Archive for August, 2013

The Guardian’s Curiously Crushed Computers

August 21st, 2013



This image has appeared in a number of articles on the Guardian’s website in relation to their dramatic claim that UK government agents destroyed hard drives containing data from the Snowden leaks.

Guardian editor-in-chief Alan Rusbridger described the event almost in passing in an opinion piece on David Miranda’s detention by UK authorities under Terrorism law – And so one of the more bizarre moments in the Guardian’s long history occurred – with two GCHQ security experts overseeing the destruction of hard drives in the Guardian’s basement just to make sure there was nothing in the mangled bits of metal which could possibly be of any interest to passing Chinese agents. “We can call off the black helicopters,” joked one as we swept up the remains of a MacBook Pro.

It’s a dramatic retelling of the event and leaves the reader with the impression that GCHQ officers came into the Guardian offices, demanded the computers and then proceeded to smash them. Subsequent articles from The Guardian have added a little more context – it was a decision that Rusbridger took in order to placate the agency and avoid possible legal action.

But still the story is dramatic – a senior editor and computer expert from The Guardian apparently carried out the destruction, under the watchful eyes of GCHQ technicians, with drills and angle grinders – the GCHQ agents directing which parts of the circuit boards should be attacked. Indeed in the pictures it’s obvious that many IC’s on the computer boards have been completely destroyed.

Why?! File storage is a pretty well understood technology, especially by computer experts and, presumably, GCHQ technicians. Files are stored on hard drives – spinning metallic platters with a magnetic coating. While there are ways to extract the contents of files from RAM while a machine is operating, that memory is volatile – it’s basically useless once power is disconnected. Simply removing the physical drives from the computers and cutting them in half would have done the trick. Entirely destroying the computers wasn’t necessary.

guardian-macbookSo, the picture. While there are various captions in different places the general impression is the same – the photo depicts the remains of “a computer” after the destruction. We can see part of a MacBook and it was a MacBook that was specifically mentioned in the first article. It appears we are to assume that we’re looking at the remains of a destroyed MacBook Pro.

But is it? What we can see is part of the iconic casing of a MacBook Pro and some circuit boards. To the general public is probably seems about right. But it’s not. Firstly the MacBook in the photo is largely undamaged with only light scuff marks, in fact it even appears to be powered up as the Apple logo is glowing. While the two black board in the picture do appear to be Apple logic boards, probably from a MacBook Pro Retina, the green and red boards really do not belong in a laptop. The red board is a PCI-express graphics card from a desktop computer. The green board isn’t easy to identify, but to looks more like it belongs in a printer than a computer. It has a metal bracket attached and the components are very sparse.

What we don’t see in the picture, surprisingly, are the remains of any hard drives. No casings, no platters. Nothing. Also the boards are completely destroyed – even the chips on the graphics card have been ground off. While graphics cards are very powerful these days, they do not store data. If destruction of data is the goal, a graphics card is not a target.

So what is going on? In general I don’t think The Guardian is lying about the event, but as seems so common with their Snowden-related coverage, later articles paint a more nuanced picture of events. The GCHQ expressed concern that the files being held at the Guardian presented a target for foreign governments or hackers. The Guardian made the choice to destroy the copies they held in London.

But the photo? Maybe it’s parts of a computer or computers they did destroy as described, but it looks like it’s a staged photo to illustrate their story. The MacBook in the picture isn’t damaged. Half of the parts aren’t from any laptop. None of the pictured parts have anything meaningful to do with the actual storage of data and the damage to them goes well beyond what might be necessary to make them non-functional.

It looks like the destruction we’d expect to see if this story played out in some Hollywood movie where everything has to look more dramatic and difficult, because simply drilling a couple of holes through the platters of a drive isn’t exciting enough.