This is the second in a series of diaries about my analysis of the Trump email server data and its possible connection to a bank computer in Russia. Read my first post for an introduction. Other relevant links are included below at the end of this diary.
Dive into the data
Stare at the above plot. The first thing you’ll notice is the mesmerizing sea of green and red points. Each one marks the time and the day that a particular event occurred. The red squares indicate when a request was made by a computer at Alfa Bank Moscow to obtain the address of a Trump-email server. The green triangles correspond to similar requests made by a server at Spectrum Health in Grand Rapids, Michigan.
If you focus on the red squares, you’re likely to notice some trends, features and patterns. Early on, in May, the events occur infrequently, but then the rate increases—in steps—over the following months. As the rate rises, a periodic pattern emerges. This pattern isn’t completely regular, instead shifting and drifting over the days. There is also a noticeable ~2 day break in activity in late July after which the activity rate is highest.
The plot is simple, but the data are not
What does this all mean? Even this simple plot is hard to understand.
At a minimum it shows activity that is complex and changing—already useful. Any explanation—even benign—should be able to account for the changes in event rate, the periodicities and drifts, and the breaks in activity that we are seeing. No prior analysis or explanation has described these events at the level of detail shown above. I won’t worry about other analyses for now, but will address some in later posts.
Do events occur only at specific times of day? (e.g. during ‘working’ hours, etc.)
From this plot, I would answer with a qualified “no”. Early on there may be times of day that are busier than others, but this doesn’t persist. Once the data frequency rises and becomes quasi-periodic there’s no obvious preferred time (e.g. Moscow, New York). We’ll also return to this in future posts.
Do any features in this plot correlate with political events?
I’ll let you be the judge. The data are subtle but if I had to pick the two strongest “features” and their dates, they would be:
- ~June 23, when the event rate increased significantly.
- ~July 23-24, when there was a nearly 2-day break in activity, followed by an increase in the event rate.
June 23 was Brexit, and it was also when Trump was visiting his golf courses in Scotland.
July 23-24 was the weekend between the Republican and Democratic Conventions
Any explanation of the activity of these servers should explain why the event rate changed markedly on these dates.