Guccifer 2.0: Game Over - Evidence of Intent

This article will provide you with independent reference materials and links to articles from Guccifer2.0's blog and will help you to see for yourself - the evidence of WHAT Guccifer2.0 was.

This is the "minimal-guidance" version of this article - it is intended for those wanting to find their own way to the evidence without having everything explained and without being told the result.

There is also a "guided" version of the article here that explains what was discovered and what it means.

I would prefer that you inspect the documents yourself (you'll be provided with a single stylesheet RSID reference that you will check for in 3 documents - that's all you need to do with the files) and then consider the implications of what you found and what it means - and figure out what a few of us (independent investigative journalists) now KNOW about Guccifer2.0.

Metadata corroborates with what we've found too - but for the sake of this article, we are focusing on a single correlation of an RSID referenced across several documents, and the metadata is not needed to support the finding. - The anomalous RSID correlation - is ALL that is needed to demonstrate INTENT.

What this means and what should happen as a result of these findings will be added to a conclusions page, a link to which will also be added to both versions of the article - when it's ready.


Source Materials

Please download the following files:

https://guccifer2.files.wordpress.com/2016/06/1.doc (link)
https://guccifer2.files.wordpress.com/2016/06/2.doc (link)
https://guccifer2.files.wordpress.com/2016/06/3.doc (link)

Mirror copies are available below (please use originals above if available):

Host: d3f.uk -> 1.doc 2.doc 3.doc
Host: g-2.space -> 1.doc 2.doc 3.doc


Reference Materials

Download Word 2007: Rich Text Format (RTF) Specification, version 9 (Page 36 covers RSIDs)
www.microsoft.com/en-gb/download/details.aspx?id=10725


Investigation Hints

To undestand and interpret the evidence - you will need to understand what RSIDs (Revision Save IDs) are and the circumstances in which they change or stay the same - and understand what it means when they are identical across multiple documents.

Across all 3 documents, search for text string:

\styrsid11758497 No Spacing;

This is the end of a stylesheet rule, each rule is encapsulated in curly braces ("{", "}")

Look at the language set within that stylesheet rule. (This may help: Microsoft Locale ID Values)

RSIDs (such as 11758497 is) can only change under certain circumstances.

Consider how the same RSID is found on all 3 documents but the body contents of each is different.

You should be able to identify chronology of data being added to the file and from that ascertain how the documents were constructed and what the intent was. -

If you understand when RSIDs change and understand the RTF data (which can be achieved with the reference materials provided) - you will know what Guccifer2.0's intent was... and you didn't have to be told to believe anything and you didn't even need timestamps to do it.

If you're confused and struggle to interpret what this all means... work with others, discuss it, investigate together and see if you can figure it out. - Please only use the guided version (link near the top of this article) when you've exhausted all opportunity to figure this out for yourself... I really don't want to lead you to the ultimate conclusion.


When you have figured it all out, we can look at the metadata... INTENT CONCLUDED