for the email sent 8 days later.

So Reeves will have a hard time proving not only defamation, but he will also have a hard time proving that Vogel even knew anything about it. There is a lot of circumstantial evidence that gives way to a lot of interesting theories, but there is no proof.

I would urge TBE to republish the documents without redacting the IP addresses. Often, internet providers own large blocks of addresses. Class B or even A. The first two sets of digits (octets) are the only ones assigned to the owner of a Class B block. And the last two octets change. Not that I think TBE is playing with the redaction’s, but since they missed completely redacting the numbers, I would like to see the un-redacted copy.

The phone number is understandable. But a Subpoena of the phone records showing a text from Gmail would be helpful.

And again, at this point I do not plan to endorse either Senator, so I am not pulling for or defending anyone here. Just looking at the evidence.

One thing Tom did not address is the possibility of IP spoofing which can easily be done. See this entry on Wikipedia, and note that there are commercial software programs used for testing websites which allow the user to do this easily.

https://en.wikipedia.org/wi…

“…commercial testing products (such as HP LoadRunner, WebLOAD, and others) can use IP spoofing…”

Not only are these products available to anyone, HP LoadRunner (for one) offers a free trial, so it would cost nothing to use it once for nefarious purposes. I’m just saying it’s possible.

Here is second article that Tom White published explaining why he now believes the Vogel internet might have been hacked:

http://www.varight.com/news/i-now-believe-lt-governor-candidate-jill-vogel-may-have-been-hacked-heres-why/

Read them and come to your own conclusions if you can, but at least you will have all the information available.

Perhaps some readers have forgotten some of Vogel’s past dirty tricks,
but I’ve been keeping an eye on her ever since she, one of her campaign
staff, and Loudoun County’s Commonwealth Attorney James E. Plowman (R)
(a donor to Vogel’s campaign) framed her Republican primary challenger
so she could win the 2007 27th District GOP Virginia Senate primary.
Unfortunately for her challenger (Mark Tate), he couldn’t prove his
innocence until after the primary, when those 11 felony charges related
to campaign fraud were thrown out of court. http://www.washingtonpost.com/…
Regardless, where does a good man go to regain his reputation
afterward, and this present kerfuffle again reeks of a political hit job
by Vogel, just as it did in 2007. Should it be proven true, well, at
the very least, the world should be informed in regards to one Jill
Vogel, whose entire campaign revolves around “Strong Family Values”.

I hear some of the Vogel supporters trying to push the “we were hacked” narrative, specifically wardriving. Wardriving is the use of software to locate unsecured access points to the Internet while driving around in a vehicle, and is relatively easy to do and can be effective in typical neighborhood, but given the terrain and distances involved at Casa Vogel, these assumptions change. The nearest road is about 450 feet away and the neighbor in which the internet is shared is about 1000 feet away, based on the Fauquier GIS information These distances require a directional antenna with an amplifier, as the signal is highly degraded by both distance and vegetation. Generally, a home wifi router is limited to about 300 feet, give or take. So, in order for someone to ‘wardrive’ their residence, they generally would need to be within 300 feet or so, or in their driveway. On at least 3 occasions and for 45 minutes the day the account was created based on the Google records. And then return to the vicinity of the Vogel residence to delete the account a week later. They would also need to access Mr. Vogel’s cell phone to obtain the authentication code at the precise moment it is sent, then delete it before he sees it, and then use the code to verify the Gmail account. Entirely possible in a technical sense, but highly unlikely.

This is an image of the distances involved. http://imgur.com/a/dINm5

I’m also sure Ed Gillespie *loves* hearing about Jill Vogel and shady ethical scandals.

So now Bryce has to decide whether or not to amend his complaint to join the Vogels as defendants and serve them with discovery requests. Responses to interrogatories are made under oath and subject to penalties for perjury.