Some forensic work on @whaledump’s “Facebook” messages

I’ll start with the executive summary, so you can avoid the technobabble:  @whaledump is publishing fake conversations between Judith Collins and Cameron Slater.   I know this for certain.

When I was reading these supposed Facebook chats between Judith and Cameron, one thing immediately struck me:  where is the profanity?

Working closely with Cam, and almost a thousand chat logs (none of them via Facebook, incidentally) to draw on, I looked back over them, and for any that go on for a reasonable length, there is always some stomach cringing statement somewhere.  That’s “our” Cam.   I’ve heard him on the phone with other journos – and they damn well know that he can’t go for two sentences without saying something crude.

Anyone who has dealt with Cameron Slater will know his conversations, written or otherwise , are peppered with sledges, slights and pretty nasty language.  Even in chats with multiple participants, he will call us by derogatory nicknames, or use other ways to have over-the-top blokey type of conversations.   For example, I drive a car not worthy of his respect, and I’m constantly getting hammered for it.

It’s the banter you have when you think you’re talking privately.

All this is completely absent from the forged “Facebook chat logs”.   I don’t know about Judith Collins, I haven’t had any private contact with her (another hint this is a beat up?).  We haven’t even met.   As such, I can’t gauge her “voice” in these logs.

I have “admin” rights to the Whaleoil Facebook page, as I have access to many things to help Cam with the day-to-day chores.   So I decided to pull down the conversation and have a look at it.

It doesn’t exist.  

Of other material that has been @whaledumped, I have been able to find the originals to match.  But not these supposed “Facebook chats”.

As I pulled some other conversations down, I noticed there is a process you go through:


You don’t get to choose where to send the logs.  It goes to your account address.   And when you click OK, it sends you two emails.  One, to tell you it’s running the data dump, two, to tell you it is complete.


When you download it, it comes as a ZIP file


And when you open it, it has a structured set of pages


and this is where it gets interesting.   The whole “data dump” you get from Facebook is in HTML format.  When you look at it, it looks like this:


(Personal data redacted).   And if you go to the raw dump files, it’s all HTML like this:


Look inside any of them, and you get this


Here is a snippet the way that @whaledump is publishing the fake Facebook chat logs


Even if these chats were real, why the change in format?   That is not a Facebook data dump.   Even if it was genuine, it has been post-processed.

And things that are post processed by a hacker with a political agenda, (do I even have to say this?).

It suits certain media outlets to breathlessly report whatever @whaledump dumps, adding minor caveats like “the hacker claims”, but there is actually no attempt to do anything other than to keep providing @whaledump with a main stream media outlet for the widest possible audience.

I understand the deep irony here, and won’t go as far as to complain how unfair it is to be at the receiving end of a media frenzy.  Whatever is true, let it be true.

But this is just faked.  And from here on in, everything that @whaledump dumps needs to be considered questionable.  For viewers and readers to be presented with this without a serious rider that the hacker may have tampered with it, or in the case of Facebook data – completely fabricated it – reinforces my opinion that the media isn’t doing a reasonable job.


Here comes the interesting bit.  Remember that I said that you can’t get the Facebook data download dump from Facebook sent anywhere else but your own email account?   That means that when the hacker generated the data dump, there would have been an email – two emails – from Facebook to Cam’s email account.

As has been clearly established by now, Cam doesn’t delete anything.  And so, having a look – those two Facebook emails, one to say a data dump is being run, the other to say that it is complete, don’t exist.

And the 2nd one is critical, as it contains the unique link to where the data can be downloaded from.

It is technically possible that the hacker sent the request, quickly trashed and permanently deleted both of those emails, but it is quite unlikely.  Especially if you then also take into account that none of the @whaledump Facebook chat “logs” are formatted anywhere like the ones Facebook sends.

Fake. Fake. Fake.


Can’t control what the media do with further @whaledump material, only to suggest that from now on, each and every release should be considered to have been altered or even created from scratch.

Consider this a formal notice that anyone who knowingly publishes further material without doing some due diligence on the authenticity of it, is going to go onto a list.   As to where that list ends up  will become clear soon.


When you fake it, instead of hack it, Typos tend to creep in too:


You have to wonder if the hackers are wetting themselves playing with the media like this.   The clues are clearly there, but in the lust to rush ahead and fortify their positions, they’ve ended up looking like amateurs.


For the hard of reading, like David Fisher, this article is not written by Cameron Slater.  Quotes from it can not be attributed to him without incurring further derision.



Do you want:

  • Ad-free access?
  • Access to our very popular daily crossword?
  • Access to daily sudoku?
  • Access to Incite Politics magazine articles?
  • Access to podcasts?
  • Access to political polls?

Our subscribers’ financial support is the reason why we have been able to offer our latest service; Audio blogs. 

Click Here  to support us and watch the number of services grow.