Sam Sloan
posted 10/24/07 @ 4:28 PM CST
Your article states, "Though Sloan did not return phone calls Tuesday, on Oct. 4". I do not know why you say this because I was home all day on October 4 except that I go out every day between 2:30 and 3:00 PM to pick up my five-year-old daughter who is attending First Grade. You can call me any time at 917-507-7226.
The proof is 100% conclusive that Paul Truong posted 2463 obscene messages mostly under my name but under other names as well. If you have any doubt about this, read the "Mottershead Report" which is posted online at http://www.ishipress.com/mottershead.pdf
The Mottershead Report shows that Truong logged in some of the time from computers on the Texas Tech campus. For example on Mon Sep 17 08:50:56 2007 129.118.87.222 "ChessPromotion" 500 "ChessPromotion" Logged in. ChessPromotion is a USER ID for Paul Truong. 129.118.87.222 is an IP address assigned to the campus of Texas Tech University. I recommend that you search your campus, find that computer and find out who was using it on Sept 17, 2007 at 8:50:56 . You will find that person to be Paul Truong.
In short, I have an air-tight case against Mr. Truong. I can think of several possible defenses your university might have, but saying that it never happened is not one of them. Once again, you can call me any time at 917-507-7226. I am almost always here.
Sam Sloan
posted 10/24/07 @ 6:28 PM CST
According to the postings by Dr. Eric Moskow on the New York Times Gambit Chess Blog, he did NOT withdraw from the Reshevsky Memorial because of the lawsuit. He withdrew in two stages:
1. While running for USCF election, Susan stated several times on her blog that Eric Moscow had promised her one million dollars in sponsorship money. After this scandal broke, Eric Moscow called Susan Polgar and said that rather than give the money directly to her, he would give it to Texas Tech University earmarked to be used for Susan's programs. Susan rejected this proposal, stating that she wanted the million dollars to be given directly to her. Dr. Moskow did not like this and for that reason canceled his sponsorship programs EXCEPT FOR the Reshevsky Memorial.
2. A few days ago, Dr. Moskow called Bill Goichberg, Sam Sloan and Susan Polgar with a detailed proposal to settle this lawsuit. Bill Goichberg and Sam Sloan accepted Dr. Moscow's proposal, but Susan Polgar rejected it. More than that, Susan Polgar implied that she was considering bringing a new lawsuit against the USCF. Since Dr. Moskow disapproves of lawsuits, Dr. Moskow cut all funding for Susan Polgar projects.
References:
http://gambit.blogs.nytimes.com/2007/10/10/interview-with-the-uscf-president-a-chess-sponsor-says-hes-had-enough/ NY Times: Interview With the U.S.C.F. President; a Chess Sponsor Says He's Had Enough
http://susanpolgar.blogspot.com/2007/10/stating-facts.html Susan Polgar Stating the Facts
http://gambit.blogs.nytimes.com/2007/10/23/polgar-responds-on-her-blog/ Polgar Responds on her Blog http://www.nytimes.com/2007/10/08/nyregion/08chess.html NY Times: Chess Group Officials Accused of Using Internet to Hurt Rivals
http://gambit.blogs.nytimes.com/2007/10/19/founder-of-af4c-the-chess-federation-needs-a-new-structure/ NY Times: Founder of AF4C: The Chess Federation Needs a New Structure
Sam Sloan
Law
posted 10/25/07 @ 3:56 PM CST
Sam said:
"Eric Moscow called Susan Polgar and said that rather than give the money directly to her, he would give it to Texas Tech University earmarked to be used for Susan's programs. Susan rejected this proposal, stating that she wanted the million dollars to be given directly to her. Dr. Moskow did not like this and for that reason canceled his sponsorship programs EXCEPT FOR the Reshevsky Memorial."
If this is true, and I have no reason to believe it is - then that is disturbing. Isn't part of Susan Polgar's job to raise money for the University to further college chess? Rejecting a donation go to Tech instead of her organization raises all kinds of conflict of interest and duty of loyalty issues. I still think this lawsuit is going to blow up in Mr. Sloan's face."
The posting above points out a problem many have noticed. While running for election, Susan Polgar stated 72 times on her blog that if elected she would bring in one million dollars in sponsorship money from Dr. Eric Moskow FOR THE USCF. Here is an example of her making this claim: http://susanpolgar.blogspot.com/2007/05/more-problems-with-uscf.html
However, now it seems that Texas Tech thought that they were going to get the one million dollars from Dr. Moskow. That is why they hired her.
Now, it turns out that Susan Polgar planned to get the one million dollars FOR HERSELF. Upon learning this, Dr. Moskow has canceled all sponsorship of her programs.
Meanwhile, on her blog, Susan complains that this entire affair is one giant conspiracy to stop girls from playing chess.
Whom do you believe?
Sam Sloan
Marcus Roberts
posted 10/25/07 @ 7:37 PM CST
Mr. Troung has threatened to kill me in these posts.
Here is proof of his guilt.
Evidence that Paul Truong is the "Fake Sam Sloan"
Report Submitted to the United States Chess Federation by Brian Mottershead
1. Background
Starting in June 2005, posts have appeared on Usenet newsgroups under the aliases of "samsloan", "Ray Gordon", "Jackass Lafferty", "AndrewZito", and "judgementday@clerk.com", as well as others. The posts on rec.games.chess.politics alone number in the thousands, and were cross-posted on several other Usenet newsgroups, rec.games.chess.misc, other rec.games.chess newsgroups,alt.chess, and others.
In addition to impersonating Sam Sloan and Ray Gordon (who are real participants in the newsgroups) as well as others, these posts, which will be referred to here collectively as the Fake Sam Sloan (FSS) posts, attacked and/or libelled the USCF, Sam Sloan, Ray Gordon, Brian Lafferty, Bill Goichberg, Erik Anderson, Beatriz Marinello, Hal Bogner, Paul Hoffman, Jennifer and Greg Shahade, and numerous other officials, sponsors, staff, and members of the USCF in language that was frequently extremely profane, obscene, indecent, racist, and misogynist.
The participants in the Usenet chess forums have generally considered one person responsible for these posts, and commonly refer to him as the "Fake Sam Sloan", even though the poster in question impersonated others as well, and some of his posts were under identities that were not impersonations of others, but simply handles. I follow the convention of referring to this Usenet poster as the "Fake Sam Sloan" in this report.
In September 2007, while working as a web developer and system administrator for the United States Chess Federation, a number of "Fake Sam Sloan" posts came to my attention that were copies of posts that had been made originally in the USCF Issues forum, but with the wording changed so as to discredit the original poster. It was apparent that in order to copy these posts, the "Fake Sam Sloan" had access to the USCF Issues forum, as this is a forum restricted to USCF members and is not accessible to the public. It seemed to me that it was highly objectionable to use the USCF Issues forum in this manner, and that it was my duty as the Administrator of the forums to stop or deter that type of usage if I could. At the outset, I was aware that there had been speculation that Paul Truong was the "Fake Sam Sloan". Though I had been outspoken in opposition to Paul Truong's candidacy for Executive Board, I did not give this speculation any great credence at the beginning.
I wanted to see if I could identify who the Fake Sam Sloan was, using information in the log files and the forums database. Since the IP addresses of Usenet posters are public information, and in the USCF web logs and database I had information as to the IP addresses of USCF members accessing the forums, it seemed likely that I would be able to identify the USCF member account that was being used by the Fake Sam Sloan to mis-appropriate USCF Issues forum posts for his posts on Usenet. If I could develop any definitive conclusions about the identity of the Fake Sam Sloan, I planned to bring that information to the attention of the Executive Director. It did not take very long to establish that the Fake Sam Sloan is indeed Paul Truong, as others have suspected. This report recaps the evidence in support of that conclusion.
2. Executive Summary
My conclusion, based on the evidence available to me, is that one person was responsible for all of the Fake Sam Sloan identities and the posts under those identities on Usenet, and that this person was Paul Truong, now a member of the USCF Executive Board. Many of the posts were made after December 2006, when Paul Truong became a candidate in the election for the USCF Executive Board. Some of the targets of the posts were other candidates in the election. Some of the posts have been made since August, when Paul Truong and his wife, Susan Polgar, became members of the USCF Executive Board.
The purpose of this memo is to review the evidence which makes the conclusion inescapable that Paul Truong was the person making these posts. It will be left to other documents to discuss the content of the FSS posts.
I show the following:
a) From March 2006 to July 2006, Truong posted to the USCF Forums almost exclusively from AOL addresses. These IP addresses were in the same small address blocks as were used on those dates by the Fake Sam Sloan identities to post to Usenet.
b) In July 2006, Truong obtained a RoadRunner cable IP address, and he had this one address persistently assigned to him for over a year, until August 2007. During this period he was posting mainly from this RoadRunner address to the USCF Forums. While the Fake Sam Sloan identities continued to post mainly from AOL addresses, there were several occasions during this period when one or more of the FSS identities posted to Usenet from Truong's RoadRunner IP address. When Truong did post from an AOL address to the USCF Issues forum, the previous pattern held up, namely that Truong's AOL address was frequently from the same small block from which one of the Fake Sam Sloan identities had posted on that same day.
c) In August 2007, Truong moved to Lubbock Texas to take up an appointment at Texas Tech. He obtained new, somewhat persistent IP addresses from Suddenlink, the cable broadband provider in Lubbock. During August and September 2007, he accessed the USCF Forums from two different Suddenlink IP addresses, one briefly and the other for the rest of that time. These two Suddenlink IP addresses were both used multiple times during that period by more than one of the Fake Sam Sloan identities to post to Usenet, while at the same time Truong was using the IP to post to the USCF Forums. In other words, when Truong moved to Lubbock, the Fake Sam Sloan identities also moved to Lubbock. Indeed they were all using the same Suddenlink IP address.
d) On September 20, Truong went to Mexico City for the World Chess Championship. While there, Truong visited the USCF Forums from a Mexico City IP address. Contemporaneously, one of the FSS identities, the Fake Ray Gordon, posted to Usenet from the same Mexico City IP address. Both Truong and Fake Ray Gordon also had the same user agent string, from a Tablet PC 2.0 while in Mexico City.
e) From September 16 onwards, when we can see what user agent string Truong's browser was sending to the USCF forums, it is identical to the user agent string being presented at the time by the Fake Sam Sloan identities on Usenet. When Truong switched to a Tablet PC 2.0 to go to Mexico City, the Fake Ray Gordon, one of the FSS identities, switched to the same Tablet PC 2.0 user agent string, at the same time switching to the same Mexico City IP address as Truong. The odds against all of these correlations resulting from chance are overwhelming, and the almost inescapable conclusion is either that Paul Truong and the person behind the Fake Sam Sloan posts are one and the same.
3. Types of Technical Evidence.
There are several sources of technical evidence in this matter.
a) The Usenet Newsgroup Posts.
First, there are the Usenet posts themselves. Usenet posts are maintained on Network News Transfer Protocol (NNTP) servers, also referred to as news servers. These servers organize posts into threads or topics and the topics are grouped into "newsgroups". A "newsgroup" is much like any other Internet forum. A newsgroup poster makes his post on one of the news servers, and from there it is sent to other news servers. A poster can delete his posts from the news server where he originally made it, and this deletion command is propagated to the other news servers. However, because of frequent abuse of this deletion feature, many news servers do not honor deletion commands from other servers.
The newsgroups in which the Fake Sam Sloan was active were rec.games.chess.politics, rec.games.chess.misc, alt.chess, as well as others. Most of the posts were cross-posted in several of these newsgroups. The news server on which the FSS identities posted was operated by Google, which provides a web-based news reader interface at groups.google.com. This is the largest and most popular of the news servers. A person reading or posting to a newsgroup uses a client program, called a "news reader". One of the reasons that Google is the most popular news server is that it has an Usenet archive spanning decades and provides a convenient web-based news reader.
Posts in a newsgroup are accompanied by a number of so-called header fields, similar to email headers. Some of these originate from the news reader; some of them are attached to the post by the news server where the post is injected. Here is a typical set of headers, from one of the FSS posts:
Path:g2news2.google.com!postnews.google.com!n39g2000hsh.googlegroups.com
From: "Ray Gordon, creator of the pivot"
Newsgroups: rec.games.chess.politics,rec.games.chess.misc, rec.games.chess.computer,rec.games.chess.analysis,alt.chess
Subject:Did Hal Bogner and Brian Mottorshead hack USCF members' accounts?
Date: Tue, 25 Sep 2007 14:39:29 -0700
Organization:http://groups.google.com
Lines: 7
Message-ID:
References:
NNTP-Posting-Host: 201.134.236.150
Mime-Version: 1.0 []
Content-Type: text/plain; charset="us-ascii"
X-Trace: posting.google.com 1190756370 17523 127.0.0.1 (25 Sep 2007 21:39:30 GMT) X-Complaints-To: groups-abuse@google.com
NNTP-Posting-Date: Tue, 25 Sep 2007 21:39:30+0000 (UTC)
In-Reply-To:
User-Agent: G2/1.0
X-HTTP-UserAgent: Mozilla/4.0 (compatible; MSIE 7.0; AOL 9.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.0.04506; Tablet PC 2.0),gzip(gfe),gzip(gfe)
Complaints-To: groups-abuse@google.com
Injection-Info: n39g2000hsh.googlegroups.com;posting-host=201.134.236.150; posting-account=ps2QrAMAAAA6_jCuRt2JEIpn5Otqf_w0
It may be seen that the headers include a lot of information about the origin, processing, and timing of the Usenet post. Some of these headers are displayed routinely to readers. The full list, as above, is displayed upon request. In the example above, note the NNTP-Posting-Date header and the X-HTTP-UserAgent headers. These are attached to the post by the news server, and they give the IP address of the user who made the post, and the User Agent string that was transmitted by his web browser when he submitted the post. Thus, the NNTP-Posting-Host for the example was 201.134.236.150. and the browser user agent string was:
Mozilla/4.0 (compatible; MSIE 7.0; AOL 9.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.0.04506; Tablet PC 2.0),gzip(gfe)
Not all newsgroup servers capture all this information, but most of them do. The Google news server, which was used by FSS for injecting his posts into the newsgroups, does capture the NNTP-Posting-Host and X-HTTP-UserAgent headers, and these headers were captured for all the FSS posts that I have inspected. This is how we know what IP address the Fake Sam Sloan identities had for each of their posts, as well as what browser and type of computer he was using when he made the various posts. b) US Chess Forums Database
During much of the period that FSS was making his newsgroup posts, Paul Truong was a member of the USCF Forums. The USCF Forums run on the uschess.org website using the "phpBB" bulletin board software. Paul Truong started posting in the USCF Forums in March 2006. During most of the time since then, USCF was running phpBB Version 2. The software was upgraded to phpBB Version 3 on September 14, 2007. Both versions have a database based on MySQL, which contains all the forum posts and user records. During the upgrade from Version 2 to Version 3, all the information from Version 2 was transferred and converted to the format of the Version 3 database.
Paul Truong was active in the USCF Forums under the username "ChessPromotion" from March, 2006 onwards. That ChessPromotion was Paul Truong was well known and was no secret. On the USCF Forums, all posters to the USCF Issues forum must be registered USCF members and the USCF ID numbers of forum members are displayed in their user profiles. Thus, anybody can look up a USCFId and learn the name, state, and USCF tournament and rating history of any poster, even though he may be posting under a handle. "ChessPromotion" was completely open that he was Paul Truong.
In the phpBB database, one of the data elements that is captured is the IP address that the poster had at the time of the post. This database element is present for all ChessPromotion posts in the database. This is how we know the IP addresses from which Paul Truong posted to the USCF Issues forum during 2006 and 2007.
c) Web Traffic Logs When the new forum version went live on September 14, it included a "single login" feature. A user logging into the web site is not required to log in separately to the forums. If he were eligible for forum access, a user would be logged in automatically to the forums under the same username for which he had registered on the web site as a whole. The single login feature is accomplished by a software module called the "Joomla-phpBB3 Bridge". This is a module which I wrote specifically for the USCF web implementation. The way the Joomla- phpBB3 bridge works is that it intercepts every request made on the forums, looks at the current Joomla and phpBB3 login states of the user, makes these the same by logging the user into or logging him out of phpBB, and finally passes the request on to phpBB3. Note that Joomla and phpBB require all usernames/handles to be unique. One of the features of the Joomla-phpBB3 bridge is that it keeps a log of every forum request that it intercepts, and records the date and time, the IP address, the URL, the user agent string and the cookies sent by the browser. This log was intended for debugging purposes. From these logs, it is possible to determine the IP address and user agent of particular forum users for each and every request to the forum system that is intercepted by the Bridge. These logs exist since September 14 but not all the fields were in the first version of the log. IP addresses were not captured initially. But IP address logging was added on September 16, and we know the IP addresses of the requests through the Bridge from September 16 onwards. The User agent string was logged from September 17 onwards. The phpBB software for the USCF Forums runs under an Apache web server. This web server logs information about each request (or "hit") made by browsers to the server. USCF's ISP, INebraska, saves these logs. Each line in the log file records the date and time, the IP address, the URL that was requested and the user agent string sent by the browser. For each line in the Bridge logs, there should be a corresponding line in the Apache logs with the same timestamp (possibly with a little clock skew and slight delay), IP address, URL, and user agent string. I have not had access to the Apache web logs. However, these Apache logs might be used to corroborate the information in the Joomla-phpBB3 Bridge logs.
d) WHOIS Information
It is easy to determine which ISP owns an IP address via a "WHOIS" lookup.
4. All the "Fake Sam Sloan"
Usenet identities Are One Person Many participants in the Usenet rec.games.chess.* newsgroups have asserted that the following posters to those groups are the same person:
* "Fake Ray Gordon" (raygordon@writeme.com, raygordon@seductive.com, and others)
* "Fake Sam Sloan" (ismailsloan@gmail.com, samsloan@usa.com, sloan@whoever.com, sloan@journalist.com, andrewzito@mail.com, and others)
* "AndrewZito" (andrewzito@mail.com)
* "Jackass Lafferty" (bplafferty@lawyer.com)
* judgementday@clerk.com
On rec.games.chess.politics alone, these identities account for 2463 posts since mid 2005, with a similar number on rec.games.chess.misc, as well other posts on alt.chess and other rec.chess.* newsgroups.
The widespread view that one person is actually responsible for all of these posts is based on subjective factors, such as the fact that these identities have the same targets/victims/obsessions, and that their posts are similarly foul-mouthed, racist, and misogynist. My analysis of the Usenet posts cements this conclusion through a study of IP addresses and user agent strings from the Usenet data -- all objective data.
1. There are numerous cases where one of the "Fake Sam Sloan" email addresses posted as Ray Gordon, and vice-versa. That is, the name on the post might be "Ray Gordon", but the email address is given as one of the samsloan email addresses, and vice versa. This suggests that the FSS poster was logged in as one of the identities to the newsgroup but "signed" the post as one of the other identities, perhaps by mistake. Similarly, andrewzito@mail.com posted as all three of "Sam Sloan", "Ray Gordon", and "AndrewZito". This mixing of names and emails was quite common.
2. All the identities used Google Groups for injecting their Usenet posts.
3. From July 2005 onwards, the identities all posted predominantly from AOL IP addresses. The personalities tended to be alternated, and there would be a run of Ray Gordon posts, followed by a run of Sam Sloan posts, etc. However, it did happen from time to time that several of the identities were used on the same day and within short spans of time, and when this occurred it can be seen that the identities were all posting from IP addresses within the same small AOL IP address blocks.
4. The set of user agent strings from the browsers was small. The identities were using the same computers and had the same small set of user agent strings. While there was more than one user agent string, suggesting that the person responsible was using more than one computer, all of the identities were seen with each of the various user agent strings. The user agent strings changed over time, and when a new user agent string appeared for one of the identities, it generally wasn't too long before the other identities would appear with that new user agent string also.
There are numerous occasions when IP addresses and user agent strings were exactly the same on the same day for more than one of the identities. For example, on 6 Feb 2006, andrewzito@mail.com and raygordon@writeme.com both posted within minutes of one another from 152.163.100.6 with the same user agent string. Again, on 17 March 2006, raygordon@seductive.com and samsloan@usa.com both posted from 205.188.117.73 with the same user agent string within 10 minutes of one another. On 11 Nov 2006, both raygordon@seductive.com and ismailsloan@gmail.com posted from 64.12.116.67 with the same user agent string, separated in time by about two hours. On 12 Feb 2007, both raygordon@seductive.com and judgementday@clerk.com posted from 205.188.116.132 separated in time by 40 minutes, and with the same user agent string. The same thing happened the following day from 152.163.101.14. If one looks not for exact IP matches between the various identities, but only for IP addresses within the same small AOL block, there are many, many, other examples.
On April 15 2007, the person behind these identities acquired or gained access to a Media Center PC 5.0. At this point in time, he was posting mainly as raygordon@seductive.com. Late that evening, we see ismailsloan@gmail.com posting for the first time from a Media Center PC 5.0, and the next post from judgementday@clerk.com, on May 8, is also from a Media Center PC 5.0, the exact same user agent string. All three identities continue also to post from another computer, a Media Center PC 4.0, again all with the same user agent string.
On 23 July 2007, both samsloan@usa.com and Jackass Lafferty (bplafferty@lawyer.com) posted from 64.12.116.134 with the exact same user agent string, a Media Center PC 5.0). This happened again on 26 August 2007, from 75.111.199.177. On 9 Sep 2007, this happened once more from 75.111.200.21. Note that these last two IP address, unlike all the others mentioned in this paragraph are Suddenlink IP addresses in Texas, not AOL IP addresses. 75.111.200.21 address is noteworthy, because it is from this IP address that Paul Truong first posted on the USCF Issues forum from a Suddenlink IP address.
The Usenet cast of characters had moved to Texas, and so had Paul Truong.
On 10 Sep 2007, samsloan@usa.com posted from a Suddenlink IP address for the first time, 75.111.194.9, again with the same User agent string. samsloan@usa.com posted again from this IP on Sep 11. raygordon@seductive.com posted from this address for the first time on 15 Sep 2007, and then continued to post from it on Sep 16 and Sep 19. This Suddenlink IP address, 75.111.194.9, is another important one because it is also definitively tied to Paul Truong.
Finally, after I posted some of my conclusions on the USCF Forums, on September 25, 2007, both ismailsloan@gmail.com and raygordon@seductive.com made posts mocking that case. The two posts were within 5 minutes of one another and were both from 207.200.116.5, an AOL address. The user agent string was the same; the same Media Center PC 5.0 user agent string that had been seen from all of the identities since April 15, 2007. (Incidentally, as we discuss later, Paul Truong visited the USCF Forums from this same AOL IP address the following day.)
There is no doubt that this set of Usenet identities were all the same person, and at least three of them -- bplafferty@lawyer.com, samsloan@usa.com and raygordon@seductive.com -- are definitely tied to Paul Truong.
5. Evidence that Paul Truong is the Fake Sam Sloan.
Paul Truong, under the handle ChessPromotion, started participating in the USCF Forums on March 10, 2006. He continued with regular participation until May 5, 2007, when he announced that he would stop. He recommenced on July 28, 2007 and continued with regular participation until he again announced that he would stop on September 20, 2007. This participation divides into three periods.
a) From March 2006 until July 2006, Truong accessed the USCF forums through AOL. This was determined from the IP addresses on posts in the forum database. During this period, the Fake Sam Sloan identities were also posting to Usenet via AOL, which can be determined from the NNTP-Posting-Host on the posts.
AOL assigns users dynamic IP addresses and these change frequently, often from minute to minute. Because of this, it is difficult to draw definitive conclusions from AOL IP addresses about the identities of users. Even if there were a ChessPromotion post in the USCF forum separated by only minutes in time by a post on Usenet from Fake Sam Sloan, it would not necessarily follow that the two posters were the same person.
However, both FSS and Truong were using AOL during this period, and they were receiving IP address assignments that were very close to one another. There is a pattern to AOL assignments. A client computer connected to the AOL network seems to receive address assignments from a relatively small block of addresses, and when the address changes, it is to another one from the same small block. From an analysis of the data, it is clear that Fake Sam Sloan and Truong were frequently receiving address assignments from the same small AOL block. On almost every occasion that Truong posted in the USCF Issues forum during this time frame, there is a Usenet posting close in time from one of the FSS set of identities and from the same small AOL IP address block as Truong had used.
b) From July 2006 to September 2007. During this period, which included a short gap during which he was not posting on the forum, Truong accessed the forum mainly from one IP address associated with RoadRunner, Time Warner's cable internet ISP. The RoadRunner address was probably a dynamic one but, as often happens with cable broadband IP addresses, Paul had the same one persistently from the time he first appeared with it in the USCF Forums in July 2006, until August 2007, when he moved to Lubbock. This address was 24.90.223.35. When addresses are assigned persistently in this manner over long periods, it becomes like a static IP address, with the assignee controlling it exclusively until it is lost.
During this period, the Fake Sam Sloan identities continued to post mainly from AOL. However, there are a number of occasions when the Fake Sam Sloan identities did post from the RoadRunner IP that was assigned to Paul Truong persistently. This is extremely significant because this IP address was not a highly dynamic AOL IP address, but rather a RoadRunner IP address that was definitively associated with Paul Truong at the time.
For example, on June 20 2006, raygordon@seductive.com posted from 24.90.223.35. This address was used again by ismailsloan@gmail.com on 24 Dec 2006, and by raygordon@seductive.com on 15 April 2007. The only explanation for this is that Truong was taking care after he obtained his persistent RoadRunner IP not to use it for his Fake Sam Sloan posts on Usenet, but that he slipped up a few times, perhaps supposing that nobody would notice. These three slip-ups definitively tie Paul Truong to the Fake Sam Sloan identities even before he moved to Texas.
From time to time after getting the RoadRunner address, Truong did post to the USCF forums as ChessPromotion via AOL, indicating that he was still using AOL for USCF Forum access occasionally. As before, on many occasions when he accessed the USCF forums during this period from AOL, on those same dates one or more Fake Sam Sloan identities posted from AOL IP addresses from the same small blocks.
c) From the US Open 2007 to September 20, 2007. After the US Open, Truong posted to the USCF forums from hotels in Lubbock, and from Texas Tech. He had moved to Lubbock Texas. From September 6 onwards until September 20, all of his posts to the forums were from 2 Suddenlink IP addresses. He made 3 posts on September 6 from 75.111.199.177, which is a Suddenlink IP address. Suddenlink is a cable internet ISP, a subsidiary of Cox, which services Lubbock. After Sep 6, he made 21 posts to the forums from 75.111.194.9, another Suddenlink IP address.
From the 16th onward we also have the Bridge log data, and from this we can see that almost all of his visits to the forum (not just posts) were from this one Suddenlink address, 75.111.194,9, except for one quick visit to the forum from a computer at Texas Tech. From this pattern, we can conclude that 75.111.194.9 was persistently assigned to the computer that Truong was using for almost all his USCF forum access. Possibly it was his home computer. Starting on September 16, when IP addresses started being logged by the Joomla bridge, and continuing through September 20, there were 958 hits on the USCF forums by ChessPromotion from 75.111.194.9. All the hits from that address were by ChessPromotion.
From the NNTP-Posting-Host headers on the FSS Usenet posts, we know that Jackass Lafferty posted from 75.111.194.9 on 26 August, 27 August, and 6 September, that Fake Sam Sloan posted from it on September 10, 11, and 13, and that Fake Ray Gordon posted from it multiple times on September 15, 16, and 19. These data present a highly significant correlation that could not have occurred by chance.
Based on the X-HTML-User-Agent headers on the Usenet posts, we know that the Fake Sam Sloan identities had the following user agent string during much of September 2007:
Mozilla/4.0 (compatible; MSIE 7.0; AOL 9.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.0.04506; InfoPath.2), gzip(gfe),gzip(gfe)
The user agent string presented by Paul Truong's browser in the USCF forums during the same period was:
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.0.04506; InfoPath.2)
The basic elements of these strings are the same. There are two differences: one of them indicates that AOL 9 was being used. The other is that in one of them gzip was enabled. The strings are compatible and one computer would have been able to generate both of these user agent strings, depending on the situation. In the USCF Forums, only one other user had a user agent string that was close to these. These data corroborate the correlation demonstrated above by the parallel IP-Addresses.
A comprehensive analysis of user agent strings in the Apache web logs would be interesting. The strings of the Fake Sam Sloan posters have changed over time. It is possible to identify when those changes occurred and correlate those times with the times when User Agent strings presented by Paul Truong's browser changed in the uschess.org web logs. For example, in both the FSS and Paul Truong user agent strings above "InfoPath.2" appears. InfoPath.2 is a Microsoft Office add-on and this indication appeared relatively recently in the User Agent strings on the FSS posts. It would be interesting to determine exactly when this appeared on Paul Truong's USCF web log hits.
d) September 20, 2007 to date. On September 20, Truong went to Mexico City for the World Championship Tournament, accompanying his wife. He had stopped posting in the forum, but from the Bridge log data, we know that he continued to access the forums to read posts and personal messages.
With the exception of one short visit on September 20, when he was most likely in transit, almost all of his accesses to the forum while in Mexico City were from 201.134.236.150. This is an IP address of Uninet SA de C.V., a Mexican ISP.
The first post from Fake Ray Gordon after the ones on September 19 from the Suddenlink address was on September 25, He posted three times to rec.games.chess.politics from 201.134.236.150, the same address.
When Paul Truong went to Mexico City his user agent string in the USCF Forums changed to:
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.0.04506; Tablet PC 2.0)
This is a tablet PC, with software otherwise similar to his other computer. The user agent string on the November 25 post by the Fake Ray Gordon was: Mozilla/4.0 (compatible; MSIE 7.0; AOL 9.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.0.04506; Tablet PC 2.0),gzip(gfe),gzip(gfe)
Thus, once again, characteristics of the computer used by the Fake Ray Gordon also tracked a change in the computer used by Paul Truong, just as the IP-Address was tracked.
It is inescapable that when Paul Truong moved to Texas and Suddenlink, the Fake Sam Sloan identities did also. Indeed they moved to the identical IP address as did Paul. When Paul went to Mexico City, the Fake Ray Gordon did too. When Paul switched to a Tablet PC 2.0 for his travel to Mexico City, so did the Fake Ray Gordon.
e) On September 25, I first posted information concerning these conclusions on the USCF Forums. Almost immediately large numbers of Fake Sam Sloan (etc) posts were deleted from Usenet, especially from August and September 2007. From the Bridge logs, it is apparent that Truong was up during all that night. It can hardly be a coincidence that the FSS identities were deleting their August and September 2007 posts throughout that night. Despite these deletions the posts still exist on news servers that don't honor delete commands, and on users' hard drives, a fact of which Truong may have been unaware.
On Sep 26 at 11:30 pm, the Fake Ray Gordon posted:
Thanks for destroying the first couple for everyone. We can't allow them to have power, can we? We need to stick together and get rid of all the freaking foreigners. Saludos!
This was posted from 207.200.116.5, a Netscape/AOL IP address. The user agent string was the same as the Fake Ray Gordon and Paul Truong posts from the Mexico City IP address. A few minutes later, the Fake Sam Sloan also posted from 207.200.116.5. On the following day, Paul Truong visited the USCF forums from this address, with again the same Tablet PC 2.0 user agent string.
6. Conclusion
The odds against all of these correlations occurring by chance are overwhelming. The only reasonable inference that can be drawn from the evidence is that Paul Truong and the person behind the Fake Sam Sloan posts on Usenet are one and the same person.
Appendix A. Attachments
1. chesspromotion-uscf-posts.txt. This is a listing of the post dates and IP addresses of the 668 ChessPromotion posts in the USCF Forums database from March 2006 to date.
2. chesspromotion-joomla-bridge.log. This is an extract of the Joomla-phpBB3 Bridge log, showing all requests on the USCF Forums, through the Bridge, made by "ChessPromotion" from September 16 to date.
3. fake-sam-sloan.txt. The full text of all 2464 "Fake Sam Sloan" posts on rec.games.chess.politics, extracted from the news.giganews.com news server.
4. fake-sam-sloan-hdrs.txt. This is a listing of the NNTP-Posting-Host header, the From header, the Date header, and the X-HTTP-UserAgent header, for all 2464 posts made by the Fake Sam Sloan identities to rec.games.chess.politics, extracted from the news.giganews.com news server.