Within Earle Claim
Did deleted logs prove real disruption?
Deleted logs and startup files sit at the heart of the dispute between the prosecution's damage narrative and McKinnon's denial.
On this page
- What files were allegedly deleted
- Why logs mattered for attribution and recovery
- How Mc Kinnon's denial complicates the record
Page outline Jump by section
Introduction
The dispute over deleted logs and startup files is one of the most important unresolved issues in the Gary McKinnon case. Publicly available records show broad agreement that McKinnon gained unauthorised access to US military systems, including computers at Naval Weapons Station Earle. The deeper disagreement concerns causation: did he merely intrude into poorly secured systems, or did his actions directly cause the operational disruption and recovery costs later described by US authorities? The answer matters because the Earle allegations became a central part of the narrative that transformed a UFO-motivated hacker into someone accused of causing significant military network damage. The evidence available to the public largely comes from indictments, court summaries and legal filings rather than a full trial record, leaving important questions about attribution and impact contested. [Department of Justice]justice.govDepartment of Justice British National Charged with Hacking Into N.Jallegedly caused approximately $290,431 in damage to NWS Earle by deleting computer files needed to power up some of th…
What files were allegedly deleted?
US prosecutors did not limit their allegations to password theft or unauthorised access. They claimed that during a September 2001 intrusion into the Earle network, McKinnon deleted two categories of files:
- Computer logs that recorded activity on the network and documented the intrusion itself.
- Files needed to power up or operate some of the computers connected to the network.
According to the US Department of Justice, these actions formed a substantial part of the alleged $290,431 damage attributed specifically to Naval Weapons Station Earle. Prosecutors argued that the deletions, combined with the installation of remote-access software known as RemotelyAnywhere, impaired the integrity and security of the network. [Department of Justice]justice.govDepartment of Justice British National Charged with Hacking Into N.Jallegedly caused approximately $290,431 in damage to NWS Earle by deleting computer files needed to power up some of th…
Later judicial summaries in the United Kingdom repeated the allegation that logs were deleted from Earle computers, including a system used to monitor the status and readiness of naval vessels. The House of Lords judgment described the deletion of these files as rendering the base’s network of more than 300 computers inoperable during the sensitive period immediately following the 11 September attacks. [UK Parliament]publications.parliament.ukmckinn 1UK ParliamentMckinnon V Government of The United States of America…30 Jul 2008 — Having gained access to these computers the appellant…
What is notable is that public documents generally describe the categories of deleted files rather than publishing detailed forensic inventories. Readers therefore encounter the allegation mainly through legal characterisations rather than through disclosed technical evidence.
Why logs mattered for attribution and recovery
Log files are often crucial after a network intrusion because they help investigators answer three basic questions:
- What happened?
- When did it happen?
- Who did it?
If logs disappear, investigators lose a primary source of evidence about the sequence of events on a compromised system. From the prosecution’s perspective, the alleged deletion of Earle logs therefore had significance beyond the immediate technical effect. It potentially hindered investigators’ ability to reconstruct activity on the network and determine exactly what had occurred. [Department of Justice]justice.govDepartment of Justice British National Charged with Hacking Into N.Jallegedly caused approximately $290,431 in damage to NWS Earle by deleting computer files needed to power up some of th…
The recovery problem was also practical. Prosecutors argued that the combination of deleted files, compromised accounts, stolen passwords and installed remote-access tools forced administrators to undertake extensive restoration and security work. Their position was that the resulting disruption justified the large damage estimates presented in indictments and extradition proceedings. [Department of Justice]justice.govDepartment of Justice British National Charged with Hacking Into N.Jallegedly caused approximately $290,431 in damage to NWS Earle by deleting computer files needed to power up some of th…
This point is important because the Earle claim was never simply that information was viewed or copied. The government’s case framed the incident as one in which the loss of operational and forensic records contributed directly to a network outage and a lengthy recovery effort. [Department of Justice]justice.govDepartment of Justice British National Charged with Hacking Into N.Jallegedly caused approximately $290,431 in damage to NWS Earle by deleting computer files needed to power up some of th…
Did the deleted logs prove the shutdown?
The existence of the allegation does not automatically resolve the question of causation.
US authorities consistently argued that the deleted files formed part of the reason the Earle network became unusable. Public summaries often present the sequence in a straightforward way: logs and other critical files were deleted, the network became inoperable, and substantial recovery work followed. [UK Parliament+2Department of Justice]publications.parliament.ukmckinn 1UK ParliamentMckinnon V Government of The United States of America…30 Jul 2008 — Having gained access to these computers the appellant…
However, the publicly available record contains relatively little technical detail showing exactly how the deletion of specific files translated into a week-long shutdown of roughly 300 computers. Most accounts rely on prosecutorial allegations and court summaries rather than a fully litigated evidential record tested through cross-examination. Because McKinnon was never extradited and never stood trial in the United States, the evidence was not subjected to the kind of adversarial scrutiny that often clarifies technical causation disputes. [UK Parliament]publications.parliament.ukmckinn 1UK ParliamentMckinnon V Government of The United States of America…30 Jul 2008 — Having gained access to these computers the appellant…
This distinction matters. Deleting startup or operating-system files can unquestionably disable computers. Deleting logs, by contrast, usually affects investigation and attribution more than day-to-day operation. Public descriptions sometimes discuss both categories together, making it difficult to determine which alleged deletions were considered responsible for operational failure and which were considered responsible for hindering forensic investigation. [Department of Justice]justice.govDepartment of Justice British National Charged with Hacking Into N.Jallegedly caused approximately $290,431 in damage to NWS Earle by deleting computer files needed to power up some of th…
How McKinnon’s denial complicates the record
McKinnon’s position evolved in a way that created a nuanced dispute rather than a complete denial of involvement.
He repeatedly acknowledged gaining unauthorised access to military and NASA systems. He also accepted that he installed software and explored networks while searching for information related to UFOs and hidden technology. What he disputed was the government’s account of the damage caused. Reports covering his legal campaign consistently note that he admitted the hacking activity while challenging prosecutors’ descriptions of the resulting harm. [Pinsent Masons]pinsentmasons.comPinsent MasonsMcKinnon renews appeal for UK trialJanuary 13, 2009 — 13 Jan 2009 — NASA hacker Gary McKinnon has renewed his appeal to be…
A particularly important document in the public record is a legal note associated with his defence. It states that deletion of activity log files would amount to unauthorised modification but records that he did not accept that he had carried out those deletions. In other words, the defence position was not simply that the deletions were harmless; it was that he disputed responsibility for at least some of the alleged file removals. [media.techtarget.com]media.techtarget.comNote re GARY MCKINNON23 Sept 2001 — Similarly his deletion of the log files of his activity would have amounted to an unauthorised modifi…
The House of Lords judgment also recorded a distinction that became central to the controversy: McKinnon admitted responsibility for accessing the systems but did not admit that he had caused the damage alleged by US prosecutors. [UK Parliament]publications.parliament.ukmckinn 1UK ParliamentMckinnon V Government of The United States of America…30 Jul 2008 — Having gained access to these computers the appellant…
That leaves a persistent evidential gap. If the logs were deleted exactly as prosecutors claimed, the deletions would themselves make reconstruction of events more difficult. Yet the public record available today does not contain a detailed forensic narrative showing how investigators conclusively linked every alleged deletion and every resulting outage to McKinnon’s actions rather than to broader system weaknesses or recovery decisions.
Why this remains a key point in the Earle controversy
Within the broader Earle Naval Weapons Station claim, the deleted-log allegation serves two functions at once.
First, it supports the government’s argument that the incident was more than curiosity-driven trespassing. Deliberately removing logs can be interpreted as an attempt to conceal activity, while deleting startup-related files can be viewed as intentional disruption. [Department of Justice]justice.govDepartment of Justice British National Charged with Hacking Into N.Jallegedly caused approximately $290,431 in damage to NWS Earle by deleting computer files needed to power up some of th…
Second, it highlights the limits of what the public can verify. The strongest public descriptions of the damage come from indictments, prosecutorial statements and judicial summaries of those allegations. McKinnon admitted the intrusions but denied causing the operational damage as described. Because no US trial occurred, the competing interpretations were never fully tested before a jury. [Department of Justice+2UK Parliament]justice.govDepartment of Justice British National Charged with Hacking Into N.Jallegedly caused approximately $290,431 in damage to NWS Earle by deleting computer files needed to power up some of th…
As a result, the deleted logs remain at the centre of the dispute. They are simultaneously one of the prosecution’s strongest indicators of intentional harm and one of the areas where independent public scrutiny of the underlying technical evidence is most limited. The unauthorised access itself is largely undisputed; the extent to which deleted logs and startup files directly produced the operational disruption claimed at Earle remains the more contested question. [Department of Justice+2UK Parliament]justice.govDepartment of Justice British National Charged with Hacking Into N.Jallegedly caused approximately $290,431 in damage to NWS Earle by deleting computer files needed to power up some of th…
Amazon book picks
Further Reading
Books and field guides related to Did deleted logs prove real disruption?. Use these as the next step if you want deeper reading beyond the article.
The Cuckoo's Egg
Rating: 4.5/5 from 8 Google Books ratings
Focuses on logs, attribution, and tracking intrusions.
The Art of Intrusion
Rating: 4.0/5 from 10 Google Books ratings
Examines attack methods and evidence trails.
eBay marketplace picks
Marketplace Samples
Example marketplace items related to this page. Use the search link to explore similar finds on eBay.
Endnotes
-
Source: justice.gov
Title: Department of Justice British National Charged with Hacking Into N.J
Link: https://www.justice.gov/archive/criminal/cybercrime/press-releases/2002/mckinnonIndict2.htmSource snippet
allegedly caused approximately $290,431 in damage to NWS Earle by deleting computer files needed to power up some of th...
-
Source: publications.parliament.uk
Title: mckinn 1
Link: https://publications.parliament.uk/pa/ld200708/ldjudgmt/jd080730/mckinn-1.htmSource snippet
UK ParliamentMckinnon V Government of The United States of America...30 Jul 2008 — Having gained access to these computers the appellant...
-
Source: media.techtarget.com
Link: https://media.techtarget.com/rms/computerweekly/DowntimePDF/pdf/mckinnon.pdfSource snippet
Note re GARY MCKINNON23 Sept 2001 — Similarly his deletion of the log files of his activity would have amounted to an unauthorised modifi...
-
Source: depositedpapers.parliament.uk
Title: uk Deposited papers
Link: https://depositedpapers.parliament.uk/Source snippet
papers - UK ParliamentView and download deposited papers placed in the House of Commons or the House of Lords Library...
-
Source: Wikipedia
Title: Gary [Mc Kinnon]({{ ‘mc-kinnon/’ | relative_url }})
Link: https://en.wikipedia.org/wiki/Gary_McKinnonSource snippet
Gary McKinnon... ". After the September 11 attacks in 2001, he allegedly deleted weapons logs at the Earle Naval Weapons Station, rend...
-
Source: pinsentmasons.com
Link: https://www.pinsentmasons.com/out-law/news/mckinnon-renews-appeal-for-uk-trialSource snippet
Pinsent MasonsMcKinnon renews appeal for UK trialJanuary 13, 2009 — 13 Jan 2009 — NASA hacker Gary McKinnon has renewed his appeal to be...
Published: January 13, 2009
Additional References
-
Source: telegraph.co.uk
Link: https://www.telegraph.co.uk/news/worldnews/northamerica/usa/5945693/Gary-[McKinnon-timelineSource snippet
Gary McKinnon: timeline of the computer hacker's caseUS prosecutors also allege he deleted files which shut down the US Army's military d...
-
Source: reddit.com
Link: https://www.reddit.com/r/hacking/comments/1etqs6b/how_gary_mckinnon_did_what_he_did/ -
Source: mg.co.za
Title: 2008 07 30 uk computer hacker loses appeal over us extradition
Link: https://mg.co.za/news/south-africa/2008-07-30-uk-computer-hacker-loses-appeal-over-us-extradition/Source snippet
Mail & GuardianUK computer hacker loses appeal over US extradition30 Jul 2008 — The US authorities allege he stole 950 passwords and dele...
-
Source: itnews.com.au
Title: lord carlile sides with mckinnon in extradition battle 138093
Link: https://www.itnews.com.au/news/lord-carlile-sides-with-mckinnon-in-extradition-battle-138093Source snippet
Lord Carlile sides with McKinnon in extradition battle24 Feb 2009 — But the US government has argued that McKinnon caused a network in Wa...
-
Source: infosecurity-magazine.com
Link: https://www.infosecurity-magazine.com/news/ufo-hacker-gary-mckinnon-denied-appeal-route-to/Source snippet
11 Oct 2009 — "In addition, he will also be shown to have deleted US Navy Weapons logs, rendering a naval base's network of 300 computers...
-
Source: forbes.com
Title: fbi confirms it deleted files from 4258 us based computers
Link: https://www.forbes.com/sites/daveywinder/2025/01/17/fbi-confirms-it-deleted-files-from-4258-us-based-computers/Source snippet
computers and networks have had malware files deleted by the FBI, which said it did not collect other information during...
-
Source: cbsnews.com
Title: brit hacker loses us extradition appeal
Link: https://www.cbsnews.com/news/brit-hacker-loses-us-extradition-appeal/Source snippet
Brit Hacker Loses U.S. Extradition Appeal30 Jul 2008 — McKinnon, 42, an unemployed computer administrator, allegedly broke into 97 comput...
-
Source: telegraph.co.uk
Link: https://www.telegraph.co.uk/news/2474364/Hacker-Gary-McKinnon-to-take-extradition-battle-to-European-Court-after-Lords-refusal.htmlSource snippet
A British computer hacker who wreaked havoc with vital...Read more...
-
Source: media.defense.gov
Title: Mc Kinnon comphacker
Link: https://media.defense.gov/2002/Nov/12/2001711901/-1/-1/1/McKinnon_comphacker.pdfSource snippet
Department of WarU.S. Department of Justice United States Attorney Eastern...12 Nov 2002 — According to the [indictment]({{ 'indictment/' | relative_url }}), between March of...
-
Source: theregister.com
Title: mckinnon loses lords appeal
Link: https://www.theregister.com/offbeat/2008/07/30/mckinnon-loses-lords-appeal/827846Source snippet
30 Jul 2008 — UPDATED Accused Pentagon hacker Gary McKinnon has lost his appeal in the House of Lords against extradition to the USA, but...
Topic Tree