Tag Archives: Google Cache

A computer forensics analysis of 2 Sandy Hook documents

This is a continuation (Part 5) of FOTM’s investigation into a curious document, Crisis Management Institute’s “Talking With Children About the Sandy Hook Tragedy,” which was uploaded to the Internet — and linked to the website of Arlington Local Schools, the Arlington Red Devils — four days before the massacre on December 10, 2012.

This is not just a matter for computer techies. Rather, this is a matter of grave import because the Obama regime and the Left are using the shooting murder of 20 elementary school children to justify (via appealing to our emotions) the most radical and restrictive gun control measures in U.S. history.

Before you read this post, please acquaint yourself with the posts that precede this one:

See also our “Sandy Hook Massacre” page for FOTM’s other posts on this tragedy.

FOTM is grateful to computer forensicist Peter Offermann for giving so generously of his time, expertise, and tireless labor to this inquiry.

~Eowyn

computer forensics

DETAILED ANALYSIS OF THE 2 GOOGLE CACHE RECORDS OF A NEWS ITEM ARCHIVED FROM THE ARLINGTON LOCAL SCHOOLS WEBSITE (ALS)

The Arlington Local Schools Website from which these Google Cache records originated was designed by a commenter here on FOTM called Jeremy. Jeremy also developed the SpireCMS (sCMS) software, which is a Content Management System (CMS), that runs the ALS website.

SpireCMS is similar, but not identical to other brands of CMS software such as WordPress (WP), Blogger, TypePad, etc.

Because I do not have access to SpireCMS, I cannot test it directly. However all CMS programs have key capabilities that are required to qualify them as CMS systems. I have identified one important difference between SpireCMS and WordPress which I will clearly define during this article.

My tests which will be illustrated below were conducted in WordPress.

What I will attempt to do in this article is prove technically, that the two cache records, shown in summarized form below, were created before December 14, 2012. Doing so would prove someone had foreknowledge of the Shooting Event about to occur at the Sandy Hook School.

Jeremy claims that errors in his code forced the school to pre-date news items in order to get them to appear in the news stream. Jeremy did not offer any technical proof of this when asked to backup his claim. All we have is his unsubstantiated word about what happened. Because of the importance of the Sandy hook Event I cannot just accept anyone’s word that they made a mistake. I need to see concrete proof that indeed an error caused those Google cache records to appear.

Lacking proof from Jeremy I have done my best to reverse engineer what happened on the ALS website. I did this by using the many clues that are available when examining a website from the outside, if one is familiar with the technical aspects of computer software, CMS based websites, database functionality which is the core component of CMS systems, and Internet infrastructure.

In order to convince you that I am right, I need to simplify the explanation of what occurred at ALS to the point that a layman can understand it. In an attempt to do this I will break the explanation into individual related segments so each concept can be grasped by itself, instead of being confused with others.

STAGES

1) Identify and explain the important elements on the 2 Google cache records. They tell us very specific things about the records. They will allow us to identify the date, possibly dates, the records were created.

2) Step through the process of creating such a news item in WordPress to illustrate how the website code handles these pieces of information.

3) Point out a key difference between how sCMS and WP treat such items.

4) Summarize the above to the point it demonstrates conclusively that the documents were created on the dates shown in the PERMALINK.

5) Disprove Jeremy’s claim that back dating a news item would cause what is shown in the 2 Google cache records.

6) Explain conclusively…

a) how the two document came to be cached by Google.
b) what the two dates on the cache records, Dec 18, 2012 and Jan 12, 2013 refer to.
c) The significance of the Google search return of Dec 13, 2012.
d) The findings, and non findings, in the WayBack Machine Archives of these news items.

This article will only contain stages 1 through 3.

Stages 4 through 6 will be dealt with later in the discussion below the article.

————————————————————————————

STAGE 1

Below are 2 images that summarize the important elements on the 2 Google cache records.

doc-1-close-marked_thumb

doc 2 closeup marked

You can click the icons below to view the original screen captures of each page in order to verify that the important parts of those pages shown above are accurate. (Close the new window to return here.)

doc1icon doc2icon

Please notice the word PERMALINK in the two images above. In both items the word points at a URL, (webpage address) where the page referred to can be found on the internet as long as it exists.

DEFINITION OF PERMALINK http://www.techterms.com/definition/permalink

Short for “permanent link.” A permalink is a URL that links to a specific news story or Web posting. Permalinks are most commonly used for blogs, which are frequently changed and updated. They give a specific Web address to each posting, allowing blog entries to be bookmarked by visitors or linked to from other websites.

Because most blogs are published using dynamic, database-driven Web sites, they do not automatically have Web addresses associated with them. For example, a blog entry may exist on a user’s home page, but the entry may not have its own Web page, ending in “.html,” “.asp,” “.php,” etc. Therefore, once the posting is outdated and no longer present on the home page, there may be no way to access it. Using a permalink to define the location of each posting prevents blog entries from fading off into oblivion.

A section of the permalink/url is outlined in red in both documents. One of the circles in each document highlights /2012/12/10/.

Each document also has a second red circle surrounding a date. These circled dates are the ‘Published Date’ of the document. Notice they are different. One says December 10, 2012 and the other says December 13, 2012.

REGARDING WORDPRESS>——————————————-

Both the ‘/2012/12/10/’ in the permalink, and ‘Dec 10, 2012′ in the published date are dates. The dates are just shown in a slightly different format.

When WP is configured to use /yyyy/mm/dd/ in the permalink structure an author cannot directly edit the /yyyy/mm/dd/ in the permalink.

However the author can cause the /yyyy/mm/dd/ in the permalink to automatically change by changing the ‘published date’ they can change in the document.

Within WP the date embedded in the permalink link will always match the published date of the article.

A WP author can either pre or post date an article to whatever date they choose BUT the permalink and published dates will always match.

that is…

If the news item was created on Dec 17, 2012 and was published on that day the permalink would contain /2012/12/17/ and the published date would show December 17, 2012.

If the author decided they needed to change the published date to a prior date they could change the published date to December 10, 2012. The permalink would then contain /2012/12/10/ and the published date December 10, 2012. Although a different date than the original date of Dec 17, 2012, within the edited item the dates would still be identical.

Because the permalink and published dates within WP are always identical it is impossible for a reader of a news item to determine on what date the news item was actually created. This is because the author can change both the visible date indicators to whatever date desired.

REGARDING SPIRECMS>————————————————-

sCMS uses the same date formats as WP but the way the permalink and published date relate is crucially different.

Notice that in the second document, the permalink has /2012/12/10/ BUT the published date is different at December 13, 2012. To create a document with such a difference is impossible within WP. In WP the dates will ALWAYS match.

Within sCMS the permalink is indeed permanent and always points at the date the item was first created. The author changing the published date does not change the permalink.

Within sCMS if the permalink states /2012/12/10/ it means that is the date that item was first created.

Within sCMS the published date can be set to whatever date the author desires in order to place it properly in the news stream but the permalink will never change.

SUMMARY STAGE 1 >—————————————————-

The above is not yet proven, it is only a statement made by myself. The following stages will provide the proof. I’m sure both Brant and Jeremy will hotly dispute my conclusion in the comments below. I look forward to answering all their questions then.

The critical thing to remember from this stage is…

Within SpireCMS the actual created date of a news item can be determined from the date embedded within the PERMALINK.

——————————————————————————–

STAGE 2

This stage will step through the process of creating a news item in WordPress to illustrate how the website code handles permalinks and published dates.

This stage will confirm what I said about WP above is true.

In a recent discussion about this, Brant produced several videos trying to demonstrate what I say about WP isn’t true, but all his tests were flawed, as they didn’t match the conditions in sCMS. Yes, WP can act differently than I said in some circumstances, but only when it is configured differently. When WP is configured to embed dates in the permalink it always acts the same.

I have not yet seen a reply video from Brant, after I specified he match the sCMS layout. I am curious to see if he managed to get WP to do what I could not.

I do not have the available bandwidth to easily produce videos. I also find videos about technical issues are not great at studying the subject at hand in detail because important information slips by too quickly.

For my demonstration of how WP acts when configured to embed dates into permalinks, I will instead use annotated screen captures.

Unfortunately to see the important information requires the images to be larger than fit comfortably in the layout of FOTM so they have been shrunk to fit.

To view the images at full resolution click on the image and it will expand. Use the back button to return to the article.

The first image below shows a news item post I made on Feb 7, 2013. I did not touch the published date and it automatically defaulted to the current date in both the published date and the permalink.

I clicked publish and then went to the news section of the site to view it. The result is shown below. notice the red markup I did. The dates are the same in both places.

feb-6-011

(click the image above to see a full resolution copy)

I then went back and edited the news item by only changing the published date to January 7, 1999.

I pressed publish after setting the new date and again went to the news section to view the article.

The result is shown below. Both the permalink and the published date now say January 7, 1999. Though a different date than before, they are still identical.

This means that there is no clue on that page as to when the page was created. As a viewer it is impossible to know that it did not originate on January 7, 1999. Only the author knows for sure.

feb-6-012

(click the image above to see a full resolution copy)

SUMMARY STAGE 2>——————————————————

In my tests above, I was able to return the published date back to the original date successfully while still making the news item visible to the public. In WP you can change the published date as often as you like and every time the permalink will match the current published date.

Looking back at the DEFINITION OF A PERMALINK suggests that WP permalinks don’t fit that description. In WP it appears possible to change the PERMALINK of an item whenever you feel like it. That’s not permanent.

There is an explanation for this seeming anomaly.

It is shown in the image below.

feb-6-013

(click the image above to see a full resolution copy)

What is shown in the image above is the bottom of the editing page where an author writes material. it shows that WP automatically saves many copies of the same document in the background as an author works. This allows the author to go back to an earlier version if they make a catastrophic mistake.

Each news item in WP and sCMS is a record in a database. Each revision of a document in WP is also a separate record in a database.

A database is like a fancy spreadsheet which some of you might be more familiar with. The image below illustrates what a record looks like when shown in a spreadsheet. Database records can easily be moved back and forth between databases and spreadsheets.

feb-4-018-sm

(click the image above to see a full resolution copy)

The blue horizontal line above is one record in a database. It can store all the information needed to show a single news item. The RECORD is broken vertically into FIELDS such as shown in the last blue column on the right.

The information in each record is broken into pieces so that information common to all records can be easily accessed. The column titles show the field names. ‘Document name’ is in one field, ‘document text’ is in another and so on.

The section in red is the PERMALINK area of each record. In this example the permalink is composed of the contents of three different fields. Site Address, Document location, and document name.

If you look at the items in the rows numbered 107 thru 111 you will first see two news items listed that were on the ALS website during December 2012. The last 3 items at first glance appear to be duplicates of the news item we are discussing.

If you look more closely at those 3 items you will discover differences in the Document Location Field, first record has /2012/12/10/, second record has /2012/12/11/ the third record has /2012/12/12/. The Published Date field has Dec 10, 2012, then Dec11, 2012, then Dec 12, 2012.

The above illustrates that WP doesn’t actually break the rule that a PERMALINK be permanent. It only appears to do so. Each record, there are 3 for the same article above, always keeps its own permalink.

In WP what automatically happens without authors realizing it when they change the published date of a document, is WP creates a duplicate new record of the original document.

The difference between records can be as little as a new copy having unique permalink and published dates which are different from the original record. The text content of the different records could also vary.

—————————————————————————————-

STAGE 3

In the image below I embedded the second Google cache record so you can see how it is different than what WP does. I found it impossible to get WP to match the Google cache of the Dec 13th, 2012 sCMS news item shown below.

feb-6-015

(click the image above to see a full resolution copy)

SUMMARY STAGE 3>——————————————————-

The reason sCMS does not treat permalinks and published dates the same as WP is most likely because it does not keep different revisions of documents. I can’t say that for sure without having access to sCMS but it would technically explain why the PERMALINK doesn’t always match the published date in sCMS.

If the above is the case, then when an author edits a news item in sCMS, they always work on the original record of the first news item. sCMS does not automatically create revision copies in the background.

Because there is always just one copy of any news item in the sCMS database, unlike WP that can contain many copies of each news item, sCMS cannot allow the PERMALINK to change in order to preserve the sanctity of PERMALINKS.

In sCMS when an author changes the published date, it does not also change the permalink date.

For technical reasons beyond the scope of this article, the sCMS way of dealing with news items is superior to WP. It allows search engines to access changed news items more efficiently than WP. It also avoids breaking links to the article my other sites.

The above statement suggests that even if sCMS does implement document revisions, they chose to keep the original permalink intact in all revisions in order to get more reliable results from search engines and outside links.

I can’t tell which is the case but the Google cache record with a permalink date of Dec 10, 2012 and a published date of Dec 13, 2012 clearly demonstrate sCMS did allow the two dates to part ways. Computer programs are not like humans who can change their minds willy nilly. A specific process will always act the same.

There is no other logical explanation for the difference in dates on that Dec 13, 2012 Google cache record.

If that record was created on December 17, 2012 as Jeremy states, the permalink would show /2012/12/17/ and the published date would show, December 13, 2012, not /2012/12/10/ and December 13, 2012.

FOOTNOTE STAGE 3>——————————————————

While conducting these test in WP I conducted one other test which will become relevant later. I will add it here as it is somewhat related.

Jeremy claims there is a problem in his software with dating items. I wanted to rule out one possible source of error.

I wanted to confirm that if the person entering a news item, be it someone at ALS, or at CMI, had the date on their computer set incorrectly, the news item would still show the correct default date in the news item because it used the clock of the host server in San Antonio to get the current dates.

We discovered earlier in a previous article when doing a whois of the ALS site, that the host server in San Antonio also contained 25 other websites.

Jeremy stated that the dating issue at ALS was a bug that existed for quite a while but ALS personnel never informed him so he could fix it. It is highly unlikely that the clock on a server serving 25 websites was wrong for an extended period. In my mind that rules out a clock problem causing the problems at ALS.

The results of my test are shown below.

feb-6-009

That’s it for this article.

Peter

Update (Feb. 9 2013):

Peter’s computer crashed again. He will respond to comments/questions when he has everything restored. Stay tuned!

~Eowyn

Sandy Hook Massacre: The People v. Crisis Management Institute

This thread is a continuation of the January 26 post, “How we know a guide on counseling children about Sandy Hook predated the massacre.

For the back story of this, see “Guide on how to talk to children about Sandy Hook 4 days BEFORE massacre,” Jan. 16, 2013.

Peter, the author of “How we know a guide….,” continuea to make his case with “Exhibits” on some highly technical aspects of “How we know….” I will be adding to this post, so please check back for updated material.

If you write a comment, please refer to the particular Exhibit to which you’re addressing, as in “re. Exhibit #1″ or “re. Exhibit #2.”

Peter will present his case as a prosecutor at a criminal trial. Let’s call it “The People v. Crisis Management Institute-Arlington Red Devils.” Below is his “Opening Statement.” I will be adding his Exhibits, as he writes them.

~Eowyn

_______________________________________________

The People v. Crisis Management Institute-Arlington Red Devils

So that I can place all the information I have for you to consider here in an orderly fashion I will present it in the fashion of a prosecutor in a criminal trial.

At the start of a Criminal Trial the Prosecutor makes a statement explaining what the Crime consists of, who he thinks is the criminal, and outlines how he intends to provide evidence showing that his case is accurate.

OPENING STATEMENT

On December 14, 2012 there was a School Shooting Incident at the Sandy Hook School. Some days after the actual shootings, Documents 1, 2 & 3 in “How we know a guide on counseling children about Sandy Hook predated the massacre were found on the Internet. We will examine all 3 very closely to determine how they came to exist.

Documents 1 & 2 were found in Google’s Webcache, a place that records all public documents Google finds on the Internet.

Document 3 was found using the Google search engine.

The published dates displayed on all three documents predate the events of Dec 14, 2012.

Document 1 shows Dec 10, 2012, Documents 2 & 3 show December 13, 2012.

Our task here is to examine and present all the evidence available to us in order to determine whether the documents originated before or after Dec 14th, 2012.

The process will have 3 stages.

1. Determine if there is enough evidence to proceed with this investigation. If there is not enough evidence stop here. If there is enough evidence go on to stage 2.

2. Determine the date the documents were created. If the document are shown to originate after the events stop here. If the documents are shown to predate the actual event proceed to Stage 3

3. Determine who is responsible for creating Documents 1, 2 & 3 as they appear within Google’s servers.

If it is proven the documents did originate before Dec 14, 2012, it means that someone had foreknowledge and it was likely a massive preplanned event rather than a random shooting caused by a deranged individual.

Determining who falsified the documents will point to the guilty party by determining who had the access required to change them and also who had a motive to change them.

EXHIBIT 1: Who Had Access?

The Arlington Schools, not school Website functions within computer software called SpireCMS, the developer of this software and most likely the designer of the website is present here as commenter Jeremy.

I owe him an apology for something I had written in public on this thread. [Note from Eowyn: I've since deleted Peter's accusatory comments about Jeremy, and have apologized to Jeremy.] I said what I said in public because my communication with the staff here is limited. I am only a guest here as Jeremy is. I am ALWAYS open to changing my opinion if I discover I have been wrong.

Jeremy could provide much valuable information about the site in question if he chooses to do so. I hope he does.

I am going to place many urls / weblinks in this thread which will allow you to go to the actual sites being discussed whenever possible.

The first website is: http://www.arlingtonlocalschools.com/

To go to the site, copy and paste the url above into another window of your browser.

Visting the site shows us the schools are located in Ohio. The website shows an address of 336 South Main Street, Arlington, Ohio 45814; phone: 419-365-5121; fax: 419-365-1282. I assume this is their School District’s Office.

There is an Internet Tool called Whois which when used in conjunction with a search engine such as Google will return detailed information about websites.

To find out where the computers that hold the Arlington Schools Website are located, I did a whois and checked two different databases.

1. http://www.ip-adress.com/whois/arlingtonlocalschools.com

The results are:

This report on Arlingtonlocalschools was run on January, 01, 2013.
Arlingtonlocalschools.com Server Details
IP address:
184.106.51.33
Server Location:
San Antonio, TX in United States
ISP:
Rackspace Hosting

2. http://whois.domaintools.com/arlingtonlocalschool.com

The results are:

25 other sites hosted on this server. Remember this it will be important.
IP Address:
184.106.51.33
IP Location:
United States – New York – New York City
Domain Status:
Registered And Active Website

I have not included all the information available, only what is relevant here. You can verify what is here is accurate by using the url’s.

I won’t explain what everything here means, just tell you what it tells me in plain English. Other techies are welcome to comment if they feel I am wrong.

The Arlington School’s Website is not physically located in Ohio where the schools are. Until at least Jan 1, 2013, they were on a server located in Houston, Texas. The site was recently moved (Jan 1, 2013) to a server located in New York City.

The above means that when staff at the Arlington Schools’ Office sit down at a computer to manage the website, they are not working on a Website hosted locally on a computer in their offices. Until Jan 1, 2013 they were managing their website on a server located in Texas and from that date to the present on a server in New York.

Jeremy’s SpireCMS is what easily, without technical skills, allows them to do this.

SpireCMS, that’s used by Arlington Schools, is an example of Content Management Systems (CMS). So is WordPress, that’s used to create and manage this blog, FOTM. Content Management Systems easily allow owners with very minimal technical computer skills to make available to the public whatever information they like.

The staff person at the school in Arlington who maintains the website, could as easily be sitting here beside me in Ocean Falls and do everything they could from their office. Neither location is where the Website server computer is.

All that is required to do this is for the staff person to have a username and password with authorization as an administrator.

Obviously you don’t want everyone who uses the site to have administrator rights as anyone could then possibly do serious damage or steal confidential information.

CMS systems commonly allow a number of different levels of access, such as (I won’t mention all of them here, only enough to illustrate what is needed):

  • End Users: such as parents or children who can only comment as we guests on FOTM can. They can also possibly access areas of the site not open to the public.
  • Authors: Authors are allowed more privileges than End Users but not all the privileges of an administrator. They cannot change the site layout or functioning, they can only create documents and place them where needed. While creating documents they are allowed to upload files from their own local computer to add to the document they create. The uploaded documents can be pretty much anything, a picture, a video, a song, a pdf file.
  • Administrator: An admin can do everything an author can plus tweak all the controls on the site.

The link below is live and can be clicked directly to see how authority is set:

http://www.oceanfalls.org/misc/sh/a2/wpuser.jpg

It will show the section of the WordPress control panel on one of the sites I manage which allows an administrator to authorize each member with their own unique privileges.

All that the staff person at Arlington Schools would need to do to authorize a trusted person to upload and create content on the site is to go to that member’s profile record, partially shown above, open the dropbox as illustrated, and decide what they will allow that person to do.

That person could then access the School’s website — Arlington Red Devils — from any Internet connection in the world.

Giving such a person any privilege from author up, would allow them to do everything required to create and place the Documents 1, 2, & 3 we are discussing, without the intervention from anyone directly associated with the school.

If Jeremy would be so kind as to confirm spireCMS works similarly to this and has the same capability, it would prove someone could place the documents without anyone at the school knowing about it.

If Jeremy won’t confirm this, I will ask Eowyn, the owner of this site, to temporarily elevate my privileges so I can demonstrate how it is done.

The above proves to me conclusively that the possibility that someone not directly associated with the school could have uploaded and created the content we are discussing.

If we all agree with my conclusion we can continue on and next try to determine if anyone outside the school had opportunity to create the material by being given such authority.

-Peter

================================================

Update (Feb. 8, 2013):

Peter continues to make his case by examining two Google cache documents. See “A computer forensics analysis of 2 Sandy Hook documents,” Feb. 8, 2013.

How we know a guide on counseling children about Sandy Hook predated the massacre

This is the second piece by guest columnist Peter Offermann, on the Crisis Management Institute (CMI) pdf document puzzle. FOTM is grateful to Peter for giving so generously of his Internet technical knowledge and analysis.

Here is the first part of Peter’s analysis: “An Analysis of Anomalies on ArlingtonLocalSchools.com (Part 1),” Jan. 22, 2013.

For the background on the CMI document, see “Guide on how to talk to children about Sandy Hook 4 days BEFORE massacre,” Jan. 16, 2013. For FOTM’s other posts on the massacre, go to our “Sandy Hook Massacre” page.

~Eowyn

CNN #2 The school these police officers were running into is NOT Sandy Hook Elementary School! See “CNN deception: Live aerial footage of police running into Sandy Hook was of another school,” Jan. 22, 2013.

HOW TWO  GOOGLE CACHE RECORDS WITH PUBLISHED DATES PREDATING THE EVENTS AT SANDY HOOK SCHOOL CAME INTO BEING

By Peter Offermann

I will refer to 3 images in this document that show the anomalies in the Google cache records of The Arlington School’s News Items.

Document 1 is an image of a Google cache record showing a published date of Dec 10, 2012 which  states Google recorded it on Dec 18, 2012.

The URL below used to access the page imaged below – it now returns a 404 page error. Anyone that has copies of the image please keep it safe.

http://webcache.googleusercontent.com/search?q=cache:http://www.arlingtonlocalschools.com/news/2012/12/10/talking-with-your-child-about-the-sandy-hook-tragedy

it could also be accessed from

HTTPS://www.Google.com/search?q=inurl:http://www.arlingtonlocalschools.com/news/2012/12/10/talking-with-your-child-about-the-sandy-hook-tragedy&as_qdr=y15

by selecting to view the page.

It now returns….

Your search – inurl:http://www.arlingtonlocalschools.com/news/2012/12/10/talking-with-your-child-about – did not match any documents. Reset search tools

DOCUMENT 1

DOCUMENT 2 below is  an image of a google cache record showing a published Date of Dec 13, 2012 which states Google  recorded it on Jan 12, 2013.

As of this writing, January 25, 6:21pm PT it is still available at the url below.

http://webcache.googleusercontent.com/search?q=cache:http://www.arlingtonlocalschools.com/news/2012/12/10/talking-with-your-child-about-the-sandy-hook-tragedy

DOCUMENT 3  is an image of a google search return to a document Published  Date of December 13, 2013 the same as in Document 2.

The link to this page has been disappeared by google as of today.

https://www.google.com/search?q=inurl:http://www.arlingtonlocalschools.com/news/2012/12/10/talking-with-your-child-about-the-sandy-hook-tragedy&as_qdr=y15

DOCUMENT 3

I am going to explain to you in this article how those document came to appear on the internet on the Published Dates shown, December 10, 2012 and December 13, 2012. I will also explain how the search return came into being.

In order to do this I am going to ask you to suspend disbelief so you can follow the timeline explaining the documents.

Events like 9/11 have demonstrated that news items about them appear almost instantly after such events. Many are complex documents that would be impossible to create in that short a period of time. If someone is preparing a false flag the most effective period to introduce your desired interpretation of the event is immediately after the event while people are still in shock. In order to meet a tight deadline there are many trusted people working in the background preparing documents and then sitting and waiting to pull the trigger and make them public the moment the event is planned to occur. These people are scattered all over and working off their own script with a time to make their information public.

CMI (Crisis Management Inc) which had author permissions on The Arlington School Website as a contractor to upload their material to the website as needed. They could upload, create links to their material, and publish news announcements all from their own offices without anyone from the School being involved.

The School shootings that took place in Sandy Hook on December 14, 2012, were originally planned to happen on December 10, 2012.

If you check on a calendar you will see Dec 10 was a Monday and a school day so the event could have been planned for that date.

DECEMBER 10, 2012

Everyone involved with media material had the material prepared referring to the date Dec 10, 2012.

On December 10, 2012 someone at CMI was waiting to pull the trigger and publish the news item (Document 1) and related documents such as the pdf the news item announces.

For some reason the event was called off at the last moment.

Everyone who had planned to submit material was frantically called to NOT submit their material.

The message for some reason didn’t get through to CMI in time and they submitted the pdf, created the link to it, and published the news item shown in Document 1 .

The other anomalous documents predating Dec 14, 2012 that appeared all over the Internet originated the same way. (See “Sandy Hook RIP/donation webpages created BEFORE the massacre,” Jan. 8, 2013; and “Another Sandy Hook fundraiser that pre-dates the massacre,” Jan. 17, 2013. ~Eowyn)

Because of a technicality (RSS Feed) that is explained by the developer of the program that manages the Arlington Schools site a record of the document immediately left the site and was submitted to people hooked up to the feed as well as to Google which published the item for availability in their search engine. (see document 3)

Google took the opportunity while going to the site to capture the thumbnail of the page seen on the right of document 2 to also put it into their cache database.

In the Technical Discuss Thread at http://fellowshipofminds.wordpress.com/2013/01/21/sandy-hook-phony-documents-open-thread/#comment-164225

Jeremy the developer of the software SpireCMS which the School uses to manage their website stated: “When a news item is created in our system, it is pushed out via an RSS feed and, Google has it indexed usually under 24 hours.”

The above means the article could be found on the Google search engine on that date and also in their cache shown in Document 1.

The search record was scrubbed by Google for this Dec 10, 2012 item, but events that took place on Dec 13, 2012 caused an identical entry to be made only with a published date of December 13th. I’m not sure why it wasn’t scrubbed by Google before today. It is shown in Document 3.

DECEMBER 13, 2012

The Sandy Hook Shooting event was rescheduled to this date and was again scrubbed. It Was a Thursday, also a viable date.

It was again scrubbed for some reason.

CMI  again did not get the word to not publish in time.

They published the news item again, on Dec. 13,  but this time with a published date of Dec 13, 2012 causing another RSS submission creating Document 3  and also a second cache record (Document 2).

Jeremy stated above that “Google has it indexed usually under 24 hours” which means Document 1 would originally have shown either “as it appeared on 10 Dec 2012 or possibly 11 Dec 2012.”

The December 13, 2012 (Document 2) would originally have shown either “as it appeared on 13 Dec 2012 or possibly 14 Dec 2012.”

No one in the loop realized there was an RSS feed on the news items at Arlington School and that the 2 pages (Documents 1 & 2) were recorded in the google cache.

AFTER DECEMBER 14 

Some bright Internet users discovered the cache records predating the actual events and all hell broke loose.

The people behind the false flag frantically tried to cover up these incriminating cache records  and the search return.

For technical reasons too complex to explain here, it was impossible to erase the records.

Publicly removing the cache document after they were found would also be suspicious.

As a temporary fix someone authorized by Google edited the records as below.

Document 1, which first read “as it appeared on 10 Dec 2012 or possibly 11 Dec 2012 was changed to read 18 Dec 2012” — a date after the events of December 14th. This document was still suspicious but at least is showed it was recorded after the event it announced.

Document 2, which first read “as it appeared on 13 Dec 2012 was changed to read “as it appeared on 12 Jan 2013” — a date after the events of December 14th. This document was still suspicious but at least is showed it was recorded after the event it announced.

To make these changes at Google would take no more than about two minutes. All that needed to be done is to select the records in the database and edit the field that holds the date Google recorded the record.

JANUARY 25, 2013

Google decided that the evidence implicating them in these events were getting too dangerous to leave available and removed them from public view even though that looks very suspicious.

This happened because I stated publicly that it is impossible for a document — published with an RSS feed request to Google — to take 30 days as shown in Document 2 and 8 days as shown in Document 1 after the developer publicly stated at  http://fellowshipofminds.wordpress.com/2013/01/21/sandy-hook-phony-documents-open-thread/#comment-164225 : “When a news item is created in our system, it is pushed out via an RSS feed and, Google has it indexed usually under 24 hours.”

There is an enormous amount of corroborating evidence that I described before at Fellowship of the Minds.

If you find the information above compelling enough to look further, and if I survive to tell about it, this discussion will be continued.

That Google is currently scrubbing the evidence does not bode well for those publicly explaining it. Although Google can hide the incriminating evidence from the public, they cannot remove the internal traces from their servers. We who made screencaptures and didn’t clear our browser histories have evidence they existed to the last date we accessed it. Guard that information well.

I am going to stop here to let you consider what I said.

-Peter

Update:

Peter continues to make his case that the CMI was uploaded online BEFORE the massacre, as a prosecutor would in a criminal trial. Please go to our technical discussion thread about this post, “Sandy Hook Massacre: The People v. Crisis Management Institute,” by clicking here.