Statement by cybersecurity consultant Harvey Newstrom, October 3, 2009
Statement by Harvey Newstrom, October 3, 2009
I will confirm here that Alcor did utilize my services to perform a forensics investigation on Larry Johnson’s PC after he left their employ. I won’t get into any specifics about what Alcor had me look for and what I found. But I will try to dispel some unfounded rumors floating around by assuring everyone that everything I found was completely boring. There was no evidence of the horror stories we are hearing now. There was no evidence of intrigue and subterfuge. All these stories seem to have been created after the fact.
I was able to recover all his deleted emails and files. Mr. Johnson kept everything until the end, and then deleted everything at one time, which was trivial to recover. No sophisticated efforts were made to destroy files and hide files. I was able to recreate his complete Internet activity history and local network activity, including his access history to Alcor networked files. They had an anti-virus program that scanned all files and logged a summary, so I could double-check the count of files I was recreating in the history with the logged number of files on the disk each week. There were dozens of system logs that helped verify the timestamps and lack of any gaps in the recovered histories. The internal structure of the Outlook mailbox helped verify that there were no missing emails that were not recovered. It was one of the most straight-forward and complete forensics recoveries I had ever done.
And I found nothing interesting.
None of the day to day emails or reports to or from Mr. Johnson indicated problems with Alcor’s treatment of patients. None of the outrageous stories that appeared afterwards were mentioned beforehand. There were not even hints or references to problems or concerns of any kind. In fact, the reports were pretty positive about how well everything was going, and how much improvement was occurring due to Mr. Johnson’s leadership.
I was able to read the history of Mr. Johnson’s disputes with Alcor management. They were concerning his own contractual relationship with Alcor and his expected future advancement within Alcor. There were no disputes over patient care or Alcor’s handling of patients.
I was also able to recreate the history of Mr. Johnson’s search for the attorneys in the Williams case, and his attempts at making first contact with them. This indicates that Mr. Johnson was not a mole into Alcor or secretly working against Alcor beforehand. It also seemed to indicate that he became disgruntled first, and started looking for problems later.
There did seem to be a concerted effort to systematically go through all the networked disks and directories looking for files. But the list of files accessed did not indicate any pattern or anything important. If this indeed was a search for something bad, it doesn’t appear that anything was found.
Everything I was able to uncover showed normal operations, no problems, and just the usual political disagreements that sometimes arise between employer and employee. Based on the sheer amount of information and complete lack of any mention of problems or inappropriate behavior, it did not appear that any of these concerns existed before Mr. Johnson left Alcor. All these stories seem to have been manufactured after the fact.