Butler's secret political operation used PGP encryption to protect its documents. Yet the same PGP process is exactly what preserved additional digital forensic evidence.

When the files were decrypted, the metadata inside each Word document was perfectly intact: who created it, who last edited it, when, on what computer, using which template, and sometimes the exact file path on the author's hard drive. Encryption scrambles a file's contents, but it does nothing to that metadata. Across all 1,781 documents, it tied the files to specific people, specific machines, and specific organizations, putting Butler's secret operation on a map.

1. The SIF secretive PGP encryption process preserved the documents' metadata

The operation treated its documents as sensitive. Files moved as PGP-encrypted attachments through a confirmation-of-receipt workflow. But encryption only scrambles the contents of a file. It does not touch the document's internal properties, the author name, the editor, the timestamps, the company registration, the template, and embedded file paths. Once decrypted, those properties were fully readable across all 1,781 documents, and they tie the files to specific people, specific machines, and specific organizations.

2. Documents were written on U.S. government computers

Sixteen documents in the archive carry a "Company" registration showing they were created or edited on government machines, the field Microsoft Office fills in from the computer's Office registration. The entities include the U.S. House of Representatives, the United States Senate, and a federal agency, the National Marine Fisheries Service. The documents are largely "GabbardMentions" media-monitoring files authored by congressional staffers.

Media monitoring is a normal congressional staff function. What is not normal is that government-produced files ended up inside the encrypted archive of a private religious organization's political operation, and that a document preparing questions for a House Armed Services Committee hearing was created on a federal fisheries agency's computer. ¹

3. The documents were part of an assembly line

The metadata shows a standardized production system. Hundreds of documents were built from the same custom Word templates, the marks of a repeatable, standardized workflow.

The work was divided among a fixed cast of editors. A handful of people touched hundreds of documents each, the signature of a staffed back office.

4. The metadata named the machines and the operatives

Of the 1,781 documents, 1,570 are registered to "Hewlett-Packard Company," indicating a fleet of matching HP computers, the hardware of Butler's project office. Beyond the company field, embedded file paths inside the documents leak the Windows usernames of the people who made them, including "Vikram K.," "Govinda Lila," "Radha S.," and "TV." A document's template path is supposed to be invisible. Here it names the operative and the machine. ²

5. A 15-year political operation

Document creation runs consistently from 2010 through 2025, peaking across 2014, 2015, and 2016, Tulsi Gabbard's first congressional terms and her rise to national prominence.

More than half of the entire archive, 918 documents, are transcripts of Butler's dictated instructions. A private citizen with documented ties to the Chinese Communist Party was generating a continuous stream of political directions, and a staffed office was turning them into reports, talking points, social media, and legislation for more than a decade.

The email forensics point to the same network

The documents are only half the record. A parallel analysis of 284,909 emails from two archives, made possible because the operation's Office 365 system stamped each device's originating IP address into the headers, points to the same people and the same machines. ³

34 shared IP addresses tie the anonymous "Please Confirm" account to the operatives

The "Please Confirm" document-distribution account shared 34 IP addresses with known operatives, including identical IPv6 /64 home-router addresses on Charter/Spectrum Hawaii. A shared /64 means the same physical router.

A 3:44 AM email shows Kit Robinson provisioning the secret email accounts

Kit Robinson handed over a new Office 365 mailbox, rebecca@researchhq.org, with a temporary password and setup instructions, identifying him as the operation's IT administrator across its private domains.

Tulsi Gabbard used a private alohafuture.com address inside the operation's email system

She received and sent on an alohafuture.com address hosted in the same Exchange system the operatives used.

Mike and Carol Gabbard received more than 770 political documents directly

Carol Gabbard's own email confirms her "dhdtennis" alias and lists the SIF operatives and campaign staff on a single distribution: the campaign and the religious network operating as one.

Operatives logged in from Australia and the Philippines

Originating IPs place operatives on Telstra (Australia) and Globe Telecom (Philippines), with a mainland contractor in the Pacific Northwest.

Taken together, the documents and the emails describe a single, staffed, 15-year political machine: a private religious organization, led by a man with deep ties to the Chinese Communist Party, generating the directives, transcripts, reports, and talking points of a member of Congress who also served as Director of National Intelligence.