Slashdot Mirror
The Virus Did It
scubacuda writes "The Inquirer and Get Reading report that a UK man accused of having pornographic pictures of kids on his computer was acquitted after a court heard that his machine was infected with a Trojan on his PC which probably auto-downloaded the images. (In light of moves like Operation Ore, we'll probably hear more defenses like this.)"
...of making a virus that downloads child pr0n onto a remote computer? I thought virii were created to wreak havoc, not frame random computer users... or am I wrong? And furthermore, if a jury can believe this defense, what's to keep all the imminent RIAA and MPAA suits from being defused by the same argument? FIRST POST! WOO!!
"Life in every breath... that is bushido"
- Bill
The more it goes, the more I think that the main issue of online security is not the protocols (SSL, SET...) but the security of the endpoints, and particularly of the clients.
I would not be surprised if we found a virus that searches through the local (and even LAN-accessible) documents for interesting keywords or types of information, then somehow manages to send this information back to some spying agency. In fact, I think this has probably already been done.
Imagine the potential:Of course, most corporate networks are firewalled. Still, lots of binary data is exchanged. You just have to hide yours in the flux... Do you really think this would be noticed in the middle of a virus attack?. Traffic analysis would be thwarted by the viral attack sending information in many directions, with no obvious destination. Onion peel routing and distribution through Usenet or WWW bulletin boards could do the rest - untracable information.
Very dubious indeed. I find it very hard to believe that he did not notice several image files appearing on his drive. Also such paedophiles are monitored very carefully, and not without reason.
This may have been a case where the jury and judge knew very little about the natures of trojan and computer.
I am a man, not a toy.
This case sounds interesting for a couple of reasons. The defendent's entire case is out the window, of course, if the prosecution shows that the virus was not responsible for downloading kiddie pr0n. Assume such a virus existed for the sake of argument.
First, there is negligence for allowing one's computer to become infected. A related precedent would be the owner of a condemned house allowing it to become a crack house. IANAL, but in a lot of ways it seems the cases are similar. One could claim that the software manufacturer (MS) was responsible for faulty software, or that the virus writer was responsible for letting loose his creation. In the same way, the crackhouse owner could claim that the lock manufacturer did a poor job, or that the addicts breaking into his house were at fault.
Second, if computers become more like personal extensions of ourselves, indispensible, parts of our consciousness in some far-fetched way, then the defendent might take the insanity route. That is, "God told me to take 7 wives and this girl is one of them." However, computers are subject to more detailed forensics that people's brains, so claiming an insane computer might not withstand much scrutiny in court.
"Provided by the management for your protection."
With that out of the way, I find it amazing the lengths people will go to to blame anybody or anything for their actions but themselves. "I didn't download pictures of naked children, the computer did it!" or "I didn't willingly throw myself upon a flaming mattress, that show on MTV made me do it! or "I didn't want to get pregnant, it was HIS fault!"
I apologize for this somewhat offtopic rant, but it's this kind of lack of personal responsibility that's eroding our society.
There's a Mercedes gap too. I want one and can't afford one, but it's not government's job to do anything about it.
But maybe in the future it would.
With all the programs that offer to manage your financial account details, all it would need is an app that automatically fills in those credit card numbers for you when you go to buy something.
Then all you need is a Virus that can get at that data and bingo - a Virus that can sign you up to all sorts of things, and all in your name.
Now imagine if that Virus ran, signed you for an annual subscription to a porn site (at a time you were logged in and browsing) before deleting itself without a trace. Try getting your money back then.
This is why all kinds of automation should be rejected and our non techie friends educated.
Basically if its on the machine, assume that someone else can get at it.
>No.. no... the virus not only downloaded the
>porn, but also used his credit card information
>to sign up for the site, confirmed his
>subscription via email,
If it got his credit card details, registering to a porn site would be no problem. You don't even need his email.
This would be a viable defense IMHO.
--
GCP
My brother called me one day to say that his new computer had run out of disk space and he didn't know why. I connected to his computer via Remote Desktop and browsed his folder and when I got to his My Music directory it was full of 7 gigs of movie files, none of which he had seen before. I deleted them and suggested he get a firewall program.
Sure enough, as soon as he got his firewall up he got a slew of alerts about people trying to connect to his computer. I make sure I keep my firewall up at all times now.
The articles don't mention why the authorities looked on his PC for kiddie porn. What tipped them off?
I suspect there's much more to this case than the articles mention.
Anyway, with P2P getting more sophisticated, efficient and private, I can easily see this happening a lot. Of course, I don't think anyone should be guilty in cases like these. Apparently, neither do the British courts.
2001-12-25 02:34:02 Porn trojan virus? (articles,security) (rejected)
I've seen and disinfected a laptop of a friend who was infected with a virus that downloaded porn pages in the background whenever he connected to the internet. I guess it was to collect link credits. His history and cache would fill up with porn crap and he claimed to not be visiting the sites. At first I didn't believe him (obviously) and was surprised when I saw the behavior for myself. Beware!
I see a lot of comments about - wink, wink - sure it was the virus, or dumb ass for executing a Trojan.
My first lesson with an improperly configured Linux box outside the firewall was when my ISP called asking about some insane bandwidth use. What? I checked the box and it seemed fine. Found out the traffic was on FTP, which I was not using. Sure enough, tons of porn and other files were getting uploaded and downloaded... all the files in a hidden directory. The box was owned, and I ended up rebuilding from scratch, this time leaving services off I did not actually use and patching some of the services I did. Than I discovered ssh and a few other key insights that were new to me.
I cannot believe I am the only one this kind of thing happened to...
+++ UGUCAUCGUAUUUCU
A couple of months ago CSO magazine ran an article about a similar problem, except it was coupled with the threat of blackmail.
Could it possible that this (or something similar) can get an innocent victim arrested? In a less technologically literate or a far more fundamentallist culture, the "virus did it" defense probably won't work . . .
I agree to a certain extent but..
What if you wake up in the middle of the night and find someone in your house hurting a family member. You approach the situation and the person starts running away. I do not know exactly what I would do but there is a chance that the average person would be inclined to chase him down and cause great harm with any weapon they could find. Does that mean you'd be a potential harm to society and should be locked up? You were never a treat to the general public, only someone that was causing harm to your family. Granted the person was running away so technically you may still be able to claim self defense. There is no cookie cutter answer for every situation.
Bad boys rape our young girls but Violet gives willingly.
So, the day has come at last. I must say I'm surprised, as I've been expecting it for over 5 years.
The point is that the law has to decide how much responsibility a person has for what their computer decides to do.
Up till now, the assumption has been that whatever your computer does, is done at your request, and you are wholly responsible. This despite the fact that that has never been true, and is getting further from the truth every year.
There is no legal tradition to apply here. The nearest analogy to the relationship between a person and his computer is the relationship between a man and his dog.
People have kept dogs for thousands -- most likely tens of thousands -- of years, so everyone has a rough idea what the deal is. The general legal view is that you have a duty to keep your dog from causing harm under forseeable circumstances, but there is a distinction between what your dog does and what you do. If your dog attacks a child, you are not guilty of Grievous Bodily Harm, but you might be guilty of keeping a dangerous dog. If your dog craps on the street, that is different than if you crap on the street, but you might still be fined.
If you are found guilty of not properly controlling a dog, you can be banned from keeping one. If your dog causes harm and is considered not to be controllable, the court can order it to be destroyed.
(If you deliberately cause your dog to kill someone, that is still murder of course, but your intention is crucial)
This is the only rational legal framework for crimes committed by a computer without the intention of its owner.
When will computers that run MS-Windows be ordered to be put down?
Guy was accused of having pornographic pictures of kids on his computer, right? Well he did! It's purely mitigation that it wasn't his fault - but legally it was still his responsibility, if the law was written that way. Bit like receiving stolen goods law.
Now if the burden of proof becomes the presecutor's to PROVE the defendant knowingly downloaded the material (as opposed to reasonable likelyhood),then we're going to get a lot of ISP log requests to differentiate between an upload by nastyware and a download by user.
UK law regarding child pornography is so broken as to be seriously unfunny. The police are currently interpreting the law in such a way that if the police can find five images of child pornography on your hard drive, by any means, then you are guilty. Almost uniquely in non-negligence law there is no need to prove intent. As a result it is an easy means for them to get their statistics up so it is zealously persued.
Now consider the "by any means" bit. As far as I can tell they do a block-by-block analysis of the hard drive. So deleted files, swap and linked files are all identified. So if you use your web browser to read your email and you are sent an email with five indecent images then you're toast. Deleting the mail message doesn't help because the downloaded images still live in your cache. Purging your cache or letting it time out doesn't help unless the blocks get overwritten by other data. If you try to explain this to the police man/woman you will be told that your questioner doesn't use the net so they can't understand what you're talking about.
(Incidentally, none of this is hypothetical. I have a friend going through this hell right now.)
As for the list of credit cards, the confusion within the British Parliament beggars belief. One rabid member of parliament was on TV describing how they could still prosecute paedophiles from the credit card trail even if no images could be found on their computers. At the same time a minister in the Department of Trade and Industry was describing how terrible a problem identity theft was!
Incidentally, under UK law it appears that you are not allowed to challenge the alleged ages of children in pornographic images with a medical expert witness.
Put bluntly, the UK law on child porn sucks. The law has all the hallmarks of legislation brought in in a state of panic.
Those who do not learn from Dilbert are doomed to repeat it.
Don't like the guy next door? Next time he's out, get into his house (where I live most people leave a door unlocked or window open, so this wouldn't be difficult) and download some KP to his computer.
... "But Your Honor, I swear I didn't even know it was on my computer! Someone must have planted it!"
If you want to be really tricky, hide it somewhere he won't find it, and come back once in a while over the next couple o weeks and download some more, delete some of it, etc. -- make the activity look "real." Hell, use his CD burner to put some on CD and stick it in the mess he no doubt has on his desk.
Then call the cops and leave an anonymous "tip."
There's no chance anyone will ever believe him; even if you left fingerprints galore all over the computer there's no way the cops would waste their time checking -- why try to help that sick pervert?
___
On a less hypothetical note, let me say you don't even need to waste time planting it. A friend of mine had a tussle with his roommate six months ago and ended up calling the cops on him (for legitimate reasons; his roommate has been arrested more times than I can count, he's a bit on the aggressively drunk side).
The roommate decided to get even by telling the cops he'd seen KP on my friends computer. They took it away from him (he needs it to work) and told him he'd have it back in two weeks if they found nothing on it; it's been six months...
Yeah, or if it passes through the machine in unencrypted form, even. This is why passwords and credit card numbers (and similar) suck, and why we need biometric identification instead. Credit card numbers are the worst, because you regularly show them to people at stores and whatnot.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
This guy really got screwed. Unfortunately he had gotten screwed for years. The story started with a bright young senior in HS in a small town preparing to join the military. Unfortunately he was accused of something (I forget what). The woman described the person, police found this teen that fit the description, and arrested him. She said it was him and it went to trial. The problem however was that this boy had a rock solid undeniable alibi. He was with his HS principal at the time of the incident. There was no way he could have done this since we can't be in two places at the same time. The jury still convicted him though. That ruled out his military hopes and dreams. He went to work in the town's mines. Later another crime was committed. Police always suspect the previously convicted first. They brought him in. This person IDd him as well. Here comes another trial. Once again he had a rock solid alibi with a very credible person. Once again the jury ignored this and convicted him out of prejudice. This guy was screwed repeatedly by fuck ups. In a legal system such as that, has can any innocent person expect a fair trial?