Slashdot Mirror
The Virus Did It
scubacuda writes "The Inquirer and Get Reading report that a UK man accused of having pornographic pictures of kids on his computer was acquitted after a court heard that his machine was infected with a Trojan on his PC which probably auto-downloaded the images. (In light of moves like Operation Ore, we'll probably hear more defenses like this.)"
I guess you should have invested in some virus protection software. Could have saved a lot of money.
I doubt this type of defense will help people who used their credit card to sign up for child porn sites.
Yet another example of why the decision to allow defendants in criminal trials to be named was a bad decision *sigh*.
As to the story - sounds strange that a trojan would do that unless someone was using his machine as a proxy and in that case why would the images be cached on his system?
When the crime is as insane as "possession of a picture" (a digital one, no less), the defenses to the crime will sound somewhat nutty as well. It's to be expected. The only solution is to eradicate due process entirely and just execute the acccused immediately. Considering we're talking about kiddie porn here, i'm sure a vast majority of people wouldn't mind doing so at all.
Stupid people make stupid things profitable.
The problem this guy is going to face is that, despite his conviction, the prevailing mood in the UK is such that he will still find himself stigmatised for a very long time.
As he found out from the vigilante attacks before his trial, the maxim "innocent until proven guilty" doesn't seem to apply for some people any more - the witch hunts led by certain newspapers mean that any slight suggestion of paedophilia turns the accused into an immediate fugitive.
Therefore, though it's very kind of the Crown Prosecution Service to accept this explanation at trial, why did they wait before it was up before a judge with all the attendant publicity before letting him off the hook?
In the minds of some people as well, there's going to be an attitude of "that's right, blame it on the computer - he would say that, wouldn't he?". Technology-based defences simply don't hold water for a lot of non-technical people - which with the increasing number of technological offences being put to juries is quite a worry.
So, this guy will still be stigmatised as a paedophile, all for the price of some virus checking software...
The point of trojans generally is that they let the evil hacker commit crimes in a less trackable way: Whether it's DOSing Yahoo, defacing websites, or cracking into banks. It seems logical to extrapolate that that they could use it to download and archive their child pornography as well, leaving all tracks pointing to the poor trojaned PC owner, while the hacker disappears into the night. While it's obvious that defenses like this mean that every child porn fanatic is going to stick a trojan on their PC to have a legal out, realistically it means that law enforcement should consider options when they move in on a suspect, such as monitoring all incoming and outgoing traffic for control commands, etc, or replacing the user's PC with a honeypot.
I read this story about a week ago. It worried me a lot at the time for the precedent it sets. From the story, either someone was out to incriminate this guy by planting child porn on his computer or this guy really did download it and he is up against some really pathetic prosecutors. We read that he has been attacked in his neighbourhood, and that he is an all round family man. Fine. But that in itself doesn't make the story more credible... Either way, the guy responsible has got away free. Isn't that the most worrying thing...
"...of making a virus that downloads child pr0n onto a remote computer? I thought virii were created to wreak havoc, not frame random computer users... or am I wrong? And furthermore, if a jury can believe this defense, what's to keep all the imminent RIAA and MPAA suits from being defused by the same argument? FIRST POST! WOO!! "
Didn't wreak havoc? The guy lost his 500 pounds a day job, didn't work for two years, got his named associated with child pornography...this trojan already made him lose out on two years of his own life. I'd say that constitutes as wreaking havoc.
See, its not a problem that the odd inncent person has his life ruined by association with crimes that they did not commit, because we're dealing with kiddie porn! Sure, a few people will have their lives ruined, but it's kiddie porn!
I personally think that we should skip the trials altogether. Sure, some innocent people will end up in the nonce wing for life, but it's kiddie porn!
Won't somebody please think of the children!
O.K, I'll stop now. I don't even know if I'm being sarcastic any more...
I find it entirely feasible that a person would not notice a large amount of files added to their computer. Not all people know their computer well enough to notice image files being added onto their hard drive - particularly if added to a system directory or somewhere a casual user doesn't normally peruse. Take OS X for example - I could load tons of files into the /var directory. To see the contents of /var on a normally configured OS X machine you have to go to the terminal or specifically configure the file browser (Finder) to make those type of directories visible. On my Windows 2000 machine at work I cannot browse the WINNT directory unless I click on Show Files (after reading the "This isn't the directory you're looking for. Move along now." warning). I'm 99.99% sure that I could add a gig of porn to my parents hard drive and they would never be the wiser.
Because those of us at Slashdot are more technically adept and let's face it - our computers are a major part of our day-to-day life - we assume incorrectly that everyday people are more capable with their computers and see them more than just a box that balances their checkbook.
Whether someone is insane, is experiencing delusions or not, this should not mean that the person does not need to be taken off the streets.
I don't care what is the reason sopmeone pumps the guy's head full of lead. Insane or sane. They need to be taken off the streets for everyone else's protection. No nonsense about "you were insane, so you should go free".
But then, what about "I was insane, it was temporary. Now at trial, I am sane. Because I was not responsible, I must not be punished."? Hey, if you could be temporarily insane before, then you can be temporarily insane again. You need to not be walking the streets.
Hey, I'm not responsible! Each time I killed one of those 14 victims, I was insane at the time. I am sane all the rest of the time. I am sane now. I should not be punished for something that I am not responsible for.
The voices told me to clean the guns today.
I'll see your senator, and I'll raise you two judges.
First, there is negligence for allowing one's computer to become infected.
Someday, we may be able to claim this. But I'm really uncomfortable claiming it today.
A couple of computers got hacked. One of them was with a vulnerability that I hadn't even heard of yet in samba; I got my Debian announcement later that day.
Right now, even the most updated computer is just too full of vulnerabilities to make a valid case that it should be possible to maintain a computer that has no vulnerabilities at all. That line of reasoning is too dangerous, and will make felons of us all.
Not that it's a bad idea in theory, but the times aren't ready for it.
In this case a crime was committed. Whether the crime was committed by the accused or some unknown third party is irrelevant. All that is relevant is known security holes and popular complacence allowed the criminal(s) to escape prosecution. Would the firewall banned by the ISP had helped this guy? Who knows. Will following the paranoid government route of building back doors and escrowed keys into every so-called secured system make the situation worse? Probably. The government will have great motivation to prove their protocols are one hundred percent secure, and will have no motivation to make sure justice is done by finding the real criminals.
"She's a scientist and a lesbian. She's not going to let it slide." Orphan Black
I was discussing this very notion with a co-worker not to long ago as a way to get around the RIAA. If someone writes a virus that connects to P2P networks would you be liable for songs downloaded onto your machine if it was discovered that you were infected?
And drinking is the interesting analogy because you generally begin sober and aware that drinking will lead to a lack of accountability. In many jurisdictions, this knowledge means you are still liable because the ultimate consequences are forseeable.
So now, what if I offered a site that wanted to distribute a banned kind of material (kiddie porn, secure encryption technology, that kind of thing) and it was known that anyone connecting could not legally ask for what they surely wanted. Isn't the obvious solution for me to make a virus that will "helpfully" download it for you? You'd just pay for "time at my site" browsing my fine HTML pages, not for the content. But, magically, the content would just get thrust upon you. Escort services use this dodge. Customer pays for time, not service. But customers get service, typically, or they don't come back. Still, legally, the transaction may be quite distinct from prostitution (so I'm told).
Then again, the escort service model obliges me to come to the issue of "victimless crime". Driving drunk and injuring someone has a victim, and we want to fix the legal system to minimize such cases. Escort services have no obvious victim, IMO, and so I'd argue the other way--that perhaps the simpler solution is just to legalize prostitution.
Child porn is caught in between these two scenarios, I think, with some parts of it falling into one scenario and some into the other. Certainly, if the pics are of real children, then that's bad. But it's within range of technology to make the entire industry based on fabricated images. Then who would be the victim? If no child was abused in the taking of the pictures, for all we know, the people in possession of them are sublimating urges they might otherwise carry out. Is taking the photos away going to cause them to not have the urge? Or just cause them to be out on the street seeking real children? We're so quick to make assumptions in this area, I just don't know why we don't just make a death penalty for anyone even suspected of child abuse or kiddie porn and be done with it mercifully, because nothing the person can do for the rest of their life after they're found in possession of something like this will ever be normal.
When I see a child being abused, it's not erotic to me. That it is to someone shouldn't make it a crime for me to see it--maybe I and all of us need to see that picture to understand someone's outrage about a crime. How do we know when someone is seeing something for a "legitimate" reason or not? There may be pictures of murders that arouse people, but we distinguish between "snuff films" (which are illegal because of their filming technique, not their content) and other films about murder, because murder is a fact of life we need to understand. I am alarmed at the concept that the mere possession of certain kinds of topic material, in and of itself, a crime. Who will study this crime if no one may possess its materials? Will images of murder, of feces, or other things that turn others on but not me one day also be illegal to possess? Where does it stop?
Sure--people are legitimately angry at people who harm children, and they want someone to punish. They can't catch the guy who makes it, so they find someone else to lash out at. (The drug war is the same way. Sometimes drugs cause problems, so we make all uses of drugs illegal whether they hurt anyone or not, just so there's always someone handy to punish when we're mad.) I just hope that in our rush to make it possible to punish people who too easily elude our present systems, we don't take away rights which are not causally related to any kind of harm. And I have to say, the idea of criminalizing the viewing a picture, any picture, in privacy, whether it's a field of daisies or a torture chamber somewhere, is
Kent M Pitman
Philosopher, Technologist, Writer
Kinda makes you want to update your virus detection/bot detection/firewall/etc, doesn't it?
That may not help much. A couple years back, I inadvertently started a minor "research project" at a place I was working by checking out a link to a bit of cute satire sent to me by a friend. I chuckled at it a bit, and then forgot about it. For about one day. When I came in the next morning, the NT workstation that I'd used was showing a rather pornographic picture.
I quickly verified that the site was indeed primarily a port site, though it did have some good cartoons and satire in a few directories. My friend had looked at it from a unix-type system, using netscape, and didn't see any of the porn.
I showed it to the other guys in the lab, and we investigated. We found that the site sent something in the first web page that we couldn't decipher (as it wasn't any sort of standard html), but which caused the browser to fetch the site's main page every day just after midnight. Most of the time this page was pornographic.
This only worked on Windows, though it affected both IE and Netscape there. The only way we found to prevent it was to turn off all scripting. This couldn't be done in the browsers; it had to be done on a system-wide basis. And the place to do it was different on nearly every Windows machine we had, so I can't tell you how to do it on your Windows box.
I don't work there any more, but I wouldn't be surprised if some of the machines there are still downloading porn every day just past midnight local time. A lot of the machines were used for testing java, javascript, active-X, and other scripting languages, so we had to leave such things enabled.
We did wonder whether the folks monitoring the network noticed that we were apparently sneaking in at midnight and downloading porn to a number of the lab machines. We all thought it was pretty funny, and a good example of why you should disable all scripting. Virus protection and firewalls won't help you. If any of your installed packages can ever interpret any downloaded text as commands, you are vulnerable. And on Windows, automatic execution of content is turned on by default in more packages than you want to think about. Unless you can find all of them and disable this execution everywhere, you are vulnerable to having your disk filled with porn.
Unixoid systems tend to be more sensibly run, and such things are usually off by default. But not always.
Anyway, it does make for a good defense. Especially if you're running Windows, where it's so difficult to even find such things and disable them. We had a bit of fun showing this to some of the more important folks in the company's network management team, and innocently asking them if they knew how to prevent this problem. They were obviously a bit embarrassed by not being able to give us good answers.
Those who do study history are doomed to stand helplessly by while everyone else repeats it.
Most people, if you kick their dog, won't kill someone.
What's the difference between someone with a mild 'illness' like a hair trigger temper and a true ilness (NGRI)?
Should I plead 'hair trigger temper' and get anger management counseling?
Seems like both make a person unable to function in normal society doesn't it?
The guy is a sicko. No doubt about that. Second, I have a real problem with the way they seem to be handling kiddie porn prosecution. They are going, it seems, after the users and not the sick bastard who took pictures of the children in the first place, and put them up on the web. If the kiddie porn producers are taken care of, then the user end pretty much gets taken care of by itself. I ain't saying that these sickos should not be watched. If you download them, chances are, you will upload them. So, yeah they should monitor the guy. I never said that what they user does is right either, it's just if the picture does not exist to download, well, you get the idea. He'll just have to go somewhere else for his sick fantasy. Also, there are a ton of porn sites that ride the edge in my opinion. I mean have you ever gotten a e-mail (that was not filtered yet) and the girl in that porn spam looked like she was WAY too young. I have seen this time and time again (SPAMMERS! Got to hate them....).
Gorkman
I imagine many of you have used P2P apps like KaZaA. I'd bet money that almost all of you even downloaded some porn with it. Don't be bashful. There's nothing wrong with it. However I'm sure you too have noticed the overwhelming amount of BS crap files that get turned up in searches. Many of them say "underaged" or "pre-teens" or many other things that indicate a minor child. And many of them are pure junk and are simply pictures ripped from a Girls Gone Wild video. However some times you end up downloading a picture you just can't identify. You really can't tell if those are kids, flat-chested and baby-faced college seniors, or midgets. If you don't delete these files and leave them on your computer, are you now guilty of having child pornography if someone proves that the picture you downloaded 1 year ago and is still in you junk directory?
Lets say for example that your ex knows you have porn on your computer. Hell she and you used to watch it together. You break up with her and she's pissed. She makes an anonymous call to the police one night when drunk. The next day and overzealous police officer has a warrant from a judge looking for some good PR for the election coming up. They confiscate your computer and arrest you, even though all they have as proof is the anonymous tip. A lab goes through your hard drives and CDs while you're grilled by a cop with bad breath over how you abuse children. You don't want to call for a lawyer because you don't want to seem guilty. You think it's all a big mistake. The lab boys come back with the porn. The cops browse through it. A picture comes up of Devon in her early years. "Does she look like a minor to you, Bob?" "She sure looks like a minor to me, Chuck." They arrest you and charge you with child pornography, even though they have confirmed that the person in the photo is a minor. The PD and DAs office goes public to say how they've arrested a vile child pornographer. Media coverage. Citizen outrage at him. yadda yadda yadda. In the meantime he's arrained. This gives an assistant DA time to go through all the porn on the hard drive. Whoops. It turns out that the photo the cops thought was child porn wasn't. Hell it obviously wasn't. Damn overzealous cops. Nevertheless he goes through all the porn. He even enlists the help of a person in the pornography business who can recognize many of his fellow actors. Finally they come down to a small handful of pictures that no one can identify. Of these 3 could be of a minor. The DA picks the most child-like photo as proof and goes to trial. The prosecution paints the defendant as a vile, horrible child pornographer. A few of his ex-girlfriends step into the lime light to say how he was abusive or was obsessed with kids or some other bullshit like that. The defense lays out the facts of law and that the photo can't
I really can't see anything objectionable with just looking at pictures and jacking off. Frankly, if these people have to get their rocks off, isn't it better they do so into a box of Kleenex? If some nonce is at home having a w@nk then he's not out there doing any *real* damage; nor is he likely to be capable of any real damage for a few hours.
I say - decriminalise mere *possession* of images and concentrate resources on the *real* problems. For a start, find out what the real problems *are* instead of going around in denial (which is what the vigilante mobs are doing; they set out to attack suspected paedophiles to reinforce the idea that they themselves couldn't possibly entertain such a notion).
The amount of harm done to a child by the manufacture of one pornographic picture of them is the same whether one person or a million people look at it -- as long as looking is all they do. Remember the old rule of "innocent until proven guilty" - it used to be a principle of British justice.
Je fume. Tu fumes. Nous fûmes!