** THORNE RESEARCH CORP DATA BREACH ** PROJECT AURORA ** CLASSIFIED FILES ** ** ZIP FILE NO LONGER AVAILABLE. READ THE NOTES BEFORE EMAILING ME ** ** THE TRUTH IS OUT THERE. IT WAS IN A 5MB ZIP FILE ** ** THEY PULLED IT WITHIN 3 HOURS ** WHAT ARE THEY HIDING **    
<< back to trustno1's homepage  |  freespaces.net/~trustno1/thorne-dataloss.html

THORNE RESEARCH LAB BREACH?
STOLEN FILES LEAKED BY ANONYMOUS

Posted by: trustno1  |  February 12, 2000  |  Last updated: March 14, 2000

!! IMPORTANT — READ BEFORE EMAILING ME !!

THE ORIGINAL ZIP FILE IS NO LONGER AVAILABLE.
I DO NOT HAVE A COPY.
PLEASE STOP EMAILING ME.

I have received over 400 emails since this page went up. I cannot respond to all of them. I do not have the file. The FTP link is dead. I cannot get the file back. I do not know who else has a copy. Read the article and use the information here.

:: THE STORY ::

Last month, the hacking group Anonymous released a mysterious 5MB ZIP file containing what appeared to be classified internal data from Thorne Research Corporation. It was available on a public FTP server for mere hours before it was taken down. It was rumored to have various blueprints, codebases, and internal memos with mentions of a Project Aurora.

I downloaded it. I read it. Here is what I found.

I am not going to pretend this is journalism. I am one person on a dial-up connection. But I know what I saw, and what I saw did not look like a hoax.


:: HOW I GOT THE FILE ::

On the night of February 9th, 2000, a link appeared in an IRC channel I monitor. The link pointed to:

ftp://ftp.anon-drop.net/pub/trc-files.zip

The accompanying message in the channel read: "TRC internal files. Not ours. Make copies. They will pull this fast."

I connected via FTP, downloaded the file — it was 5.1MB, took about 18 minutes on my connection — and started going through it. At approximately 3 hours after the link first appeared, the FTP server returned a 550 error. The file was gone. The server itself went dark about an hour after that.

I do not know if the file was pulled by the FTP host, by Thorne, or by someone else. I know only that it was available and then it was not.


:: WHAT WAS IN THE ZIP FILE ::

The archive contained several folders and dozens of files. I did not have time to read everything before the connection dropped. Here is what I documented before it went offline:

trc-files.zip
  |
  +-- BLUEPRINTS/
  |   +-- TRC-ENG-0071-B.pdf   [blueprint, labeled "Phase 1 array, tower B"]
  |   +-- TRC-ENG-0092-A.pdf   [blueprint, labeled "subsurface conduit routing"]
  |   +-- TRC-ENG-0107.pdf    [labeled "cranial interface housing — prototype C"]
  |   +-- TRC-ENG-0118-D.pdf   [blueprint, "resonance emitter array — DHB site"]
  |
  +-- CODEBASE/
  |   +-- sync_module_v3/
  |       [directory of C source files — did not have time to read]
  |   +-- aurora_init.sh      [shell script, 847 lines — partially read]
  |
  +-- INTERNAL-MEMOS/
  |   +-- memo_phase2_deploy.txt  [READ — see excerpt below]
  |   +-- memo_funding_Q3.txt    [partially read]
  |   +-- memo_personnel_redact.txt [could not open — corrupted or encrypted]
  |
  +-- AURORA/                   [folder — could not fully explore before file went offline]
     +-- [contents unknown]

NOTE: I was still downloading/exploring when the FTP server dropped. The AURORA/ folder had additional subdirectories but I was not able to get a full listing before the connection died.

:: INTERNAL MEMO EXCERPT ::

The following is from memo_phase2_deploy.txt, the file I was able to read most completely before losing access. I am reproducing it from notes I took while reading. This is not word-for-word — I was reading fast — but the substance is accurate.

FROM: D. THORNE / EXEC OFFICE
TO: PROJECT LEADS — PHASE 2 WORKING GROUP
DATE: NOVEMBER 1999
RE: PHASE 2 DEPLOYMENT STATUS & SITE READINESS
CLASSIFICATION: INTERNAL — NOT FOR DISTRIBUTION



Team,

Quarterly review confirms all Phase 1 deliverables met or exceeded benchmarks. The array calibration at Site A returned within acceptable variance. DARPA liaison has confirmed continued funding through Q3 under PROGRAM CODE [REDACTED].

Re: DHB site — geological survey complete, recommend Phase 2 proceed as scheduled. Survey team flagged minor subsurface anomaly at sector 7-G but engineering review concluded it does not impact foundation integrity for the emitter array installation.

Personnel note: the three researchers who expressed concerns in the September review have been reassigned to the Marin facility on administrative leave. HR will handle their exit interviews.

All Phase 2 teams are reminded that discussions of project scope outside of designated secure channels are a termination-level violation of your NDA. This includes personal email, telephone, and internet communication.

Proceed on schedule.

D. THORNE

trustno1 note: I want to be clear about what this says. They are threatening their own employees with termination (or worse) for talking about this project, even on personal email. That is not standard NDA language. And the three researchers who asked questions got "reassigned." Where, exactly?

Also: "DHB site" appears repeatedly in this memo and in the engineering blueprints. TRC-ENG-0118-D specifically says "resonance emitter array -- DHB site." I have no idea what DHB refers to. If you do, please leave a note in the guestbook (when it's back up).


:: PROJECT AURORA ::

The name AURORA appears in this file archive in the following places:

• aurora_init.sh — the shell script in the CODEBASE/ folder. The filename alone is significant. I got through about 200 lines before the connection dropped. It appeared to be initialization code for some kind of environmental monitoring and triggering system. The comments inside used terms like "atmo-resonance threshold," "geological sync," and "phase-lock confirmation." I don't know what that means but it does not sound like pharmaceutical research.
• AURORA/ folder — this entire directory at the root of the archive. I could see subdirectory names but my FTP client timed out before I got a full listing. The subdirectory names I caught included: FREQ_LOGS/, SITE_COORDS/, and PHASE2_DATA/. There was at least one more folder I didn't capture.
• memo_phase2_deploy.txt, the internal memo above. Aurora is the name of the project. Phase 2 is an active deployment. The DHB site is the deployment location.

I have since found one reference to "Project Aurora" in an unrelated context: a DeepWebLeaks.org article on Thorne's DARPA connections mentions Aurora as a program name in a footnote, citing a 1998 procurement document. I had not seen that article before I downloaded this file.

They are consistent with each other. That matters.


:: TIMELINE ::

DATE / TIME (UTC) EVENT
Feb 9, 2000 ~03:00 Link to ftp.anon-drop.net/pub/trc-files.zip appears in IRC channel. Archive is live.
Feb 9, 2000 ~03:20 I begin download. ~18 minutes on dial-up connection.
Feb 9, 2000 ~03:40 Download complete. Begin reading archive contents.
Feb 9, 2000 ~06:00 FTP server returns 550 error. File is gone. Server goes offline within the hour.
Feb 12, 2000 I publish this page on freespaces.net/~trustno1/.
Feb 12–March 2000 18,000+ page views. 400+ emails. I stop responding to email about the ZIP file.
March 14, 2000 Page last updated. Memo excerpt clarified. DHB note added. No new information on file availability.


:: MY COMMENTS ::

Some people have emailed me to say this is a hoax. Maybe. But consider:

1. The engineering blueprints looked real. I've seen patent filings and engineering diagrams before. The formatting, the project codes, the level of detail. These were not things a hoaxer would bother with.

2. The file was pulled fast.

3. Thorne Research Corporation is a real company with real government contracts. You can look them up. Visit their suspiciously polished official website if you want to see what a company that wants you to think it's legitimate looks like.

4. The "DHB site" reference in the blueprint and the memo is consistent. Hoaxers don't maintain internal consistency across documents they're faking unless they're very, very good. These documents felt like they were written by different people at different times.

5. DeepWebLeaks.org's independent DARPA article references "Aurora" in a completely separate context. I hadn't read that article when I downloaded this file.



I'm not saying I know what Project Aurora is. I'm not saying I know what "DHB" refers to. I'm not saying Thorne Research Corporation is definitely running a secret government program out of a mysterious site somewhere. I'm just saying: this is what was in the file, this is what it looked like, and then the file disappeared in three hours.

You decide what that means.

— trustno1


:: RELATED LINKS ::

deepwebleaks.org "Black Ops Funding? Thorne Research Corporation and Government Ties". The DARPA article that first put Thorne on my radar. Independently corroborates the Aurora name.
horizonwatchers.com "Strange Frequency Readings Near Thorne Research Facilities". Their sensor logs pre-date my download by two years. If Phase 2 is a deployment, it's been building for a while.
thorneresearchcorp.com Their suspiciously polished official website. Read it.


One more time: I do not have the ZIP file. I cannot send it to you. The FTP server is dead. If you have a copy, you may reach me via the guestbook when it's back online. I will not respond to emails asking for the file.

If you have new information about Thorne Research, Project Aurora, or the "DHB" location reference, then yes, I want to hear from you. Use the guestbook (when it's back).

- trustno1

trustno1 — freespaces.net/~trustno1/thorne-dataloss.html

<< Back to trustno1's homepage

"When you are ready to know the truth, you will find it."

This page last updated: March 14, 2000

© 2000 trustno1. All rights reserved.

Best viewed in Internet Explorer 5.0 at 800x600 resolution.
Hosted free at freespaces.net — FreeSpaces.net is not responsible for content on user pages.

What is this?