www.justiceforchandra.com Forum Index www.justiceforchandra.com
Justice for Chandra Levy and missing women
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 

Chapter 9. On Her Computer

Post new topic   This topic is locked: you cannot edit posts or make replies.    www.justiceforchandra.com Forum Index -> Murder on a Horse Trail
View previous topic :: View next topic  
Author Message

Joined: 13 Sep 2002
Posts: 9255
Location: Jacksonville, FL

PostPosted: Mon Apr 18, 2005 8:57 am    Post subject: Chapter 9. On Her Computer Reply with quote

available from Amazon.com:

Murder On A Horse Trail: The Disappearance of Chandra Levy
by Ralph Daugherty
ISBN: 0-595-31847-9

Murder on a Horse Trail: The Disappearance of Chandra Levy also available free to read online here on www.justiceforchandra.com
Back to top
View user's profile Send private message Send e-mail Visit poster's website

Joined: 13 Sep 2002
Posts: 9255
Location: Jacksonville, FL

PostPosted: Tue Apr 19, 2005 7:29 am    Post subject: Reply with quote

On Her Computer

Tuesday morning, May 1, Chandra logged onto the internet at 9:30 a.m. Chandra spent the morning "surfing the web", Washington Police Chief Charles Ramsey told Bob Schieffer of CBS Face The Nation "...from the e-mail message she sent her mother, from the surfing of the web, for lack of a better word to describe the other activity that was taking place, there`s nothing that would be suspicious in nature that would lead us to believe that, you know, she had been attacked or there was some problem or whatever. It could just be coincidence, but certainly it is something that our investigators have looked at."

Yet, nothing actually identified Chandra as being on the computer. The password for logging onto the internet is commonly left in the login dialogue box. The e-mail sent to her mother was actually "a very generalized e-mail about Southwest specials flights", Susan Levy told the Today Show. It was a "snippet of information about a sale fare from Southwest Airlines" that had been forwarded from Chandra's computer to her parents in Modesto. [1] Lisa DePaulo describes it in Talk:

On May 1 the Levys got their last communication from
their daughter in the form of an e-mail sent to them
at 10:45 a.m. Washington time. Contrary to reports,
Chandra did not write about her plans to fly home.
The message contained no personal note, just a list
of supersaver flights between Modesto and Los
Angeles. (The family planned to fly to Chandra's
graduation together.) What the Levys didn't know at
that point was that Chandra hadn't yet made any
plans to get back to California. had no airline
ticket, no train ticket, no car. [2]

It could be considered awfully strange to send an e-mail home, forwarded or not, without adding a comment, especially when leaving a message for her aunt a day and half earlier that she had "big news, call me".

She had big news for Linda Zamsky but did not mention it to her mom, not even a "wait till you hear this" alert. Nothing. Condit was a secret that Chandra had inadvertantly confided to Linda. Could the big news have been something she could have only told Linda, at least right away?

The last time Chandra had talked to her parents was Friday evening, more than three days earlier. In that time she talked to Condit and had vacillated between telling her landlord on Saturday of a moveout date on the coming weekend and on Sunday saying she would have a firm moveout date on Wednesday, tomorrow in fact. She had left a call for Sven on Saturday, wanting to talk. She had big news for her aunt on Sunday. Her parents were looking for word from her of when she would arrive to make plans for the family to attend her graduation. Yet all that was sent from her computer on Tuesday morning was an e-mail notification from Southwest of supersaver fares forwarded to her parents without comment. Was it Chandra on the computer who forwarded that e-mail?

The questions were to persist. Two weeks after Ramsey first told Bob Schieffer it was Chandra on the computer, Schieffer had him back on CBS Face The Nation:

SCHIEFFER: And, Chief, let me ask you this because
this is a question that so many people have asked
me. Are you satisfied that the computer traffic on
her computer that day, how do you know it was her?
Could it have been someone else?

RAMSEY: Well, I mean, obviously it could be, but we
doubt it because of the nature of the traffic. We`ve
been able to go back not just that date but a couple
of months, and what we found is a regular pattern of
sites that she visited and things of that nature. So
there`s no reason for us to believe that there was
anyone other than her on the computer that morning.

Is there something in that surfing that tells us what was to happen to Chandra? Or something that someone wanted us to think happened? The surfing was extensive, over three hours visiting a wide range of sites. Washington's ABC affiliate WJLA provided the list:

Chandra Levy Website Addresses

Earlier this week, the Metropolitan Police
Department announced it would release a list of
websites visited by Chandra Levy on May 1, 2001, in
the hopes it may generate additional tips into her
disappearance. Some of those websites follow:


Additional websites and specific pages visited
within those sites will not be released at this
time. This information is considered evidentiary and
part of the ongoing investigation. [4]

Michael Doyle of the Modesto Bee summed up the sites visited as "three-plus hours the morning of May 1 tapping into more than 30 Internet sites from her laptop computer. The sites covered everything from the House Agriculture Committee, on which Condit serves, to Southwest Airlines, Amtrak and the Hollywood Reporter."

CNN pointed out that she "also visited thomas.loc.gov, a site operated by the Library of Congress that contains information about activities in Congress" and "visited sites for her hometown paper, the Modesto Bee in California, as well as the Washington Post, USA Today, the Washington City Paper, the San Francisco Chronicle, Nando Times, the Hollywood Reporter, National Geographic, the Drudge Report and the Los Angeles Times".

CNN continues:

She viewed sites for Southwest Airlines, Amtrak and
gofrance.about.com, which has information about
traveling to France.

Other sites on the list included the popular search
engines Yahoo, AltaVista and Lycos; Hotmail, an e-
mail site; vicinity.com, which gives users maps to
specific locations, two entertainment sites, E!
Online and Mr. Showbiz; the portal site msn.com; and
the site for ice cream chain Baskin-Robbins. [5]
Back to top
View user's profile Send private message Send e-mail Visit poster's website

Joined: 13 Sep 2002
Posts: 9255
Location: Jacksonville, FL

PostPosted: Tue Apr 19, 2005 7:31 am    Post subject: Reply with quote

According to the Mercury News, police said she bounced from site to site. "She was all over the place, some for a tenth of a second," Executive Assistant Police Chief Terrance Gainer told the Mercury News. "Clearly, she was tracking Condit."

In my opinion, that is Chandra's entire bookmark list and indeed not much more than a cursory visit to the entire bookmark list was done. It's somewhat unusual to use Lexis-Nexis, Google, AltaVista, Yahoo, and Lycos search engines in one three and a half hour session along with six newspapers and three Hollywood gossip sites, and travel sites and Baskin Robbins, in terms of time. Only a very focused search could be done over that range of material in one session.

It's my experience that different search engines produce different results, and in the past I have gone through a few before I was able to find something, but so rarely I dropped them off my bookmark list. I use Google exclusively, and it had links for AltaVista, Lycos and Yahoo at the time.

She might have had a meta-search site that drops the same search into every site. I tried it a couple of times but it was pretty cumbersome. Throws up a window for every search site. Also there are the techniques to harvest new references like newspaper articles with a bot on an ongoing basis, so that every day you can produce a new list of articles that reference the search.

The point is, whether Chandra used one or not, the concept of searching through all search engines to perform usually repetitive thorough searches is valid, and in fact automated as well as can be done by meta-search sites. It doesn't make a person a computer whiz to search in every search engine. It does make them extremely thorough, and this is yet another incident with multiple explanations. It is consistent with being interested in a job working for Condit. It is also explainable as her being very interested in his actions for some reason. I think that she just clicked through to AltaVista, Lycos, and Yahoo from Google to perform the same search. Thorough, and would have resulted in articles on his lunch at the White House on Monday.

And I didn't even mention the government sites, which are very static and change infrequently, which makes for a quick check but also a very tiresome check to do any more than infrequently, and also National Geographic included in that 30 sites.

That's an average of 7 minutes per site, somewhat reasonable on the face of it, but then there was time involved in handling e-mail, forwarding one to her parents, taking a break once in a while, but still some sites can be clicked through somewhat quickly, but the first screen for Lexis alone dripped in like molasses. How do you look at a newspaper in 5 minutes, just scan the front page looking for a specific type of article? The two things listed by police with specifics, the Baskin-Robbins special and the map of the streets and park around Klingle Mansion, take a little effort to bring up and take a look at.

I'm satisfied that she used Lexis-Nexis for the Congressional World services. It has detailed information on all congressional activities. That would be where she would be able to see scheduled activities of committees that Condit was on.

She would have used a government signon for Lexis-Nexis that she used at the BOP. There are also extensive personal information research capabilities at Nexis, and she may have had access to those services as well in working with criminal related research at the BOP. She did internet searches and scanned newspapers in her job in the information office at the BOP. But the Congressional World service is exactly what she would have wanted for searching on Condit.

Of course, this conjures up that she's on to something and digging into his past, whereupon he has to stop her, but that's a vast conspiracy image. It is so difficult to envision her tracking everything that could be associated with him after telling her landlord there's no reason to stick around anymore, unless he told her something Sunday that got her very interested in his area of responsibility.

That might be bringing her back to work for him in D.C. That would be big news for Zamsky and something she wouldn't want to broach with her parents until necessary. That would placate her for him not helping her with a Federal job, and she would believe it even if he was just telling her something to get her off his back.

She was digging way deeper than what one would do to determine his schedule, and quite frankly you couldn't determine much of anything of his schedule or whereabouts even with an exhaustive web search. For example, he was in a meeting with Cheney. That wouldn't have been anywhere on the web.

To dig that deep, she was researching his past or had been told she would be a legislative aide for him as soon as he could arrange it, and she was digging deeper than ever into all possible issues affecting his office, becoming an expert. The big news she left for Zamsky was not dark and mysterious, indicating a dig into a dark past. It was upbeat and enthusiastic. Maybe she was coming back to D.C. to work for Condit.

And I didn't mention the travel sites specifically. Amtrak, Go France, Southwest, 7 minutes a piece, ok, a tenth of a second on some, but clicked through to leave enough time for things like checking schedules on Amtrak.

In the only trip Chandra made home during her half year in DC, she flew with a ticket from Condit. There is no indication she made any travel plans to go to her graduation, even as she was telling fellow workers at the BOP that she was going.

On the other hand, any travel arrangements at that time would have been a round trip, as she expected to remain employed at her internship at the BOP up until a week before she disappeared.

Even in the week after her internship was terminated, she made no travel arrangements. Her parents wonder why she was so fuzzy about her plans to come home. Susan told the Baltimore Sun, "She wasn't giving us any details or times exactly when she was coming in. It was kind of unlike her". Only in the Saturday e-mail to her landlord, even as Carolyn was arriving at the airport, did she e-mail her landlord and say that there was no longer any reason for her to stay in D.C., and that she must terminate her lease.

But the next day she talked to Condit again, and then called Linda Zamsky to say she had big news. And e-mailed her landlord that her move out date of the next weekend was now uncertain. She would have a definitive moveout to tell him on Wednesday. What would have made it become definitive tomorrow, and did it have anything to do with checking her answering machine repeatedly for a message?

Chandra visited the Amtrak website the morning she disappeared. She would be able to go get on a train and be in California in a day and a half. Was she contemplating making her moveout sooner than the next weekend, or later? What was she waiting for, an answer from Condit as to whether he was still going to give her a flight ticket she would have been expecting to use? Why was it uncertain?

The police came out with a list of websites asking for help from the public. Some sites were not made public, cited as "evidentiary". [6] An incomplete list provides for incomplete or misleading help. I guess we're lucky to have any list at all since it was so hard for them to find out what was on her computer because the hard drive crashed on them.

I didn't try to visit all the websites and time it, but I did go through the list and try to see what Chandra would have done on those sites and try to determine if the list was consistent with what we would expect from Chandra's web surfing. There is no end to the conspiracy to imitate Chandra on her computer Tuesday morning theories, debated at length on the internet.

The most frequent suggestion is that the sites were visited at some other time than Tuesday morning. However, the Internet Service Provider that Chandra dialed into would normally record the 9:30 a.m. login and the 1:00 p.m. logout from that phone line, and e-mail was recorded at multiple ISP's as being sent at 10:45 a.m. from there. These activities cannot be faked elsewhere at a different time.
Back to top
View user's profile Send private message Send e-mail Visit poster's website

Joined: 13 Sep 2002
Posts: 9255
Location: Jacksonville, FL

PostPosted: Tue Apr 19, 2005 7:31 am    Post subject: Reply with quote

Also frequently suggested is changing the time on her computer clock. Any timestamp on the computer is irrelevant on its own, but if within the ISP recorded log in and out times, then it is much more legitimized but of course still prone to manipulation. These are three timestamps that are of interest:

a) browser history file. I am looking at my browser history file now. It shows the time that each web page was visited. It shows long URL's for each page including search parameters. It is very comprehensive.

The history time stamps would accurately show the time each page was visited and therefore how long was spent on each page before visiting the next one. It is not reasonably easy to go through the history info and edit it but of course it is data on the computer, and a specialized program could be used to do it. It would need to be browser and version specific, and after a person visited all the pages as quickly as possible, the program could start at a certain point and spread out the times over a longer period.

A remote possibility is a recorded script from another computer that recorded visiting all the sites, then was played on Chandra's computer keystroke for keystroke to simulate it. Given the vagaries of internet response time, it is beyond possibility in my opinion to get an accurate rendition of the first session.

Even assuming a script program that duplicated the time lapses between each keystroke, one missed or late screen would throw it off until the next URL was entered somehow or selected from bookmarks. From my experience of pop up windows, pages with frames, and the necessity of getting focus to enter data, the script would have to capture mouse clicks at extremely precise pixel locations as well as keystrokes, and the computer where the script was created would surely have to be her own at some time when she wasn't home. The script would have to be recorded and replayed that morning.

Naturally, this now brings us to the possibility of accessing the computer remotely to start the script, but of course the computer needs to be online to access it remotely. I have seen everything postulated concerning these possibilities, and one tossed out frequently is that she may have had DSL and her laptop online all the time. You still are logged in to an ISP over a DSL or cable network, and the police say she logged in to the ISP around 9:30 am.

Again, this is CIA level stealth and so unworkable that I've never heard of it being attempted. An internet browser is probably the worst thing in the world in which to have to recreate a previous computer session verbatim. The vagaries of internet page generation and the high degree of mouse activity and precision required makes this probably an impossible task. Certainly not when a person could sit there and do the same thing from a written script.

b) browser cache file timestamps. Browser cache files are computer files with names and timestamps just like any other computer file. The timestamps are easily changed with a tool. However, they would have to be changed to match the history timestamp of the page where they came from, and it is not trivial to go through a cache and match each file with the page it came from. This also would have to be done ahead of time and be done by a program to implement the changes. A tremendous research effort.

The police said, for example, that Chandra only visited some sites for as brief as a tenth of a second, although my history timestamps are accurate only to the second. The precision was probably from the cached file time stamps, which are recorded at millisecond precision. It would be possible forensically to see the files in chronological order and note where the content came from had changed to another page, and see only a tenth second on a page in between two other pages.

It is also possible to change those times stamps, and change them in coordination with changes made to the browser history data. And that is after all the pages were visited as fast as they could be clicked. We're only talking about the time being spread out of page visits between log in and log out. It would take longer to do that than to sit with realistic pauses on each page to recreate a three and a half hour session.

c) e-mail time stamps. E-mails are archived at the e-mail host as they pass through, so the computer time is irrelevant. In addition, Susan Levy received the 10:45 am e-mail at 7:45 Pacific time. The scripting would have to include interaction with the e-mail program and obviously a requirement is that a realistic e-mail from Southwest would have to be bogusly created to a degree that even examining it today would not be able to determine that Southwest didn't generate it.

Some have suggested that some software may have been installed surreptitiously and then deleted itself after performing the websurfing. If files were deleted, they are not cache files that are being looked at to determine what Chandra looked at, for example the map of Rock Creek Park.

Commercially available erase software would overwrite data with nulls (the conceptual equivalent of blanks in binary, but not the same as text blanks) rather than leaving the data there and Windows just marking the space as available. Defragging would also make it likely deleted files would be overwritten. What would be erased? Some of this software we're talking about that would need to be installed before using.

Believe me, it is infinitely easier to sit there for three and a half hours and visit ice cream and Hollywood gossip sites.

So assuming that whether Chandra or someone else, this looks to me like right down her bookmark list. Search on Condit? There's a no brainer. An e-mail for a flight to LA? Okay, forward to parents. No brainer. Lexis-Nexis? Now that's more interesting. They would have a record of login and search history, at least number of them, results retrieved, etc. The person must use the same login as Chandra used at the BOP. Ahhh, I can hear it now. Sven, run, run, the mob is coming after you again...

Then there's the ever popular the computer was sanitized. Far from sanitizing the computer from references to Condit, her activity that morning is totally oriented around Condit. The police described her as stalking him.

The interesting aspect of this is that it is a behavioral analysis, not a technical analysis, to determine if it was Chandra on the computer. The computer recorded what happened regardless of who the person was. It is up to us to judge the behavior of that person. It looks like Chandra to me, at a minimum going through her regularly bookmarked sites to stay up to date as an insider, at most sleuthing and finding something that cost her her freedom.

It would be a typically bad B-movie script to be researching a person such as Joyce Chiang on the internet, another government employee from California who disappeared five blocks from Chandra two years earlier, then go to a closed, isolated mansion in a nearby forest and turn up missing as well. But this whole saga has been too unbelievable to even dream up as a script. It would get tossed.
Back to top
View user's profile Send private message Send e-mail Visit poster's website

Joined: 13 Sep 2002
Posts: 9255
Location: Jacksonville, FL

PostPosted: Tue Apr 19, 2005 7:34 am    Post subject: Reply with quote

Next chapter - Klingle Mansion

Murder on a Horse Trail - Table of Contents

On Her Computer
1. Arax, Mark and Stephen Braun. “Days of Torment for Interns Parents.” Los Angeles
Times 7 July 2001.

2. DePaulo, Lisa. Talk 8 Aug. 2001.

3. Ramsey, Charles, Michael Doyle and Tom Squitieri. Interview with Bob Schieffer.
CBS. 29 July 2001. Transcript.

4. “Chandra Levy Website Addresses.” WJLA 20 July 2001.

5. “Missing Intern.” CNN 21 July 2001.

6. Ibid.

Doyle, Michael. “Condit’s schedule checks out.” Modesto Bee 22 July 2001.

Lengel, Allan and Sari Horwitz. “Levy Looked Up Map Of a Rock Creek Site.”
Washington Post 16 July 2001.

Levy, Susan. Interview with Katie Couric and Matt Lauer. Today. NBC. 17 May
2001. Transcript.

“Lost in a Washington mystery.” Baltimore Sun 26 May 2001.

Murray, Frank J. “Who is Chandra Levy?” Washington Times 29 July 2001.

Ramsey, Charles. “Is Private Lie Detector Test Taken by Rep. Gary Condit
Good Enough for D.C. Police?” Interview with Bob Scheiffer. Face the Nation.
CBS. 16 Jul. 2001. Transcript.

Stites, Roxanne and Lori Aratani. “Levy may have tracked Condit via Web the
day she disappeared.” San Jose Mercury News 19 July 2001.

Sweet, Lynn. “Police: Missing intern no ‘trollop’.” Chicago Sun-Times 19 July
Back to top
View user's profile Send private message Send e-mail Visit poster's website
Display posts from previous:   
Post new topic   This topic is locked: you cannot edit posts or make replies.    www.justiceforchandra.com Forum Index -> Murder on a Horse Trail All times are GMT - 4 Hours
Page 1 of 1

Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

Powered by phpBB © 2001, 2005 phpBB Group