Outside the Perimeter: More detail on forgery using Word

Along with the post below, this is my analysis of the National Guard memos. I have been a user and teacher of Microsoft Word for nine years.

The relevent feature of Word is something called "Autoformat As You Type", which for sake of brevity, I will call AAYT. The point of AAYT is to help Word users make a document appear more professional by automatically reformatting certain types of text. For example, AAYT automatically converts "straight quotes" into the curly "smart quotes". As another example, AAYT converts fractions such as "1/2" into fraction characters.

One of the features of AAYT is to replace ordinals (1st, for example) with superscript.

Word uses AAYT to autoformat text as you type. When you type in the text "1st", for example, the text stays as you have typed it. After you type in that text and then press the spacebar, Word then automatically converts the text in the number/letter combination (the "st") to superscript.

AAYT can be frustrating at times, particularly for a novice user of Word. AAYT is "turned on" by default in Word and a novice user can have a difficult time figuring out how to turn it off - thanks to the infamous Help system of word.

Looking at the four memos, I can easily see where the forger or forgers ran afoul of AAYT. Microsoft Word is a computer program. As such, it will always do the same thing under the same conditions. Knowing what these conditions are, as I do, I can reconstruct what the forger was doing and WHY the documents are formatted as they are.

Here is what happened as the forger was typing up the documents:

Looking at the memos as a whole, you can see that AAYT automatically superscripted the text only some of the time. The first step in understanding why only part of the text following numbers was superscripted is to understand when AAYT will automatically superscript the text. AAYT will only automatically superscript the text when a user types in a number followed by text according to certain rules built into Word.

For example, if you type in the number 5, then the text "th" without a space between them, nothing happens. However, if after typing in "5th" and you then press the spacebar, Word will automatically superscript the text "th". Word "knows" which number and letter combinations will trigger AAYT. If you were to type in "3th" for example, Word does not automatically superscript the "th".

In other words, Word know which number/letter combinations should be automatically superscripted and which should not.

You can see two examples in the documents of where the Word did this automatically: In the memo "Annual Physical Examination" the word "147th" is superscripted and in the memo "CYA" the word "187th" is superscripted. This is consistent with the rules of AAYT in Word.

There are also more places in the documents where there are number/letter combinations that are NOT superscripted. In some cases, the explanation of why AAYT was not triggered is straightforward - the forger left a space between the number and the letters in the combination. For example, in the cases of the number/letter combinations "147 th" and "9921 st". In the cases of these combinations, AAYT would not recognize that the text should be superscripted, because of the space between the numbers and letters. This is also consistent with the AAYT rules of Word.

This explains what happened with the combinations "147th", "147 th", "187th", and "9921 st" combinations. However, there are other combinations where the rules seem to have been followed, and yet AAYT did not automatically superscript the text in the combinations.

Those combinations are "111th" and "1st". In these cases, it appears at first glance that the rules of AAYT were followed and yet Word did NOT automatically reformat the combinations. This is where knowing something about the typeface "Times New Roman" comes in handy: In the Times New Roman typeface, the number "1" and the lower case letter "L" appear virtually identical (See previous post for a screenshot of the two).

The forger did not type in "111th" and "1st" when creating the documents. Instead, the forger typed in "lllth" (or "11lth", or "ll1th" or "l11th") for one-hundred and eleventh. The forger typed in "lst" for first. (Note: It is hard to tell, because of the quality of the documents, which of the combinations the forger might have used. My best guess would be "ll1th" because of the slightly longer top of the last character in "ll1")

This IS consistent with why AAYT did not automatically reformat the number/letter combinations with superscript. Because in these cases they were not number/letter combinations. They were letter/letter (or number/number/letter/letter) combinations, and AAYT would not consider them text to be automatically reformatted.

AAYT Summary

There were three different types of apparent number/letter combinations in the memos, and they were all formatted in a way consistent with the default AutoFormat As You Type rules of Microsoft Word:

"187th" and "111th" - text that DID follow the rules of AAYT and were automatically reformatted.

"147 th", "9921 st", and "1 st" - text that DID NOT follow the rules of AAYT and were NOT automatically reformatted.

"lllth"/"11lth"/"ll1th" and "lst" - text that DID NOT follow the rules of AAYT and were NOT automatically reformatted.

"Who Might Have Done It"

Autoformat As You Type can be tricky for the novice user of Microsoft Word and different users figure out different ways to get around it. An experienced Word user would turn off the feature (Tools, AutoCorrect, then the Autoformat As You Type tab on the AutoCorrect dialog box) or he or she would reformat the text after AAYT does it's thing (select the text, right-click, choose Font, uncheck the Superscript option, then click on OK).

However, the forger seemed to use different techniques to get around AAYT in different documents. For example in the "Discussion with Bush, 1 st Lt. Bush" memo, the forger used a space so AAYT would not autoformat the text. However, in the memo "Suspension of Flight Status", the forger used a lower case "L" in "lst" to get around AAYT. However, in the document "Annual Physical Examination", the forger used "lllth" or "11lth" and "lst" to get around AAYT while seeming not caring that the "111th" in the second paragraph was autoformatted with superscript.

It is possible that one or more people typed these up, so they is why inconsistent methods were used to get around AAYT. It also possible that it was just one inexperienced Word user, and that he or she was just sloppy and/or frustrated by AAYT.

Whatever the case, it is clear to me, because the documents followed the AAYT rules, that these documents were produced in Microsoft Word.

My New Forgery

As below, I decided to make my own forgery, complete with signature to show you how this could have been done:

Click to Enlarge

Comments

I love geeks.

Posted by: Jason | September 13, 2004 at 05:49

You're an nut... why would the forger not just TURN OFF autoformat to get around it? I have never heard of anyone smart enough to use the letter 'l' instead of the number '1' but dumb enough not to just turn autoformatting off.

Your also ignore the fact that in Times New Roman the number '1' and the letter 'l' are actually subtly different - '1' (one) has a slightly wider base and a slightly wider serif on the top that 'l' (el). Why don't you try zooming in really close on the forged document and seeing if you can work out which they are.

Nice job, Sherlock Holmes. I propose that instead of periods the forgers used really really small font-sized 'O's.

Posted by: Piggington | September 27, 2004 at 13:19

Piggington:

Next time you might want to think about reading the entire article before commenting on it.

The bottom line is that an inexperienced Word user would likely not know how to turn off Autoformat As You Type. Of course, I am only basing that on my experience teaching hundreds of people to use MS Word.

Posted by: Blind Pig | September 28, 2004 at 04:08