The Shadow Brokers: a Grammatical Analysis – August 13, 2016 Post

  • posted May 16, 2019

Reading the Shadow Brokers’ postings, I made a cursory note that there appeared to be a systematic way they employed The English language (even if it also appeared to changed within and between separate posts).

I read a few analyses, primarily focused on computational linguistics, but felt they didn’t provide enough substance regarding how the posts were constructed (to avoid detection or to communicate an intended message to the intended target). I also wanted to know if the grammar indicated something about the author(s) or ruled other things out.

Since I spent a considerable amount of my youth diagramming English sentences, translating Latin ones, and studying German, I decided to do it myself.

I am not an expert in linguistic profiling. I would not know how a North Korean native typically writes English as a second language, compared to a Russian, who is educated at home versus abroad– or by watching American programming.

Instead, I wanted to see how each post was structured, what linguistic devices (if any) were used or not (but expected), and if the elements are consistent within each post, and then compared to others.

I broke the first post down line by line, indexed and studied the parts of speech and linguistic elements as written.

Once I noted what was used, I considered what parts of speech were not use. I plan to do this for each of the nineteen postings.

So, this is an analysis of the August 13, 2016 post. Once I have completed all of them, I will do a comparative analysis.

The Surface on August 13, 2016

Let’s start with the surface. The Shadow Brokers use a seemingly idiomatic English phrase “dumb cattle” and netizen spellings for “handjob” and “blowjob” (spelled as one word, and not two), as well as selective parentheticals, capitalizations, and quotations that are intriguing.

For example, TSB places quotations at three of the 89 lines that comprise the post (separated by periods, minus URL Links) read as follows:

67 We have final message for “Wealthy Elites”.
80 You see what “Equation Group” can do.
88 “Do you feel in charge?”

Single quotation marks (the apostrophe), and double quotation marks are used in programming to signify characters or strings. According to at least one source on hacker jargon circa 2001:

Another hacker habit is a tendency to distinguish between `scare’ quotes and `speech’ quotes; that is, to use British-style single quotes for marking and reserve American-style double quotes for actual reports of speech or text included from elsewhere. Interestingly, some authorities describe this as correct general usage, but mainstream American English has gone to using double-quotes indiscriminately enough that hacker usage appears marked…One further permutation that is definitely not standard is a hackish tendency to do marking quotes by using apostrophes (single quotes) in pairs; that is, ‘like this’. This is modelled on string and character literal syntax in some programming languages (reinforced by the fact that many character-only terminals display the apostrophe in typewriter style, as a vertical single quote).

Double quotations are placed around “Wealthy Elites,” “Equation Group,” and “Do you feel in charge?” The last, appears to be in reference to the film embedded above, specifically. But all three may work in tandem.

In the case of the first two, the punctuation seems to insinuating that TSB can directly quote “Wealthy Elites” and “Equation Group.” In other words that TSB is suggesting that it has the capability, whether by offensive SIGINT or traditional espionage to monitor what the “Wealthy Elites” and “Equation Group” are doing.

The excerpt from the Dark Knight Trilogy in the context of the overall post echos– albeit from the more cynical perspective and rhetoric of anarcho-capitalism, a theme that Julian Assange, Jacob Appelbaum, and Sarah Harrison’s present in a keynote from 30c3, entitled “Sysadmins of the world, unite!”

In that keynote, the presenters speak to a technical aristocracy, system administrators. The first part of the TSB post is also addressed to “government sponsors of cyber warfare and those who profit from it,” which includes sysadmins or those in this technical class (or aristocracy), like the “Equation Group” who profit by building, managing, and protecting the infrastructure upon which the “Wealthy Elites” rely.

Whereas 30c3 keynote presents same proposition albeit from a Marxist perspective, TSB does so from an anarcho-capitalism one.

TSB also employs incorrect or untypical English phrasings, for example, “as like,” “top friends,” and they reverse expected word order, for example in “pump price up,” instead of “pump up the price,” etc. They also never used an indefinite article (a/an), and rarely used the definite one (the).

Apostrophes

The post also contains no apostrophes, even though a possessive form of the apostrophe is required in at most five instances.

TSB even split the imperative, “Let us spell out for Elites,” instead of writing “Let’s.”

TSB also uses the 3rd person singular personal pronoun, “it” just once. Incidentally, TSB does not use linking verbs as often as required (see below, in regard to missing linking verbs).

That has me wondering if TSB avoided apostrophes (and “it is,” because of the contraction “it’s,” and what it might indicate about proficiency or deception. One person’s linking verb is another’s auxiliary.)

Or, is TSB so unfamiliar with the English language that contractions are too advanced (this may be why they avoid declining irregular pronouns as well)?

Does their keyboard have an apostrophe function?

Mood and Voice

Also, how much does one have to know a language to convey irony, mockery, malicious intent, etc.? How does mood or voice change over the course of the post?

Simple Present

The August 13, 2016 post is primarily written in simple present. In fact 75 percent of the sentences contain simple present tense; whereas 4 percent contain present continuous; 4 percent contain a modal; and two percent contain simple future. It’s striking.

Given that simple present verbs are, well, simple (e.g. you bid, you pay, we give), let’s look closely at the few times TSB employ a different tense.

Present Continuous

It’s awkward to write in simple present when making nuanced statements about an action, state, or occurrence, including a threat or even trolling.

An author can provide more information about an action by using the present continuous “we are auctioning,” or present perfect, “we have auctioned,” compared to the simple past “we auctioned” versus the past perfect “we had auctioned.”

The present perfect continuous “we have been auctioning” describes an action that started in the past and continues into the present. So tense describes when the action took place and can imply to varying degrees (including relative to other words) a sequence of events (for example, the past perfect “we had been hacking” implies that it is occurring before another verb’s tense, for example, “we have been auctioning” or, that the hacking, which occurred in the past, has now ended. In other words, tense can show continuance and even finality.

The use of simple present to discuss finding and hacking could be appropriately vague for the intended target, e.g. we follow, we find, we hack. Is it in the past, the present and continuing, or in the future?

Same with the use of “you see” (assuming it’s intending to imply what TSB sees), and from that follows, what is TSB seeing? Like I said, it could be maliciously vague enough with just the right component to avoid attribution. Something to consider is if the use of tenses between post show deliberate changes depending on what TSB is elucidating. If they use simple present to mask their capabilities, but do not when trolling; then we might assume they are proficient English speakers. Just an unimpeached consideration for now.

So, TSB only uses present continuous in four places in the 89 line post(without the carriage return URLS):

By using the present continuous for “are auction” even with its incomplete verb ending (-ing), they are being explicit, that the best files are being auctioned *now* and into the near future. If they employed the simple present for this, it might still work; but not as clearly (assuming it’s intentional).

But what about lines 69, 71, 72(the other three instances)?

If they use the simple present, it could read as a generality or opinion: “Elites make” or “break law” in simple present.

By employing the present continuous, specifically “Elites is making laws” and “Elites is breaking laws” (even with the improper auxiliary “is” instead of “are”), TSB implies that is occurring and continues, and perhaps that they “see” this because they “follow, find, and hack” (remember the use of simple present in the vast majority of the text, including when describing TSB capabilities vis-a-vis Equation Group.

Present continuous is also set in relation to the present and continuing “auction,” mentioned above (the first instance of present continuous). In other words, the use of present continuous taken together could be use to make sure that the post is not read as a statement about a punishment for the fact that Elites are supposedly corrupt.

Instead, it suggests a conditional possibility without employing modals or other devices. Compare, “hack…war, tomorrow,” with “could be hack…war tomorrow.” If the stakes are high, then a nuanced threat (even if given in the voice of an auctioneer to security professionals and so-called “Wealthy Elites”– i.e. including, politicians or factions, who “make and break laws”– requires such particulars to be clearly mitigated, while allowing for the desired ambiguity.

I can’t help but think about this post and compare it to news NBC broke in October 2016 regarding a U.S. president Barack Obama administration plan to retaliate against Russia for election interference. This isn’t a conclusion about the post’s intention, just an intriguing elucidation, of why present continuous may be more useful here, if intentional and used limitedly.

Modals

Same thing goes for auxiliary verbs (to have and to be), which I will get to down below, including modals (can, could, would, should, may, might).

Using the simple present, TSB doesn’t use auxiliary verbs or modals, even where they would be expected to, for example in an interrogative, e.g “Q: Why I trust you?” compared to Why [should, can, would] I trust you?” or “You worry more, protect self from other bidders, trolls, and haters” compared to “You [should] worry more, protect self from other bidders, trolls, and haters.”

Here is where they do use them:

By using “can” they draw specific attention to capability (arguably as a threat), but “could” softens the statement, and suggest a conditional or a possibility. This could be especially important when conveying a threat, namely one associated with a lot of risk.

Auxiliary, Infinitive and Linking Verbs

Very few auxiliary verbs are employed (forms of “to be,” e.g. is, are, will, etc., which help form other tenses).

By using the auxiliary verb, “will” in only two places, TSB creates the simple future. The following would be incomprehensible in simple present:

So, those idiosyncrasies, alongside others listed below, are something to look out for in other posts when comparing.

For example “is” occurred in 11 percent of sentences, but linking verbs were missing in 4 percent (is/are), and the infinitive form was missing “to” in 4 percent of sentences, while “will” was employed 2 percent, and “are” just once (as noted above for present continuous).

Nominatives and Objects

Aside from improper verb endings, even while employing simple present and the few other tense occurrences (e.g. auction-ing, say-ing, ruin-ed, and gave v. have given), other idiosyncrasies for non-verbals are:

Nominatives in the main or dependent clauses were missing in 11 percent of sentences (10 out of 89 independent and subordinate clauses).

The post was written primarily using 1rst person plural and 2nd person (singular or plural), when personal pronouns were employed.

The demonstrative pronoun “that,” which works as a subordinating conjunction in the nominative and object case was never used, “which” was employed just once. This makes for very difficult construction of complex and compound sentences.

But, by avoiding nominatives and object nouns/pronouns, especially in the subordinate modifying clauses, meaning can still be inferred.

TSB employ determiner and pre-determiner pronouns (see below), and very rarely used definite (the), and never indefinite articles (a/an), as mentioned.

The 3rd person singular neuter (it) was only used once.