Within UFO Hackers
Why the Missing Evidence Changes Everything
Without original files, screenshots, paths, logs, or notes, investigators cannot determine what McKinnon saw or how it should be interpreted.
On this page
- What primary evidence would establish
- How memory can distort technical encounters
- The limits of retrospective testimony
Page outline Jump by section
Introduction
Gary McKinnon’s unauthorised access to United States government computers is well documented. The extraordinary material he said he encountered is not. No publicly available original image, screenshot, spreadsheet, directory listing, file path, access log or contemporaneous note allows independent investigators to reconstruct what appeared on his screen. That gap changes the status of the story: it remains testimony about a digital encounter, not verifiable digital evidence.
This does not prove that McKinnon invented or misunderstood what he saw. It means the central claims cannot be authenticated, interpreted in their original setting or tested against ordinary explanations. In digital investigations, the surrounding data often matters as much as the eye-catching content. A filename, folder hierarchy, creation date, software environment or neighbouring document can reveal whether a strange-looking item is operational material, a simulation, a draft, an illustration or something genuinely unexplained. Without those records, the most consequential questions cannot be answered.
What primary evidence would establish
McKinnon said that while remotely browsing a NASA computer, he viewed part of a high-resolution image showing a smooth, silvery, cigar-shaped object. He also recalled an Excel document headed “Non-Terrestrial Officers”, containing names, ranks and references to unfamiliar ships or transfers. In his 2006 Wired interview, however, he acknowledged uncertainty about the spreadsheet’s significance, accepting that it might have concerned a military game or hypothetical scenario. He also said that his slow connection was interrupted before he could preserve the image he was viewing.[WIRED]wired.comufo hacker tells what he foundMcKinnon tells what he found and discusses the motivation behind his online adventures in this exclusive phone interview with Wired News…
A serious assessment would need more than a picture copied into an article or a remembered phrase. The most useful surviving evidence would include:
- The original files, rather than compressed reproductions or later reconstructions.
- Exact filenames and directory paths, showing which system, project and organisational unit held them.
- File metadata, including dates, dimensions, format, creator information and revision history where available.
- A complete screenshot or screen recording, preserving application windows, menus, labels and nearby material.
- Access logs and timestamps, linking the files to the claimed session and host machine.
- Cryptographic hashes, which act as digital fingerprints and allow later copies to be checked against a preserved original.
- Contemporaneous notes, written before years of interviews and public discussion could influence recollection.
- Related files from the same folders, needed to distinguish an operational record from training, fiction, concept art or testing data.
These are not bureaucratic extras. They answer different questions. A hash can help show that a file has not changed since collection. Metadata may identify the program that produced it. A directory path may connect it to a spacecraft-imaging project, a graphics department or a simulation exercise. Logs can establish whether the relevant computer was actually accessed at the stated time. NIST defines digital forensics in terms that include chain of custody, mathematical validation, validated tools, repeatability and reporting; its preservation guidance stresses documentation of a file’s original source, integrity and handling history.[nist.gov]nist.govdigital evidence preservation considerations evidence handlersDigital Evidence Preservation: Considerations for Evidence Handlers | NISTSeptember 8, 2022 — (2022), Digital Evidence Preservation…
In McKinnon’s case, the difference is decisive. His access to government systems is supported by legal and official records: the United States alleged that he entered 97 government computers between February 2001 and March 2002, and British authorities seized his computer during the investigation. Those facts establish that an intrusion occurred. They do not establish that every file he later described existed as remembered or meant what he inferred from it.[UK Parliament]publications.parliament.ukUK Parliament House of LordsUK Parliament House of Lords
A file without context can mean almost anything
Digital artefacts rarely interpret themselves. Even apparently direct wording can be ambiguous when detached from the system that produced it.
“Non-terrestrial”, for example, could conceivably mean beyond Earth, but the phrase alone would not identify extraterrestrial beings, recovered craft or a secret space fleet. It might refer to personnel assigned to space-related duties, fictional planning, an exercise, database test entries or an internal label whose meaning depended on a local naming convention. McKinnon himself reportedly understood the listed officers as human personnel rather than aliens and conceded that the material could have had a hypothetical purpose.[WIRED]wired.comufo hacker tells what he foundMcKinnon tells what he found and discusses the motivation behind his online adventures in this exclusive phone interview with Wired News…
The same problem affects the alleged image. A smooth object against Earth might be remarkable, but investigators would first need the entire frame and its technical history. Cropping can remove scale and orientation. Low-colour remote-display settings can flatten shading and conceal detail. Partial loading may create blocks, bands or incomplete shapes. Image-processing stages can make an ordinary object appear unfamiliar when an observer sees only one version without captions or mission data.
McKinnon described viewing the image through a remote Java application over a 56K dial-up connection, after reducing the screen resolution and colour depth. He said there was no reference scale and that he presumed the picture had been taken by a satellite. Those viewing conditions imposed substantial limits: he was not examining a preserved full-resolution file locally, and even the image’s source and viewing geometry were uncertain.[WIRED]wired.comufo hacker tells what he foundHe claims to have discovered a NASA department that airbrushes UFO images from high-resolution photos and an Excel spreadsheet titled "No…
The reported presence of “processed” and “unprocessed” folders is likewise not proof of concealment by itself. Scientific and government imaging routinely involves calibration, noise removal, contrast adjustment, stitching, annotation, geometric correction and preparation for public release. A comparison between originals and processed products could reveal improper removal of objects, but only if the files were preserved and analysts could determine what changed, why it changed and whether the procedure was documented. Without the pairs, even the claim that anomalous objects had been removed cannot be tested.
How memory can distort technical encounters
Memory is not a video recording retrieved intact from storage. It is reconstructed, and that reconstruction may absorb later language, interpretations and expectations. This is especially important when the original event was brief, visually degraded and emotionally intense.
McKinnon had entered the systems specifically looking for evidence of UFO secrecy and suppressed technology. That prior belief does not discredit him, but it matters because expectations influence which details attract attention and how ambiguous material is classified. A person seeking signs of a hidden space programme may assign greater significance to an unfamiliar ship name or unusual image than an analyst approaching the same material without that expectation.
The encounter also appears to have occurred under pressure. He was operating without authorisation, navigating remote systems through a slow connection and anticipating discovery. He later described being intensely excited as the image appeared and then being disconnected just before capturing it. High arousal can make an experience feel exceptionally vivid while leaving peripheral or technical details less secure.[Richard Medhurst]richardmedhurst.comRichard Medhurst EXCLUSIVE: GARY MCKINNON INTERVIEWRichard Medhurst EXCLUSIVE: GARY MCKINNON INTERVIEW
Research on eyewitness memory does not justify assuming that every recollection is unreliable. Initial, uncontaminated reports can carry real evidential value, and carefully measured early confidence may sometimes correlate with accuracy. The difficulty is that confidence recorded much later can be affected by repetition, feedback and post-event information. Studies have found that repeatedly retrieving a memory may increase confidence even in incorrect details, while the National Academies has warned that confidence reported long after an event can be inflated by influences other than the original memory.[sciencedirect.com]sciencedirect.comOpen source on sciencedirect.com.
That distinction is crucial here. The best-known detailed accounts appeared in interviews years after the alleged access. By then, McKinnon had repeatedly discussed the story, encountered media retellings and spent years defending his motives during an internationally reported extradition dispute. Consistency across later interviews may show that his narrative stabilised, but it cannot reveal whether every detail was present in the earliest recollection or became sharper through repetition.
Technical memories are particularly vulnerable to retrospective tidying. A witness may remember the apparent meaning of a document more strongly than its exact wording, column headings or directory location. Several incomplete impressions can merge into a single coherent episode. An assumption made during the event—such as identifying an image as satellite photography—may later be remembered as part of the file’s known provenance. None of this requires deliberate deception.
Retrospective testimony has hard limits
Personal testimony can establish what a witness believes happened. On its own, it usually cannot establish the authenticity, origin or correct interpretation of a digital object.
The first limit is non-repeatability. Another investigator cannot reopen the stated file, compare versions or reproduce the viewing conditions. Repeatability is central to digital forensics because it allows independent examiners to determine whether the same methods produce the same findings. In this case, there is no disclosed dataset on which such examination can begin.[NIST Computer Security Resource Center]csrc.nist.govSP 800-86 under Digital ForensicsNIST Computer Security Resource Centerdigital forensics - Glossary | CSRC In its strictest connotation, the application of computer scien…
The second is no reliable provenance. Provenance is the history of where an item came from and how it was handled. Even if a purported McKinnon screenshot surfaced now, investigators would need to know when it was made, whether it came from the seized hard drive, whether it had been edited and whether its contents matched data retained by the relevant government system. NIST preservation guidance emphasises original-source documentation, hashes, backups and a maintained chain of custody precisely because digital files can be altered without obvious physical traces.[nist.gov]nvlpubs.nist.govOpen source on nist.gov.
The third is interpretive underdetermination: several explanations remain compatible with the surviving account. The image might have shown an unconventional vehicle, an ordinary spacecraft component, a photographic artefact, incomplete rendering, an illustration or a manipulated image. The spreadsheet might have been literal, speculative, fictional, administrative or misunderstood. Because the original artefacts are absent, investigators cannot rank these possibilities using the files themselves.
The fourth is selection bias. McKinnon reportedly browsed large numbers of machines and folders while searching for a particular subject. Without a record of the wider search, there is no way to know how many mundane files surrounded the few remembered anomalies. An unusual phrase found among thousands of routine records can feel more significant when the routine material disappears from the retelling.
Finally, the extradition proceedings did not resolve the UFO claims. The legal records concerned alleged unauthorised access, damage, jurisdiction, sentencing pressure and McKinnon’s health. The extradition was blocked in 2012 on human-rights grounds because of the assessed risk to his life, not because a court authenticated or rejected the files he said he had encountered.[GOV.UK]GOV.UKgary mckinnon extradition case home secretarys statementgary mckinnon extradition case home secretarys statement
The right conclusion is uncertainty, not dismissal
The absence of preserved evidence does not logically prove that nothing unusual was present. It prevents a reliable conclusion in either direction. Declaring McKinnon’s account definitive proof exceeds the evidence, but claiming that the missing files demonstrate fabrication would also go too far.
The strongest defensible assessment separates three propositions:
- McKinnon accessed US government systems. This is supported by official proceedings and his own admissions.
- He later described seeing unusual material. This is supported by recorded interviews.
- The material proved extraterrestrial technology or a secret off-world programme. This is not established, because the underlying files and contextual records are unavailable for authentication and interpretation.
That separation explains why missing files matter so much. Extraordinary claims are not weakened merely because a witness lacks institutional approval or because a story concerns UFOs. They are weakened when the evidence needed to check the claim has vanished. With original artefacts, investigators could challenge NASA, test alternative explanations and perhaps verify a genuinely important discovery. Without them, the account remains historically interesting but evidentially unresolved.
Amazon book picks
Further Reading
Books and field guides related to Why the Missing Evidence Changes Everything. Use these as the next step if you want deeper reading beyond the article.
The Demon-Haunted World
Rating: 4.5/5 from 43 Google Books ratings
NEW YORK TIMES BESTSELLER • From the renowned astronomer and author of Cosmos comes a “powerful [and] stirring defense of informed ration...
Calling Bullshit
Bullshit isn’t what it used to be. Now, two science professors give us the tools to dismantle misinformation and think clearly in a world...
The Skeptics' Guide to the Universe
An all-encompassing guide to skeptical thinking from podcast host and academic neurologist at Yale University School of Medicine Steven N...
Mistakes Were Made (but Not by Me)
Why is it so hard to say "I made a mistake"-and really believe it? When we make mistakes, cling to outdated attitudes, or mistreat other...
eBay marketplace picks
Marketplace Samples
Live-tested eBay searches with available results related to this page.
Selected fromhacker wall art oneBay.co.uk.
Endnotes
1.
Source: wired.com
Title: ufo hacker tells what he found
Link:https://www.wired.com/2006/06/ufo-hacker-tells-what-he-found/
Source snippet
McKinnon tells what he found and discusses the motivation behind his online adventures in this exclusive phone interview with Wired News...
3.
Source: nist.gov
Title: digital evidence preservation considerations evidence handlers
Link:https://www.nist.gov/publications/digital-evidence-preservation-considerations-evidence-handlers
Source snippet
Digital Evidence Preservation: Considerations for Evidence Handlers | NISTSeptember 8, 2022 — (2022), Digital Evidence Preservation...
Published: September 8, 2022
4.
Source: csrc.nist.gov
Title: SP 800-86 under Digital Forensics
Link:https://csrc.nist.gov/glossary/term/digital_forensics
Source snippet
NIST Computer Security Resource Centerdigital forensics - Glossary | CSRC In its strictest connotation, the application of computer scien...
5.
Source: nist.gov
Link:https://www.nist.gov/glossary-term/38726
Source snippet
Hash, Hash Value | NISTHash, Hash Valuea string of numerical values used to substantiate the integrity of digital evidence or for inc...
6.
Source: csrc.nist.gov
Title: SP 800-72 under Chain of Custody
Link:https://csrc.nist.gov/glossary/term/chain_of_custody
Source snippet
NIST Computer Security Resource Centerchain of custody - Glossary | CSRC A process that tracks the movement of evidence through its colle...
7.
Source: publications.parliament.uk
Title: UK Parliament House of Lords
Link:https://publications.parliament.uk/pa/ld200708/ldjudgmt/jd080730/mckinn-1.htm
8.
Source: GOV.UK
Title: latest on [gary mckinnon case]({{ ‘mc-kinnon-case/’ | relative_url }})
Link:https://www.gov.uk/government/news/latest-on-gary-mckinnon-case
9.
Source: sciencedirect.com
Link:https://www.sciencedirect.com/science/article/pii/S1364661325000270
10.
Source: nvlpubs.nist.gov
Link:https://nvlpubs.nist.gov/nistpubs/ir/2022/NIST.IR.8387.pdf
11.
Source: GOV.UK
Title: gary mckinnon extradition case home secretarys statement
Link:https://www.gov.uk/government/speeches/gary-mckinnon-extradition-case-home-secretarys-statement
12.
Source: cps.gov.uk
Title: Disclosure Manual: Chapter 30
Link:https://www.cps.gov.uk/prosecution-guidance/disclosure-manual-chapter-30-digital-material
13.
Source: nist.gov
Title: new report reveals evidence handlers common practices makes recommendations
Link:https://www.nist.gov/news-events/news/2025/12/new-report-reveals-evidence-handlers-common-practices-makes-recommendations
14.
Source: nist.gov
Title: provenience based cross verification digital forensic artifacts applied ntfs
Link:https://www.nist.gov/publications/provenience-based-cross-verification-digital-forensic-artifacts-applied-ntfs
15.
Source: wired.com
Title: mirai untold story three young hackers web killing monster
Link:https://www.wired.com/story/mirai-untold-story-three-young-hackers-web-killing-monster/
16.
Source: nist.gov
Title: digital evidence
Link:https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-tool-testing-program-cftt/digital-evidence
17.
Source: nist.gov
Title: framework harmonizing forensic
Link:https://www.nist.gov/adlp/spo/organization-scientific-area-committees-forensic-science/framework-harmonizing-forensic
18.
Source: nist.gov
Link:https://www.nist.gov/itl/csd/secure-systems-and-applications/national-software-reference-library-nsrl/about-nsrl/nsrl
19.
Source: nist.gov
Title: nsrl 0
Link:https://www.nist.gov/itl/csd/secure-systems-and-applications/national-software-reference-library-nsrl/about-nsrl/nsrl-0
20.
Source: wired.com
Title: uk hacker gary
Link:https://www.wired.com/2008/08/uk-hacker-gary/
21.
Source: wired.com
Title: british ufo hac
Link:https://www.wired.com/2008/07/british-ufo-hac/
22.
Source: wired.com
Title: militarys own u
Link:https://www.wired.com/2008/07/militarys-own-u/
23.
Source: wired.com
Title: british hacker
Link:https://www.wired.com/2007/04/british-hacker-/
24.
Source: wired.com
Title: court filing confirms spy docs
Link:https://www.wired.com/2006/05/court-filing-confirms-spy-docs/
25.
Source: wired.com
Title: whistle blowers evidence uncut
Link:https://www.wired.com/2006/05/whistle-blowers-evidence-uncut/
26.
Source: wired.com
Title: slideshow whistle blowers evidence uncut
Link:https://www.wired.com/2006/05/slideshow-whistle-blowers-evidence-uncut/
27.
Source: wired.com
Title: stumbling into a spy scandal
Link:https://www.wired.com/2006/05/stumbling-into-a-spy-scandal/
28.
Source: wired.com
Title: terrorist or ufo truth seeker
Link:https://www.wired.com/2006/04/terrorist-or-ufo-truth-seeker/
29.
Source: wired.com
Title: accused pentagon hacker in court
Link:https://www.wired.com/2005/06/accused-pentagon-hacker-in-court/
30.
Source: nist.gov
Title: computer forensics tool testing cftt
Link:https://www.nist.gov/publications/computer-forensics-tool-testing-cftt
31.
Source: nist.gov
Title: national software reference library nsrl
Link:https://www.nist.gov/publications/national-software-reference-library-nsrl
32.
Source: nist.gov
Link:https://www.nist.gov/
33.
Source: nist.gov
Link:https://www.nist.gov/digital-evidence
34.
Source: csrc.nist.gov
Title: hash chain
Link:https://csrc.nist.gov/glossary/term/hash_chain
35.
Source: sciencedirect.com
Link:https://www.sciencedirect.com/science/article/abs/pii/S2211368114001089
36.
Source: sciencedirect.com
Link:https://www.sciencedirect.com/science/article/pii/S1361372307701458
37.
Source: committees.parliament.uk
Link:https://committees.parliament.uk/writtenevidence/53322/html/
38.
Source: richardmedhurst.com
Title: Richard Medhurst EXCLUSIVE: GARY MCKINNON INTERVIEW
Link:https://www.richardmedhurst.com/gary-mckinnon-interview/
39.
Source: pmc.ncbi.nlm.nih.gov
Title: Pub Med Central (PMC)Eyewitness accuracy and retrieval effort: Effects of time
Link:https://pmc.ncbi.nlm.nih.gov/articles/PMC9451081/
40.
Source: Wikipedia
Title: Gary Mc Kinnon
Link:https://en.wikipedia.org/wiki/Gary_McKinnon
41.
Source: Wikipedia
Title: Eyewitness memory
Link:https://en.wikipedia.org/wiki/Eyewitness_memory
42.
Source: apa.org
Link:https://www.apa.org/ed/precollege/topss/lessons/memory.pdf
43.
Source: sciepublish.com
Link:https://www.sciepublish.com/article/pii/567
44.
Source: youtube.com
Link:https://www.youtube.com/watch?v=FIlHu3YUBN4
45.
Source: frontiersin.org
Link:https://www.frontiersin.org/journals/psychology/articles/10.3389/fpsyg.2019.00703/full
Additional References
46.
Source: youtube.com
Title: Hacking for UFOs and fighting for his life. Who is Gary Mc Kinnon? | Nord VPN
Link:https://www.youtube.com/watch?v=OImdnvQx7sQ
Source snippet
Gary McKinnon UFO hacker evidence Gary Mckinnon: The Hacker Who Found UFOs Thinker...
47.
Source: youtube.com
Link:https://www.youtube.com/watch?v=-1ATzz7Gfdc
Source snippet
Hacking for UFOs and fighting for his life. Who is Gary McKinnon? | NordVPN...
48.
Source: psychologicalscience.org
Link:https://www.psychologicalscience.org/topics/eyewitness-memory
49.
Source: youtube.com
Title: The Hacker That Found NASA’s Secret Space Fleet [Gary Mc Kinnon Interview]
Link:https://www.youtube.com/watch?v=2ttdlCa5ZCI
Source snippet
UFO Hacker Shares New Secrets | Gary McKinnon...
50.
Source: ojp.gov
Link:https://www.ojp.gov/ncjrs/virtual-library/abstracts/best-practices-maintaining-integrity-digital-images-and-digital
51.
Source: justice.gov
Link:https://www.justice.gov/archive/criminal/cybercrime/press-releases/2002/mckinnonIndict.htm
52.
Source: psychologicalscience.org
Title: eyewitness confidence can predict accuracy of identifications researchers find
Link:https://www.psychologicalscience.org/observer/eyewitness-confidence-can-predict-accuracy-of-identifications-researchers-find
54.
Source: youtube.com
Title: Gary Mckinnon: The Hacker Who Found UFOs
Link:https://www.youtube.com/watch?v=8_1DuqeU8hw
Source snippet
Hacker Gary McKinnon about NASAs UFOs and other technologies 2015...
55.
Source: researchgate.net
Link:https://www.researchgate.net/publication/387792852_Ensuring_the_Integrity_of_Digital_Evidence_The_Role_of_the_Chain_of_Custody_in_Digital_Forensics