# So what's all this about Romney's tax returns being hacked?

**URL:** <https://boards.straightdope.com/t/so-whats-all-this-about-romneys-tax-returns-being-hacked/633796>\
**Category:** Politics & Elections\
**Created:** [September 5, 2012, 9:54pm UTC](https://boards.straightdope.com/t/so-whats-all-this-about-romneys-tax-returns-being-hacked/633796 "2012-09-05T21:54:31Z")\
**Posts on this page:** 20\
**Page:** 6

<div class="post-metadata">

**Author:** ![davidm](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/davidm/32/225_2.png) [@davidm](https://boards.straightdope.com/u/davidm)\
**Post date:** [September 7, 2012, 12:33pm UTC](https://boards.straightdope.com/t/so-whats-all-this-about-romneys-tax-returns-being-hacked/633796/101 "2012-09-07T12:33:15Z")

</div>

> [@Measure\_for\_Measure](#):
>
> But I was running the hoax scenario. If the files are forgeries, they never set foot at PWC.
> 
> **SteveNC** : Forensic accounting involves internal consistency checks. There might even be publicly available claims that could be verified or at least ones that will play on Fox News. The bar at that network is pretty low after all. There are also some less well known tricks which I’m uncomfortable discussing here, though I learned of them from a general publication on the internet. Nothing is 100% of course: I’m just thinking that forging the figures on a tax return with only hazy knowledge of the target would be challenging. What are the odds that the perps are CPAs with multiple years of experience handling hedge fund accounts? I wouldn’t say zero, but I was sketching a scenario with components that were most probable individually.

This is an important point. Forging something as complex as Mitt Romney’s tax returns in a way that would pass simple consistency checks (internal and external consistency) would be difficult and require diverse knowledge and skills. Doing it in a way that would fool forensic accountants would be even more difficult if not impossible, and you can bet that the best forensic accountants on the planet would be poring over these things if they were released.

---

<div class="post-metadata">

**Author:** ![BigT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bigt/32/12044_2.png) [@BigT](https://boards.straightdope.com/u/BigT)\
**Post date:** [September 7, 2012, 12:42pm UTC](https://boards.straightdope.com/t/so-whats-all-this-about-romneys-tax-returns-being-hacked/633796/102 "2012-09-07T12:42:34Z")

</div>

> [@davidm](#):
>
> If they were in fact pulled from a network share then this thing is real.
> 
> If they weren’t then how did the parties involved know that they were accessible from that particular office? Presumably they are, otherwise PWC and the Secret Service would know this is a scam.
> 
> I suppose the whole thing could be a lucky guess but I notice that no one is questioning the details about how they got into the office, so the perpetrators seem to have some knowledge of the layout of the building.
> 
> If I were planning a hoax like this I’d avoid details that could potentially be proven wrong. I’d simply claim to have hacked into their computers remotely, or that I had broken into a PWC office without saying which one, in what part of the country, or how I did it.
> 
> There’s a lot of detail in the story that no one so far is denying.

Liars often compensate with a lot of detail.

---

<div class="post-metadata">

**Author:** ![Enkel](https://avatars.discourse-cdn.com/v4/letter/e/df705f/32.png) [@Enkel](https://boards.straightdope.com/u/Enkel)\
**Post date:** [September 7, 2012, 1:11pm UTC](https://boards.straightdope.com/t/so-whats-all-this-about-romneys-tax-returns-being-hacked/633796/103 "2012-09-07T13:11:18Z")

</div>

BitInstant To Romney Camp: ‘We’ll Convert $1,000,000 USD to Bitcoin For Free.’ [BitInstant To Romney Camp: 'We'll Convert $1,000,000 USD to Bitcoin For Free.'](http://www.forbes.com/sites/abegarver/2012/09/07/bitinstant-to-romney-camp-well-convert-1000000-usd-to-bitcoin-for-free/)

> [@](#):
>
> their blog which reads, “Romney – if you’d like to acquire $1m worth of Bitcoins (somewhere in the range of 50,000-100,000 BTC), we’ll help you get the coins without charging any commission. That’s right, we’ll get you $1m worth of Bitcoins without taking a fee. Not only that, we’ll also show you how to safely use a Bitcoin wallet, back up and encrypt it, and make payments. We’ll even set you up with a Bitcoin app on your iPhone! You’ll be a Bitcoin expert in no time!”

When I checked the “Release the Documents” address, there’s been over 2 BTC deposited to that account. I personally wouldn’t donate to this account because they’re going to release the decryption key on 9/28 even if the account doesn’t reach the amount.

I don’t think anything has been transferred to the “Delete the Documents” account over the past day.

I think if the statements about the building, room, etc were totally false or if PWC had entirely ruled out a data theft, that there would be a public announcement to prevent people from ‘donating’ to a complete hoax on either side.

---

<div class="post-metadata">

**Author:** ![Zakalwe](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zakalwe/32/270_2.png) [@Zakalwe](https://boards.straightdope.com/u/Zakalwe)\
**Post date:** [September 7, 2012, 1:19pm UTC](https://boards.straightdope.com/t/so-whats-all-this-about-romneys-tax-returns-being-hacked/633796/104 "2012-09-07T13:19:36Z")

</div>

> [@Measure\_for\_Measure](#):
>
> ```
> Telephone: [1] (615) 503-2860
> 
> ```
> 
> Check out the [1] in front of the area code though - that international dialing code indicates either a non-US citizen or a red herring.

Ummm, the [1] is just a long-distance code, not international. International would have looked like this:

[00] [1] (615) 503-2860

---

<div class="post-metadata">

**Author:** ![pulykamell](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/pulykamell/32/3166_2.png) [@pulykamell](https://boards.straightdope.com/u/pulykamell)\
**Post date:** [September 7, 2012, 1:39pm UTC](https://boards.straightdope.com/t/so-whats-all-this-about-romneys-tax-returns-being-hacked/633796/105 "2012-09-07T13:39:35Z")

</div>

> [@Zakalwe](#):
>
> Ummm, the [1] is just a long-distance code, not international. International would have looked like this:
> 
> [00] [1] (615) 503-2860

Typically, the interntional country code would be indicated with a “+”, so if you had +1 615 503 2860, I would say that has an international code in it, but I’ve never seen the country code written in brackets like that.

---

<div class="post-metadata">

**Author:** ![Enkel](https://avatars.discourse-cdn.com/v4/letter/e/df705f/32.png) [@Enkel](https://boards.straightdope.com/u/Enkel)\
**Post date:** [September 7, 2012, 1:41pm UTC](https://boards.straightdope.com/t/so-whats-all-this-about-romneys-tax-returns-being-hacked/633796/106 "2012-09-07T13:41:52Z")

</div>

> [@Zakalwe](#):
>
> Ummm, the [1] is just a long-distance code, not international. International would have looked like this:
> 
> [00] [1] (615) 503-2860

Actually  
00 = country exit code for many countries  
1 = country code for the US and Canada (+ some others)

That is why, when dialing US/Canada to US/Canada you only have to dial the ‘1’ Essentially you’re accessing the country level routers (exchange) [but not exiting the country level exchange] instead of your local phone company routers (exchanges).

It is not typical for a US person to write a US phone number with the country code included unless they are accustomed to dialing from outside of North America.

It also isn’t typical to include the country exit code for any phone numbers. Like, if I were to write a Mexican phone number, I would write +52/###… and not include the exit code. It would physically be dialed from the US as 00 52 ####… By using the 00 code, your call is routed to the border routers between countries, bypassing the local router and country level routers. Here is a list of country exit codes: [List of country codes, international and national prefixes](http://www.howtocallabroad.com/codes.html)

I think the country code only tells us that the perpetrators are not likely to try to exchange the Bitcoins to a currency within the US. But, that would be a stupid thing to do anyway.

---

<div class="post-metadata">

**Author:** ![davidm](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/davidm/32/225_2.png) [@davidm](https://boards.straightdope.com/u/davidm)\
**Post date:** [September 7, 2012, 3:12pm UTC](https://boards.straightdope.com/t/so-whats-all-this-about-romneys-tax-returns-being-hacked/633796/107 "2012-09-07T15:12:08Z")

</div>

> [@BigT](#):
>
> Liars often compensate with a lot of detail.

Yes, but what if those details are correct? As far as I know, no one is disputing them yet. And why add details that you know are false, risking immediate exposure? To pull of a scam like this, you would only release details that you know are true.

> [@Enkel](#):
>
> I think if the statements about the building, room, etc were totally false or if PWC had entirely ruled out a data theft, that there would be a public announcement to prevent people from ‘donating’ to a complete hoax on either side.

Exactly. It’s conceivable that authorities wouldn’t point out the incorrect details for some reason or other, but it seems like someone somewhere would say, “hey that’s not correct”.

---

<div class="post-metadata">

**Author:** ![davidm](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/davidm/32/225_2.png) [@davidm](https://boards.straightdope.com/u/davidm)\
**Post date:** [September 7, 2012, 3:17pm UTC](https://boards.straightdope.com/t/so-whats-all-this-about-romneys-tax-returns-being-hacked/633796/108 "2012-09-07T15:17:16Z")

</div>

> [@Measure\_for\_Measure](#):
>
> I’m wondering whether the layout described fits with the PWC floorplan.

No one with any sense who actually wanted to succeed with the plan would include such a detail if it wasn’t correct. It’s too easily checked.

---

<div class="post-metadata">

**Author:** ![davidm](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/davidm/32/225_2.png) [@davidm](https://boards.straightdope.com/u/davidm)\
**Post date:** [September 7, 2012, 4:07pm UTC](https://boards.straightdope.com/t/so-whats-all-this-about-romneys-tax-returns-being-hacked/633796/109 "2012-09-07T16:07:15Z")

</div>

> **[BitInstant To Romney Camp: 'We'll Convert $1,000,000 USD to Bitcoin For Free.'](https://www.forbes.com/sites/abegarver/2012/09/07/bitinstant-to-romney-camp-well-convert-1000000-usd-to-bitcoin-for-free/)**
>
> In what Dina Rezvanipour, CEO of 3d Public Relations and Marketing, says may be a publicity stunt similar to Larry Flynt's (See Page 2), a Bitcoin transfer service has offered to waive its fee for Romney to convert $1,000,000 USD to...

> [@](#):
>
> BitInstant’s Statement
> 
> In a call to confirm that the offer is legitimate, Erik Voorhees said, “It is”, and directed me to the statement on their blog which reads, “Romney – if you’d like to acquire $1m worth of Bitcoins (somewhere in the range of 50,000-100,000 BTC), we’ll help you get the coins without charging any commission. That’s right, we’ll get you $1m worth of Bitcoins without taking a fee. Not only that, we’ll also show you how to safely use a Bitcoin wallet, back up and encrypt it, and make payments. We’ll even set you up with a Bitcoin app on your iPhone! You’ll be a Bitcoin expert in no time!”

This offer (not the blackmail attempt) is obviously a PR stunt by BitInstant.

---

<div class="post-metadata">

**Author:** ![davidm](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/davidm/32/225_2.png) [@davidm](https://boards.straightdope.com/u/davidm)\
**Post date:** [September 8, 2012, 4:58pm UTC](https://boards.straightdope.com/t/so-whats-all-this-about-romneys-tax-returns-being-hacked/633796/110 "2012-09-08T16:58:43Z")

</div>

It looks like that “release the forms” address is currently beating the “don’t release” address 6 to 1.

> **[Address: 12AP6iCwRNFQqKLStH3A4b4hw3SL6RaNgB](https://www.blockchain.com/explorer/addresses/btc/12AP6iCwRNFQqKLStH3A4b4hw3SL6RaNgB)**
>
> The most popular and trusted block explorer and crypto transaction search engine.

> **[Address: 1HeF89wMjC48bWNgWvVo7Wu3RaLW8XVsE8](https://www.blockchain.com/explorer/addresses/btc/1HeF89wMjC48bWNgWvVo7Wu3RaLW8XVsE8)**
>
> The most popular and trusted block explorer and crypto transaction search engine.

A Bitcoin is currently worth approximately USD $10 so it’s $30 to $5.

Interestingly there have been 18 transactions to the release address and 65 to the don’t release. So the release group seems to have a smaller number of larger donations while the don’t release consists of a larger number of smaller donations. Sort of the opposite of the real world where Obama is dependent on a larger number of small donors while the Romney camp is just the opposite.

Of course that means nothing since the donors are all silly people who are throwing away their money.

Meanwhile someone else is trying to get in on the act.  
[http://pastebin.com/EF3iEHET](http://pastebin.com/EF3iEHET)

> [@](#):
>
> We have received Quite a bit of Bitcoins on either side. The option to release information publicly is in the lead. It seems that we have become of great interest to the media and due to a few security issues we have updated the BTC wallet addresses.  
> time is running out…

This is followed by two new wallet addresses. Both those wallets currently have 0 bitcoins so this particular scam may be too obvious even for the fools who donated to the original miscreants.

---

<div class="post-metadata">

**Author:** ![FlikTheBlue](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fliktheblue/32/10972_2.png) [@FlikTheBlue](https://boards.straightdope.com/u/FlikTheBlue)\
**Post date:** [September 8, 2012, 11:22pm UTC](https://boards.straightdope.com/t/so-whats-all-this-about-romneys-tax-returns-being-hacked/633796/111 "2012-09-08T23:22:00Z")

</div>

I don’t think that Romney is involved in this, but I did think of another reason Romney hasn’t released the tax returns. Could it be that he has been planning to release them all along, maybe in early or mid October? Assuming they don’t show anything remarkable, he could then say that Harry Reid was lying all along, and try to embarrass the Democrats by showing their was no problem with the tax returns all along. I admit this is unlikely, but it sounds like a strategy some Romney advisor or another might have come up with.

---

<div class="post-metadata">

**Author:** ![Enkel](https://avatars.discourse-cdn.com/v4/letter/e/df705f/32.png) [@Enkel](https://boards.straightdope.com/u/Enkel)\
**Post date:** [September 9, 2012, 12:16pm UTC](https://boards.straightdope.com/t/so-whats-all-this-about-romneys-tax-returns-being-hacked/633796/112 "2012-09-09T12:16:26Z")

</div>

Larry Flint is offering $1 million for the tax returns. I’m sure BitInstant has already emailed him and offered to set him up with a Bitcoin Wallet.

> **[Porn Mogul Offering Huge Sum For Romney's Tax Returns](https://www.huffpost.com/entry/larry-flynt-mitt-romney-tax-returns_n_1867477?utm_hp_ref=politics)**
>
> Porn Mogul Offering Huge Sum For Romney's Tax Returns

> [@](#):
>
> The Hustler founder is offering a $1 million reward for information on Mitt Romney’s taxes, AdWeek reports. Flynt, an outspoken critic of Romney, is taking out two full page ads in Sunday’s issues of USA Today and The Washington Post to publicize the offer.
> 
> The ad offers cash in exchange for "unreleased tax returns and/or details of his offshore assets, bank accounts and business partnerships.”

The only problem is that with the bitcoin offer, Flint would be out of the money BEFORE he could verify the contents of the files. Lets hope they can work out their differences.

---

<div class="post-metadata">

**Author:** ![Frylock](https://avatars.discourse-cdn.com/v4/letter/f/ce7236/32.png) [@Frylock](https://boards.straightdope.com/u/Frylock)\
**Post date:** [September 9, 2012, 12:29pm UTC](https://boards.straightdope.com/t/so-whats-all-this-about-romneys-tax-returns-being-hacked/633796/113 "2012-09-09T12:29:29Z")

</div>

Are there legal problems with paying these guys money to release the forms? It seems like it would be a form of helping them engage in criminal actions…

---

<div class="post-metadata">

**Author:** ![Enkel](https://avatars.discourse-cdn.com/v4/letter/e/df705f/32.png) [@Enkel](https://boards.straightdope.com/u/Enkel)\
**Post date:** [September 9, 2012, 1:42pm UTC](https://boards.straightdope.com/t/so-whats-all-this-about-romneys-tax-returns-being-hacked/633796/114 "2012-09-09T13:42:30Z")

</div>

> [@Frylock](#):
>
> Are there legal problems with paying these guys money to release the forms? It seems like it would be a form of helping them engage in criminal actions…

If the unencrypted information ends up at a news agency without payment to anyone, I know the news agency can use the information because they were NOT a part of the crime committed.

As to Flint paying the group with the bitcoin accounts? If the transactions happen in the US in a way that leaves a paper trail, then I’m sure he could get caught up as an accessory.

BUT, there are many countries who aren’t so picky and cash-in-hand is very hard to track. A person with cash in hand could create a bitcoin wallet and make the transfers (using exchanges external to the US - so BitInstant would be out) and that would be nearly impossible to track down given what law enforcement is actually permitted to do.

Of course, there isn’t anything to stop the holders of the data from selling it and the decryption key directly to Flint (w/out bitcoins) while still keeping their bidding war going on line. Notice that the ad if offering CASH for the information.

---

<div class="post-metadata">

**Author:** ![Enkel](https://avatars.discourse-cdn.com/v4/letter/e/df705f/32.png) [@Enkel](https://boards.straightdope.com/u/Enkel)\
**Post date:** [September 9, 2012, 1:50pm UTC](https://boards.straightdope.com/t/so-whats-all-this-about-romneys-tax-returns-being-hacked/633796/115 "2012-09-09T13:50:43Z")

</div>

> [@FlikTheBlue](#):
>
> I don’t think that Romney is involved in this, but I did think of another reason Romney hasn’t released the tax returns. Could it be that he has been planning to release them all along, maybe in early or mid October? Assuming they don’t show anything remarkable […]

Even if there weren’t anything major, it would flood the news with each and every foreign-linked investment that could be sussed out from the returns for the final two weeks of the campaign and re-energize the ‘rich folk don’t pay enough taxes’ meme. I’m thinking that he’d have a hard time shouting about the economy over all that noise.

NOW, if he really **doesn’t** want to win, that sort of timing would be a sure way to send it down in a spectacular flaming ball.

---

<div class="post-metadata">

**Author:** ![davidm](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/davidm/32/225_2.png) [@davidm](https://boards.straightdope.com/u/davidm)\
**Post date:** [September 9, 2012, 4:38pm UTC](https://boards.straightdope.com/t/so-whats-all-this-about-romneys-tax-returns-being-hacked/633796/116 "2012-09-09T16:38:12Z")

</div>

The original [Pastebin post](http://pastebin.com/zdU1TK40) mentions that a drive was also set to PWC. Presumably, if this was done, that drive wouldn’t be encrypted, since PWC already has the data and the only reason I can see for sending a drive to them would be to prove that the burglars have what they claim to have.

> [@](#):
>
> Romney’s 1040 tax returns were taken from the PWC office 8/25/2012 by gaining access to the third floor via a gentleman working on the 3rd floor of the building. Once on the 3rd floor, the team moved down the stairs to the 2nd floor and setup shop in an empty office room. During the night, suite 260 was entered, and all available 1040 tax forms for Romney were copied. A package was sent to the PWC on suite 260 with a flash drive containing a copy of the 1040 files, plus copies were sent to the Democratic office in the county and copies were sent to the GOP office in the county at the beginning of the week also containing flash drives with copies of Romney’s tax returns before 2010. A scanned signature image for Mitt Romney from the 1040 forms were scanned and included with the packages, taken from earlier 1040 tax forms gathered and stored on the flash drives.
> 
> ```
> The group will release all available files to the public on the 28 of September, 2012
>  
>  
> This line is on all the package letters for authenticity of the email being sent.
>  
> all these considerations did not deter me from the path of duty
> 
> ```

In fact, encryption isn’t mentioned at all in this post. It’s only in the second post, which may or may not be from the same people, that encryption (and ransom) are mentioned.

That [second Pastebin post](http://pastebin.com/1j1yzQ9S), two days later, makes no mention of sending drives to PWC or either of the political parties. Instead it says that all (which seems unlikely) major news outlets will be sent _encrypted_ copies of the data.

If a large number of media outlets receive drives, some of them are going to talk about it. So far there’s nothing but silence. It could be that they haven’t been received yet, or it could be that they’ll never be received.

So far only the things threatened in the first post have happened (and not necessarily all of those things). The second one may be a different unrelated party trying to capitalize on the first post. One thing that gives me pause; if the second post was from an unrelated person, what was the point of the first post? If you’re not planning extortion, why give advance notice rather than just releasing the data immediately, and what is the significance of Sept. 28?

So, have any news outlets received copies? Will any? Has PWC recieved a copy?

If PWC hasn’t received a copy, you’d think that they would be loudly proclaiming that fact, since their reputation depends on security, but there may be reasons not to acknowledge it one way or the other.

Are both posts hoaxes? Were the drives sent but some third party simply stirring the pot for the hell of it?

Did those two packages contain the reference phrases at the bottom of those posts? Were those packages received before Sept. 2 (the date of the first post)?

---

<div class="post-metadata">

**Author:** ![Telperion](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/telperion/32/509_2.png) [@Telperion](https://boards.straightdope.com/u/Telperion)\
**Post date:** [September 9, 2012, 5:43pm UTC](https://boards.straightdope.com/t/so-whats-all-this-about-romneys-tax-returns-being-hacked/633796/117 "2012-09-09T17:43:16Z")

</div>

> [@davidm](#):
>
> If PWC hasn’t received a copy, you’d think that they would be loudly proclaiming that fact, since their reputation depends on security, but there may be reasons not to acknowledge it one way or the other.

It’s only been a couple of business days yet, so it’s probably too early to call it one way or the other. Nothing says anything was shipped within the United States, and it would be trivial to transfer any available data to Kazakhstan or wherever and mail the packages from there if someone wanted to and had the connections.

---

<div class="post-metadata">

**Author:** ![smithsb](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/smithsb/32/12107_2.png) [@smithsb](https://boards.straightdope.com/u/smithsb)\
**Post date:** [September 9, 2012, 10:44pm UTC](https://boards.straightdope.com/t/so-whats-all-this-about-romneys-tax-returns-being-hacked/633796/118 "2012-09-09T22:44:19Z")

</div>

I admit I just scanned the thread but where is the mention of Karl Rove - Republican dirty trickster? Going back to George Bush then running (poorly) for Texas Governator, Rove planted and then discovered a bug in Bush’s campaign office. Rove never said it was Bush’s opponent; he just let the media and then voters run with it. The fact that the bug had a battery life of a few hours and range of about 30 yards never came out but Bush went on to win - and you know the rest. Fast forward to the Presidential election and CBS 60 minutes came up “magically” with some damning Bush service records. A closer examination showed the records to be copied and possibly altered. Who leaked the records to the media and then was able to point out the discrepanices? I suspect Rove or inspired hencemen carried out something similar with these tax returns.

---

<div class="post-metadata">

**Author:** ![EddyTeddyFreddy](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/eddyteddyfreddy/32/18796_2.png) [@EddyTeddyFreddy](https://boards.straightdope.com/u/EddyTeddyFreddy)\
**Post date:** [September 13, 2012, 9:22pm UTC](https://boards.straightdope.com/t/so-whats-all-this-about-romneys-tax-returns-being-hacked/633796/119 "2012-09-13T21:22:50Z")

</div>

> [@FlikTheBlue](#):
>
> I don’t think that Romney is involved in this, but I did think of another reason Romney hasn’t released the tax returns. Could it be that he has been planning to release them all along, maybe in early or mid October? Assuming they don’t show anything remarkable, he could then say that Harry Reid was lying all along, and try to embarrass the Democrats by showing their was no problem with the tax returns all along. I admit this is unlikely, but it sounds like a strategy some Romney advisor or another might have come up with.

No, what he’s planning to release in October – and has said so – is his completed 2011 return; what was originally released with the 2010 actuals was an estimate as the return for 2011 hadn’t been finished and was on extension.

The Romney campaign has been firm that nothing other than 2010 and 2011 will be released.

---

<div class="post-metadata">

**Author:** ![davidm](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/davidm/32/225_2.png) [@davidm](https://boards.straightdope.com/u/davidm)\
**Post date:** [September 16, 2012, 5:28pm UTC](https://boards.straightdope.com/t/so-whats-all-this-about-romneys-tax-returns-being-hacked/633796/120 "2012-09-16T17:28:38Z")

</div>

There’s something interesting happening with this.

I was looking at the amounts deposited in the “don’t release” bitcoin address

> **[Address: 1HeF89wMjC48bWNgWvVo7Wu3RaLW8XVsE8](https://www.blockchain.com/explorer/addresses/btc/1HeF89wMjC48bWNgWvVo7Wu3RaLW8XVsE8?offset=0)**
>
> The most popular and trusted block explorer and crypto transaction search engine.

and noticed that a bunch of them are fractional amounts consisting of nothing but zeros and ones. Looking at them, I realized that they’re binary. Not only that, they’re ASCII, and if you translate them into characters they spell out three URLs. :eek:

One, [http://x.co/nbvq](http://x.co/nbvq), redirets to a [sendspace.com](http://sendspace.com) page where you can download an encrypted rar file named “Tax - Copy.rar”.

The other two lead to images of QR codes. QR codes are often used to encode website addresses.

[![](https://i.imgur.com/BH5zK.png) ](https://i.imgur.com/BH5zK.png)  
[![](https://i.imgur.com/5k6Rf.png) ](https://i.imgur.com/5k6Rf.png)

> **[QR code](https://en.wikipedia.org/wiki/QR_code)**
>
> A QR code (Quick Response code) is a type of two-dimensional matrix barcode, invented in 1994, by Japanese company Denso Wave for labelling automobile parts. A barcode is a machine-readable optical image that contains information specific to the labelled item. In practice, QR codes contain data for a locator, an identifier, and a website visitor tracking. To efficiently store data, QR codes use four standardized modes of encoding (i) numeric, (ii) alphanumeric, (iii) byte or binary, and (iv A Q...

One of them encodes a broken URL. The other encodes a valid URL which leads to a page where you can download an audio file, “where.wav”.

[http://www.sendspace.com/file/m6crjs](http://www.sendspace.com/file/m6crjs)

This is where I got stuck. If you listen to it, it’s nothing but noise. I thought maybe something was hidden in it via steganography, but that appeared to be a dead end (although that wasn’t certain).

Some Googling led me to a thread where others had discovered the binary codes and had gotten further than me.

Here’s a link to that discussion.

[https://bitcointalk.org/index.php?topic=105929.0;all](https://bitcointalk.org/index.php?topic=105929.0;all)

The first mention of the ASCII codes is at post 41.

Someone used some sort of frequency analysis software to view an image of the “where.wav” file’s sound waves. Somehow there is text visually encoded in the sound waves.

[![](http://tinypic.com/images/goodbye.jpg) ](http://tinypic.com/images/goodbye.jpg)

The text is a URL and a date: 9.10.12. The date may be in European format, indicating October 10.

The URL is

and leads to a Google UK map of an American address: 815 Brazos St #500, Austin, TX 78701, USA

At the bottom of that same frequency image is a message “All Shall be Revealed”.

[![](https://i.imgur.com/B5wsU.png) ](https://i.imgur.com/B5wsU.png)

So far, the trail ends there. People are trying to crack the password on the “Tax - Copy.rar” file but I doubt that they’ll have any luck.

I think it’s all some third party troll playing games as it makes no sense for the extortionists to do this. But someone went to a LOT of work to set it up, and it’s fun trying to follow the trail.

[Previous page](https://boards.straightdope.com/t/so-whats-all-this-about-romneys-tax-returns-being-hacked/633796.md?page=5)

[Next page](https://boards.straightdope.com/t/so-whats-all-this-about-romneys-tax-returns-being-hacked/633796.md?page=7)
