TESTIMONY OF COMPLAINANT (AS WITNESS)
Rather than a series of Questions and Answers, I will present my testimony in the form of a series of statements. Each of these statements constitutes sworn testimony.
1. I am John Woolley, a citizen of Talossa.
2. My primary email address, as is well known in Talossa, is JohnWWoolley at comcast dot net.
3. I have been employed as a software engineer for upwards of 25 years. I have been using Usenet, the Internet, the Web, and (related technologies) for about 20 years. I am quite familiar with many technical aspects of the Internet, the world-wide web, and email in general.
4. At 12:05 pm TST, 3 March 2006, I made a post on Wittenberg in which I wrote:
This marks the third time I know of where Ups has asked someone "Are you a Jew?", but only the first time where he's accompanied the question with racist remarks.
By “Ups” I was referring to the defendant in this case, Ups Antônio Martüc.
5. Seven minutes after that posting, I received the following email, posted here with its routing headers intact:
Received: from nproxy.gmail.com ([64.233.182.203])
by sccrmxc20.comcast.net (sccrmxc20) with SMTP
id <20060303181219s2000rbk1de>; Fri, 3 Mar 2006 18:12:19 +0000
X-Originating-IP: [64.233.182.203]
Received: by nproxy.gmail.com with SMTP id m19so495935nfc
for <JohnWWoolley@comcast.net>; Fri, 03 Mar 2006 10:12:19 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=beta; d=gmail.com;
h=received:message-id:date:from:to:subject:mime-version:content-type;
b=At/AlTdMUpwwrFkRKunR3cLW1m01dYLk9JlLgD/Pq43PbLCHebyhTdV12NWKQIztNQ3yhFOXO9bM4/7LR6aYItlGi48KyVV3MDv3z6/jkhVEqYb8cM/E9J QCOBCIDImnmFzDXNkY+KsUNXds54sTzo/SVuZpc3UyIvnbPwURv50=
Received: by 10.48.244.5 with SMTP id r5mr750185nfh;
Fri, 03 Mar 2006 10:12:18 -0800 (PST)
Received: by 10.49.22.9 with HTTP; Fri, 3 Mar 2006 10:12:18 -0800 (PST)
Message-ID: <8f1f25880603031012h3e8e1800p38457d867ab77cb8@mail.gmail.com>
Date: Fri, 3 Mar 2006 13:12:18 -0500
From: "=?ISO-8859-1?Q?Ups_Ant=F4nio_Mart=FCc?=" <gunshyslycat1@gmail.com>
To: JohnWWoolley@comcast.net
Subject: Hey asshole
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_Part_2635_6992368.1141409538714"
1. I never asked anyone if he/she is a jew, dumbfuck.
2. A quote can be rigged up, it's not proof, dumbfuck.
3. Jews aren't a race, retard.
4. Fuck You!
6. On 4 March 2006, I put blocks on Wittenberg to try to keep anyone from registering new Wittenberg accounts from an IP address which been used that day to create accounts with names like “joelsuckscock” and “johnfaggotwoolley”; these offensive account names would then appear on the front page of Wittenberg as “Newest Member”.
7. Later on 4 March 2006, I received the following email, posted here with its routing headers intact:
Received: from nproxy.gmail.com ([64.233.182.195])
by rwcrmxc18.comcast.net (rwcrmxc18) with SMTP
id <20060304205640r1800qb11ke>; Sat, 4 Mar 2006 20:56:41 +0000
X-Originating-IP: [64.233.182.195]
Received: by nproxy.gmail.com with SMTP id x30so637084nfb
for <JohnWWoolley@comcast.net>; Sat, 04 Mar 2006 12:56:40 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=beta; d=gmail.com;
h=received:message-id:date:from:to:subject:mime-version:content-type;
b=f9jHuUXJo696RhNqFhM5ri4Y0yzNw+fcXGub6IbSgLGyk9KJ7/dXYCrScugQZPYR6ZGAgB0IMQV4VkeHUDNFN7uuc0EfXs31yYJ/UEcVIdJg70gMuD9v7d fydrMqCCuYiq2r3e36gPFZZMnh2sE29zNGS7A46zfIPTRcawg444c=
Received: by 10.48.244.17 with SMTP id r17mr1464028nfh;
Sat, 04 Mar 2006 12:56:39 -0800 (PST)
Received: by 10.49.22.9 with HTTP; Sat, 4 Mar 2006 12:56:39 -0800 (PST)
Message-ID: <8f1f25880603041256y58c02f2ahba102074d2cb59e7@mail.gmail.com>
Date: Sat, 4 Mar 2006 15:56:39 -0500
From: "=?ISO-8859-1?Q?Ups_Ant=F4nio_Mart=FCc?=" <gunshyslycat1@gmail.com>
To: JohnWWoolley@comcast.net
Subject: n00b
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_Part_11838_20270333.1141505799926"
You're a dumb bitch ass n00b. Tried to ban my ip? ha. I just enabled my proxy and I'm still able to lurkj lmao. You're a dumb n00b. faggot
8. Both these emails still exist unaltered on Comcast’s email server.
9. In posting them here, I have not changed the content of either email, either their messages or their headers, in any way.
10. The headers of both emails show that they originated from a machine at Gmail (Google's email service), and were sent from the Gmail account GunshySlycat1@gmail.com.
11. GunshySlycat1@gmail.com is S:reu Martüc’s email address.
12. I believe that there is no way for anyone (without access to the internal workings of Gmail's mail servers) to have altered the routing headers of these emails before they reached Comcast’s servers, and no way for anyone (without access to the internal workings of Comcast’s mail servers) to have altered them after they arrived at Comcast. That is, the emails show conclusively, from internal evidence, that they were sent from S:reu Martüc’s email account at Gmail.
13. On 24 March 2006, I received 780 emails that were routed to me because they were addressed to Matthew Tumulty (a Talossan citizen), his email box was full, and my email address had been put as the “From:” address of the 780 emails.
14. Here is a sample, one of these 780 emails:
Received: from mail.localhost ([70.111.149.134]) by bay0-mc5-f17.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.1830);
Fri, 24 Mar 2006 17:06:37 -0800
Received: from int-serv1.hq.nato.int (int-serv1.hq.nato.int [152.152.96.1]) by X500ROOT.nasa.gov (IntraStore TurboSendmail) with ESMTP id AAA2113 for <postmaster@localhost>; Fri, 24 Mar 2006 20:06:39
Return-Path: <postmaster@localhost>
From: johnwwoolley@comcast.net
To: mtumulty9@hotmail.com
Subject: ANNOUNCEMENT
Date: Fri, 24 Mar 2006 20:06:27
Message-ID: <mail.892334.usr826@phasma3000>
Content-Type: text/plain; charset="us-ascii"
X-Mailer: Phasma3000 by ad4 [www.8th-wonder.net]
X-OriginalArrivalTime: 25 Mar 2006 01:06:37.0392 (UTC) FILETIME=[5DD41D00:01C64FA8]
DICK!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
16. All these emails still exist unaltered on Comcast’s email server.
17. In posting this sample, I have not changed its content, either the message or the headers, in any way.
18. I was not, in fact, the sender of any of these emails.
19. The routing headers show that they originated from the IP address 70.111.149.134.
20. According to the American Registry for Internet Numbers (ARIN) “Whois” service, this IPA is in the block (from 70.104.0.0 to 70.111.255.255) assigned to Verizon Internet Services Inc.
21. On 24 March 2006, I received 569 identical emails (identical except for timestamps in their headers, that is) with Joseph Walkland’s email address in the “From:” field.
22. Here is a sample, one of these 569 emails:
Received: from mail.localhost (pool-70-111-149-134.nwrk.east.verizon.net[70.111.149.134](untrusted sender))
by rwcrmxc11.comcast.net (rwcrmxc11) with SMTP
id <20060324095653r11004jh57e>; Fri, 24 Mar 2006 09:56:53 +0000
X-Originating-IP: [70.111.149.134]
Received: from int-serv1.hq.nato.int (int-serv1.hq.nato.int [152.152.96.1]) by X500ROOT.nasa.gov (IntraStore TurboSendmail) with ESMTP id AAA2113 for <postmaster@localhost>; Fri, 24 Mar 2006 04:56:53
Return-Path: <postmaster@localhost>
From: jwalkland@gmail.com
To: johnwwoolley@comcast.net
Subject: ASSHOLE
Date: Fri, 24 Mar 2006 04:52:42
Message-ID: <mail.956010.usr746@phasma3000>
Content-Type: text/plain; charset="us-ascii"
X-Mailer: Phasma3000 by ad4 [www.8th-wonder.net]
BL0W M3 :)
23. All these emails still exist unaltered on Comcast’s email server.
24. I have not changed their content, either their message or their headers, in any way.
25. The routing headers show that they originated from the IP address 70.111.149.134, the same IP address from which the previous day’s email bombing of Matthew Tumulty originated.
26. The routing headers show, further, that the emails originated from the domain “nwrk.east.verizon.net”, which serves Verizon customers in Newark, New Jersey.
27. The defendant lives in Newark, New Jersey. Joseph Walkland lives in England, where Verizon Internet Services doesn’t provide Internet access. I live in Centennial, Colorado; my Internet Service Provider is Comcast.
28. On March 26, I received this email from Tomás àl Bosc, a Talossan citizen:
Subject: Re: Hello
what the hell?
johnwwoolley@comcast.net wrote:
FAGGOT!!!!!!!!
I answered:
Not from me. These are coming (in huge bunches, right?) with faked-up headers, either from Ups Martüc or his friend Vincent Manzelli.
Do you know how to look at the routing headers on the messages? If so, please send a copy of the headers to me. How many of these did you get? And what are the times of the first and last ones?
We’re trying to stop this guy, but it’s difficult. Sorry for the inconvenience.
— John Woolley (the real one)
Tomás answered:
Ahh, I see. I got three from Sat, 25 Mar 2006 23:11:30 to Sat, 25 Mar 2006 23:11:48... I don't know how to look at the routing headers on the messages, sorry.
I wrote:
If you’re in yahoo.com’s email, when you bring up a message you should see a button (at the bottom right of the message) that says “Full Headers”. Click that, and you get the message displayed with full headers. Pick up all the text of the message with the cursor — highlight it and hit control-C or Copy — and then email me and Paste (or control-V) what you picked up into the email. I’d appreciate it!
— John
He answered:
here is everything:
From: johnwwoolley@comcast.net Sat Mar 25 23:11:48 2006
X-Apparently-To: oneholyidol@yahoo.com via 68.142.201.224; Sat, 25 Mar 2006 20:11:46 -0800
X-YahooFilteredBulk: 70.111.149.134
X-Originating-IP: [70.111.149.134]
Return-Path: johnwwoolley@comcast.net
Authentication-Results: mta169.mail.re4.yahoo.com from=comcast.net; domainkeys=neutral (no sig)
Received: from 70.111.149.134 (HELO comcast.net) (70.111.149.134) by mta169.mail.re4.yahoo.com with SMTP; Sat, 25 Mar 2006 20:11:45 -0800
Received: from int-serv1.hq.nato.int (int-serv1.hq.nato.int [152.152.96.1]) by X500ROOT.nasa.gov (IntraStore TurboSendmail) with ESMTP id AAA2113 for <postmaster@localhost>; Sat, 25 Mar 2006 23:11:48
Return-Path: <postmaster@localhost>
From: johnwwoolley@comcast.net View Contact Details Add Mobile Alert
To: oneholyidol@yahoo.com
Subject: Hello
Date: Sat, 25 Mar 2006 23:11:48
Message-ID: mail.388187.usr448@phasma3000
Content-Type: text/plain; charset="us-ascii"
X-Mailer: Phasma3000 by ad4 [www.8th-wonder.net]
Content-Length: 16
FAGGOT!!!!!!!!
29. I have not modified the content of any of these messages in any way.
30. The routing headers on all five groups of emails (three received by Brad Holmes, and one each by Joseph Walkland and Tomás àl Bosc), of which S:reu Holmes and S:reu Walkland posted samples in their testimony, and I provided a sample from S:reu àl Bosc, show that all five groups originated from the same IP address — 70.111.149.134.
31. It is easy for the sender of a piece of email to “spoof” (that is, to fake) the “From:” field on an email, but it is impossible for the sender to fake routing headers which are added to the email by the machines that handle it after it leaves the sender’s control.
32. Even though the “From:” field on all those emails indicated that I had sent them, in fact I did not.
33. The “X-Mailer:” header on the sample emails provided shows that they were all sent using the emailing program “Phasma3000”, an anonymous mass-mailer designed to make spam (with fake “From:” headers) easy. The Phasma3000 program would have had to be installed on the computer from which any of these email bombings were sent.
34. An IP address represents, basically, a connection made between the Internet and a single computer or network of computers. Most home Internet users have a “dynamic IPA” system, in which every time their home network reconnects to the Internet (but not necessarily every time they reboot their computer), their Internet Service Provider (ISP) assigns them an IP address from the pool of IP addresses belonging to the ISP; so a home user’s IP address changes from time to time, but always within the range of IPAs assigned to his ISP. A home user might keep the same IPA for weeks, or might get a new one every few minutes if he deliberately resets his Internet connection.
35. As an example of this, every one of the 475 postings that the defendant has made during his Wittenberg career have come from IPAs within the block assigned to Verizon Internet Services Inc, but those 475 postings have come from at least 12 different IPAs (all beginning with 70.111). The defendant has had some of these IPAs for only a few hours each, and others for extended periods of time; for instance, he posted from 70.111.127.171 from 12 March until 25 March, a period of nearly two weeks.
36. On March 26, I reënabled the defendant’s Wittenberg account. He promptly logged onto Wittenberg, from IPA 70.111.149.134. He went on using 70.111.149.134 from then until after his sixth posting in this Courtroom thread, the one dated 12:28 pm on April 5. Those first six postings after I reënabled his account were all made from 70.111.149.134 –
the very same IPA from which Brad Holmes, Joseph Walkland, Tomás àl Bosc, and I had been “email bombed” on March 24 and 25.
37. In my opinion, this evidence proves that the defendant Ups Antônio Martüc (either by himself or acting through someone to whom the defendant provided the use of a computer in his home, use of a email-spamming program installed on that computer, access through the defendant’s home network to the Internet, and access to the defendant’s passworded gmail.com email account) committed the 3261 crimes alleged in my amended complaint.
This concludes my direct testimony.
— John Woolley, UrN