On February 24, 10 days after multiple internal documents from a Heartland Institute Board meeting were published on the web, The Heartland Institute posted redacted screen captures of some of the emails that had been sent to Peter Gleick’s spoofed email address. These emails show that there are some discrepancies between the files Heartland transmitted and those that were later published. The emails also show how easy it was for Gleick to impersonate a member of Heartland’s Board.
The screen captures show the files that were sent to Gleick:
On February 3, the following two files were attached to an email: “2 Agenda for January 17 Meeting.pdf” and “Board Meeting Package January 17.pdf”
On February 6 at 8:57 AM, the following two files were attached to another email: “(1-15-2012) 2012 Heartland Budget.pdf” and “(1-15-2012) 2012 Fundraising Plan.pdf”
Two minutes later, the following four files were attached to a third email: “Binder1.pdf”, “Board Meeting Package January 17.pdf”, “CHARLES LANG-Resume2011.pdf”, and “Minutes of January 17 meeting.doc”
And finally, on February 10, one more file was attached to the last email Heartland released: “Board Directory 1-18-12.pdf”
Comparing these screen captures to the files published at DeSmogBlog, Greg Laden’s blog, and ThinkProgress, the file names appear to be identical except for the occasional appended “(2)” that is added when multiple copies of a single file are accidentally saved in a common folder. However, three files are unaccounted for.
First, we see that nowhere in these emails was the 2010 IRS form 990. This form is public information, available in nonprofit reports like those available from GuideStar.
Second, the allegedly fabricated strategy memo is not included in these emails. Gleick claims that he received that memo first, before assuming a board member’s identity to acquire the other files, and Heartland agrees that the memo was not sent to Gleick in these emails. So the fact it’s not included is entirely expected.
Third, the 8:59 AM email screen capture shows that Gleick received a copy of the 2011 resume of Board member Charles Lang (“CHARLES LANG-Resume2011.pdf”). Gleick did not send this file along with the others and it was not published by any of the sites mirroring the documents.
S&R asked Gleick’s lawyer if Gleick would explain where he got the IRS form 990 from 2010 that he distributed and why he chose not to distribute the resume, but we have not received a response.
Also notice that Heartland’s screen captures are not complete. Note the scroll bars on the right sides of the January 28, January 30, February 2, February 3, and February 6 emails indicate that there is quite a bit more to the email thread than what is shown. The Jan 28 and 30 emails are clearly related, as are the Feb 2 and Jan 28 emails, so the scroll bars may simply be showing the top of emails that are already shown. However, there is no way to demonstrate this connectivity on the Feb 3 or Feb 6 emails from what is shown. As such, the screen captures could easily be presenting a highly selective, perhaps even deceptive, picture of the exchanges between Heartland and Gleick. Without additional information there is no way to know for certain.
Beyond the discrepancies and incomplete picture painted by the screen captures, however, the emails do show that it was apparently easy for Gleick to get confidential information.
The Jan 27 email has the presumed board member simply asking a Heartland staff member to “please add (or have the appropriate staff member add) this personal email address to the Board mailing list for all future Board communications? Do not delete my [redacted] address — just add this one as a duplicate.”
The Jan 28 email indicates that the Heartland staff member has contacted someone else and that someone added two emails to the Board directory, one of which is the supposed personal address of the presumed Board member.
That’s all it took. Assuming we take Heartland’s emails at face value, there were no requests sent from the Heartland staff member to verify the presumed Board member’s identity. Why not? Did Heartland contact the presumed Board member using his previous official email to verify, and what was the result? The email screen captures don’t say. It shows a marked lack of IT security and/or significant naivety that staff at The Heartland Institute were so easily duped. According to the official press release regarding these emails, “[m]inor redactions have been made to the emails to protect the individual privacy of those involved,” but those minor redactions also hide the identities of the staff members who were so easily duped.
The email screen captures raise a number of questions – why didn’t Gleick distribute the resume he received along with all the other documents, what’s hidden by the scroll bars in some of the emails, how was The Heartland Institute so easily duped – but fails to answer any of them. Unfortunately for The Heartland Institute, these questions can only lead to others that they’d rather weren’t asked, like “what is Heartland hiding,” “who is Heartland protecting,” and “are we being told the whole story.”
We have an answer to that last question, and it’s a simple “no, we aren’t.”