Hadley’s Email

Okay, now for the Hadley weirdness revealed in the White House email searches revealed in a document turned over to CREW.

On the morning of October 15, Karl Rove testified before the Plame grand jury for appearance number 3.  He justified testifying to Fitzgerald by handing over the email Rove purportedly sent Hadley on July 11, 2003, just after he leaked Plame’s identity to Matt Cooper.

Either that day (the file searches appear to be dated October 15) or the next, someone did a series of searches, apparently looking for Hadley’s emails; these searches appear on pages 47-49. Here are the searches in the order of which they were last opened (here’s the spreadsheet if you want to play along).

So here’s what appears to have happened.

Either the same day Rove testified or the next day, someone started doing searches for Hadley’s email. On that day they appear to have run the search at least 7 times, from 2:12 PM to 8:22 PM, until the file size had been shrunk significantly. That Friday, October 22, 2004, at 5:34 PM, someone did two more searches. Then, in the middle of the night that night (that is, from 2 AM to almost 5 AM on a Friday-Saturday night),  someone did five more searches; the first one of these was opened again on November 4. The last of these searches–like the last of the searches saved on October 16, 2004, was significantly smaller than the rest of the searches done that day.

Then, finally, someone did a search under a slightly new name: HadleyInitial Search. We don’t know when this search was saved–the two runs of the search are titled simply 1st Hadley Results and Hadley Final. These files were both much smaller than any of the earlier searches.

On October 28, 2004 someone appears to have done a whole slew of searches in the NSC files, many of them date-specific (these aren’t in the spreadsheet, but appear in the PDF). But a number of these searches were named with the same NSC_2004_Saturday October names that the earlier files had been named. Given the file sizes, it appears that "search" may have consisted of nothing more than renaming the searches done the previous week.

The Appeals Court ruled that Cooper and Judy would have to testify on February 15, 2004. In March, someone opened several of these files.

On March 9,2005, at 5:34 PM, someone opened the two searches saved with an October 22, 2004 file name and the search, 1st Hadley results. And then, in the middle of the night (3 AM), someone opened the filed titled Hadley file.

Now, I’m going to have to let William Ockham (who first pointed these searches out to me) or MadDog or someone explain the intricacies of this. But it looks to me as if within a day after Rove testified about his mysteriously discovered email to Hadley, someone went in and spent 6 hours playing around with the PST file that had Hadley’s emails in it. They may have done so again a week later (or those files could have been renamed). And finally, when it became clear that Judy and Cooper would have to testify, someone was looking at them again. 

Now, the Rove and Cooper searches were called a November 9, 2004 search. The slew of searches on October 28 were called an October 25 search. It looks like it’s possible that someone got into the PST files and altered them before Fitz came looking for the Hadley email.