The Virus Did It

scubacuda writes "The Inquirer and Get Reading report that a UK man accused of having pornographic pictures of kids on his computer was acquitted after a court heard that his machine was infected with a Trojan on his PC which probably auto-downloaded the images. (In light of moves like Operation Ore, we'll probably hear more defenses like this.)"

Comments

Insanity

[dledeaux]

Human: I plead insanity! I wasn't aware of my actions at the time that I was doing them. I can't be held responsible.

Computer: I plead trojan. I wasn't aware of my actions at the time that I was doing them. I can't be held responsible.

Re:Insanity

[Dogun]

Forgive the sound of the dying giraffe, but I have to say that the insanity defense is no joke. NGRI is something under constant attack by people who don't really understand it.

Consider this: you are driving your car. you hit a baby, baby dies. You weren't driving particularly recklessly, under the speedlimit, visibility was just low. It's sad and it happens.
Consider this: you are drunk, driving your car. And by drunk, I mean you are impaired. You aren't driving particularly recklessly, but the same thing as above happens.

Now, this doesn't apply to NGRI directly, but consider this: the circumstances around a crime impact the meaning of it. Both of those situations flat out suck, but the argument is that you were being especially irresponsible in the second case, but not in the first.

Let's say you are sane and you kill a guy named Sam. (Sorry, Sam.) He kicked your dog, and now you're going to pump his head full of lead and do some of that stuff out of the first scene of "Way of the Gun".

Now, consider case two: you are insane, and you believe that Jodie Foster is in love with you and tells you to do things, and you feel complied to do so. You are not even aware of your delusion, and the fact that you are having the delusion implies that a great deal of your judgement is impaired. In fact, you could say that you didn't know what you were doing - you can still remember doing them, but you thought you were killing the martian high leader of the invasion force or something. In this case, are you responsible for killing a man, or are you responsible for falling for a delusion, which to you seemed very, very real.

I argue that in this case, you are not guilty of the crime you are charged with because you frankly were not in control of your reality.

And ultimately, if you look up statistics on the defense, you'll find that it is hardly ever used, does not work when it should, and that the mean time spent incarcerated in mental hostpitals by NGRI people is higher than the mean time spent in prison for the same crime.

There is actually a famous case where a guy shot somebody very important under the compulsion of one of his delusionary characters and was found not guilty by reason of insanity, who is now sitting, treated, recovered, in a mental hospital, getting clean review after clean review and not being released by the board that controlls his release.

Whine as much as you want about the implications of this trojan defense, but don't equate it or compare it to the not guilty be reason of insanity defense. They are quite different.

Also, note that it *IS* possible that a trojan's job would be to search for child pornography on Kazaa or something. Ultimately it'll probably just pull up legit porn, but somebody COULD design such a program.

Now, granted that, the prosecution should have made a serious attempt to disprove the defendants claims. I suspect they did otherwise.

Re:Insanity

[Tuxinatorium]

That's not very relevant, because legal punishments have two purposes only: deterrance and keeping dangerous people off the streets, so that they cannot harm others, insane or not (you'd have to be insane to be a serial killer anyway). People who are acquitted on capital crimes on the basis of alleged insanity or temporary insanity should NEVER be released until it can be thoroughly proven that they have regained mental balance and are no longer a threat to the public. Whether they are a continued threat or not is far more important that whether they were insane at the time.

Re:Insanity

[SerpentMage]

Here is another maybe potentially simpler analogy.

Lets say you have a wireless phone. Very common here in Europe. One day somebody comes by and notices that they have cracked your digital code. The digital codes are not that hard to crack. At that point the person makes a phone call and it turns out to be a murderer or terrorist (popular term these days). The question is if you are liable? Answer not likely since this was done without you knowing what is going on. At the worst you can be held as an accomplice to the crime.

But I was wondering when something like this would happen..... Glad to know that law still recognizes innocent mistakes....

Re:Insanity

[DickBreath]

Whether someone is insane, is experiencing delusions or not, this should not mean that the person does not need to be taken off the streets.

I don't care what is the reason sopmeone pumps the guy's head full of lead. Insane or sane. They need to be taken off the streets for everyone else's protection. No nonsense about "you were insane, so you should go free".

But then, what about "I was insane, it was temporary. Now at trial, I am sane. Because I was not responsible, I must not be punished."? Hey, if you could be temporarily insane before, then you can be temporarily insane again. You need to not be walking the streets.

Hey, I'm not responsible! Each time I killed one of those 14 victims, I was insane at the time. I am sane all the rest of the time. I am sane now. I should not be punished for something that I am not responsible for.

The voices told me to clean the guns today.

Re:Insanity

[Anonymous Coward]

This is my only "Not Guilty by Reason of Insanity" story:

A friend of mine beat a reckless driving charge (after going something like 110 in a 55 MPH zone) by pleading "Temporary Insanity".

And I will absolutley agree that he was insane at the time... but I still would have convicted him because he brought the insanity on himself after a week long Extasy binge. The next time he did that, we at least managed to get him committed.

Stay off the Extasy, kids.

Re:Insanity

[Dogun]

there is quite a difference between insanity and being a (psycho|socio)path.
The point of justice is not actually what you think it is, either. It's rehabilitation.
Someone who is insane probably does not have an accurate view of reality - like in the example I listed earlier. Someone who goes around murdering people out of malice, knowing full well what he is doing is not necessarily insane, and certainly not by virtue of his actions by our legal definitons.

And that point about releasing people who are found not guilty by reason of insanity; I agree with you on this. The problem is that people who have recovered/leanred to live with their disorder under appropriate supervision/medication should be released. The fact of the matter is that people who have recovered - and I'll trust their evaluators on that fact - are not released as commonly as you probably would like to think. For this reason, I think that the issue deserves attention, respect, and sensativity.

Re:Insanity

[Dogun]

This is a very good example of a plausible situation where you get fux0red. In this case, I doubt that you would have a great deal of luck determining if your cell phone had been cloned, and showing that to the court - though the burden of proof should be on the prosecution to show that your cell phone had not been cloned.

However, I don't think that a cell phone call is sufficient evidence to build a case around you without some other stuff - and yes, it is very conceivable that a number of circumstantial elements could converge on your and you get screwed.

In the case of this trojan, however, an effort should have been made to locate the trojan and determine how it works so that the prosecutor could have either avoided embarassment or disproven the defense conclusively.

Re:Insanity

[nolife]

I agree to a certain extent but..

What if you wake up in the middle of the night and find someone in your house hurting a family member. You approach the situation and the person starts running away. I do not know exactly what I would do but there is a chance that the average person would be inclined to chase him down and cause great harm with any weapon they could find. Does that mean you'd be a potential harm to society and should be locked up? You were never a treat to the general public, only someone that was causing harm to your family. Granted the person was running away so technically you may still be able to claim self defense. There is no cookie cutter answer for every situation.

Re:Insanity

[dledeaux]

Ok, consider this:

A large breed dog mauls a person and kills them. The dog is considered unsafe and is put down in the event that it might happen again in the future.

Is the dog aware of his own actions? No, not in the sense that we as humans are.

Now consider this:
An individual who believes that Jodie Foster is in love with them and that she is telling them to do things, etc. The person kills another person.

Is he aware of his own actions? You are saying that he is not aware of his own actions in the sense that normal people are.

So does that mean that the insane person should be put to death much in the same way that the dog is? What if this person later on decides that Britney Spears is in love with him and repeats his actions again?

Hopefully this won't get too off topic, I'm just trying to draw some parallels.

Re:Insanity

[Unknown Poltroon]

"The point of justice is not actually what you think it is, either. It's rehabilitation."

What country to you live in, hippie!! THis heres america. Whe thro em into overcrowed prisons with basic cable where the classrooms have been turned into bunkrooms, becasue after 10 years of that, theyre bound to come out and not ever want to commit any heinous crimes like pot smoking ever again. /sarcasm

Re:Insanity

[Anonymous Coward]

Because I have so many "admirers", I must post anonymously. I'm sure you'll understand.

I am Jodie Foster. I really am.

And I am telling each and every one of you to do this:

Shut up!

Re:Insanity

[fredklein]

I think insane criminals should be locked up for LONGER.

Think about it- if someone kills their spouse because the spouse cheated on them, that's one thing. The rest of society is not in danger from the spouse-killer. On the other hand, if a crazy person kills a stranger at random, the rest of society IS at risk.

Re:Insanity

[fredklein]

I don't care what is the reason sopmeone pumps the guy's head full of lead. Insane or sane. They need to be taken off the streets for everyone else's protection.

Not necessaarilly. If someone kills their spouse because the spouse cheated on them, that doesn't mean they are a threat to "everyone else".

Re:Insanity

[Charm]

Ok, consider this:

Or what about this one? You have a delusion that the government is out to get you. One day your best friend says something that makes you suspect he is part of the government plot. Later that night at home with your wife, you think you recieve a important message through your toothbrush. The message is that the feds are going to break into your house and kidnap your wife. You pull out your gun and walk agitated around the house. You hear a knock on the door. Opening it you see your friend but the voices in your head tell you he is the government agent, you pull the trigger, all you see is the government agent die. Later on they tell you that you just shot your best friend.

That is the sort of scenario that should be a insanity plea. It is not about awareness of the act itself but rather what the circumstances are at the time. Most of the time people like that don't understand the circumstances because of their delusions. Shooting someone in cold blood is one thing shooting someone because you "think" they are going to kill you is another.

Re:Insanity

[nanoakron]

You're just plain wrong.

The statistics don't back you up. Schizophrenics and other mentally ill people account for fewer than 1% of murders, and when successfully treated, are just as likely to kill again as you or I. So why should they be imprisoned because they were ill when they committed a crime?

It's kinda like putting everyone with a broken arm in jail, and not releasing them when they get better - mental illness is an illness like any other, once cured you're back to normal and should be treated like any other normal person.

-Nano.

Re:Insanity

[Surreal_Streaker]

... legal punishments have two purposes only: deterrence and keeping dangerous people off the streets

That is a very limiting way to look at modern legal systems. In one of the cases mentioned above, a person driving in a cautious and legal manner accidentally hits and kills a child in the street. While the driver is legally culpable for the death his punishment serves neither to deter future accidents, nor to keep a person that is exceptionally dangerous off the street.

Clearly accidents happen, and can not be deterred, and people involved in true accidents are not a future risk to society. Punishment in this case serves only to engender a sense of fairness and prevents the family of the victim from seeking their own form of retribution.

Our legal systems are intellectual masterworks, but they have a very real and important pragmatic basis as well.

Re:Insanity

[JimDabell]

Whether someone is insane, is experiencing delusions or not, this should not mean that the person does not need to be taken off the streets.

What part of the post you are replying to disagrees with this? Did you miss the bit that said:

And ultimately, if you look up statistics on the defense, you'll find that it is hardly ever used, does not work when it should, and that the mean time spent incarcerated in mental hostpitals by NGRI people is higher than the mean time spent in prison for the same crime.

Hey, I'm not responsible! Each time I killed one of those 14 victims, I was insane at the time. I am sane all the rest of the time. I am sane now. I should not be punished for something that I am not responsible for.

You know, there is such a thing as a jury. Having the right to plead insanity is not the same as compelling the jury to find the defendant not guilty each time it is used.

Re:Insanity

[carlos_benj]

The problem is that people who have recovered/leanred to live with their disorder under appropriate supervision/medication should be released.

But that's part of the problem, isn't it? They're perfectly fine within the controlled and supervised environment of the institution, but what about on the outside where there are different stressors and little to no supervision. Who's there to see to it that they take their medication? How many doses can they skip before their grasp on reality is impaired enough to fear the medication and deliberately not take it?

I know lots of people who won't take medications designed to keep them from dying - people who have full control of their mental faculties. What makes you think that your recovered mental patient will do any better?

Re:Insanity

[Amroarer]

I disagree. If somebody's wife cheaten on them, I would expect them to be angry.

But simply being very very angry does not excuse you killing somebody.

Re:Insanity

[Xiamin]

What if you wake up in the middle of the night and find someone in your house hurting a family member. You approach the situation and the person starts running away. I do not know exactly what I would do but there is a chance that the average person would be inclined to chase him down and cause great harm with any weapon they could find.

Myself, I would be tending to my hurt family member and seeing that they get prompt medical attention (phoning the ambulance, applying first aid, etc). I know it's a hypothetical situation, but you really should think it through. You're saying you'd rather hurt the assailant than make sure your injured family member is ok. Maybe you need to reasses your priorities.

Re:Insanity

[rifter]

No, just any woman stupid enough to marry a spouse-killing abusive moron.

Re:Insanity

[carlos_benj]

Clearly accidents happen, and can not be deterred, and people involved in true accidents are not a future risk to society.

And that's why that person likely will not go to jail. The comment you responded to was about what the poster felt 'legal punishment' was for and the fact that they mentioned 'keeping dangerous people off the streets' and 'deterrence' would have exempted your example, making your refutation actually an agreement.

Re:Insanity

[milo_Gwalthny]

The point of justice is not actually what you think it is, either. It's rehabilitation.

Well, rehabilitation is not the point of justice, the point of justice is Justice. Rehabilitation may be the point of the Justice System, although that is simply your view, certainly not the view of all people.

In your example, insane guy kills Sam, I don't believe you think that a Just outcome exists: if Sam is prosecuted, it is unjust because he is insane; if Sam is not prosecuted, it is unjust because the victim has not been treated fairly (he was killed, and there was no countervailing action.) What is just in this situation?

Some cultures would also disagree with your contention that it is the intent that matters. There are cultures that believe that if you run over a baby by accident or if you are drunk, the punishment should be the same. This makes sense, in a way, because it is difficult if not impossible to objectively and consistently know intent. I, personally, disagree with this approach with people--it reminds me of how we treat dogs: bite once and be destroyed, no matter the circumstances.

But, my main point is that rehabilitation and justice are barely connected. Rehabilitation is a social goal, not a factor in justice. If there was a machine where we could push a button and make sure Sam's killer was 'rehabilitated', I do not believe most people would consider this treatment enough to satisfy the goal of justice.

Re:Insanity

[rifter]

Jack, is that you?

Re:Insanity

[Anonymous Coward]

This is a good time to point out that schizophrenics are no more likely on average to commit violent crimes. Indeed, they are far more likely to be victims of violent crimes.

Re:Insanity

[knobmaker]

mental illness is an illness like any other, once cured you're back to normal and should be treated like any other normal person.

This might be true if there were actually cures for such major mental illnesses as schizophrenia, but unfortunately there are no such cures. In the case of schizophrenia, the only treatment available is palliative treatment-- medications that reduce the worst symptoms of the condition to a degree that the patient and his family can bear.

Re:Insanity

[Tony Hoyle]

What if you wake up in the middle of the night and find someone in your house hurting a family member. You approach the situation and the person starts running away.

I if you chase after him and cause him damage you will go to jail whatever the motivation - the same law applies to you, too.

Re:Insanity

[dh003i]

Your underestanding of the insanity defense is a little bit warped. Insanity as a defense only works if the defendant did not know what they were doing was wrong or if they could not control their actions. If you hear Jodie Foster in your head telling you to kill someone, you still know that's wrong, and still have control of your actions.

Re:Insanity

[The_K4]

Only you missed the most important point. Just because you hear voices telling you to do things does NOT mean that the insanity plea works. You must (at the time of the crime) not have known that what you were doing was wrong! "Insane" (in terms of this plea) means unable to tell the difference between right and wrong. There are other pleas that do not have that distinction (Extream emotional distress (in a moment or rage killing a peson who you just saw kill a spouce) and Diress by Physical threat to person (Joe Gangster pust a gun to your head and says "kill X right now or die)) but buy and large the insanity plea fails to work because the person KNEW they were doing something wrong/illegal and did it anyway. There are many killer (even some serial killers) that commited crimes because voices told them to, they were guilt because they knew it was wrong and listened to those voices anyway.

Re:Insanity

[confused philosopher]

"And by drunk, I mean you are impaired. You aren't driving particularly recklessly"

And you don't consider people who drive drunk to be driving recklessly by definition, unless they actually are insane and don't realize they are driving?

I think your idea of reckless driving isn't very good.

Re:Insanity

[The_K4]

Easy, i would go into the call history on my phone and say "Look that call's not here. It didn't come from my phone!". Gotta love a phone that keeps a call history of 250 calls. :)

Re:Insanity

[Aquitaine]

Troll and overrated? What, does no-one here read Douglas Adams?

Goodness. You people take yourselves awfully seriously.

Re:Insanity

[The_K4]

Actually, yes it is. It's called "Not Guilty by reason of Extreme Emotional Distress". It's been used in that exact situation on many occations. Being very very angry IS a reason to kill in the US.

Re:Insanity

[Concerned Onlooker]

All this talk of insanity is making me crazy.

Just as a point of reference, in the DSM IV (the definitive book that psychiatrists use) the word insane does not even appear. It's an old and outdated rubrik that is used as a catch all and as a bad plot element in movies.

While there is much more to DSM IV, you can think of it this way: Axis I disorders, which are brain chemistry/genetic problems such as depression, and Axis II, which are personality disorders such as narcissism and antisocial behavior (psycho/sociopathic). The main difference being that Axis I disorders are treatable, while Axis II remains a life-long problem.

There is no mention of trojan viruses in DSM IV....

Re:Insanity

[RollingThunder]

insane guy kills Sam, I don't believe you think that a Just outcome exists: if Sam is prosecuted, it is unjust because he is insane; if Sam is not prosecuted, it is unjust because the victim has not been treated fairly

Leave Sam alone, the poor guy's dead. ;)

Re:Insanity

[Anonymous Coward]

This idea suddenly doesn't seem so hot when you're this imaginary government agent.

The point behind insanity pleas is that the person did not know what they were doing was wrong. If you still know that killing people is wrong, illegal, and you will go to jail when found, even when they're evil government agents, then you don't get off.

If you don't like the look of the guy hanging around on the corner down the street from your house, and you think he's bad news, and is plotting to harm you, and you kill him, it doesn't matter who he really was, or who you thought he was, or what you imagined he was going to do. If you know it was not lawful to kill him, but ignored that knowledge anyways (which is really the only thing keeping people from killing each other and descending into anarchy), then you are guilty and will go to jail. It's that simple.

Re:Insanity

[shadowbearer]

LOL

Re:Insanity

[A_Non_Moose]

ROI==
Reason of Insanity

or

Return on Investment.

Coincidence?
Hummm

Re:Insanity

[Amroarer]

Bloody hell!

Okay, I'll take your word for it, but I don't think I want to ever visit a country where guns are legal and it's okay to kill people so long as you're really really angry...

Re:Insanity

[Neon Spiral Injector]

Insanity was never a medical term, it has always been legal.

Re:Insanity

[nanoakron]

You sound like you know what you're talking about so this is probably old news to you, but you know that only 25% of schizophrenics have a relapsing-remitting chronic illness....the rest are either curable (25% only have a few acute episodes) or the 10% who go on to kill themselves....

-Nano.

Re:Insanity

[knobmaker]

According to my wife, a licensed mental health counselor who's worked at an acute psychiatric facility for the last 20 years, there are no "cures" in the sense that the illness goes away and there are no further symptoms. There are schizophrenics who are able to function in society, though they will generally suffer from a variety of problems, due to their illness.

One of the interesting things my wife has told me about schizophrenics and other patients with major mental illnesses is that just like everyone else, there are goodhearted lunatics and badhearted lunatics. There are those who use their illnesses to justify evil deeds, and those who manage to be good people in spite of their illnesses.

perhaps...

[HBI]

Perhaps Mr. Schofield should be charged with the misdemeanor offense "Running Windows".

Some community service should put things aright, methinks.

Re:perhaps...

[miu]

Perhaps Mr. Schofield should be charged with the misdemeanor offense "Running Windows".

Ever head of an attractive nuisance ?

Re:perhaps...

[Capt. DrunkenBum]

Windows is anything but attractive.

Re:perhaps...

[drinkypoo]

On the contrary, windows is primarily attractive. I'm not talking about its appearance, which as we all know is reminiscent of something from fisher-price or my first sony, but of it's feature set and ease of use. The comment you reply to is more appropriate than your joke would suggest. Windows claims it makes it easy to do things like burn a CD, manipulate images and video, and so on, and for the most part it's right... But it also seems to have a significant chance to just blow up on you. (Then again, various linux systems I've owned have taken a giant shit when I installed upgrades from the distribution, and I've had plenty of kernel panics from release version linux kernels, so I'm not sure Windows is really less stable, now that Windows XP SP1 has become so reliable. I probably still wouldn't use Windows as a server of any kind except Active Directory or .NET.)

Re:perhaps...

[Capt. DrunkenBum]

It is a matter of personal opinion, but windows every version up to and including XP is the most horribly ugly thing I have ever set my eyes on.

Strangely enough I also can't stand Mac OS 9-8-7.

What do I like? I like Mac OSX 10.2.x once some of the eye candy is shut off, and I like KDE 2.X +

Hmmm...

[DarkBlack]

I guess you should have invested in some virus protection software. Could have saved a lot of money.

Re:Hmmm...

[NetDanzr]

Or you can turn it the other way round. Suddenly, I have the urge to ununstall all my virus protection and run that trojan I found, which automatically downloads mp3s of my favorite artists ;)

Re:Hmmm...

[Old Uncle Bill]

Yeah, I have a similar trojan running on my machine at home. I think it starts with a K and keeps downloading all this music...

In Prison (aka webchat.org)

[Anonymous Coward]

The virus would have to ask kc or ScottK if it could do it.

Re:In Prison (aka webchat.org)

[Anonymous Coward]

you must submit the following to register a nickname on our service:

1) Birth certificate
2) DNA sample (swab of cheek)
3) Males: semen sample - Female: egg
4) Color Photo of yourself
5) Registration form consisting of
all your personal information, including SSN.

What's the Point...

[Valthonis]

...of making a virus that downloads child pr0n onto a remote computer? I thought virii were created to wreak havoc, not frame random computer users... or am I wrong? And furthermore, if a jury can believe this defense, what's to keep all the imminent RIAA and MPAA suits from being defused by the same argument? FIRST POST! WOO!!

Re:What's the Point...

[kinnell]

Well, for the sake of argument, if someone had a grudge against the guy and wanted to cause him hell without being found out, they would have done an outstanding job.

Re:What's the Point...

[ergo98]

The point of trojans generally is that they let the evil hacker commit crimes in a less trackable way: Whether it's DOSing Yahoo, defacing websites, or cracking into banks. It seems logical to extrapolate that that they could use it to download and archive their child pornography as well, leaving all tracks pointing to the poor trojaned PC owner, while the hacker disappears into the night. While it's obvious that defenses like this mean that every child porn fanatic is going to stick a trojan on their PC to have a legal out, realistically it means that law enforcement should consider options when they move in on a suspect, such as monitoring all incoming and outgoing traffic for control commands, etc, or replacing the user's PC with a honeypot.

Re:What's the Point...

[mindaktiviti]

"...of making a virus that downloads child pr0n onto a remote computer? I thought virii were created to wreak havoc, not frame random computer users... or am I wrong? And furthermore, if a jury can believe this defense, what's to keep all the imminent RIAA and MPAA suits from being defused by the same argument? FIRST POST! WOO!! "

Didn't wreak havoc? The guy lost his 500 pounds a day job, didn't work for two years, got his named associated with child pornography...this trojan already made him lose out on two years of his own life. I'd say that constitutes as wreaking havoc.

Re:What's the Point...

[TopShelf]

Theoretically, a tech-savvy kiddie porn junkie could use a trojan to store the material on other people's computers, and browse it from there. Probable? Hardly. Possible? I'd think so...

Re:What's the Point...

[Eric Ass Raymond]

Actually that's pretty much how Freenet works.

Re:What's the Point...

[Valthonis]

OK, so maybe I DIDN'T get first post... silly lag. The proposal of a distributed file system to enable a virus author to download questionable (and illegal) files is a plausable one... but isn't that an awful lot of trouble to go to just to get your hands on pr0n?

Re:What's the Point...

[arivanov]

The netnanny alert sets off simulatenously on all employees in the company. That is mayhem and destruction way beyond the scale of an average virus. It is havoc squared ;-)

Re:What's the Point...

[N1XIM]

Not only is it possible.......IT HAPPENS! I have worked on a friends machine where some guy from the ISP (RoadRunner) was using port 53 (yes, the nameserver) to force him to log onto the ISP's network--thus allowing the intrepid sikko to download kiddie porn through this guy's machine via a trojan horse + buffer overflow (use the buffer overflow to place the trojan) attack. This is on WinXP, WinME, and Win98. I know this because I did the packet trace & analysis of what happened when he booted the machine. When he switched to my local nameserver running on my laptop, mind you, he got spared.
So, not only is it possible, it is being done.
I now run UNIX as much as possible--especially since one of my idiot roommates just switched us to RoadRunner (even after I told her about this happening......). This guy whose machine I worked on was behind a firewall, and he still got hacked. UNIX it is for me, thank you.

Re:What's the Point...

[Anonymous Coward]

Now this isn't a half bad idea. Who can build the smallest p2p trojan possible that will infect god knows how many machines, slowly filling their hard drives with random tunes?

First time someone gets acquitted because of such a thing is the last time the RIAA will be able to sue for copyright infringement.

Although, I suppose there are ethical concerns about disrupting law enforcement by way of making all parties guilty as a smokescreen.

Re:What's the Point...

[Snotnose]

I can see using a wireless link to intall the virus/trojan, going away, then coming back in a week to download all the gathered stuff via the wireless link. Makes it a hell of a lot harder to trace the real culprit. Not saying the guy had Wifi, but it's making me want to enable WEP on my home system. I don't care if you surf the net on my link, but I don't want asshats storing pr0n on my machine.

Re:What's the Point...

[zoward]

I removed a virus from someone's computer that does something very similar. It added a program to the Windows registry startup tree that would change all of the default settings in IE, including the homepage, to point to a certain kiddie porn page. Every time the user brought up IE, it went straight to that page. Even after reboot.

Why would someone write a trojan to do this? Aside from malicious glee the virus writer gets, if you run the web site you might pick up a few extra customers this way.

I worry about this as a legal defense. So I can infect my machine with this virus, and now I can collect kiddie pr0n on the 'Net (no credit cards! that would imply human interaction) and I have an easy out if Mr. FBI knocks on my door. Not cool.

Re:What's the Point...

[jc42]

This isn't at all hypothetical. I wrote up a little javascript demo a couple of years ago. Similar things can be done to you if you have any sort of "scripting" turned on in your browser, email program, etc.

This is especially a problem on Windows machines, where all sorts of software comes with the ability to execute downloaded files, and this is usually turned on by default. Most Windows users aren't much aware of the problem, and don't understand it when you try to explain it to them. The config thingies that disable it are hidden all over the system, and very difficult to find. And they change from one release of Windows to the next.

It's not just Windows, though. Unix/linux browsers tend to come with javascript enabled, too, which can make you susceptible to this sort of attack.

I've seen a number of machines at work with porn in the browser cache, and users who seem to be honestly surprised when I show it to them. If you've seen how simple the code is, you are likely to believe them when they say they didn't download those things. Anyway, you're welcome to my demo code. There are lots of other such things around on "HOWTO" sites.

Re:What's the Point...

[mattsucks]

It is also possible that the whole purpose of the Trojan was to set up a child pr0n sharing node on a computer without the owner's knowledge.

Re:What's the Point...

[rifter]

What I think is missing here is what the trojan was. If it was identified, they should have told what it is. If it is not identified, no AV software can protect you, and they shoudl have reported that. Then again, the whole thing could have been hypothetical (they did not find a trojan, they just claimed it was possible a trojan did it) which is even more dangerous because no one will find the trojan if it exists, and if it does not we let a kiddie porn enthusiast free (or rather the uk did).

Re:What's the Point...

[Anonymous Coward]

What's the Point... ...of making a virus that downloads child pr0n onto a remote computer?

Why, it's quite simple. If you infect the home PCs of judges, lawyers, and lawmakers, and download tons of child porn, then these people will quickly begin to realize how ridiculous it is to prosecute people for unknowing involvement in child porn. Hey, why bother assassinating a judge when you can just hack into his machine and frame him?

The only thing this trojan is missing is the ability to fire off an email to local law enforcement and news agencies.

Re:What's the Point...

[ivan256]

I thought virii were created to wreak havoc, not frame random computer users... or am I wrong?

Back in December I noticed upload speeds on my SDSL line were not quite what they used to be. A tcpdump listed loads of IRC and FTP traffic. A quick check of machines in my house led me to IRC and FTP servers running on my fiancee's windows box that were installed maliciously. The hard drive was full with porn, and lots of people were downloading. The point was niether to frame her for having kiddie porn on her machine, nor to wreak havoc, but to steal my bandwidth and hide the identity of the real distributors. The same thing easily could have happened to this guy.

Re:What's the Point...

[Anonymous Coward]

One could easily argue that framing people for owning child porn IS wreaking havoc. Or did you think such a charge would be a cakewalk?

Re:What's the Point...

[HiThere]

The first one I encountered insisted "Give me a cookie!", and wouldn't stop until you responded "a cookie".

I suppose that you could say that wasn't a virus, but rather something else (worm? trojan?) as it was rather primitive, and not particularlly infectious (for spreading it depended on someone recreating it on another computer). This is hardly wreaking havoc.

What a virus does is immaterial to whether it is a virus or not. So one that downloads some particular class of files would qualify. A virus is distinguished from other variants by it's mechanism of infection. Viruses hide themselves within other files, and depend on those files being activated. Then they reproduce, and hide the copies within other files. Worms spread via weaknesses in communication protocols, and are free-standing programs in their own right (though they may adopt a name that disguises them as another program). Trojans pretend to be something that they aren't, and depend on people activating them intentionally (thinking that they are the thing they are disguised as).

Note that all of these things are very similar, and around the borders it can be difficult to say exactly which one is dealing with. But none of the definitions require that they engage in any particular acts of mischief. Indeed, there have been some that were intended to patch security holes.

What's the point? I frequently have a difficulty in deciding what the point of some particular virus is. Usually I just decide someone wanted to prove that they could be an A** without getting their nose punched in. That would fit here, if the virus really existed. But it probably was just a deus ex machina.

Sounded fishy at first...

[Hee Hee Hee]

This sounded fishy at first, until I saw

"The specialist found the day before the images were downloaded the program was implemented, so there's a direct correlation between them,"

in the second article cited. Kinda makes you want to update your virus detection/bot detection/firewall/etc, doesn't it?

Re:Sounded fishy at first...

[cybermace5]

Still sounds fishy to me. I believe there are "dialers" that dial up a private connection to someone's server, after you download and run it. Could easily be a virus in one of those.

Though I certainly would not put it past a virus maker to attempt a little social sabotage. And it doesn't take much to get a trojan on your PC. A year or two ago I was repairing my mom's Windows machine, and discovered a trojan that had installed itself because she had sharing turned on (not even an open drive). The trojan itself was mostly benign, other than using the computer to scan for others to infect. The dangerous part was that the virus itself was infected, with Kriz. It was one week until Christmas.

Re:Sounded fishy at first...

[Anonymous Coward]

It was one week until Christmas.

And all through the house
Not a PC was stirring
Not even the mouse.

Re:Sounded fishy at first...

[Anonymous Coward]

The "specialist" is irrelevant as you can get another "specialist" with an opposing viewpoint to cancel each other out.

As for whether it is true or not: Consider driving your car. You have some friends in the car in which case one of them drops drugs. You get pulled over for speeding and the cop see's the drugs in the backseat. Do you know that you are still responsible for it because it is your car and you are responsible for the contents of it, period (at least in America). Being that this is a personal computer and not a business network should it really be considered any different?

Re:Sounded fishy at first...

[DickBreath]

Kinda makes you want to update your virus detection/bot detection/firewall/etc, doesn't it?

Kinda makes you want to keep a compromised Windows box lying around, doesn't it?

Your honor, this Windows box used to be exposed to the net. It must have been compromised by some evil anonymous remote hacker prior to my acquisition of a firewall. That's where all these evil mp3's came from.

What's that? Yes, I did run Windows Update. But that must have occured after the box was root compromised.

(I can say from personal experience that Windows "techies" I know don't understand that merely updating the exploitable software after a remote root compromise does NOT mean that everything is now A-OK.)

Re:Sounded fishy at first...

[jc42]

Kinda makes you want to update your virus detection/bot detection/firewall/etc, doesn't it?

That may not help much. A couple years back, I inadvertently started a minor "research project" at a place I was working by checking out a link to a bit of cute satire sent to me by a friend. I chuckled at it a bit, and then forgot about it. For about one day. When I came in the next morning, the NT workstation that I'd used was showing a rather pornographic picture.

I quickly verified that the site was indeed primarily a port site, though it did have some good cartoons and satire in a few directories. My friend had looked at it from a unix-type system, using netscape, and didn't see any of the porn.

I showed it to the other guys in the lab, and we investigated. We found that the site sent something in the first web page that we couldn't decipher (as it wasn't any sort of standard html), but which caused the browser to fetch the site's main page every day just after midnight. Most of the time this page was pornographic.

This only worked on Windows, though it affected both IE and Netscape there. The only way we found to prevent it was to turn off all scripting. This couldn't be done in the browsers; it had to be done on a system-wide basis. And the place to do it was different on nearly every Windows machine we had, so I can't tell you how to do it on your Windows box.

I don't work there any more, but I wouldn't be surprised if some of the machines there are still downloading porn every day just past midnight local time. A lot of the machines were used for testing java, javascript, active-X, and other scripting languages, so we had to leave such things enabled.

We did wonder whether the folks monitoring the network noticed that we were apparently sneaking in at midnight and downloading porn to a number of the lab machines. We all thought it was pretty funny, and a good example of why you should disable all scripting. Virus protection and firewalls won't help you. If any of your installed packages can ever interpret any downloaded text as commands, you are vulnerable. And on Windows, automatic execution of content is turned on by default in more packages than you want to think about. Unless you can find all of them and disable this execution everywhere, you are vulnerable to having your disk filled with porn.

Unixoid systems tend to be more sensibly run, and such things are usually off by default. But not always.

Anyway, it does make for a good defense. Especially if you're running Windows, where it's so difficult to even find such things and disable them. We had a bit of fun showing this to some of the more important folks in the company's network management team, and innocently asking them if they knew how to prevent this problem. They were obviously a bit embarrassed by not being able to give us good answers.

Re:Sounded fishy at first...

[CrazyDuke]

This actually happened to me as well, mostly because of my own stupidity.

I set up a anonymous ftpd on a non-standard port on my machine to use as a kinda "floppy disk" when running around between my computer and computer labs across campus. Low and behold, someone port scans me and starts using me as their private warez and mp3 server. Oh, well, after that I had to not be a lazy ass and type in a user and pass.

Re:Sounded fishy at first...

[SomeGuyFromCA]

> you are vulnerable to having your disk filled with porn

A lot of slashbots would not consider that a bad thing.

I would, but after ten years online, I'm rather jaded.

Re:Sounded fishy at first...

[Rary]

The difference is this: In your car example, you willingly and intentionally invited your friend into your car, thereby accepting responsibility for him, his posessions, and his actions. The analogy would only work if the trojan was willingly and intentionally invited into (ie. installed on) the man's computer.

I don't know what the law would say if, in your car example, the person with the drugs was hiding in the trunk without the driver's knowledge, but I'd bet there'd be plenty of lawyers willing to argue that the driver can't be held responsible for passengers he didn't even know were there.

Any lawyers out there want to offer an opinion on that?

Re:Sounded fishy at first...

[ckaminski]

The ONLY cure for a remote root compromise is a complete reinstall. No matter WHAT the OS. You can not be sure you nailed every last bit of compromised files. Or that there isn't some disk-sector based crap floating around waiting to bite you in the ass...

I must have lots of viruses....

[hoggoth]

They've been downloading MP3s, porn, movies, all kinds of stuff I am not aware of!

Re:I must have lots of viruses....

[Andrewkov]

I believe that virus is called "Kazaa".

Re:I must have lots of viruses....

[Surak]

Prosecutor: "How did that copy of Unreal Tournament 2003 end up on your computer?"
Me: "It was a virus! It downloaded it along with all the other pirated stuff on my computer and it even downloaded the DeCSS code! I don't even know how it got there!"
Prosecutor: "So how did you get that account on fragism.com?"
Me: "The virus stole my credit card # and signed me up! I had nothing to do with it!"

Re:I must have lots of viruses....

[DickBreath]

I must have lots of viruses... They've been downloading MP3s, porn, movies, all kinds of stuff I am not aware of!

Baloney! You did it. You are guilty. You should be sued for $150 Billion. (Can't be taking food out of the mouths of artists now, can we.?)

Your defense does not hold up because, at present, there is no virus that credibly does the things you describe.

hint, hint, wink ;-), wink ;-)

Re:I must have lots of viruses....

[Bonker]

I wish I had mod points right now.

Seriously, this defangs just about every piece of computer crime law ever written. Virus writers are getting damp in their drawers at the thought of making viruses that do exactly these things.

Re:I must have lots of viruses....

[Capt. DrunkenBum]

Give me 5 mins.. :)

Trojans

[rf0]

Now this is why you should always use protection? Don't know what you will catch

Rus

Re:Yeah sure it did...

[Querty]

How eloquently expressed...

Won't Work

[Unoriginal Nick]

In light of moves like Operation Ore, we'll probably hear more defenses like this.

I doubt this type of defense will help people who used their credit card to sign up for child porn sites.

Re:Won't Work

[NiteHaqr]

But maybe in the future it would.

With all the programs that offer to manage your financial account details, all it would need is an app that automatically fills in those credit card numbers for you when you go to buy something.

Then all you need is a Virus that can get at that data and bingo - a Virus that can sign you up to all sorts of things, and all in your name.

Now imagine if that Virus ran, signed you for an annual subscription to a porn site (at a time you were logged in and browsing) before deleting itself without a trace. Try getting your money back then.

This is why all kinds of automation should be rejected and our non techie friends educated.

Basically if its on the machine, assume that someone else can get at it.

Re:Won't Work

[miketang16]

No.. no... the virus not only downloaded the porn, but also used his credit card information to sign up for the site, confirmed his subscription via email, and initiated correspondance with Michael Jackson...

Re:Won't Work

[Skuto]

>No.. no... the virus not only downloaded the
>porn, but also used his credit card information
>to sign up for the site, confirmed his
>subscription via email,

If it got his credit card details, registering to a porn site would be no problem. You don't even need his email.

This would be a viable defense IMHO.

--
GCP

Re:Won't Work

[iainl]

Operation Ore is proving a rather overzealous thing, actually. Turns out that the credit card database is from a place that did signups for all sorts of porn sites, not just the ones this bad. The police are working their way through the list, seizing their PCs, and (not very promptly, or with any due course to the damage to reputations they are causing) releasing them once it turns out that they don't have anything actually illegal on them.

Imagine if Worldpay (for example) had been sloppy enough to act for a front for one of these sites, and everyone who had ever bought anything through them found themselves on the list. Thats roughly equivalent to what has happened here.

Re:Won't Work

[beders]

Identity fraud is the fastest growing crime or so I heard. If someone doesn't like you, stealing your credit card number in conjunction with a trojan to download the pics and bingo! You're a kiddie porn subscriber.

Re:Won't Work

[EasyTarget]

I doubt this type of defense will help people who used their credit card to sign up for child porn sites

Yeah, they should have got smart and used someone else's card.. If you're the sort of perv who will take the time to search out kiddie porn then searching further for credit card lists has to make a certain sense.

It was fear of -exactly- this that finally got me reading my CCard statements very carefully.

Re:Won't Work

[gurps_npc]

"I gave my credit card number to this web site selling cooking books, and now the web site is closed and I got a virus that downloads porn and tries to send the porn to the IP address of the closed website"

Re:Won't Work

[drinkypoo]

Basically if its on the machine, assume that someone else can get at it.

Yeah, or if it passes through the machine in unencrypted form, even. This is why passwords and credit card numbers (and similar) suck, and why we need biometric identification instead. Credit card numbers are the worst, because you regularly show them to people at stores and whatnot.

Re:Won't Work

[Anonymous Coward]

Don't be so certain - a trojan can easily grab your credit card number, passwords and all sorts of useful and nasty information about you.

Although a trojan that captures such potentially valuable things is more likely to send them to its creator than use them to make you look bad...

Re:Won't Work

[plover]

Biometrics are the worst possible answer.

The output of a biometric interface is a blob of data. That blob can be captured and used later in a replay attack. And being biometric, you can't change it if it gets stolen!

Consider the victim of the article's hacking. Doesn't matter how he signed on or authenticated himself, once a trojan or virus ran with system authority it was in control. It could then choose to steal biometric info at will.

The only way to secure anything like that is via a trusted computing device. While I'm not ruling out Palladium, I'm really referring to a smart card that performs challenge/response exchange with the authorizing host.

Biometrics can be copied (and thus forged.) Do not place blind trust them.

Great defense.

[grub]

Himmler: My orders were not from Hitler but from a virus.
Tim McVeigh: A virus filled that truck with diesel and fertilizer.
Magic Johnson: I didn't get AIDS from a woman but from a virus.

well.. ok, you can scratch the last one.

Re:Great defense.

[schon]

I didn't get AIDS from a woman but from a virus.

well.. ok, you can scratch the last one.

No, that's crabs that makes you scratch - and that's a parasite, not a virus :o)

Not that I know from experience, though :o)

UK Law...

[MrBandersnatch]

In the run up to the case, according to the Reading Evening Post, Mr Schofield suffered vigilante attacks and had to first hide in his home then move away to avoid continued attacks

Yet another example of why the decision to allow defendants in criminal trials to be named was a bad decision *sigh*.

As to the story - sounds strange that a trojan would do that unless someone was using his machine as a proxy and in that case why would the images be cached on his system?

Re:UK Law...

[BobDowling]

UK law regarding child pornography is so broken as to be seriously unfunny. The police are currently interpreting the law in such a way that if the police can find five images of child pornography on your hard drive, by any means, then you are guilty. Almost uniquely in non-negligence law there is no need to prove intent. As a result it is an easy means for them to get their statistics up so it is zealously persued.

Now consider the "by any means" bit. As far as I can tell they do a block-by-block analysis of the hard drive. So deleted files, swap and linked files are all identified. So if you use your web browser to read your email and you are sent an email with five indecent images then you're toast. Deleting the mail message doesn't help because the downloaded images still live in your cache. Purging your cache or letting it time out doesn't help unless the blocks get overwritten by other data. If you try to explain this to the police man/woman you will be told that your questioner doesn't use the net so they can't understand what you're talking about.

(Incidentally, none of this is hypothetical. I have a friend going through this hell right now.)

As for the list of credit cards, the confusion within the British Parliament beggars belief. One rabid member of parliament was on TV describing how they could still prosecute paedophiles from the credit card trail even if no images could be found on their computers. At the same time a minister in the Department of Trade and Industry was describing how terrible a problem identity theft was!

Incidentally, under UK law it appears that you are not allowed to challenge the alleged ages of children in pornographic images with a medical expert witness.

Put bluntly, the UK law on child porn sucks. The law has all the hallmarks of legislation brought in in a state of panic.

Re:UK Law...

[Alsee]

The law has all the hallmarks of legislation brought in in a state of panic.

Irregular/damaged goods 75% off retail!
Buy one get three free!
Would you like fries with that?
Please pull up to the second window to pay for your order.

-

wow

[Anonymous Coward]

couldnt he tell the increbible slowness of his internet connection was caused by something? did he just think his computer slowerd overnight? he needs a fine for being an idoit

Re:wow

[kinnell]

did he just think his computer slowerd overnight?

Isn't that normal for a windows machine?

he lived near me

[Anonymous Coward]

This bloke lived near me, he was hounded out of his home by ignorant fuckwits who presume that becuase somebody lives with their mother and father (after the age of 18) and is being done for paedophile images, the must be guilty.

It's a bit of a wake up call to the moronic masses that people can be innocent as well as guilty!

Re:he lived near me

[Anonymous Coward]

Still doesn't beat the pediatritian[1] who was attacked in his home. Not only are the mases moronic but their poor spellers, too!

Oh come on, you know I'm talking nonce-sense!

[1]: Is that right? Damn, I forgot now

Re:he lived near me

[Anonymous Coward]

It reminds me of the time a doctor was harrassed, abused, and finally forced out of her home by idiots living nearby, simply because they didn't know what the difference was between a paediatrician and a paedophile.

Sometimes I think that vigilante justice is worse than the original crime.

I see

[Joe the Lesser]

So that's how those pictures of mating llamas got on my hard drive!

Why haven't I deleted them?...

*shifts eyes, and flees*

Re:I see

[Andrewkov]

As long as you don't have any from that goatsex site...

Re:I see

[LizardKing]

So that's how those pictures of mating llamas got on my hard drive!

That would be the Jeff Minter virus ...

Chris

automated?

[ih8apple]

It's not clear from the articles....Is this guy claiming that the virus automatically downloaded the images themselves or that the virus opened up a back door for someone else to use his PC as a storage facility for their images?

I wonder where else that would work...

[Anonymous Coward]

Like when the BSA or RIAA come a-callin':

I swear I didn't copy and install all that software illegally. I swear I didn't download all those MP3s and put them into my playlists. A trojan did it.

(Lame, I know. But, one can certainly hope...)

I see a market here!

[elwinc]

I see a market here: howzabout selling software that (a) appears to be a virus infection -- well, OK, a voluntary virus; and (b) downloads porn automagically! Not only does it save typing and clicking, it provides a tested legal defense for your first arrest! Plus, we can have the porn providers pay to have their ad banners downloaded! Quick, get me to a venture capitalist!

the largest security hole is the client machine

[Submarine]

The more it goes, the more I think that the main issue of online security is not the protocols (SSL, SET...) but the security of the endpoints, and particularly of the clients.

I would not be surprised if we found a virus that searches through the local (and even LAN-accessible) documents for interesting keywords or types of information, then somehow manages to send this information back to some spying agency. In fact, I think this has probably already been done.

Imagine the potential:

• economic espionage
• blackmail (emails showing that he has a mistress / has taken illegal bribes...)

Of course, most corporate networks are firewalled. Still, lots of binary data is exchanged. You just have to hide yours in the flux... Do you really think this would be noticed in the middle of a virus attack?. Traffic analysis would be thwarted by the viral attack sending information in many directions, with no obvious destination. Onion peel routing and distribution through Usenet or WWW bulletin boards could do the rest - untracable information.

Re:the largest security hole is the client machine

[Surak]

The more it goes, the more I think that the main issue of online security is not the protocols (SSL, SET...) but the security of the endpoints, and particularly of the clients.

Which includes brain damaged users. I own two Linux boxes and several Windows machines and have yet to get a single virus on any of them.

That's because I only download software from known, trusted sources, carefully inspect attachments I wasn't expecting and NEVER open them directly from the e-mail package. It's OBVIOUS if an attachment is an e-mail virus, EVEN IN OUTLOOK. Only people who blindly click on attachments have this problem.

I mean people need more common sense. The Internet is a LARGE, UNTRUSTED NETWORK. You should be VERY CAUTIOUS of ANY transmissions you get from the Internet, because ultimately, you probably have no idea where they came from or where they've been, nor is there (for the most part), any way to really tell.

Re:the largest security hole is the client machine

[vinsci]

The FBI is way ahead of you... Enhanced Carnivore To Crack Encryption Via Virus. That's from 2001.

There are so many of these Big Brother spying technologies, I don't even know where to begin. You should at least learn about Echelon II, though.

Re:the largest security hole is the client machine

[carlos_benj]

You should be VERY CAUTIOUS of ANY transmissions you get from the Internet, because ultimately, you probably have no idea where they came from or where they've been, nor is there (for the most part), any way to really tell.

That's why I never put downloads in my mouth or touch them with my hands...

Dang! I knew that kindergarten training would come in handy some day.

Re:the largest security hole is the client machine

[drinkypoo]

The more it goes, the more I think that the main issue of online security is not the protocols (SSL, SET...) but the security of the endpoints, and particularly of the clients.

I'm sorry, but you have just managed to say absolutely nothing. The "security of the endpoints" is partly determined by the strength of the protocols to which it listens and partly by the implementations of those protocols which may have implementation-specific holes such as race conditions and buffer overruns; In the case of machines which people run software on locally you have to worry about bugs in that software which allow others to execute arbitrary code such as well-publicised holes in IE and Outlook, most of which have been closed recently but not all, and in the case of a machine to which random members of the public may have physical access, you must worry about other compromises.

Given that all of these are issues which determine the overall "security" of the machine, how can you discount the protocols? They are as much an issue as anything else.

Re:the largest security hole is the client machine

[Anonymous Coward]

Just a little history lesson for ya:

There was a time when people would merely PREVIEW a message (not even click any attachments) and it would infect their system, via Outlook. It's not just blind attachment clickers.

Re:the largest security hole is the client machine

[Surak]

There was a time when people would merely PREVIEW a message (not even click any attachments) and it would infect their system, via Outlook. It's not just blind attachment clickers.

Solution: don't run Outlook. I don't. I use Kmail on my Linux machines, Eudora on the Windows machines. At work I have no choice, I have to use Lookout, but like all smart companies, we run antivirus software on the mail server.

Re:the largest security hole is the client machine

[Submarine]

Maybe I expressed myself badly.

Much of the attention on the security of online transactions has focused on the design of protocols (and cryptographic primitives). You may then add bugs in the implementations.

What I'm concerned about is the security of information not in the client software (Internet Explorer, Outlook Express...) but on the client machine as a whole.

It's not just the holes in Internet Explorer and Outlook Express. It's the myriad utilities, gadgets, games, toolbars and whatever that many Windows users install on their machines.

Any of these can easily contain a virus.

Re:the largest security hole is the client machine

[Anonymous Coward]

Yes, and you are absolutely sure there no remote exploits in your software that are unknown to the manufacturers and white hats? Your box could have been 0wn3d since day 1, and you wouldn't even know it.

the defense is a product of the offense

[kaltkalt]

When the crime is as insane as "possession of a picture" (a digital one, no less), the defenses to the crime will sound somewhat nutty as well. It's to be expected. The only solution is to eradicate due process entirely and just execute the acccused immediately. Considering we're talking about kiddie porn here, i'm sure a vast majority of people wouldn't mind doing so at all.

Re:the defense is a product of the offense

[Anonymous Coward]

Yeah, especially since they get off on kiddie porn, they must be planning to rape and kill every kid within 20 miles. ...just like everyone that gets off watching horror flicks is going to kill everyone one night...

Re:the defense is a product of the offense

[kaltkalt]

the one thing all politicians can agree on (and no politicians would dare disagree with) is that kiddie porn is the worst problem our society faces, requiring the most drastic of measures to be employed. yeah, people who jerk off to kids is sick, but as long as they're not hurting the kid(s) directly there's no problem. I don't by the "the fact that they like it creates a market for it which in turn causes children to be hurt" argument. If you sexually abuse a kid, you go to jail--it's already a crime and always has been as far as I know (maybe not in Roman times and in Arkansas). The tenuous "market theory" is not a good enough reason for banning pictures in the land of the free. The taliban did stuff like that...

Acquitted - but...

[Chocaholic]

The problem this guy is going to face is that, despite his conviction, the prevailing mood in the UK is such that he will still find himself stigmatised for a very long time.

As he found out from the vigilante attacks before his trial, the maxim "innocent until proven guilty" doesn't seem to apply for some people any more - the witch hunts led by certain newspapers mean that any slight suggestion of paedophilia turns the accused into an immediate fugitive.

Therefore, though it's very kind of the Crown Prosecution Service to accept this explanation at trial, why did they wait before it was up before a judge with all the attendant publicity before letting him off the hook?

In the minds of some people as well, there's going to be an attitude of "that's right, blame it on the computer - he would say that, wouldn't he?". Technology-based defences simply don't hold water for a lot of non-technical people - which with the increasing number of technological offences being put to juries is quite a worry.

So, this guy will still be stigmatised as a paedophile, all for the price of some virus checking software...

Re:Acquitted - but...

[jkrise]

"the prevailing mood in the UK is such that he will still find himself stigmatised for a very long time."

And OTOH, I think he will shortly become a Consultant. Naming defendants in such cases is a double-edged sword - it can backfire... he has defended himself successfully against a criminal case, citing viruses and trojans. That makes him a valuable commodity for other crooks as well.

Secondly, this could open up a new avenue for viruses... new versions could be written and loaded by the user himself, as a defense tactic..

Re:Acquitted - but...

[Downside]

The lynch-mob mentality has caught on in the UK - even a paediatrician was attacked because her job title sounds like "paedophile".

There were several vigalante attacks, some on the wrong people, after the "News of the World" tabloid whipped up lynch-mob hysteria.

Re:Acquitted - but...

[Chocaholic]

Bad form to follow myself up, but...

"The problem this guy is going to face is that, despite his conviction...

For "conviction", read acquittal. *doink*

Re:Acquitted - but...

[PetiePooo]

As he found out from the vigilante attacks before his trial, the maxim "innocent until proven guilty" doesn't seem to apply for some people any more

That maxim has never applied to me, as I have never been in a jury. As an individual, I have every right to make a judgement of guilt on my own. Of course, its probably not that wise of me to make such a judgement without all the pertinent facts (its called prejudism), but we're all free to make that judgement.

Case in point: If someone walks up to me and slaps me, I have all the facts on hand to make a summary judgement of his guilt. Don't try to tell me I should respond with, "I think you slapped me. As soon as I get a judges opinion, I'm going to slap you back!"

Now, that said, everything changes when I become a juror. Then, I need to abide by the maxim you present. After all, I would want jurymembers to abide by it if I were the defendant. The ability to put aside prejudice is a requirement for jurors, and the jury selection process is intended to weed out those peers that are unable to do so.

A similar creed should exist within the press. They should not be making judgements of guilt in their news, unless, of course, it is clearly labeled as opinion. News is, by definition, factual. They can report the facts of the case as they know them, but should leave the judgement up to the aptly named (but unfortunately sometimes incompetent) judicial system.

Re:Acquitted - but...

[MrFredBloggs]

Perhaps now is a good time to ban all reporting of any criminal-law case until conviction? No conviction, no identification.

Naaah, that's too much like common sense!

Re:Acquitted - but...

[Anonymous Coward]

That makes him a valuable commodity for other crooks as well.

"Other crooks"? You know, when someone is found not guilty then that means that they are innocent. Didn't do it (As far as the law is concerned). Innocent, not a crook. "Other crooks?" My, you almost sound as if you've judged this man to be guilty based on no evidence other than he has been associated with kiddie porn. Fancy that, what a surprise.

Been on any good lynches lately?

Re:Acquitted - but...

[Anonymous Coward]

Fine, but judging (Or even worse, pre-judging) without knowing the facts would simply make a erson ignorant. That, sadly, is usually what happens.

Re:Acquitted - but...

[Anonymous Coward]

On the other hand, it's a great response to the old "Well why should I care about security - who'd want to hack me? You're just paranoid." remarks when you see them installing anything they can find off kazaa.

Re:Acquitted - but...

[PetiePooo]

Agreed. That's a flaw with people and reporters though, not the judicial system. And its only remedy is truthful, complete reporting of the facts, and an educated population.

I know; That will happen about the same time as world peace... *sigh*

Re:Acquitted - but...

[WickerChap]

I am a brit, and mob mentality will always rule. They even mobbed a *pediatricians* office because of the red mist built up by the british tabloid papers (Mainly the News of the world, but this happened after a satirical zine (privateeye.co.uk) made a joke about pediatricians getting attacked).

They probably did not realise that peadophiles do not tend to have brass plaques outside their front door advertising their tendancies.

Never underestimate the power of stupid people in groups.

Re:Acquitted - but...

[Anonymous Coward]

A similar creed should exist within the press. They should not be making judgements of guilt in their news, unless, of course, it is clearly labeled as opinion.

Are you familiar with the UK press? Their tactics are to do things like print a massive photo of the person on the front page, with the headline being something like "is this man a kiddy-fiddler"? (see page 5 for rest of story), and follow it up with "we don't know, the police are talking to him about something like that though."

Yes, given a more sensible public, the lynch-mobs wouldn't happen, but the newspapers print stuff like this fully knowing what the reaction will be. It sells more papers, who cares about the guy?

Re:Acquitted - but...

[mattsucks]

Therefore, though it's very kind of the Crown Prosecution Service to accept this explanation at trial, why did they wait before it was up before a judge with all the attendant publicity before letting him off the hook?

I know this sounds ass-backwards, but what if:

If they'd just quietly dropped the case with no public explanation, the guy would have been stigmatized forever. There would be no public resolution, so the public would just assume he was guilty and keep making his life hell. Since the case WAS resolved and dropped in such a widely-known public forum, maybe there is a sliver of a chance that this guy can get his life back. He has something he can point to and say "see? i didn't do it?" Publicity can work _for_ you also.

whether it works or not is another story ... i think he's got several more tough of years ahead of him.

Re:Acquitted - but...

[KC Swan]

In the Western World, actually, NO, being found "not guilty" does NOT mean "innocent". "Not guilty" means the state failed to show guilt. The law places the burden of proof on the prosecution; the defendent does not need to show innocence, only that the state cannot prove guilt.

This is why the OJ criminal trial result shows that the system does work. The prosecution failed to convince the jury, and the jury found OJ not guilty. We can debate all week why they were not convinced (well, YOU can, I won't participate), but they were not. The jury DID NOT found OJ innocent.

Dubious.......

[Angleworm]

Very dubious indeed. I find it very hard to believe that he did not notice several image files appearing on his drive. Also such paedophiles are monitored very carefully, and not without reason.

This may have been a case where the jury and judge knew very little about the natures of trojan and computer.

Re:Dubious.......

[Anonymous Coward]

Very dubious indeed. I find it very hard to believe that he did not notice several image files appearing on his drive. Also such paedophiles are monitored very carefully, and not without reason.

This may have been a case where the jury and judge knew very little about the natures of trojan and computer.

Excuse me? Maybe the judge and jury were ordinary people, and not obsessive compulsives who spend an hour each day checking every single folder on thier drives.

Do you keep a log of all file activity happening on your drive? Do you look at a list of all recently modified files on your drive daily? Would you notice if someone made a new folder in C:\Program Files\FakeProgramName and stuffed a bunch of image files in there? Would you even notice a gig missing on an 80G drive?

Re:Dubious.......

[Anonymous Coward]

i really doubt it. i have no idea what kind of images they were, but i doubt they are bigger than 1 meg each. then, with modern harddrives, many people wouldn't notice 100 of those, as long as they are in folders they dont look into

Re:Dubious.......

[Obasan]

Do you live on the same planet? My computer has tens of thousands of "image" files on it - most of them are jpeg, bitmaps, pcx etc. etc. etc. associated with installed software or in various caches from web browsing. Most computers are like this. Do a search on any windows computer for common image formats and you'll get back hundreds if not thousands of results. Do you know what every single one of those images are? Didn't think so.

If these things were saved to his desktop or something, thats one thing, but most likely they were stuffed away in some folder with a data-like name.

You can bet the prosecution had experts on their side who would have ripped this guys defense to pieces if it was that easy to find a hole in it. The court found this guy innocent - we should respect the courts finding and drop the witch hunt.

Re:Dubious.......

[wazzzup]

I find it entirely feasible that a person would not notice a large amount of files added to their computer. Not all people know their computer well enough to notice image files being added onto their hard drive - particularly if added to a system directory or somewhere a casual user doesn't normally peruse. Take OS X for example - I could load tons of files into the /var directory. To see the contents of /var on a normally configured OS X machine you have to go to the terminal or specifically configure the file browser (Finder) to make those type of directories visible. On my Windows 2000 machine at work I cannot browse the WINNT directory unless I click on Show Files (after reading the "This isn't the directory you're looking for. Move along now." warning). I'm 99.99% sure that I could add a gig of porn to my parents hard drive and they would never be the wiser.

Because those of us at Slashdot are more technically adept and let's face it - our computers are a major part of our day-to-day life - we assume incorrectly that everyday people are more capable with their computers and see them more than just a box that balances their checkbook.

Re:Dubious.......

[Anonymous Coward]

Without looking, what do you have in /tmp (s/tmp/C:\Temp) right now?

How about /usr/local/lib? /opt/bin? /lib/X11/?

Re:Dubious.......

[Anonymous Coward]

You know, the funny thing is, I *did* add a gig or so of porn to my mother's computer once. It was like in a sub-folder on the desktop, so one day she found it and deleted it.

So when I got home I just pulled it out of the Recycle Bin and from then on I kept it in a subfolder on the H: drive. She never found it again.

Just goes to show ya, if it ain't on the desktop, most people don't even know it exists. ;)

Re:Dubious.......

[rascal_one]

have to agree with this I'm a newbe and still learning I have an old k5-133 with 2 2.5g harddrives found out about places like kazaa and with this old slow beast thought virus protection was too much effort ie:slowed it down way to much. Well guess what it slower and slower.time to learn found worms and trogans and all manor of stuff a whole bunch ofcache 32 stuff. the good thing was I had to learn more to get it cleaned up

Really

[g0bshiTe]

IT wasn't ME it was the one armed man!

Negligence Or Delusion

[4of12]

This case sounds interesting for a couple of reasons. The defendent's entire case is out the window, of course, if the prosecution shows that the virus was not responsible for downloading kiddie pr0n. Assume such a virus existed for the sake of argument.

First, there is negligence for allowing one's computer to become infected. A related precedent would be the owner of a condemned house allowing it to become a crack house. IANAL, but in a lot of ways it seems the cases are similar. One could claim that the software manufacturer (MS) was responsible for faulty software, or that the virus writer was responsible for letting loose his creation. In the same way, the crackhouse owner could claim that the lock manufacturer did a poor job, or that the addicts breaking into his house were at fault.

Second, if computers become more like personal extensions of ourselves, indispensible, parts of our consciousness in some far-fetched way, then the defendent might take the insanity route. That is, "God told me to take 7 wives and this girl is one of them." However, computers are subject to more detailed forensics that people's brains, so claiming an insane computer might not withstand much scrutiny in court.

Re:Negligence Or Delusion

[Jerf]

First, there is negligence for allowing one's computer to become infected.

Someday, we may be able to claim this. But I'm really uncomfortable claiming it today.

A couple of computers got hacked. One of them was with a vulnerability that I hadn't even heard of yet in samba; I got my Debian announcement later that day.

Right now, even the most updated computer is just too full of vulnerabilities to make a valid case that it should be possible to maintain a computer that has no vulnerabilities at all. That line of reasoning is too dangerous, and will make felons of us all.

Not that it's a bad idea in theory, but the times aren't ready for it.

Re:Negligence Or Delusion

[autopr0n]

First, there is negligence for allowing one's computer to become infected. A related precedent would be the owner of a condemned house allowing it to become a crack house. IANAL, but in a lot of ways it seems the cases are similar. One could claim that the software manufacturer (MS) was responsible for faulty software, or that the virus writer was responsible for letting loose his creation. In the same way, the crackhouse owner could claim that the lock manufacturer did a poor job, or that the addicts breaking into his house were at fault.

Holding people responsible for having secure computers is idiotic. The vast majority of people out there probably have insecure systems, even if they are protected from the most common attacks (like the ones used by worms). And anyone can leave some hole open by accident.

Unlike a crackhouse, which is an eyesore and reduces quality of life for the people around it, a few jpgs on a hard drive that are never looked at by anyone are not going to cause problems.

Re:Negligence Or Delusion

[4of12]

the most updated computer is just too full of vulnerabilities

Well, that probably says a lot about the overall state of computer security.

But if you've kept your system updated with the latest patches, then most people would think that you've exercised due diligence.

Re:Negligence Or Delusion

[4of12]

Unlike a crackhouse, which is an eyesore and reduces quality of life for the people around it...

A lot of people, myself included, would be inclined to believe that a insecured, vulnerable and 0wn3d computer on a high BW connection represents an inconvience and reduction in quality of life to the net community.

Getting a DDOS attack from compromised zombie machines is as bad as getting woke up in the middle of the night by gunshots coming from the crackhouse down the block.

Re:Negligence Or Delusion

[Anonymous Coward]

A related precedent would be the owner of a condemned house allowing it to become a crack house.

Your precedent is backwards. Under U.K law there exists "Squaters Rights" Basically, the owner of a house is not responsible under law for keeping the house secure; if they leave the house insecure and someone gets in and squats, that is their problem. Anything that happens in that house when someone is squating is also not their problem.

So what was your argument again?

Re:Negligence Or Delusion

[Teppy]

I suspect M$ would be thrilled if you could be held negligent for running a computer that was insecure. "Yes, WinXP has security holes, but we don't support that version any more. Upgrade to WinXP2 (now with Extra DRM!) to avoid liability."

Re:Negligence Or Delusion

[Anonymous Coward]

Getting a DDOS attack from compromised zombie machines is as bad as getting woke up in the middle of the night by gunshots coming from the crackhouse down the block.

This is one of the most idiotic things I've read on /. in days, and there are lots of idiotic things posted on /.

"My kids can't use the computer because I'm getting DDOS'd right now. They should go outside and play. Don't worry about those gunshots, it's just the local crackhouse. The kids have quick responses, and the critical care unit is only 5 or 6 miles away."

Sheesh.

Re:Negligence Or Delusion

[clambake]

First, there is negligence for allowing one's computer to become infected. A related precedent would be the owner of a condemned house allowing it to become a crack house. IANAL, but in a lot of ways it seems the cases are similar. One could claim that the software manufacturer (MS) was responsible for faulty software, or that the virus writer was responsible for letting loose his creation. In the same way, the crackhouse owner could claim that the lock manufacturer did a poor job, or that the addicts breaking into his house were at fault.

If a real virus infects your body and causes damage to other people who get infected around you, how liable are you?

Re:Negligence Or Delusion

[rifter]

The was going by US law, specifically the property seizure laws passed as part of the drug war (of course, the kidpr0n case under discussion did occur in the UK...). Under such laws, if a tenant is involved in the manufacture and/or distribution of narcotics the landlord can be held liable and the property seized. It was meant as a means to get landlords to watch tenants and turn them in, beside the fact most landlords spy on their tenants (they routinely have maintenance enter whether you know they are going there or not, and scout around) and will evict on suspicion of any such activity.

Re:Negligence Or Delusion

[Anonymous Coward]

Negligence may be considered a fault if the negligence lead to harm.

In this case, the negligence didn't lead to harm, it lead to the transfer of potentially incriminating material.

Your reasoning doesn't make sense.

Re:Negligence Or Delusion

[Mitreya]

First, there is negligence for allowing one's computer to become infected.

Negligence is an accusation that should be used very carefully. Suppose someone robbed a bank and hid the money in your garden without your knowledge. At this point you have been negligent in that you have failed to secure your garden (dogs, electric fence, etc). Right?

In other news...

[xYoni69x]

A trojan horse program, codenamed "Kazaa", has been reported to download pirated music and DVDs on thousands of computers throughout the world. The matter is being investigated.

err....

[idfrsr]

I am sorry Mr. President... my computer was infected with a virus and this trojan submitted comupter code to terrorist supporting open source projects. Particularily, OpenBSD...

Windows

[Mattygfunk1]

That's the reason I keep a windows box around. If anyone comes knocking then it was a hacker that downloaded those Britney Spears tracks.

--
cheap website hosting

Re:Windows

[Dark Lord Seth]

That's the reason I keep a windows box around. If anyone comes knocking then it was a hacker that downloaded those Britney Spears tracks.

Then again, if you download Britney Spears MP3s you don't need to go to jail, you need to go to an institution for the mentally & audibly handicapped instead...

Re:Windows

[docbrown42]

That's the reason I keep a windows box around. If anyone comes knocking then it was a hacker that downloaded those Britney Spears tracks.

"You're under arrest!"
"No Officer, I swear that some hacker took over my computer and downloaded those Britney Spears songs. Honest!"
"Sorry son, but no hacker is that stupid. Come along..."

Re:Windows

[DickBreath]

That's the reason I keep a windows box around. If anyone comes knocking then it was a hacker that downloaded those Britney Spears tracks.

You need to keep a compromised Windows box around. It needs to look like it also runs an open FTP server that someone else uses to stash their warez and mp3z.

Hey Judge! It must have been some hacker on my Windoze box. It used to be directly exposed to the net, but sometime in the past, I acquired a new firewall. So the evil intruder must have compromised my WinBox before I had a firewall. Yeah. That's what happened!

Re:Windows

[jkrise]

"You need to keep a compromised Windows box around. "
er.. excuse me, is there an uncompromised Windows box? The Windows auto-update and GoToMyPC can puch thru the built-in firewall!

It is safe only when you switch off your Windows computer.

Re:Windows

[Jugalator]

Ok, so Windows might not be that great, but I still think you abuse it more than necessary... Forcing it to download Britney? Ouch.

Re:Windows

[MoreDruid]

defendant: "I really don't know how that pirated copy of Windows XP got on my computer. It must have been a trojan!"

Re:Windows

[Anonymous Coward]

Britney Spears tracks? Why bother with a ficticious hacker defence when you're obviously either well under the legal of childhood or blatently nuts?

Personal Responsibility Today

[TrollBridge]

OK first of all I'm not going to judge whether or not this guy's defense is valid. I guess they'll have to take a look at the supposed 'virus' to determine if that was in fact the cause of the porn downloads.

With that out of the way, I find it amazing the lengths people will go to to blame anybody or anything for their actions but themselves. "I didn't download pictures of naked children, the computer did it!" or "I didn't willingly throw myself upon a flaming mattress, that show on MTV made me do it! or "I didn't want to get pregnant, it was HIS fault!"

I apologize for this somewhat offtopic rant, but it's this kind of lack of personal responsibility that's eroding our society.

Re:Personal Responsibility Today

[Anonymous Coward]

ummmm yeah, lets look at this another way. Average Joe has his computer hacked and a trojan is installed. Trojan downloads child porn and places is it somewhere on the hard drive. No lets discount everyone on this site and think about...say your mom, do you honestly believe that the general public knows enough to keep this from happening? Or even knows about it when it does? For christ's sake Windows obscures the viewing of whole diectories by default!

Lack of personal responsibility is a lame excuse. You have to take into consideration perceived threat vs. enforcing policies and technology in relation to time and effort able to be exerted.

Re:Personal Responsibility Today

[Anonymous Coward]

My point was a little more general about the concept of accountability. As I said at the beginning of my post, maybe this really was caused by a trojan horse. But it's just as likely that he willingly downloaded those images, and using some bogus excuse to absolve himself.

Re:Personal Responsibility Today

[Anonymous Coward]

The lack of personal responsibilty is very much an American phenomenon. This was a British case.

Stereotypes aside, in the other cases that you mention, it is a matter of people convincing themselves that the outside influence (which factually occurred) was primarly at fault, it's just a matter of perspective whether it can be blamed.

In this case, either it's plain lying or a valid defense. AFAIK there is no trojan that tempts you to download child porn.

You're trying to draw parallels where they don't exist.

Re:Personal Responsibility Today

[Anonymous Coward]

The trojan doesn't tempt you into downloading child porn, the whole point of the trojan would be to download the illegal porn by itself and set up a backdoor so others could get at it.

Re:Personal Responsibility Today

[0x0d0a]

But it's just as likely that he willingly downloaded those images, and using some bogus excuse to absolve himself.

I'd be surprised that a hacker would use his *own* computer if he wanted to obtain child porn, given the current legal climate. Make much more sense to go through someone else's.

Or another possibility -- defendant's fifteen-year-old son downloaded images of the fifteen-year-old subjects.

Re:Personal Responsibility Today

[Anonymous Coward]

OK first of all I'm not going to judge whether or not this guy's defense is valid.

That's nice of you.

With that out of the way, I find it amazing the lengths people will go to to blame anybody or anything for their actions but themselves. "I didn't download pictures of naked children, the computer did it!" or "I didn't willingly throw myself upon a flaming mattress, that show on MTV made me do it! or "I didn't want to get pregnant, it was HIS fault!"

I myself find it amazing that you are so quick to assume that he's just reaching for someone to blame. I'm glad you haven't judged him already, I'd hate to see your response.

Re:Personal Responsibility Today

[Anonymous Coward]

Pictures of fifteen-year-olds are hardly the material of concern in most child porn cases, pedophiles are interested in much younger children.

RIAA....

[LurkerXXX]

Hmm, I need to go home and install a few inactive trojans (blocked by my firewall of course. "But your honor. I didn't download all those illegal MP3's. It must have been that trojan installed on my computer!"

Bogus story

[release7]

Uh, you might want to reconsider believing the story attributed to the Register. The domain name for the Register story is an IP address.

Re:Bogus story

[kasperd]

Uh, you might want to reconsider believing the story attributed to the Register.

Where do you see that story?

Worrying precedent

[m_dob]

I read this story about a week ago. It worried me a lot at the time for the precedent it sets. From the story, either someone was out to incriminate this guy by planting child porn on his computer or this guy really did download it and he is up against some really pathetic prosecutors. We read that he has been attacked in his neighbourhood, and that he is an all round family man. Fine. But that in itself doesn't make the story more credible... Either way, the guy responsible has got away free. Isn't that the most worrying thing...

Re:Worrying precedent

[Anonymous Coward]

We read that he has been attacked in his neighbourhood, and that he is an all round family man. Fine. But that in itself doesn't make the story more credible... Either way, the guy responsible has got away free. Isn't that the most worrying thing...

The most worrying thing, you half-literate fuckwit, is that he was attacked in his house by a bunch of retarded vigilante cunts like yourself. Pretty much the same thing that happens to anyone even remotely related to any criminal case involving children and sex of any sort in this country.

(sarcasm) Because we know that is the worst possible thing that could ever happen to any child; forget all that death stuff.

Re:Worrying precedent

[Anonymous Coward]

Either way, the guy responsible has got away free. Isn't that the most worrying thing...

Gee, you're right. So let's just throw someone in jail - doesn't matter if he's guilty or not, but someone MUST pay!

And since you're so eager to see someone pay, I guess you should be the first one to be convicted, right?

Here's a quote: "Better that a thousand guilty men go free, than one innocent man be imprisoned."

Think about it for awhile.

Re:Worrying precedent

[Anonymous Coward]

The person responsible is irrelevant to this case.

The fact that person X is found to have child porn in his posession does not imply a specific crime.

That same material is probably in the posession of numerous other people, as well - the crime of abusing children in the production of this material is not tied specifically to this case.

Even if the person in this hadn't been in posession of those pictures, the pictures would exist, and the situation (in terms of the crimes involved) would exist.

So...

[genzil]

... when your found to have cracked the latest software and the DMC is after you could you claim a virus but the software there!

Bye bye Symantec...

[dreadpiratemark]

I gotta keep this short 'cause I have to go uninstall Symantec Norton Antivirus Corporate Edition to make sure that my company lawyers have a good defense for some of our employees.... Hell, I might just turn off our firewall and load MS Backoffice for an OS as long as we're looking to give more people/programs easy access.

Pete Townsend

[Andrewkov]

I wonder if Pete Townsend will change to this defence?

Oh yeah, did you hear his new song, Pre-Teanage Wasteland?

Re:Pete Townsend

[presearch]

And did you hear that you're a dumbass?
Stop trying to be clever. It's not working.

Re:Pete Townsend

[Anonymous Coward]

Don't you mean Baby O'Reilly?

Don't blame the virus...

[TheConfusedOne]

So that's how those pictures of mating llamas got on my hard drive!

It sounds like you were just putting the finishing touches on the latest O'Reilly book:
Pr0n in a Nutshell.

the UK are awful at catching paedophiles

[Anonymous Coward]

While the genuine ones are released in months or a couple of years (but don't drive over the speed limit or no more car nor freedom for you!), batches of arrests with public announcements of guilt-before-proven-guilty are made on the basis of such reliable things as "tip-offs" (which come after "set-ups") and the joke that is Operation Ore. Now anyone with a stolen credit card number can be branded a paedophile. I admin an e-commerce site... as Fisher Price, the well-known Windows XP UI and kindergarten toy designer, would say, "Imagine the possibilities."

Re:the UK are awful at catching paedophiles

[Anonymous Coward]

Mod parent up. And what about Matthew Kelly, the TV host who resigned after he was taken in for questioning on a 20-year-old case, despite being released without charge soon after? I feel the label "paedophile" will at some point converge with the already synonymous labels "terrorist" and "disagrees with government".

Not unheard of

[DavidLeblond]

My brother called me one day to say that his new computer had run out of disk space and he didn't know why. I connected to his computer via Remote Desktop and browsed his folder and when I got to his My Music directory it was full of 7 gigs of movie files, none of which he had seen before. I deleted them and suggested he get a firewall program.

Sure enough, as soon as he got his firewall up he got a slew of alerts about people trying to connect to his computer. I make sure I keep my firewall up at all times now.

Re:Not unheard of

[mrtroy]

Exactly. If I were you, or your brother (but since he has limited computer knowledge), I would get a virus scanner and locate the backdoor or two he has on his system. Nobody puts movies on your computer unless they want to serve them to a lot of people.

Also, your brother needs a larger hard drive, 100+ gigs are cheap now!

Basically, the majority of the things "insert anyone but my name here" downloads, from xbox games to movies or new music albums is obtained the quickest from places like xdcc channels, which backdoor unsuspecting users on fast connections, put files on their computers and distribute it to the masses. So, I would assume child porn people could, and would, do the same.

Re:Not unheard of

[Casca]

He doesn't need a firewall, just turn off that remote desktop service that people were using to put files on his computer. That and disable file and print sharing, or at least unbind it from the TCP/IP adapter. Assuming he isn't running a webserver or anything like that (which it sounds like he isn't intentionally), that will knock out 99% of all the sources of attack on his computer.

Firewalls are not the end-all be-all of security, and in many cases promote poor security habits. Turn off the stuff you don't need, and patch the stuff you do, and you'll be just fine. A firewall won't do shit for you if someone comes in through a hole you punched in it so you could run your unpatched IIS server.

Re:Not unheard of

[revery]

I connected to his computer via Remote Desktop and browsed his folder

Hmmm....I think we may found the problem right there. Have you told your brother that it was you yet? ;)

Re:Not unheard of

[N1XIM]

What kind of idiot are you? Windows' DNS is more likely to be hacked than any of the above by the peoople whom have the technical saavy to be doing anything except using a klez virus derivative to DoS the White House. I dare say that you have little to no idea what you are talking about.
The idea of a firewall is that you can have lax internal security policies, but have strong external policies. Not that it works out that way if any of the programs that you actually let talk to the real world are buggy--but at least you segmented out your security domains from each other.
That is the main ideal of personal firewall software today--it only really checks to see what programs are using the network. That doesn't encourage bad habbits from people whom aren't likely to have formed any yet!! Therefore, a good firewall is a good thing for 99.99% of all users, just because it handles things that they don't comprehend.

Re:Not unheard of

[Anonymous Coward]

...and when I got to his My Music directory it was full of 7 gigs of movie files, none of which he had seen before.

Uh-huh.

I deleted them and suggested he get a firewall program.

How about, oh, I don't know, FIXING THE PROBLEM instead of a band-aid like that. What was the problem - a wide-open share? Fix it. Security hole? Patch it. What happens when, six months down the line, he runs out of disk space, and decides to uninstall the firewall because he can't see any reason to keep it on?

Sure enough, as soon as he got his firewall up he got a slew of alerts about people trying to connect to his computer.

The usual cause for this is connections to whoever had the ip address last, or all sorts of other innocuous activities. Of course, the firewall vendors won't tell you that, because as long as you are scared, you'll keep buying their products.

I make sure I keep my firewall up at all times now.

There is a time and a place for a firewall. They are certainly a good security measure when you pay attention to the rest of your security measures. But just installing a program and hoping it is some kind of magical shield is not a good approach.

Security is a process, not something that can be installed. Your first step is always to fix the hole they came in by.

Re:Not unheard of

[Casca]

Sigh.

Why would anyone run a windows DNS server on their desktop, that would be dumb. I thought we were talking about a guy's home PC connected up via a cablemodem or something, not some corporate server.

The idea of a firewall is that you can have lax internal security policies, but have strong external policies.
No, its not. The idea is that in the event one of your strong internal security policies fails, you have a safety net to protect your ass. Like I said, many times having a firewall allows people to become complacent about security, and use it as a crutch. A firewall should never be an excuse to leave unpatched or unneeded services running on your network. Beyond that, your point is completely irrelevant, as there is no internal/external when you are talking about a single PC connected to a broadband connecting. Everything is external (unless you really know what you are doing and are running a webserver that no one can get to except the local host for some esoteric purpose).

If people didn't run services they didn't need, and kept the services they do run patched up, a firewall for a single PC still wouldn't really be necessary.

There is the issue of a firewall keeping trojan programs that have been installed on the PC from getting out. Of course if you use virus protection, and don't download junk from questionable sources, this isn't really an issue either.

Just having a firewall doesn't do a thing for you unless it is configured correctly. Giving people a false sense of security is more harmful, in my opinion, than educating them a little, and doing things the right way from the start.

Re:Not unheard of

[Anonymous Coward]

Same thing happened on my families computer a month or two ago. I was visiting again from college when I noticed there were a ton of porn files in my "My Documents" directory, which I hadn't downloaded.

I ended up checking netstat and there was something along the lines of 15 people connected to our machine. My family had taken off the firewall.

Put back on the firewall and all that was fixed. Moral of the story, is to always keep that damned thing on.

Re:Not unheard of

[Chanc_Gorkon]

EXACTLY! Only enable the services you use. The rest is a risk. Also, DISABLE telnet! Use ssh. Yes, even at home. Patching is paramount. Even on your home boxes. Also, what use is the firewall if someone standing on the outside of your house using WiFi can get to your network? I think it's sad that Linksys and such are advertising their products to those without much knowledge of WiFi. I count at least 3 unsecured AP's in my neighboard hood. One secure one, but he's stil broadcasting his BSSID! At least I will give him one thing....at least he had WEP enabled. Turn off the sending of the BSSID. You do not need it (unless your setting up a AP where this is the POINT!).

Re:Not unheard of

[Anonymous Coward]

Moral of the story is fix the problem, don't just sweep it under the carpet!

Re:Not unheard of

[drinkypoo]

People sent seven gigs of movies to his computer without him having to do anything, and you deleted them? Jesus, remind me never to call you for tech support, you baby-thrower.

An idiot (the best friend of the VP which is how he got hired) at my last place of employment (Media X, a game and web development company controlled primarily by Rainer and Nancy Poertner, who seriously screwed the company up and ran it into the proverbial ground) put up an FTP server using IIS with anonymous upload access, and without denying mkdir. We won't name names, because I've forgotten. No wait, it's four letters, and ends in "urt". Anyway, I got a lot of good music out of it when we ended up being an mp3 site for a few days, and Media X got a big bill for bandwidth.

The only reason this really pissed me off is that I was the network admin, and he put up the FTP server, and then he wanted to do the autopsy. If you ever end up in a situation like that, look for a new job, stat, because it will be obvious that management had its head up its own ass far enough to look out its own mouth. Of course, when you're in that state, all you can see is shit.

Re:Not unheard of

[HiThere]

For that matter, port 80 is almost guaranteed to go through all firewalls. But there's nothing saying that 80 is http, you can tell any program you write to use whatever port you like. So promoting firewalls as a defense is encouraging people to use port 80 for other things... anything where they manage both ends. Which includes trojans.

If you use other techniques to choke things down further, you may well find that you've broken, say, some jsp sites. Or even ftp sites. I can't get an ftp download from Sun at work, because the firewall chokes it off. But it doesn't necessarily stop viruses. Every now and then we get one that the virus checker doesn't recognize. Fortunately it almost always only affects those few who insist on using MSIE. I can almost say "they deserve it!", but we're the ones that end up fixing it, so UGH!

Re:Not unheard of

[0x0d0a]

An idiot ... put up an FTP server using IIS. If you ever end up in a situation like that, look for a new job, stat, because it will be obvious that management had its head up its own ass far enough to look out its own mouth. :-)

Where can I find this Trojan?

[LippyTheLip]

So, where can I find this wonderful program that will exonerate me from any liability should the FBI come knocking at my door?

(Knock on door) "Open up, Mr. Smith. This is special agent Johnson withthe FBI. we have a warrant to search your premises."

(LippyTheLip quickly downloads said trojan to have an alibi) "Sure, come on in Agent Smith. Let me restart my computer for you. ..."

Re:Where can I find this Trojan?

[electromaggot]

Here's one:

http://www.rapidblaster.com

Check out the home page, but don't click on any of the pictures!

Their Privacy Policy is worth a look... It's a doozy. That link is safe, but I wouldn't trust those guys beyond that.

(I got infected by this once when I clicked on a pop-up that hid the title bar and spoofed its little [X] close button. (Watch for "rb32.exe" running in your process list, started in your registry.) )

Yes!

[mrpuffypants]

this is the first virus that I want....

I'll be damned if Norton will "Protect" me from the hoors of pr0n

WOPR legal defense plea

[chuckfirment]

David Lightman - "Your computer called *me*."
Department of Defense - "David, computers don't call people."
David Lightman - "Yours did."

Hey, it worked so well for David, it'll work for me, right?

I wonder how they found the images

[radio4fan]

The articles don't mention why the authorities looked on his PC for kiddie porn. What tipped them off?

I suspect there's much more to this case than the articles mention.

One more thing

[Dogun]

Once again, sorry for bleating like a dying, clubbed baby seal, but I felt that I should add that although I don't have any links that I can think of right now DIRECTLY on the subject, I would like to direct you to a series of essays on kuro5hin.org, written by a man living with schizoaffective disorder. Although it probably won't change your viewpoints, perhaps upon reading about some of this guy's experiences, you'll have a building block to construct a more enlightened philosophy of justice and of mental disorder.

Re:One more thing

[Anonymous Coward]

Yeah.. if the guy is posting on Kuro then hes not crazy.

Period.

Stupidity

[msheppard]

I was unaware the UK had reinstated the Stupidty defense.

M@

More realistically

[IIRCAFAIKIANAL]

Surfing the web i've ended up with shortcuts to porn sites in my favourites and in my history - along with that, pictures in my internet cache. (and then when I go to type in a URL in Start->Run, fucking auto-complete puts in one of the addresses - that's always fun when you're at work, VNCing into your machine, and all your coworkers see something like www.hotpeanutbutterclits.com or something 0_0)

I've also seen people's pc's hacked and used to serve up free porn and warez.

This particular case may be unrealistic, but this sort of stuff is possible...

Oh but you misunderstand!

[Anonymous Coward]

See, its not a problem that the odd inncent person has his life ruined by association with crimes that they did not commit, because we're dealing with kiddie porn! Sure, a few people will have their lives ruined, but it's kiddie porn!

I personally think that we should skip the trials altogether. Sure, some innocent people will end up in the nonce wing for life, but it's kiddie porn!

Won't somebody please think of the children!

O.K, I'll stop now. I don't even know if I'm being sarcastic any more...

Come on...

[RecoveredMarketroid]

I don't know about British law (although our Canadian system is probably closer to it, than to the American system we see on TV), but doesn't there need to be a REASONABLE doubt?

Let's take this one step further

[Raul654]

Yes officer, the lock on my front door has been broken for a few weeks now. That body is in the basement because some bastard probably dropped it off there while I was at work

Re:Let's take this one step further

[Anonymous Coward]

you're forgetting that most usians don't know the difference between the mouse and the monitor.

This isn't unrealistic with P2P

[mdw162]

I've seen a lot of jokes about Kaaza and other P2P networks doing this automatically, modded as funny. However, I think there's more to it than that. At least with eDonkey2000, I see files appear in my download section that aren't mine. I'm not all that clear on how it works but I think it's part of the caching mechanism to help your "peers" with their downloads as they do for you.

Anyway, with P2P getting more sophisticated, efficient and private, I can easily see this happening a lot. Of course, I don't think anyone should be guilty in cases like these. Apparently, neither do the British courts.

Trojans...

[Psx29]

I have been telling people this for awhile when referencing the extremely harsh penalties imposed on even accidentaly viewing child pornography on the internet. Another example that could get you into the courts would be being coerced into going to a site by your friend. I mean everyone has fallen for the old goatse trick at least once right? And who really wants to see that?

It's possible. I've seen it!

[Anonymous Coward]

2001-12-25 02:34:02 Porn trojan virus? (articles,security) (rejected)

I've seen and disinfected a laptop of a friend who was infected with a virus that downloaded porn pages in the background whenever he connected to the internet. I guess it was to collect link credits. His history and cache would fill up with porn crap and he claimed to not be visiting the sites. At first I didn't believe him (obviously) and was surprised when I saw the behavior for myself. Beware!

Re:It's possible. I've seen it!

[KaMiKa-Z77]

2001-12-25 02:34:02 Porn trojan virus? (articles,security) (rejected)
What was this called? the Merry Christmas Trojan? :-D

Unlikely

[Gonoff]

Surely any cracker is not going to store his stuff neatly in "My Music".

The first thing your brother needs to do is to turn off the Remote Desktop - even better uninstall thet programme. That has got to be a horrendous security hole!

What firewall programme? There are some good ones and some bad ones.

Of course he got hits on his firewall! Doesn't everyone? I used to get a load from my ISP - so I moved...

Re:Unlikely

[Lester67]

Wasn't there a hole in Kazaa that allowed something like this to happen?

If so, and it was My Music that was the shared folder, then this could be how his shared files were "stuffed neatly" in My Music. (Did he say they were movie files? That's not neat... that's mislabeled! :-)

This happen in my office too.

[Tuqui]

A morning one section color laser printer was locked, there was an error somewhere, when I restablised the printer. It began to print porn photos stacked in the previous night. The suspect guy was telling everybody that the new virus are porn printing ugly ones.

Prepended by...

[Anonymous Coward]

[bart voice] I didn't do it [/bart voice]

My experience�

[(H)elix1]

I see a lot of comments about - wink, wink - sure it was the virus, or dumb ass for executing a Trojan.

My first lesson with an improperly configured Linux box outside the firewall was when my ISP called asking about some insane bandwidth use. What? I checked the box and it seemed fine. Found out the traffic was on FTP, which I was not using. Sure enough, tons of porn and other files were getting uploaded and downloaded... all the files in a hidden directory. The box was owned, and I ended up rebuilding from scratch, this time leaving services off I did not actually use and patching some of the services I did. Than I discovered ssh and a few other key insights that were new to me.

I cannot believe I am the only one this kind of thing happened to...

Re:My experience�

[Greyfox]

Yeah well you can't prosecute someone for (just) being an idiot.

Most new Linux folks (myself included) go through the "I don't see why I can't run as root; I know what I'm doing" phase of sysadminning. They also go through the "I'll give everyone I know accounts on my system" phase of sysadminning. Once they get owned a couple of times, most of them learn and don't do that anymore.

Re:My experience�

[Anonymous Coward]

Yeah well you can't prosecute someone for (just) being an idiot.

It's called criminal negligence. In the op's case, he doesn't have to be prosecuted, he can just be charged thousands for the excess bandwidth usage. In the virus victim's case, I believe simply possessing the pictures is enough to get you found guilty - even if you are not aware of it.

Re:My experience�

[drinkypoo]

It's not just a case of idiocy. Linux has been played up constantly as being more secure than windows. It might be true but it doesn't mean every linux distribution is/was secure; In fact, no linux distribution I can think of has ever been "completely" secure (no known holes within a year or two) if the default set of packages has been installed. Of course, this just might be me that doesn't know which one stayed secure for a whole year or whatever :P

The real reason linux users tend to get rooted is not because they run as root and are compromised, but that linux distributions have tended to install unnecessary packages, and linux users have a natural tendency to just go ahead and install everything. "Look at what my OS can do!" If you have an openbsd system, and you keep up with the patches, and you don't install too many associated ports, you can be pretty sure that you won't get rooted even from within. Of course, nothing is 100%...

Re:My experience�

[3ryon]

My first lesson with an improperly configured Linux box outside the firewall was when my ISP called asking about some insane bandwidth use. What? I checked the box and it seemed fine. Found out the traffic was on FTP, which I was not using. Sure enough, tons of porn and other files were getting uploaded and downloaded... all the files in a hidden directory.

But you kept the pr0n, right?

Re:My experience�

[Dimensio]

I guess that I should feel fortunate that, before getting into Linux, I was warned repeatedly about running as root by people whom I knew were experienced enough to know of what they spoke. I've never run as root, and so far I've not had any security issues on my boxen. It's spilled over into my Windows usage as well, as my Windows 2000 box (rarely used, but still) has a 'user' account and an 'administrator' account that is only used for system maintenance.

Re:My experience�

[(H)elix1]

Not that kind...

Hmm...

[Copperhead]

I wonder if he got the virus from Pete Townshend's computer.

I am curious

[Anonymous Coward]

Of how Operation Ore's organization got a hold of this list in the first place?

If this was a secure site with secure Credit Card information being transmitted, then how did they get it? Did they just ask the site to hand it over? Or do privacy laws not matter over international waters?

Did they hack the site? And if so, would that not be prosecutable? Now please, these are real qeustions of the group, and I would like to know.

My point here is, that after doing a Google on Operation Ore's organization, how easy is it to find this information that you were supposedly transmitting securely? What if there are people who pay for subscriptions to Right or Left wing political groups? Activist groups? Sure this is not child pornography, but it just seemed to easy to get subscription information, CREDIT CARD NUMBERS, and Addresses, and being so able to publish this. Although I have high doubts about any trojan doing this, just a case of plausible deniability, it's the fact that the information was so readily gotten, and usable to those who oppose their beliefs and views. And those goes for anything you put your name, CC number, and address to.

Simple defence... I have Windows XP!

[jkrise]

Need I say more?

Highly redundant distributed filesystem.

[Moderation abuser]

I could see a lot of people interested in a very high capacity distributed filesystem which could make use of hundreds of trojan'd PCs out on the internet to store information which you didn't want found on your own computer.

Make it highly redundant, self healing, replicating data as the "servers" go offline to make sure the information remains available. Hell, I could use something like that here at work.

Re:Highly redundant distributed filesystem.

[mrtroy]

A few people I know are currently constructing a music albums version of that.

The goal is to hit 1 terrabyte

Re:Highly redundant distributed filesystem.

[Pig Hogger]

I could see a lot of people interested in a very high capacity distributed filesystem which could make use of hundreds of trojan'd PCs out on the internet to store information which you didn't want found on your own computer.
Make it highly redundant, self healing, replicating data as the "servers" go offline to make sure the information remains available. Hell, I could use something like that here at work.

But this already exists! It's called Freenet.

Yay child porn is legal now

[Old Wolf]

Townshend will be kicking himself that he didn't think of this one

Yeah righ!

[autopr0n]

I probably have about 20 or 30 files sitting on my desktop that I havn't filed away, and a lot of that changes frequently. I doubt I would even notice one or two more, although I eventualy might see what they were in order to 'file' them. (and, by that I mean dumping into a big folder along with everything else I've cleaned off my desktop in the past few years)

Beyond that, my computer has hundreds of thousands of files on it, in total. I don't even know how many. I would never notice additions... unless I had something like tripwire installed, but then I wouldn't have had the trojan in the first place, now would I?

RTFP

[Dogun]

You didn't read the full post.

You don't go free after being declared NGRI. It's quite different than being declared not guilty. You go to a mental hospital until such time as some guy on some board decides that the hospital is correct and that you are sane. Until then, and that can be a long time after you've regained your sanity, you are in a mental hospital.

Re:RTFP

[H.G. Pennypacker]

No no no, you've got it all wrong. What he was getting at by analogy was that we should be taking these deranged computers off the streets!

Re:RTFP

[The_K4]

And even once you do get out, you get lots and lots of court ordered visits to more psychologists, miss and appointment, its' back to the hospital (the insane version on parol).

Re:RTFP

[JDWTopGuy]

Gee... how do you know all this?

Re:RTFP

[The_K4]

I read lots and lots of books; I like true crime/legal text books. Interesting stuff.

Maybe...

[James Lewis]

We should get one of those guys being sued by RIAA to do this just to see what happens =P

No Judge...

[Spleen]

I didn't notice the folder named "Child Porn" and all the neatly arranged subfolders inside of "My Documents".

Re:No Judge...

[jonehead]

When I've been forced to use Windows I've never used 'My Documents' for anything. It would be the best place to hide files from me.

Re:Insanity? think again

[Anonymous Coward]

Actually, considering that most trojans do come from porn sites (I only have info about legit sites, a good number of people asked me for help with computer problems after going to such sites, mostly dial-ups with old OS'es), but also hack sites, it would be actually quite likely for the trojan to download porn. It would be in the spirit of most spam-trojan-hack abusers of the internet.

You sick bastard

[Anonymous Coward]

Listening to her music? I mean, I could understand masturbating to photos of Britney, but listening to her music?

They need to put you away for the good of society.

Virii is the plural for...

[Valthonis]

the word virus.

It's not like this hasn't happened before

[Anonymous Coward]

A couple of months ago CSO magazine ran an article about a similar problem, except it was coupled with the threat of blackmail.
Could it possible that this (or something similar) can get an innocent victim arrested? In a less technologically literate or a far more fundamentallist culture, the "virus did it" defense probably won't work . . .

ISPs and spying makes this worse

[fermion]

I hope the general public starts to understand cases like this and make the connection to the ISP who wish to own their customers networks and computers, and governments that wish to have back doors into all network equipment and computers. There are so many risks associated current security holes, why do we want to add them on purpose.

In this case a crime was committed. Whether the crime was committed by the accused or some unknown third party is irrelevant. All that is relevant is known security holes and popular complacence allowed the criminal(s) to escape prosecution. Would the firewall banned by the ISP had helped this guy? Who knows. Will following the paranoid government route of building back doors and escrowed keys into every so-called secured system make the situation worse? Probably. The government will have great motivation to prove their protocols are one hundred percent secure, and will have no motivation to make sure justice is done by finding the real criminals.

Get around RIAA

[JoeCotellese]

I was discussing this very notion with a co-worker not to long ago as a way to get around the RIAA. If someone writes a virus that connects to P2P networks would you be liable for songs downloaded onto your machine if it was discovered that you were infected?

Re:Virii is the plural for... BZZT WORGN!

[Anonymous Coward]

dude, plural of computer virus is..

viruses

don't argue.

Even if his story isn't true

[ArhcAngel]

You can bet your arse someone now has the idea and is hacking away at this very moment writing this very virus not to unleash on the world but as a defense should he ever get caught. There is now case law to back it up. I wouldn't be suprised to see this defense proliferate copyright cases in the very near future.

My sad experience

[genka]

Once I made several mistakes at the same time.
1 Applied an access list to a wrong interface on a router
2 Behind this router I put a Win2k computer, which had been configured for a private network. Computer name, admin account and password for this account was the same word.
One day I found that this computer had a remote control software and FTP server installed on it. I wouldn't be surprised to find some kiddie porn few days later, so I think that the story makes sense.

Re:Your sig

[DickBreath]

"The large print giveth, and the small print taketh away" -Tom Waits

Whoever said this has obviously never read a Microsoft agreement.

Could happen....

[danro]

As to the story - sounds strange that a trojan would do that unless someone was using his machine as a proxy and in that case why would the images be cached on his system?

The story doesn't seem entirely unlikely though.
A company I know had a server compromised some time ago and had a rootkit installed. They were then used as a warez ftp server.
Why would the cracker do that?
Maybe he was just after some disk space and a fat pipe?
But maybe, just maybe it was warez the cracker absolutely positively didn't want laying around on his own box? Something they thought he could get into serious trouble over?

I'll never know, I didn't check what it was before the disk was reformatted, but whatever it was there were several GB of it...

Re:Your Sig

[DickBreath]

I am a man, not a toy.

Hey, news flash! There's no reason you can't be both! That can be fun, if you like who is having their toy playtime.

Trojans: insurance for those who enjoy child porn?

[Loundry]

Consider this. Suppose I am some piece of trash who enjoys looking a child porn. All I have to do is obtain this trojan and make it look like "the trojan did it". That way, if I get busted, the trojan takes the fall for me. It's like a get-out-of-jail free card.

UK laws

[Anonymous Coward]

I'm not aware of british laws, but here in Brazil, as far as I understand, you could never be sued by just having child pornography (or whatever) on your computer. It should be proved that you created them or paid for them. How does that works on UK? Can you actually be sued if it's unknown how you got them?

the doctor was a her

[nounderscores]

see in this post

LOOPHOLE "CREATION"!!!

[Anonymous Coward]

Simply write a little proggie (ahem... virus) that does EXACTLY THAT... downloads random porn imaged from newsgroups. It is not illegal to NOT have an anti-virus program installed!

Re:LOOPHOLE "CREATION"!!!

[Zone-MR]

Yes, and even if you do have an anti-virus program installed, a script you write yourself wont exactly match any definitions the AV proggie has in its database.

Maybe he is a Windows user

[jhines]

and installed the latest SP and has allowed MS to run software on his computer. Who is to say others haven't as well?

If you are a Windows user, you DON'T have complete control over your PC any more.

Re:Insanity: The Bottom Line

[das_cookie]

Here's the thing. I'll agree to let these insane folks out on the street again if you'll agree to let them live with you while they're out.

1+1=?

[Anonymous Coward]

The machine in question was seized and taken for forensic examination immediately after the arrest? If not then WHY NOT? Thorough forensics revealed presence of trojan and case was not prosecuted. No? Then the UK police need to get a fucking clue!

Trojan? Porn?

[Virtex]

Trojan? Porn? Yeah, I'll leave it to you to make up your own jokes.

Thinking this through...

[NetSettler]

Consider this: you are drunk, driving your car. And by drunk, I mean you are impaired. You aren't driving particularly recklessly, but the same thing as above happens.

And drinking is the interesting analogy because you generally begin sober and aware that drinking will lead to a lack of accountability. In many jurisdictions, this knowledge means you are still liable because the ultimate consequences are forseeable.

So now, what if I offered a site that wanted to distribute a banned kind of material (kiddie porn, secure encryption technology, that kind of thing) and it was known that anyone connecting could not legally ask for what they surely wanted. Isn't the obvious solution for me to make a virus that will "helpfully" download it for you? You'd just pay for "time at my site" browsing my fine HTML pages, not for the content. But, magically, the content would just get thrust upon you. Escort services use this dodge. Customer pays for time, not service. But customers get service, typically, or they don't come back. Still, legally, the transaction may be quite distinct from prostitution (so I'm told).

Then again, the escort service model obliges me to come to the issue of "victimless crime". Driving drunk and injuring someone has a victim, and we want to fix the legal system to minimize such cases. Escort services have no obvious victim, IMO, and so I'd argue the other way--that perhaps the simpler solution is just to legalize prostitution.

Child porn is caught in between these two scenarios, I think, with some parts of it falling into one scenario and some into the other. Certainly, if the pics are of real children, then that's bad. But it's within range of technology to make the entire industry based on fabricated images. Then who would be the victim? If no child was abused in the taking of the pictures, for all we know, the people in possession of them are sublimating urges they might otherwise carry out. Is taking the photos away going to cause them to not have the urge? Or just cause them to be out on the street seeking real children? We're so quick to make assumptions in this area, I just don't know why we don't just make a death penalty for anyone even suspected of child abuse or kiddie porn and be done with it mercifully, because nothing the person can do for the rest of their life after they're found in possession of something like this will ever be normal.

When I see a child being abused, it's not erotic to me. That it is to someone shouldn't make it a crime for me to see it--maybe I and all of us need to see that picture to understand someone's outrage about a crime. How do we know when someone is seeing something for a "legitimate" reason or not? There may be pictures of murders that arouse people, but we distinguish between "snuff films" (which are illegal because of their filming technique, not their content) and other films about murder, because murder is a fact of life we need to understand. I am alarmed at the concept that the mere possession of certain kinds of topic material, in and of itself, a crime. Who will study this crime if no one may possess its materials? Will images of murder, of feces, or other things that turn others on but not me one day also be illegal to possess? Where does it stop?

Sure--people are legitimately angry at people who harm children, and they want someone to punish. They can't catch the guy who makes it, so they find someone else to lash out at. (The drug war is the same way. Sometimes drugs cause problems, so we make all uses of drugs illegal whether they hurt anyone or not, just so there's always someone handy to punish when we're mad.) I just hope that in our rush to make it possible to punish people who too easily elude our present systems, we don't take away rights which are not causally related to any kind of harm. And I have to say, the idea of criminalizing the viewing a picture, any picture, in privacy, whether it's a field of daisies or a torture chamber somewhere, is

Re:Thinking this through...

[rifter]

Child porn is caught in between these two scenarios, I think, with some parts of it falling into one scenario and some into the other. Certainly, if the pics are of real children, then that's bad. But it's within range of technology to make the entire industry based on fabricated images. Then who would be the victim? If no child was abused in the taking of the pictures, for all we know, the people in possession of them are sublimating urges they might otherwise carry out. Is taking the photos away going to cause them to not have the urge? Or just cause them to be out on the street seeking real children? We're so quick to make assumptions in this area, I just don't know why we don't just make a death penalty for anyone even suspected of child abuse or kiddie porn and be done with it mercifully, because nothing the person can do for the rest of their life after they're found in possession of something like this will ever be normal.

I think at the heart of this problem is the question of children being abused, and it appears you acknowlege that much. And I understand your argument about when abuse takes place. But let's think this out a minute.

The laws against child pornography are primarily aimed at preventing child abuse. In order to produce most child pornography, children have to be abused by someone. So by trying to find the offending material and investigating to find the sources, the hope is we can prevent the abuse. This of course often involves detaining, interrogating and prosecuting end-users.

Your main issue seems to be with the process of prosecuting end-users, especially if the pornography is virtual (in other words no children were harmed in the making o fthis production, etc etc..). But again, there are important facts to consider. The consumer of child pornography has a mental problem such that viewing pictures of children being abused is enjoyable to them. They like to watch children being abused, and fantasize about abusing children. They may fear actually acting on their fantasies, but this does not mean they will not. It is clear they have taken a step in that direction, and if unchecked they may very well (as many have) act on such fantasies, especially in a moment of passion given sufficient opportunity with a perceived minimum of risk in being caught.

It is also clear that it has been common in the past for consumers of child pornography to become purveyors themselves. In the past, this was apparently the most common method for pedophiles to obtain pornography (essentially by swapping pictures like trading cards).

It is important to recognize that in our society it is unacceptable not only to abuse children, but to enjoy abusing children. If someone enjoys abusing children, and enjoys the idea, the hope is we can intervene and get this person help before they actually harm a child. That is why these laws are important.

Re:Thinking this through...

[NetSettler]

A person who has a desire to stab another has taken a step in that direction by buying a carving knife, but we still don't lock up people for having carving knives.

Society would be more honest about how it felt about this issue if it just hauled every male citizen into police stations once a year, showed them a picture of kiddie porn, and gave a lethal injection to everyone who has an erection.

But instead, since no one wants to face the fact of this underlying bloodlust openly, they find ways of gradually sticking spears in the people they suspect of this, like picadors stabbing a bull in a ring, until finally the bull charges and they feel justified saying "he was coming after us". If you knew it was going to come after you, just do it in from the start. And if you don't know, then wait. But don't do something intermediate and please don't set bad precedents for what laws should look like and what powers government should have. This country is thick with laws about "no prior restraint", and undoing that will surely make us safer but it will not leave us free.

Sounds to me like it's all black and white to you. Beat down the loopholes, then nail these suckers to the wall. But what's the difference between a "virus" doing the downloading and the browser cache doing it? What if you clicked on a link you didn't intend to, or what if you were just curious where something that was vaguely named went to? Now you've got pictures of people on your screen that you didn't want. And in your browser cache. So, loopholes all having been gotten rid of, how will you defend yourself? I'd like to defend myself by saying, "but I didn't do anything" not by having someone say "but I imagine you would have". Because what you imagine I'm going to do and what I am in fact going to do might be very different.

Required reading/viewing: The Minority Report

Re:Thinking this through...

[Rary]

"The consumer of child pornography has a mental problem"

It is important to recognize, however, that the legal system is not an appropriate place to deal with medical issues. It does no good to this consumer, nor to society at large, and in particular the children within society, to deal with that person's mental problem, if it is such, by putting the person in prison. However, this is the approach that our society prefers to take, primarily, I presume, because it's easier than actually dealing with the real problem. The same holds true with current drug laws.

"It is important to recognize that in our society it is unacceptable not only to abuse children, but to enjoy abusing children ... That is why these laws are important."

It should never be illegal simply to enjoy something. If I happen to enjoy killing, that's one thing. If I actually go out and kill someone, that's another thing entirely. We have laws against that, and I don't propose that those laws be changed. But to simply be a person who enjoys killing, and not actually do it, should never be illegal. I should, in that case, seek professional help as a preventive measure. But let's not throw people in prison for thoughts, ideas, and desires -- even if those thoughts, ideas and desires are diseased.

Let the medical profession deal with diseases, and the police deal with criminal acts.

Re:Thinking this through...

[rifter]

It is important to recognize, however, that the legal system is not an appropriate place to deal with medical issues. It does no good to this consumer, nor to society at large, and in particular the children within society, to deal with that person's mental problem, if it is such, by putting the person in prison. However, this is the approach that our society prefers to take, primarily, I presume, because it's easier than actually dealing with the real problem. The same holds true with current drug laws.

This is true, but in many states mandatory treatment is a part of sentencing. I would think it would be best if in cases where the person did not act on these impulses mandatory treatment in itself would be the whole of the sentence. In some cases it probably is.

It should never be illegal simply to enjoy something. If I happen to enjoy killing, that's one thing. If I actually go out and kill someone, that's another thing entirely. We have laws against that, and I don't propose that those laws be changed. But to simply be a person who enjoys killing, and not actually do it, should never be illegal. I should, in that case, seek professional help as a preventive measure. But let's not throw people in prison for thoughts, ideas, and desires -- even if those thoughts, ideas and desires are diseased.

Let the medical profession deal with diseases, and the police deal with criminal acts.

In general I agree with this approach, however firstly I must point out that in practice it is impossible to mandate treatment for mental disorders without involving the courts and police. I shoudl also hasten to point out my post was mainly a reaction to my perception the parent post was saying it was okay for people to have and use child pornography.

My position is it is not okay, and we should not enable the behaviour of people in general when it is likely to lead to ruin for them and grievous harm for others. We should instead throw red flags high in the air, set of loud sirens, and join in a concert of "don't do that!"

The idea that some thouhgts and ideas are dangerous is in itself a dangerous idea, and should indeed set off red flags. But likewise it is important that in the case of certain things which we as a society have decided are not okay it remains understood they are not okay.

Someone who is thinking about abusing a child should realise right away that to act on such urges would be a very bad thing, and that if they continue to have such urges they should try to get help to understand why. (Perhaps they were themselves abused as a child and have repressed the memory, for instance.) If we allow people to maintain collections of this pornography and in any way remove the stigma of the child abuse itself, as suggested by the poster, we are enabling the behaviour of the abusers by saying it is okay to want to abuse children.

It is not okay to want to kill people, and it is not okay to plan to kill people, and by the way people are prosecuted and put in jail for doing so. There is even a prominent case in which a man who was thought to be a potential danger to his ex-wife was put into prison for owning a gun.

I think the most important part of this thoughts and feelings and planning issue is the distinction between thinking about doing something and thinking about it. For instance it is one thing to think about the idea of killing, but it is quite another to think about killing someone, and another matter altogether to obsess daily about killing a particular person (in the vein of Sirhan Sirhan filling notebooks with "RFK must die").

In the case of child pornography, we are dealing firstly with an obsession. This is not something which is just casually happened upon. There is a lot of premeditation and thought involved here. Secondly, it is an urge which the pedophile often seems to feel unable to control. People who seek help for this problem often do because they realize it is wrong

Re:Thinking this through...

[rifter]

Sounds to me like it's all black and white to you. Beat down the loopholes, then nail these suckers to the wall. But what's the difference between a "virus" doing the downloading and the browser cache doing it? What if you clicked on a link you didn't intend to, or what if you were just curious where something that was vaguely named went to? Now you've got pictures of people on your screen that you didn't want. And in your browser cache. So, loopholes all having been gotten rid of, how will you defend yourself? I'd like to defend myself by saying, "but I didn't do anything" not by having someone say "but I imagine you would have". Because what you imagine I'm going to do and what I am in fact going to do might be very different.

No it's not all black and white to me, though I could see how you would get that impression. I should point out the idea of trying to nail people on pictures in their browser cache and deleted files is somewhat frightening to me, especially with all the kidpr0n spamming on ICQ and email. I think proper forensic analysis of hard drive data is a process that should be improved significantly. It should not be just a matter of "Well I found 5 pictures in the deleted files of your hard drive that might or might not be underaged models so you are going to jail, bucko."

As I state in anoter reply below, I was reacting mostly to the idea you seemed to espouse that it is okay to allow kidpr0n. I think it is not because destigmatizing these fantasies is an enabler to the behaviour. Current methods of dealing with the problem might probably be reformed, but I can't see kidpr0n as harmless because of the nature of its use and the set of ideas to which the idea of its being harmless leads.

Re:Thinking this through...

[NetSettler]

Current methods of dealing with the problem might probably be reformed, but I can't see kidpr0n as harmless because of the nature of its use and the set of ideas to which the idea of its being harmless leads.

Fair enough. But I'm not saying it should be "ok". I'm saying I don't have a moral problem with people looking at non-real images just because of the topic matter. And I'd rather they look at non-real images than at kids.

The US is a grand experiment in the trading of safety for liberty. Singapore, if memory serves, is just the opposite--an intentional trade of liberty for safety. I suppose in some abstract sense it all comes down to deciding where you'd rather live, and I'd hope anyone who didn't like it where they were could always move. But I know which world I'd rather live in.

Incidentally, there are tons of kinds of materials that I think make the world less safe. Organizational information about Naziism doesn't make me happy nor does letting it go unchallenged make me feel safer. But I'd rather let that go unchallenged and know I live in a free society than have it policed up and wonder what thoughts of mine were next to be policed. That's a far cry from saying it's "ok". We need more elaborate terminology than binary "good/bad" to really discuss things fairly here.

Re:Thinking this through...

[HiThere]

"...mandatory treatment is part of the sentencing..."

Is it effective treatment? Or is it more likely to be just another exercise of power? I can recall reports of "mandatory treatment" that involved torturing people who were convicted of being gay whenever a nude male was displayed, and (something else? don't remember what) whenever a nude female was displayed. There wasn't any evidence that it would work. But they had a "theory" (based on Behavioral pSychology == BS). Later studies showed that it was minimally effective. But that was years later, after the people who were engaged in the project had already stopped.

So basically this "mandatory treatment" reduced to torturing people.

Perhaps you should think again before you recommend putting the prison authorities in charge of medical practices. That's a practice that's been done before, with the most common result that the normal constraints that the "wardens" have on their behavior are removed, and no particular good results.

I would be willing to see evidence that I'm wrong, but the past is full of "cruel and unusual" medical treatments.

Re:Thinking this through...

[outsider007]

If someone enjoys abusing children, and enjoys the idea, the hope is we can intervene and get this person help before they actually harm a child.

I don't think anybody is really interested in helping these people. unless you consider 30 years of butt-rape helpful.

Re:Thinking this through...

[rifter]

I am not advocating putting prison officials in charge of mental health, and no one should, unless the aim is to reduce mental health. Likewise, among mental health professionals the question of how to adequately and successfully treat pedophiles (or whether it is possible) is far from satisfactorily answered. I would also hasten to point out that our mental health systems in general could stand serious reform, as could our prison system.

The question we are dealing with here is as old as philosophy itself: the question of what to do with those who cause problems in our society and by what criteria we judge such troublemakers. And whereas our general answers to these questions arguably need serious tweaking, we have to understand what we are dealing with here. We are talking about how to deal with a person who enjoys harming children, and how to best prevent them doing it, primarily because we have decided that harming children is wrong and we don't want it to happen in our society.

Now in the case of kidpr0n, the person in possession of said contraband may not have actually harmed a child. I think no one will argue whether we should do something about the person who actually harms children and is proven to do so beyond any reasonable doubt. The question here is what we do with someone who we only currently know to be in possession of pictures of children being harmed.

This question touches on two areas in which I am generally loathe to yield power to government; one being the legislation of thoughts, feelings and urges and another being creating laws against simple possession. The problem with laws of possession is there is no act involved, and no discernment of intent. Likewise the method by which these things come into one's possession is rarely part of the determination of the crime. Contraband can be planted by enemies or police, can end up in one's possession accidentally, whatever, and it does not generally matter unless the defendant can prove innocence (as this man is supposed to have done). There are many other problems with laws of possession in and of themselves and any question involving such is therefore rather thorny.

However there are several important points specific to the kidpr0n case. One is that the simple fact someone has an interest in obtaining these items should be a red flag, both to them and to anyone else privy to such information. Since the sole use of any pornography is to fantasize about the events depicted in the pornography, the person interested in such things is not only thinking about re-enacting these events, but enjoys the re-enactment. They are thinking at least on some level that harming children is good or enjoyable, at least for them. Another important difference is they are likely to act on these urges if they remain unchecked, and the victim will be an innocent child. At heart of our society's injunction against pedophilia is the idea that children need to be protected form the urges of adults.

So the question is, how do we deal with a person who feels these urges and finds themselves treading the path to the dark side? My contention, and that of the officials interviewed for this case, is that that person should be encouraged to seek professional mental help as soon as possible. It's not just to protect me and my children that I feel this way. I think for the person themselves this is the best course, because there are usually reasons the person has such feelings, often unresolved abuse they received as a child themselves. Besides is it really better for them to continue with this awful secret than to seek help?

Re:Thinking this through...

[Rary]

Just a thought that came to mind when reading your post. You state:

One is that the simple fact someone has an interest in obtaining these items should be a red flag, both to them and to anyone else privy to such information. Since the sole use of any pornography is to fantasize about the events depicted in the pornography, the person interested in such things is not only thinking about re-enacting these events, but enjoys the re-enactment. They are thinking at least on some level that harming children is good or enjoyable, at least for them. Another important difference is they are likely to act on these urges if they remain unchecked, and the victim will be an innocent child.

Now, what I propose is that you re-read that section, changing the appropriate words so that the subject is not child pornography, but violent video games instead. You point out two issues that distinguish the child porn issue from other possession laws. I would argue that the first point absolutely applies to violent video games. The second point is debatable, on both issues. I don't know what the statistics are regarding the number of gamers who commit violent acts (not just the high-profile Columbine-style acts, but violent acts in general), but I suspect they're rather low. I also don't know the statistics regarding the number of consumers of child porn who commit abusive acts on children, but I suspect it's much lower than most would guess.

There's no doubt it's a thorny issue. In any issue, I tend to lean toward the idea of punishing those who act, and not those who have the potential to act.

Definitely an interesting discussion.

Re:Thinking this through...

[rifter]

Now, what I propose is that you re-read that section, changing the appropriate words so that the subject is not child pornography, but violent video games instead. You point out two issues that distinguish the child porn issue from other possession laws. I would argue that the first point absolutely applies to violent video games. The second point is debatable, on both issues. I don't know what the statistics are regarding the number of gamers who commit violent acts (not just the high-profile Columbine-style acts, but violent acts in general), but I suspect they're rather low. I also don't know the statistics regarding the number of consumers of child porn who commit abusive acts on children, but I suspect it's much lower than most would guess.

Actually as I wrote this I was thinking of video games as well. But it is different from pornography in the means of use. In fact as I write this I was thinking of the ways in which I use both (no I do not use or tolerate kidpr0n), and I think one of the most important differences is that when I play a game there is a seperation of action such that I see myself as playing a game about doing violent things, and it is a vicarious enjoyment of those things akin to watching a television show of someone doing those things.

Pornography is more personal. Firstly in order for it to work, it has to depict something the user enjoys doing or would like to do him/herself (also the overwhelming majority of users of pornography are male, which presents a physical impossibility of using unsavoury porn). When it is used, the person becomes the actor, and thinks what it woudl be like to do those things. It is true the person does not always act on his desires. This is still fantasy we are talking about, which is the primary link between this and video games.

I do not believe that pornography makes people degenerates or likely to commit sexual crimes, and in fact the relevant studies have never been able to show such links. However, my contention is that the desire to abuse children is a bad desire to have, and that use of child pornography requires that desire. I think in such cases it is right to try and help that person.

There's no doubt it's a thorny issue. In any issue, I tend to lean toward the idea of punishing those who act, and not those who have the potential to act.

Definitely an interesting discussion.

Agreed, and agreed. I do not think it makes sense to punish people in most cases, really, but that is an aside. And I never advocated punishing people who possess child pornography. I am suggesting society should intervene in such cases and shoudl mandate some kind of treatment. I am also suggesting that we shoudl make sure as a society that we reinforce the stigma of child abuse so that people continue to believe it is a bad thing to do. If we enable child abusers by saying their desires are okay rather than saying it is an indication of mental sickness and likely rooted in past abuse of their own, we are helping no one at all.

Re:Thinking this through...

[mink]

"As I state in anoter reply below, I was reacting mostly to the idea you seemed to espouse that it is okay to allow kidpr0n. I think it is not because destigmatizing these fantasies is an enabler to the behaviour. Current methods of dealing with the problem might probably be reformed, but I can't see kidpr0n as harmless because of the nature of its use and the set of ideas to which the idea of its being harmless leads."

The above seems quite close to arguing that video games make people killers. Try replaceing Kidpr0n with Violence (or more specifically killing) and see how the argument stands.

Not that I think that Virtual Kidpr0n is a good thing, but we must be careful how we deal with the complex issues, otherwise they can have unintended consiquences.

Whether innocent or guilty

[zackbar]

it cast a shade on his life. Between the vigilantes who assumed him guilty, the fact that he lost work, the time and money he spent on defending himself, and the fact that he didn't dare see his kids for two months, he got screwed.

Now, some district attorney (or whatever they call them in England) is saying "he got off scot-free. The system worked."

This doesn't surprise me

[Anonymous Coward]

How many people do you know who are less than computer savvy and their computers fill up with spyware? If adware/spyware junk can end up inadvertantly installed, what's to stop BackOrifice or some other remote control app, or a hidden FTP client?

Picture this... Bob buys a new Windows XP machine, doesn't know about firewalls or even that it's a bad idea to click on "Yes" when a web page asks if you want to install something. Bob surfs on over to a page looking for a new Brittany Spears song and clicks "Yes" to downloading what he thinks is going to be the MP3 but actually turns out to install a stealthy FTP server that announces its presence to its creator.

Let's say the creator of this application maintains a list of all the infected machines and some child porn group decides it's not a bad idea to use a compromised machine as a hub for exchanging pictures. Sure enough, Bob's computer will be full of child porn he never knowingly downloaded.

I'd rather a few child porn downloaders end up not being locked away than one innocent person being locked up because they failed to secure their computer. My first Linux box I put online got rooted, I originally thought Comet Cursor was harmless and ended up with shitloads of spyware, and I consider myself pretty computer savvy. Nearly all my friends have constant battles with spyware and those that are less savvy don't even know why they get popups constantly even when they're not browsing the web. If you don't have full control of your computer, how can you be held responsible for its contents?

Links

[Anonymous Coward]

The Kuro5hin.org links are:

• Part I
• Part II
• Part III

Re:Virii is the plural for... BZZT WORGN!

[Anonymous Coward]

dude, plural of computer virus is..

your momma

don't argue.

Gee. Adding the words "Don't argue" doesn't make you right, it makes you look insecure and unable to defend your position.

Computers are dogs.

[amcguinn]

So, the day has come at last. I must say I'm surprised, as I've been expecting it for over 5 years.

The point is that the law has to decide how much responsibility a person has for what their computer decides to do.

Up till now, the assumption has been that whatever your computer does, is done at your request, and you are wholly responsible. This despite the fact that that has never been true, and is getting further from the truth every year.

There is no legal tradition to apply here. The nearest analogy to the relationship between a person and his computer is the relationship between a man and his dog.

People have kept dogs for thousands -- most likely tens of thousands -- of years, so everyone has a rough idea what the deal is. The general legal view is that you have a duty to keep your dog from causing harm under forseeable circumstances, but there is a distinction between what your dog does and what you do. If your dog attacks a child, you are not guilty of Grievous Bodily Harm, but you might be guilty of keeping a dangerous dog. If your dog craps on the street, that is different than if you crap on the street, but you might still be fined.

If you are found guilty of not properly controlling a dog, you can be banned from keeping one. If your dog causes harm and is considered not to be controllable, the court can order it to be destroyed.

(If you deliberately cause your dog to kill someone, that is still murder of course, but your intention is crucial)

This is the only rational legal framework for crimes committed by a computer without the intention of its owner.

When will computers that run MS-Windows be ordered to be put down?

Re:Computers are dogs.

[silverbax]

I think your analogy is excellent.

Re:Computers are dogs.

[drinkypoo]

The question is, can you get in trouble because your dog uses your computer to download images of naked (shaved?) puppies?

Re:Computers are dogs.

[bheerssen]

When will computers that run MS-Windows be ordered to be put down?

Probably when the gov't finally orders enforced euthanasia for all of those damn rat-dogs.

Evolution

[Anonymous Coward]

With each major change in technology, there is social upheavel. Checkers and chess: same board; altered function of the pieces.

I suspect this is not the last of something like this we will see. Growth is exponential, be it physical growth or intellectual advancement.

In the future, we may see the same kind of case with the exception of it was not the innocent man on the stand whose fingerprints are on the dead girls neck, rather his clone concieved (and corrupted for nefarious intentions) without his knowledge by a mad doctor from a strand of his hair left at the gym.

Like it or not, our societies are going to change and evolve; we are already seeing the cracks in the system.

There are a variety of solutions. The one John Ashcroft supports is a reversal of the current process, turning innocent until proven guilty inverted, imprisoning innocents as a side effect of relaxing the burden of proof to ensure the net casts on the guilty. That can be considered "the easy way", modifying a piece of the current system to accomodate situations previously unthought.

The alternative to putting band-aids on the symptoms without curing the cause is a reformation.

We will patch these problems for a while with a variety of laws and judgements and precedents, attempting to force the old world rules on the new world, but it is a losing battle and eventually the system will crumble under it's own weight. (How many people can we imprison, taking them out of the work force for petty crimes like marijuana and pornography until the free are simply working to keep the imprisoned as such. Once this point is crossed, who will work legitamately knowing their toils are mostly going to keep someone from working and supporting the system themselves?).

What we are going to need are revolutions. Cultural, ecological, agricultural, legal, governmental, medicinal in which we redefine the roles of the institutions within to function with the advent of perfect-digital copies, instant communication, technology (in many regards indistinguishable from magic), etc.

Two examples:
1) The difference between gulf war I and II was a matter of informational availability. In the previous gulf war, most on the scene news came from three guys in a hotel room. In gulf II wrought by unelected baby bush the information came freely over the internet (is it a coincidence, following the press debacle of rumsfeld saying one thing and the foreign press from all corners of the globe saying something totally counter, cisco who arguably runs the internet announces support for lower layer content examination and control?). Many people were horrified and fell into denial as they were presented with the pictures of what it takes to maintain the influence of the richest country in the world. The same thing has gone on since Day 1 in every empire, economic or otherwise, in history. The difference is now we can see it as it happens unfiltered by our handlers.

2) The RIAA's previous monopoly is basically over thanks to MP3. As technology evolved, it erased the need for a complex supply and distribution chain and threatens to uproot a lot of people's lives. This reminds of the people who build on a valley flood plain during a twenty year drought and then had their houses washed away when the drought ended. They had built on the land assuming it would remain as it and hadn't bothered to examine the historical context of the locality. The RIAA did not realize what had happened to telephone operators with the advent of the automated telephone switch. They were unemployed much like the carriage drivers at the advent of the car. But this is all elementary darwinism. The strong survive and the weak die off. The RIAA is weak; they are rich people used to a certain lifestyle that is based on exploiting the fruits of other's labor. In not following the trend, they have been replaced and are now fighting to survive, but the point is that they did not develop the skills to survive and the outcome is ine

Re:Evolution

[mpe]

There are a variety of solutions. The one John Ashcroft supports is a reversal of the current process, turning innocent until proven guilty inverted, imprisoning innocents as a side effect of relaxing the burden of proof to ensure the net casts on the guilty.

Probably also with mechanisms to protect the high status. Since it's kind of hard to run a government from insided a jail cell.

Warning!

[electromaggot]

After visiting the URL I just posted above (it had been a long time), I must mention: you might want to be more careful than I had initially suggested.

The site immediately pops up that bogus Windows' "Do you want to install and run..." dialog, so DEFINITELY DO NOT agree to that.

Then the site is hard to leave without subsequent redirections to porn-related stuff. I hate those web-weenie-bastards who do that stuff.

What's the diff? Still did the crime.

[inaneboy]

Most people, if you kick their dog, won't kill someone.

What's the difference between someone with a mild 'illness' like a hair trigger temper and a true ilness (NGRI)?

Should I plead 'hair trigger temper' and get anger management counseling?

Seems like both make a person unable to function in normal society doesn't it?

But... he was still guilty of the accusation!

[bagofbeans]

Guy was accused of having pornographic pictures of kids on his computer, right? Well he did! It's purely mitigation that it wasn't his fault - but legally it was still his responsibility, if the law was written that way. Bit like receiving stolen goods law.

Now if the burden of proof becomes the presecutor's to PROVE the defendant knowingly downloaded the material (as opposed to reasonable likelyhood),then we're going to get a lot of ISP log requests to differentiate between an upload by nastyware and a download by user.

Re:But... he was still guilty of the accusation!

[Anonymous Coward]

Please read and respond to my post. You and I are thinking along the same lines.

Re:Hey! Where can I catch this virus?

[cHiphead]

dont worry about it now, the feds have seen your post and their at your door. *knock knock*

wake up neo. you pedophilic pervert.

Scary point people

[phorm]

The scary question is not whether or not he was actually involved in the aforementioned illegal material - but whether such a virus could and does exist. Judging by other /. comments, I wouldn't be surprised if one does, but even if it's not a virus, it wouldn't be hard for somebody's box to become a haxored harbour for illegal material.

Recently, I've been playing with my Samba server on my home network, which also serves as my router, etc. I accidentally malformed the "interfaces" line so that I was allowing connections from my "DSL" NIC as opposed to just the LAN one. Luckily, I found some suspiciousl logs fairly soon after (it logs by username, and there were some odd Chinese-sounding names trying to log in), and tracked down the problem. BUT, if my samba server had been owned, it would have been an easy route to the windows machine in the private network behind the Samba box (not to mention the previous samba exploit, recently patched). If hacked, this box and others could easily have been a harbour for illegal porn or other nasty files.

Also, this isn't mentioning at all the fact that there is a lot of misnamed material on kaZaa, etc - and while a lot is just movies named as other movies, some of it is pretty sleazy stuff that could theoretically get you in trouble with your wife/girlfriend, if not the police. You download the file and get caught... intent can be hard to disprove.

Re:Scary point people

[silverbax]

Makes sense to me...seems like a pretty clever for someone who wanted to keep 'illegal' material to store it on OTHER people's boxes.

Re:Scary point people

[Anonymous Coward]

You are right on the money here. And even if your box was insecure and was hacked, what's to say that the PR the people in office give to your arrest doesn't end up hurting you in the end, even though you're innocent? Along the same lines, what if your box was hacked and serving child porn AND on your desktop machine's hard drive you have your own collection of porn. What if when the cops go through that HD they find a image they believe might be a minor and keeping your in custody for that? How far does it go? Just like your parent post you and I are thinking along the same lines. If you would, plese read and respond to my own post.

Re:Scary point people

[Anonymous Coward]

# IPTables script to block your samba share to the outside world
EXTDEV="eth1" # The DSL NIC
for proto in tcp udp
do
for port in 137 138 139
do
iptables -A INPUT -i $EXTDEV -p $proto --dport $port -j DROP
done
done

IF I EVER...

[Anonymous Coward]

see you I will kick your ass! your post really pissed me off1 I do not need anger management counseling you prick; why i will blow your fucking head off!

A reason to run Windows?

[djh101010]

So, if anything shows up on my systems that shouldn't be, I can blame virus-of-the-week on it?This almost gives me motivation to keep one of my boxes around the house running Windows. Almost.

First off....

[Chanc_Gorkon]

The guy is a sicko. No doubt about that. Second, I have a real problem with the way they seem to be handling kiddie porn prosecution. They are going, it seems, after the users and not the sick bastard who took pictures of the children in the first place, and put them up on the web. If the kiddie porn producers are taken care of, then the user end pretty much gets taken care of by itself. I ain't saying that these sickos should not be watched. If you download them, chances are, you will upload them. So, yeah they should monitor the guy. I never said that what they user does is right either, it's just if the picture does not exist to download, well, you get the idea. He'll just have to go somewhere else for his sick fantasy. Also, there are a ton of porn sites that ride the edge in my opinion. I mean have you ever gotten a e-mail (that was not filtered yet) and the girl in that porn spam looked like she was WAY too young. I have seen this time and time again (SPAMMERS! Got to hate them....).

Re:First off....

[Anonymous Coward]

I haven't read the story yet so I don't know if this isn't the case. My arguement is what if this guy really didn't know he had kiddie porn on his hard drive. So much of the porn out there can't be distinguished from kiddie porn, porn stars early in their careers, and midgets. Now obviously there is some porn that can easily be identified as kiddie porn. So much of it can't be though. For example I use Kazaa all the time and I've downloaded a lot of porn with it. I've come across hundreds of images where 1) I didn't recognize the actress in the picture or movie and 2) I couldn't tell what the person's age was. I know women who are 24 years old that look like they're 14. When I was 14 people thought I was 25. Appearance is deceiving. I posted a lengthy comment just after you did. Read it if you would and respond to it.

If he's a sicko then yes he really should be punished. However we can't say that by simply having an image on your hard drive of a person that appears to be a minor that you're a child pornographer. If I have any on my hard drive then I assure you it's by accident. Anything that I really think is child porn is trashed as fast as I trash gay porn (I'm a very straight white guy). However if I can't tell one way or the other I assume they're older since 999 times out of 1000 they are really 30 years old wearing a school girl outfit and pigtails. Child porn isn't as wide spread and as easy to find as people would like society to think IMHO.

Re:First off....

[MikeXpop]

I remember once I got a phone call from one of my ex girlfriends. She was crying hysterically and babbling about perverts and child porn and the such. After I got her to calm down, she explained to me what happened. It seems she was a bit insecure about her developing breasts. So for the last couple months, she had been taking digital pictures of herself without a shirt on, from many different angles. She had named them "breasts_feb.jpg", "breastsfeb.jpg" and etc. A bit later she had downloaded kazaa, and had accidently set her whole C drive to be the shared folder. It took her about 2 months after she downloaded kazaa to realize this. Horrified, she looked at her upload list, and saw her pictures being uploaded many times. She gave me the kazaa names of the people who had her pictures, and I messeged them for her (she had uninstalled kazaa by then). 2 of the guys were very cooperative and apologetic after I explained what happened. And, like the AC above me said, most of them had no clue they had underage porn.

It's not just one person. And most of them are not sickos.

Nope, sorry. Common mistake, however.

[mark-t]

Actually, the plural of virus is viruses. All rules have exceptions, and this is one of many exceptions to the rule that makes it a rule.

A more scientific explanation is found in the alt.usage.english FAQ:

"Not all Latin words ending in -us had plurals in -i. Apparatus, cantus, coitus, hiatus, impetus, Jesus, nexus, plexus, prospectus, and status were 4th declension in Latin, and had plurals in -us with a long `u'. Corpus, genus, and opus were 3rd declension, with plurals corpora, genera, and opera. Virus is not attested in the plural in Latin, and is of a rare form (2nd declension neuter in -us) that makes it debatable what the Latin plural would have been; the only plural in English is viruses. Omnibus and rebus were not nominative nouns in Latin. Ignoramus was not a noun in Latin."

(Emaphasis mine).

I did something similar

[phorm]

A friend was messing with my machine, changing my background and internet explorer start page, etc - so next time I got at his box I made a registry entry in HKLM->SOFTWARE->MS->Windows->CurrentVersion->Ru n that basically reloaded some other registry stuff every time his machine restarted. Of course, I'm not sick enough to set it up with K-pr0n, but a goatse link got the point over to him quickly enough that he should stay away from my machine if he wanted his to remain untouched :-)

How can they tell?

[Anonymous Coward]

I have to ask this question because I'm sure I'm not the only one wondering. How can someone tell if a particular image is of a child in a pornographic contex? In all honesty the crap that many people label as child porn is just an early picture of young-looking porn star, like Devon or Allisyn Chains. The so-called lolita pictures are typically a 30-year old women in pig tails and a school girl outfit. I know this because like damned near all of you I have seen porn. It's nothing to be ashamed of. We're all adults here. However I will say that I've seen some pretty questionable photos, even in my mind's eye. Some of them I honestly couldn't say if they were or weren't or a minor. That's not to say that they were for certain but that's also not to say that they were of an adult. How would a law-enforcement person prove that the person in the photo really is a minor? Wouldn't they have to find that person and get that person to say on the stand when the photo was taken and how old they were at the time? Anything else would be pure speculation. I know baby-faced and flat-chested seniors in college who could pass as a 14 year-old. Meer appearances are deceiving.

I imagine many of you have used P2P apps like KaZaA. I'd bet money that almost all of you even downloaded some porn with it. Don't be bashful. There's nothing wrong with it. However I'm sure you too have noticed the overwhelming amount of BS crap files that get turned up in searches. Many of them say "underaged" or "pre-teens" or many other things that indicate a minor child. And many of them are pure junk and are simply pictures ripped from a Girls Gone Wild video. However some times you end up downloading a picture you just can't identify. You really can't tell if those are kids, flat-chested and baby-faced college seniors, or midgets. If you don't delete these files and leave them on your computer, are you now guilty of having child pornography if someone proves that the picture you downloaded 1 year ago and is still in you junk directory?

Lets say for example that your ex knows you have porn on your computer. Hell she and you used to watch it together. You break up with her and she's pissed. She makes an anonymous call to the police one night when drunk. The next day and overzealous police officer has a warrant from a judge looking for some good PR for the election coming up. They confiscate your computer and arrest you, even though all they have as proof is the anonymous tip. A lab goes through your hard drives and CDs while you're grilled by a cop with bad breath over how you abuse children. You don't want to call for a lawyer because you don't want to seem guilty. You think it's all a big mistake. The lab boys come back with the porn. The cops browse through it. A picture comes up of Devon in her early years. "Does she look like a minor to you, Bob?" "She sure looks like a minor to me, Chuck." They arrest you and charge you with child pornography, even though they have confirmed that the person in the photo is a minor. The PD and DAs office goes public to say how they've arrested a vile child pornographer. Media coverage. Citizen outrage at him. yadda yadda yadda. In the meantime he's arrained. This gives an assistant DA time to go through all the porn on the hard drive. Whoops. It turns out that the photo the cops thought was child porn wasn't. Hell it obviously wasn't. Damn overzealous cops. Nevertheless he goes through all the porn. He even enlists the help of a person in the pornography business who can recognize many of his fellow actors. Finally they come down to a small handful of pictures that no one can identify. Of these 3 could be of a minor. The DA picks the most child-like photo as proof and goes to trial. The prosecution paints the defendant as a vile, horrible child pornographer. A few of his ex-girlfriends step into the lime light to say how he was abusive or was obsessed with kids or some other bullshit like that. The defense lays out the facts of law and that the photo can't

Re:How can they tell?

[Anonymous Coward]

You want to be really scared? Take your ex-calls-the-cops scenario, but changed slightly: neither you nor your ex ever really watched porn. Oh sure maybe a rented video now and then, but you don't have thousands of pictures on your computer. Drunk ex calls cops, just to "scare" you; since she knows you don't even have porn on your computer and nothing will really happen.

Well the bust goes okay, they get you into jail since you didn't resist (you have no idea what they're talking about since you're innocent) and they do the usual press releases about cleaning the streets of scum, etc. Finally they get around to getting your computer in the lab... and find nothing. Nada, zip, zero. You don't even have pics of classical paintings. They screwed up, big time. Now they're facing lawsuits, embarassed public officals, lost elections... but hey, the computer from that scum they caught last week is sitting right over there. A couple of copied files later (making sure to set the date back), and yes sirree, there's those nasty kid porn files on YOUR computer.

Have fun in prison, Mr. Innocent.

Re:How can they tell?

[Anonymous Coward]

This is all to likely to happen. I like cops. I have to respect what they do. They're human though and all us humans make mistakes. Unfortunately the mistakes some humans make cost others their lives or at least their livelyhood. I watched a story on TLC last night about a guy convicted or rape and murder in the early 80s and sentenced to death. He maintained his innocence throughout. DNA testing a handful of years later couldn't eliminate him as a suspect. It couldn't say it was him at all though either. See the DNA was close but as close as a sibly, ie brother or sister. The murdered woman was his sister in law. Hmmm... The initial trial was a farse. His own representation was a joke. They really couldn't do much of anything. They didn't even attempt to refute the so-called experts. Years later better lawyers can look at that and say that those lawyers fucked up badly. IIRC correctly he had a fair alibi. I can't remember for sure though. Nevertheless he was convicted. In the following years he managed to get good lawyers and experts at the convicted innocent to help him. Unfortunately a filing error thanks to his initial elected representation fucked up everything. They files a day late. Too bad, so sad. In the end he was put to death. The experts that tried to save him are still fighting however. They are trying to get the initial semen samples analyzed by today's DNA technology which lays what they could do in 1990 in the shade. The state where he was convicted and put to death is fighting it though. They are afraid of the truth in essence. If they had nothing to hide than the DNA test would vindicate them if true. If not then an innocent man can be proven as such and they murdered the wrong man.

This guy really got screwed. Unfortunately he had gotten screwed for years. The story started with a bright young senior in HS in a small town preparing to join the military. Unfortunately he was accused of something (I forget what). The woman described the person, police found this teen that fit the description, and arrested him. She said it was him and it went to trial. The problem however was that this boy had a rock solid undeniable alibi. He was with his HS principal at the time of the incident. There was no way he could have done this since we can't be in two places at the same time. The jury still convicted him though. That ruled out his military hopes and dreams. He went to work in the town's mines. Later another crime was committed. Police always suspect the previously convicted first. They brought him in. This person IDd him as well. Here comes another trial. Once again he had a rock solid alibi with a very credible person. Once again the jury ignored this and convicted him out of prejudice. This guy was screwed repeatedly by fuck ups. In a legal system such as that, has can any innocent person expect a fair trial?

Re:How can they tell?

[Anonymous Coward]

PS, please ignore my grammatical mistakes. I wrote that in one pass and didn't proof read what I wrote before submitting. For example I forgot a rather important "not" in one place.

They arrest you and charge you with child pornography, even though they have [not] confirmed that the person in the photo is a minor.

My bad. Read what I meant and not what I wrote. :)

Re:How can they tell?

[throbber]

... The PD and DAs office goes public to say how they've arrested a vile child pornographer. Media coverage. Citizen outrage at him. yadda yadda yadda ...

Pre-trial publicity in a case such as this would be bad for the prosecussion. It would make it difficult do get an unbiased jury.

Something else also just came to mind. Lets say a bunch of cops form a sting operation with a Kazaa client and files named things like "underage little girls anal.jpg", "pre-teen lolitas creampie.jpg", and "illegal girls facials.jog" and share them via Kazaa. Now I as a user download them. The cops in whatever way track the download and get my personal information from my ISP. Now they arrest me for downloading these images. Have I commited a crime? Lets say I searched for "cream pie," "facials," and "anal" for whatever reason. I received thousands of hits and I started the downloading of all of them and went to work. Maybe I haven't even seent them yet. Maybe I have seen then and ignored them because it's more Kazaa crap. Maybe I saw them, believed they might be minors and deleted them. Would I be guilty for destroying evidence? What if they named a real picture of child porn something like "Jenna Jameson -- Flashpoint.mpg" and I downloaded it while looking for a copy of that video. Am I guilty now? All this shit scares me.

This tactic is known as 'Entrapment'. If you can prove that police are inciting you to commit crime, not only will you get off, You will probably end the career of a number police.

Someone in a reply in this thread mentioned that police could doctor the evidence.

Police are supposed to go through integrity tests before the get their job. Also, there are supposed to be procedures followed that ensure that evidence has not been unduely tampered with.

Worked For Me

[sflanker]

When I was a stupid little kid, and just learning about the internet, I wanted to be a "hax0r" so I was running around the internet with a ip scanner, port sniffer, and various password brute forcing tools. Eventually my ISP cut of my family's service because they were detecting the portscans or something. I quickly installed a trojan on my own machine and blamed it. We had our service back that day.

MOD PARENT UP

[Anonymous Coward]

Please mod this up a little bit. This needs to be seen and read by people.

Automated downloading

[lightspawn]

Even without viruses, how many of you have automated scripts to bulk-download pages from link sites and binaries from newsgroups?

Now what if one day these sources get 'infected' with illegal content and for some (perhaps unrelated reason) you get search-and-seized before you notice it?

How can you be responsible for content you haven't even checked yet?

The Who?

[t0ny]

I guess Peter Townsend must have been infected with the same virus.

Strangely enough, none of the antivirus sites have a listing for a kiddie-porn downloading virus...

How to end a life without paying a hitman

[Anonymous Coward]

Don't like the guy next door? Next time he's out, get into his house (where I live most people leave a door unlocked or window open, so this wouldn't be difficult) and download some KP to his computer.

If you want to be really tricky, hide it somewhere he won't find it, and come back once in a while over the next couple o weeks and download some more, delete some of it, etc. -- make the activity look "real." Hell, use his CD burner to put some on CD and stick it in the mess he no doubt has on his desk.

Then call the cops and leave an anonymous "tip." ... "But Your Honor, I swear I didn't even know it was on my computer! Someone must have planted it!"

There's no chance anyone will ever believe him; even if you left fingerprints galore all over the computer there's no way the cops would waste their time checking -- why try to help that sick pervert?

___
On a less hypothetical note, let me say you don't even need to waste time planting it. A friend of mine had a tussle with his roommate six months ago and ended up calling the cops on him (for legitimate reasons; his roommate has been arrested more times than I can count, he's a bit on the aggressively drunk side).

The roommate decided to get even by telling the cops he'd seen KP on my friends computer. They took it away from him (he needs it to work) and told him he'd have it back in two weeks if they found nothing on it; it's been six months...

i know this will be controversial but

[ajs318]

I really can't see anything objectionable with just looking at pictures and jacking off. Frankly, if these people have to get their rocks off, isn't it better they do so into a box of Kleenex? If some nonce is at home having a w@nk then he's not out there doing any *real* damage; nor is he likely to be capable of any real damage for a few hours.

I say - decriminalise mere *possession* of images and concentrate resources on the *real* problems. For a start, find out what the real problems *are* instead of going around in denial (which is what the vigilante mobs are doing; they set out to attack suspected paedophiles to reinforce the idea that they themselves couldn't possibly entertain such a notion).

The amount of harm done to a child by the manufacture of one pornographic picture of them is the same whether one person or a million people look at it -- as long as looking is all they do. Remember the old rule of "innocent until proven guilty" - it used to be a principle of British justice.

Re:i know this will be controversial but

[poofmeisterp]

Yeah..
That would make sense except for one thing...
Some law enforcement agency (so the data must be valid) concluded with numbers and percentages, that one who posesses and looks at child pornography is more likely to harm an actual child.
Again, numbers provided by the party making the assertion... hardly valid data.

Re:i know this will be controversial but

[cranos]

I have no problem with people looking a porn so long as the porn is performed by consenting ADULTS.

I have a great deal of difficulty with the concept that child pornography should be legalised because aside from everything else by making such images legal it could be said the government is in-directly condoning child sexual abuse.

Should we also legalise the distribution of Snuff Porn? or maybe we should legalise the distribution of Rape Porn.

I'm sorry, on the issue of Child Pornography I'm just going to have be a wowser, it is wrong, it is immoral and the concept that looking at pictures of an eight year old being forced into sex makes me almost physically ill.

Pornography and Trojans?

[Pharmboy]

Does anyone else see the irony here?

Weird trojan...

[Jugalator]

A trojan that auto-downloads stuff? I thought trojans usually opened your computer to the internet to let a hacker use parts of your hard drive? That's hardly auto-downloading since it's not really the virus that's doing it.

Michael Jackson...

[Peterus7]

Now has an excuse for having child pornography on his 'puter. "It was a computer virus... I love the children, but those darn computer viruses just upload such dirty pictures... I love the children though... But not like that... Opps, come back nose!"

And I don't even want to think about how Paul Reuben would try to explain his...

too funny.

[twitter]

I connected to his computer via Remote Desktop and browsed his folder and when I got to his My Music directory it was full of 7 gigs of movie files, none of which he had seen before. I deleted them and suggested he get a firewall program.

Of course this is "not unheard of". The question this begs is if there is a person out there who does not know someone who's trashy M$ box has been abused in this manner. I know two people, my brother in law who likes music and a friend of my wife who is a competent NT sysadmin.

Your brother should rebuild the machine. It was owned and the owners could have installed anything they wanted on it, including services your "firewall" will not catch.

You should also caution your brother about running all sorts of services he does not need or use, such as remote desktop, or many of the other big bright blinking "rape me" services M$ puts on their boxes. The easiest way to do this is to not use windows. Look to Debian or Mandrake for reasonable setups.

My IT friend gave up windows for personal use a year ago. Someone put an ftp server on one of his NT machines. The server refused local connections, so that he could not see it from itself. The ftp directory was hidden, but he was able to see it when he looked hard enough. He was denied the ability to see within it, however. He could see the server from other machines, though he was not able to login. It should be rather obvious that he was not the owner of his own machine at that point. That was it for him.

The analogy breaks down

[nytes]

It would be a stretch to go into court and claim that, as a result of visiting some malicious store, someone who you don't know was able to slip something into your pocket that taught your dog to kill on command from a remote control.

The ownership of a car might be more apt.

If my car runs over someone, I'm liable. But what if someone deliberately puts something in the road that causes my tires to blow out, thereby causing my car to veer out of control and hit someone?

I'm sure that I'd still bear some liability (at least in a U. S. court), but I'd be able to skate on part of it because control of my vehicle was taken away from me by persons unknown.

What?

[JKConsult]

Now this is why you should always use protection? Don't know what you will catch

Isn't the Trojan supposed to be the protection? That's what their commercials tell me.

And furthermore...

[nytes]

I realize that my post hardly affects your proposal. Your proposition is still very much on the money.

Computer owners need to bear some responsibility. If you can't control it, you should have one. Just like cars and dogs.

Of course.

[JKConsult]

If the kiddie porn producers are taken care of, then the user end pretty much gets taken care of by itself.

Of course. This logic is what has led to such a resounding success in the War On Drugs, which as we all know, ended in 1986, after a few years of fighting the suppliers.

how about...

[Mir322]

Back Orifice 2k, get into someone's system after successful implant of the trojan/remote admin tool. Then store your illicit goods in a deep buried subdirectory somewhere in a hidden (folder options / do not show hidden files)c:/windows/something/something/ . With 80gig hard drives being fairly average. It would be easy. And scary. As for antiviris software, how many normal non geeky people use it religiously ~only after~ having been hit with something?

Nasty idea for a vengeance virus

[spun]

Imagine a virus that downloads kiddy porn and stolen credit card numbers onto your hard drive, then emails the FBI and deletes itself. Ouch. How could you defend against something like that in court?

Re:Nasty idea for a vengeance virus

[Ra5pu7in]

There are various ways of tracking when files were downloaded and what was running at the time. Given that and solid alibis (you could not have been at the computer at the time such activity took place), you could defend yourself.

Also, if this "virus" was spread in any way it would result in repeat occurrences with each email to the FBI being identical and the list of files/credit cards would match up. Too much coincidence even amongst just two people.

So, this would have to be a privately done vengeance. In that case, an investigation could reveal who 1) hated you that much and 2) had access to get all those sources and content and 3) had the skills to generate the script to do so. It would just be a matter of getting at least one investigator to believe that you are not guilty (I know, not an easy proposition).

Re:Trojans: insurance for those who enjoy child po

[Anonymous Coward]

That's just as well, because the fact that the mere posession of child pornography is punishable is absurd.

Pete Townshend was charged, although he quite credibly claims that he was researching the issue. I for one would give him the benefit of the doubt.

The real criminals are those who abuse children, and that's a crime independent of the posession of pictures. Arguably the posession of pictures should be legal - if for no other reason, then because the more widespread they are, the more easily available the evidence against those who actually abused the children in the first place!

Re:Your sig

[rifter]

Erm, just a guess, but I would suspect the person who said it was Tom Waits. :P

Live Update

[Jim_Hawkins]

:: panic ::
Has Symantec released the update for this!
How about WindowsUpdate...will that protect me!
AHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHH HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHH HHHH!
:: end of (exaggerated) panic ::

Seriously -- if people knew more about the systems they run on, they wouldn't have problems like this. For example...all pictures should be stored in the 'My Pictures' folder provided by Microsoft. Why do you think it's there?

(Okay..maybe that wasn't so serious.)

could work

[gobbligook]

until they decompile the trojan, or find proof otherwise. The burden of proof is on the prosecution.

Then the defense would have to prove the defendant didn't build the trojan.

interesting

Computer: I plead Windows

[RyatNrrd]

The court doesn't know what the Windows code does. IANAL but I reckon it might be entertaining to construct a defense around the statement "Windows did it".

Not just a claim.

[Ra5pu7in]

One thing quite a few people seem to have missed, both in this Trojan case and in NGRI cases, is that simply making a claim is not sufficient. In an NGRI case, the prosecution must be convinced or a jury must be convinced by expert evidence (medical examinations, etc.) that the accused is actually suffering from more than a desire to avoid responsibility. Likewise, in this Trojan case, an outside expert determined that such a Trojan DID exist and DID download files -- and he proved it well enough that the prosecution accepted it.

What I have to wonder about is why it took so long to determine this. Did investigators simply decide he was guilty at the beginning and refuse to consider other possibilities?

So...

[Realistic_Dragon]

So any Linux using peadophiles are going to jail then? After all, they can't plead trojan.

Link to pointlessness

[Anonymous Coward]

Another nutters comments: http://www.geocities.com/totierne/hammer9.html

hell go mad and read a whole nutters blog through recent breakdown.
http://www.geocities.com/totierne
fol low Analyse this

Anonymous Coward: aka Turloch 'bipolar' OT
5 breakdowns and back on my feet.

Why the current legal system is the way it is

[0x0d0a]

You approach the situation and the person starts running away. I do not know exactly what I would do but there is a chance that the average person would be inclined to chase him down and cause great harm with any weapon they could find.

If you happen to accidentally instead blow away the police officer who's been trying to track down the guy for peering into a window a few houses down thirty minutes ago, then you're causing more damage to society.

Our legal system is designed to, if at all possible, defer punishment until it can be reviewed in a levelheaded manner by a jury of peers, and to prevent escalation of a situation. Why? Because preventing people from making sudden, potentially nasty calls in the heat of the moment tends to be a good idea.

Obviously, that doesn't work if someone has a knife to your throat. You *can't* defer judgement then, which is why we have a self-defense defense.

If everyone carried guns and was legally entitled to fire at a fleeing suspect that is not threatening them, then a case of mistaken identity and a couple of people making mistakes in the heat of the moment could cause a sudden large shootout.

You don't need a God-damned firewall for that

[0x0d0a]

The degree to which firewall vendors can get away with overselling their product amazes me. It even dwarfs the antivirus vendors of the last decade (matter of fact, a coupla companies sell both -- similar marketing skills). You keep people afraid and they keep giving you money.

(a) You *do* realize that those TCP connections you saw with netstat could be all sorts of things? Old waiting-to-time-out http connections, etc. They don't mean that someone's controlling your computer from the outside.

(b) If it's in "My Documents", the chances are a million to one that it was someone using the computer locally. Someone in your family, or a friend, or whatnot.

(c) If it really is a security issue, it's cheaper and less intrusive to just turn off shares/flip off the web server/etc that you're running, instead of leaving all that crap in place and snapping a firewall on top.

Now, wait one darn minute

[0x0d0a]

Of course. This logic is what has led to such a resounding success in the War On Drugs, which as we all know, ended in 1986, after a few years of fighting the suppliers.

Uh...so your logic is that the War On Drugs should go after end users as well? It *does*.

I think the same problem applies to kiddie porn. People want it, and it's essentially impossible to keep it from flowing (it's *data* for chrissake...we use the same argument about the RIAA and music).

gtk-gnutella autodownload

[0x0d0a]

gtk-gnutella has the ability to autodownload anything grabbed from search results flying past you on the wire that match some set of criteria you set. So if you leave it running, and tell it to download everything with "friends AND episode" in it and a search result comes past reading "two underage lolita girls fuck their friends [kiddie porn episode].avi", your filter will match, and the client will start yanking it down.

warez communities

[Anonymous Coward]

do this all the time. i mean ALL the time.
they use x-scan or some other tool like grims ping and scan entire networks for vulnerable 2k machines with shitty passwords or IIS holes, get access to it, and turn it into xdcc bots that serve warez on IRC servers using that machines bandwdith. this is nothing new really..
its brilliant actually since it runs it as a hidden process, named like SVChost or some bs thing that no one will notice, starts on boot, and has serv-u, as well as that xdcc serving bot all running. and to make things worse, serv-u can execute programs, so use flashfxp and you have total control of that machine. through an ftpd.

for gods sake people, port over chroot haha.

Ahhh Insanity in my form!

[Zerocool3001]

Um Ah Jhonny Chocraine! Help! Oh wait, I hacked the CIA database in Quantaco? Oh shit, must be that email virus thats going around

Makes me wonder if they have computer Robetusen

Proof?

[Cmdr. Walrus]

I think it's a relatively weak correlation that the Trojan showed up the day before the images did. It seems likely that the Trojan downloaded them, but I wouldn't call that proof! Couldn't they analyze the trojan, either by reverse-engineering it or by running it in a controlled environment, to prove "beyond a shadow of a doubt" that it was the Trojan and not Mr. Schofield who downloaded them?

Yeah...

[Rob Simpson]

There's reasonable doubt that he's not guilty. After all, he hasn't been proven innocent yet, has he? Just to drive the point home, we're talking about folks that would harass and threaten a pediatrician...

Elvis said it best

[jellyfish_green]

Caught in a loop
and I can't log out
I've been hacked on my port 80
Why can't I free
system memory
Why didn't McAffe's checker save me

I cant go online ever
with these malicious MIMEs
Now I know I should have never
clicked suspicious MIMEs...

Popup windows
that I can't ever close
Backspawn themselves and won't go away
My javascript's bad
I guess I've been had
by some script kiddie based in Bombay

My own ISP
is denying service to me
They say I hosted last night's ping storm
And I'm spamming the net
and people I've never met
Are questioning my taste in p0rn

I cant go online ever
with these malicious MIMEs
Now I know I should have never
clicked suspicious MIMEs...

Re:Elvis said it best

[EddWo]

Wow.

Love It

IANAM, I am not a moderator. +4 Funny