The Story of the Pedophile-catching Hacker

missing30 writes "A Turkish hacker seeding usenet groups with trojan horses has made it a habit to hunt down pedophiles trolling the groups. The cases go back to 2000, with the mysterious good samaritan responsible for several arrests. The man now has tacit approval from the FBI for his actions." From the article: "At the urging of Montgomery Police Capt. Kevin Murphy, '1069' eventually turned over more and more information that led back to a computer owned by Bradley Joseph Steiger, who had worked as an emergency room physician in Alabama. The hacker's finds included information from Steiger's AT&T WorldNet account, records from his checking account, and a list of directories on his computer's hard drive where sexually explicit photographs were stored."

Comments

I say the ends don't justify the means.

[rodgster]

I say the ends don't justify the means.

I don't think the police should be allowed to use illicitly gained information or that they should be allowed to encourage private citizens to commit felonies.

>
>"we have not seen anything to indicate that this person is other than...a citizen of Turkey."
> That turned out not to be entirely true: The FBI actually had made contact with "1069"
>through a U.S. phone number
>

Where does it end?

If it is OK to do to catch pedophiles then it is OK to do the catch terrorists and I know I've read several accounts of where patriot and other anti terror acts have been used for entirely unrelated crimes.

Re:I say the ends don't justify the means.

[Rolo Tomasi]

I'd rather have private hackers do it than the government.

Re:I say the ends don't justify the means.

[Ph33r th3 g(O)at]

If the government is making under-the-table dealings with "private" crackers, what's the difference?

Re:I say the ends don't justify the means.

[Anonymous Coward]

I'm rather worried that hacker can put information onto someone else's computer (photos, jpegs, etcetera) and then turn around and finger that person to the police. With an open net connection 24/7 and the ability to hide/decrypt things or just plain old hiding folders in bizarre/out-of-the-way directories, there is no telling what is on someone's computer at all times. In addition, harddrives are so big now, small movies let alone hundreds of photos can escape detection (hey, why is my drive capacity getting continually smaller?)

BTW, I am not saying that is the instance in this case nor do I believe it, but vigilante justice opens up the whole system to abuse.

Re:I say the ends don't justify the means.

[Dun Malg]

I don't think the police should be allowed to use illicitly gained information or that they should be allowed to encourage private citizens to commit felonies.

Thing is, 4th Amendment protections only prohibit the government from illegally searching your property. If a burglar breaks into your house and steal a sack of the counterfeit money you're printing then later gets caught and fingers you, the 4th Amendment doesn't apply. They still need a warrant to search your place, but the sack of C-notes with damp ink are easily enough to get one. Now, if the government hires a burglar, that's a 4th Amendment no-no; otherwise, you can press charges for criminal trespass if you like-- from your prison cell. The moral of this story is that if you're a criminal, be careful about protecting your stuff from other criminals, particularly if they "have it in for you". Nothing new there.

Re:I say the ends don't justify the means.

[TheSkyIsPurple]

The difference is that the government was prosecuting the burglar already... they were pursuing him for a crime, which means they didn't approve his actions.
If they are not going after this guy, then they are approving his actions, and he's effectively working for them, and the evidence is subject to 4th ammendment protections.

At least that's how it looks in my head

Re:I say the ends don't justify the means.

[Deltaspectre]

What? This?

The phone rings at KGB headquarters.

"Hello?"

"Hello, is this KGB?"

"Yes. What do you want?"

"I'm calling to report my neighbor Yankel Rabinovitz as an enemy of the
State. He is hiding undeclared diamonds in his firewood."

"This will be noted."

Next day, the KGB goons come over to Rabinovitz's house. They search
the shed where the firewood is kept, break every piece of wood, find no
diamonds, swear at Yankel Rabinovitz and leave.

The phone rings at Rabinovitz's house.

"Hello, Yankel! Did the KGB come?"

"Yes."

"Did they chop your firewood?"

"Yes, they did."

"Okay, now it's your turn to call. I need my vegetable patch plowed."

http://www.netjeff.com/humor/item.cgi?file=kgb.txt (and found at http://it.slashdot.org/comments.pl?sid=194175&cid= 15918611)

Re:I say the ends don't justify the means.

[sdriver]

I don't wear a shirt you insensitive clod!

Re:I say the ends don't justify the means.

[gutnor]

Especially that planting evidence against you can have tremendous impact. If the hacker can access the private machine of an individual for a while, it is not technicaly very difficult to create evidence that stand up against first examination ( i.e. mixing true family photo with closely looking child, ... ), especially if the hacker is motivated by the ex-wife, an employer or concurrent.
When you have been investiguated for child pornography you can say bye bye to a normal life.
Think about what it can do to your marriage, or about the common belief that if somebody has been investiguated, he is not completely clean ( especially in case like this).
And if we are talking about terrorism you can even wake up in guantanamo stripped from all your legal rights.

Re:I say the ends don't justify the means.

[cfulmer]

The difference is whether it's a violation of the 4th amendment or not.

Here's an analogy: Let's say that your neighbor trespasses through your backyard and, in doing so, happens to look through your window and sees you molesting a child. If he goes to the police and says what he saw, should they be able to act on it?

Is it different if he silently broke into your house to steal some silver and happened to look into a room where you were doing the molesting? What if he happened to have a camera and took pictures?

My point is that you have a reasonable expectation of privacy in your house, and the GOVERNMENT generally can't invade on that privacy without a warrant. If they do, then evidence they get can't be used against you. This is the "exclusionary rule," and it's intended to prevent the government from conducting searched and seizures in violation of the 4th Amendment. The rule itself, though, is not actually constitutionally required -- there would just need to be an alternate way of handling with 4th amendment violations that provided enough of a disincentive.

In this case, the government's not doing anything wrong -- somebody just dropped this in their laps. Telling them "sorry, you can't use that" doesn't deter ANY behavior -- it doesn't keep the government from invading your computer AGAIN, because they didn't do it in the first place. This Turkish guy would probably continue to do it, possibly choosing instead to publish the guy's information on-line. Heck, if he had that much control of the pedophile's computer, he could just send an email from the pedophile to the FBI saying "I just wanted to show you what I have stored on my computer" and attaching a picture. Should the FBI ignore leads like that as well?

Re:I say the ends don't justify the means.

[budgenator]

Last time I was in the Jury pool, the presecuter went to very long lengths to explain the difference between "preponderance of evidence", "reasonbable doubt" and "any Doubt" blurring the differences tends to get you excused from jury duty. The truth is once the FBI gets interested in this guy and supeneas ISP logs, they can start looking at what he's actually downloading, when the pics are downloaded, when the 'puter was accessed through the subseven backdoor and what the timestamps on the illegal material is; the guy going to be toast anyways. I'm sure his logins quickly got transfered to the "special server" that does a more meticulous job of logging than the "normal servers" do. Imagine the task faced durring discovery when the prosecution sends over 5 or 6 DVD's of server logs of everything that came out or went into your clients computer. The Gov can throw a lot of resources into a prosecution and even an ER doctor is going to get bled dry by expert witnesses at $300.00/hr to counter the governments experts.

Re:I say the ends don't justify the means.

[Maxmin]

The other thing the Constitution says is that you have the right to confront your accusers. Ah, who is the accuser in this case? An anonymous person! Could the FBI and the police have made this person up? You don't know. Dilemma.

If the doc has any mettle, this case would likely go to the supremes, as clearly there are unanswered questions.

Re:I say the ends don't justify the means.

[ultranova]

The truth is once the FBI gets interested in this guy and supeneas ISP logs, they can start looking at what he's actually downloading,

Irrelevant, since once you gain control of a computer you can make it download anything you want.

when the pics are downloaded,

Irrelevant, since there's no way to know when the hacker first gained access to the computer.

when the 'puter was accessed through the subseven backdoor and what the timestamps on the illegal material is;

Irrelevant, because

1. The computer is able to run timed jobs; that is, the hacker can tell it to download child porn two hours after the hacker disconnects and
2. There's no way to know how the hacker gained access to the computer; even if there's evidence to one method, the hacker could have used another and simply planted evidence pointing to the first. Specifically, this guy could have gotten a virus or trojan which contacted the hacker (indirectly, of course) for instructions, removing any trace of inbound connections.

The Gov can throw a lot of resources into a prosecution and even an ER doctor is going to get bled dry by expert witnesses at $300.00/hr to counter the governments experts.

So basically guilt and innocence are based on how much money the accused has. I'm starting to think that US courts deserve to be held in contempt.

So it's OK?

[bky1701]

To hack anyone as long as you say you are hacking to catch "pedophiles"? Sounds more like the FBI trying to side-step normal limitations of spying on people.

You're obviously a pedophile.

[Anonymous Coward]

Only a pedophile would have anything to hide from hackers. I bet you hate America. Please turn yourself in to your nearest police station or orphanage. Thank you.

yeah

[misey]

that's awesome, and it may give those fbi agents a different view on things like the 2600 magazine, Off the Wall/Hook, and Emmanuel Goldstein.

Yeah

[Walzmyn]

Mild mannered pedophile catcher by day...
Evil identity theif by night.

Yeah, what's the next step?

[someone1234]

Next time a hacker will plant the images himself and then get brownie points with the FBI.

It's called a "search warrant".

[khasim]

I'd rather have private hackers do it than the government.

If it is going to be done, then it should be by the government and they should be required to get a search warrant.

Otherwise, anyone in ... say Russia for example, can crack your computer and search for child pornography ... and credit card numbers.

Oops. Sorry. Those credit card numbers were accidentally leaked, along with your Social Security Number and such.

But at least those Russian "hackers" know you weren't collecting kiddie porn.

Re:It's called a "search warrant".

[zecg]

Otherwise, anyone in ... say Russia for example, can crack your computer and search for child pornography ... and credit card numbers.

Also, they also can plant the pornography themselves, once they root the user's box.

Re:It's called a "search warrant".

[lawpoop]

I am absolutely against vigilante justice. We need government to do it properly, ot allow for oversight and prevent abuse.

Hut part of me says, how is this different than an anonymous tip? What if someone called the police and said "I was using my roommate's computer and found these images..." and the police asked him to go in an investigate further?

Re:It's called a "search warrant".

[TheGavster]

The police shouldn't be asking the roomate to investigate further. They should tell a judge "we think this guy is doing X", get a warrant, and investigate themselves. If you don't have enough evidence to support convincing a judge to issue a warrant, I would suspect it's just a fishing expedition. I mean, seriously, how hard is it to find probable cause when the searchee isn't even present to defend themselves?

Re:It's called a "search warrant".

[LurkerXXX]

Hmm, hack a box, steal credit card info, identity info, then plant kiddie porn and tip off cops.
The patsy is busy with a trial followed by a long trip to jail, leaving no time for him to find mysterious credit card/mortgages/loans charged to his identity. Sounds like the way to get a long lead when your job is identity theft. Scary.

Re:It's called a "search warrant".

[hords]

Heck, they could even surf child porn sites from your machine and use your credit card and identity to purchase access to such sites. Who is to say that the hacker isn't the pedophile?

But your honor...

[gwayne]

This hacker obviously planted that child pornography on my computer with a trojan, in an attempt to blackmail me, a promonent local physician...

Re:But your honor...

[legoburner]

Good point, if the defendant can prove they did not have absolute control over their computer, perhaps the charges are null and void. Only if the FBI were directly monitoring him after the tip off would he not be able to use that defense, and even then it can be argued that it was a hacker making his computer do it, making it look like him.

Re:But your honor...

[telchine]

I've read that this is quite a common excuse used by people caught in posession of child pornography in the UK. They say "look my wi-fi connection isn't encrypted, it could have been a hacker that put those images there". Apparently it doesn't work as a defence because they are responsible for the security of their own computer.

Interestingly though, if they catch someone stealing an Internet connection via unsecured wi-fi, it's the person who is using the connection that is at fault, not the person who's failed to secure their Internet connection.

Re:But your honor...

[cpu_fusion]

if the defendant can prove they did not have absolute control over their computer, perhaps the charges are null and void

I am not yet a lawyer, and this is not legal advice, but I'd say there are two problems here. The first is that judges and juries don't understand technology the way we do, and all they will have to go on is expert witnesses, whom the prosecution would deliver as well as the defense. The second is that when the DA offers a deal, which they will given the desire for an easy conviction, the suspect have to ask himself if he wants to take a very big gamble.

In a more perfect world, plea bargaining wouldn't exist (nor be thought of as "necessary" by a system loaded with vice-crime offenses), our courts would allow scientific facts to be determined through inquisitorial "expert" judges rather than juries, and the FBI and law enforcement wouldn't be cooperating with self-confessed law breakers to catch innocent-until-proven-guilty suspects, who at worst are shown simply to possess an image of an act (not actually participated in the act) no more or less heinous than videotapes of the twin towers falling and killing 3,000 people. (i.e. the images themselves are just images, its the unprovable-without-confession arrousal that is the sick act.)

Anyways, G-d Save the Constitution.

Re:But your honor...

[Peaker]

Its not the "sick arousal" that's the problem.

The images are a problem if they encourage people to go catch kids to make those images.

If a guy is unlucky enough to be a pedophile, he is expected to avoid sexual satisfaction as to avoid harm to children. You can't expect something that's probably genetic or in any case not in the control of the person to be controlled (i.e aroused by child porn) but you can expect him to do whatever is necessary to not act upon those urges.

The pictures of the WTC are not the encouragement for such acts, and are not problematic - so you cannot compare them with the images that required child abuse and made only for those who seek to view them.

Re:But your honor...

[Sage Gaspar]

who at worst are shown simply to possess an image of an act (not actually participated in the act) no more or less heinous than videotapes of the twin towers falling and killing 3,000 people. (i.e. the images themselves are just images, its the unprovable-without-confession arrousal that is the sick act.)

As far as I understand, the rationale behind child pornography laws isn't the arousal, it's the implicit support of child pornographers. The Supreme Court struck down the parts of COPA that made virtual child porn illegal, and I'm guessing that virtual child porn has pretty much the same "arousal factor" as the real stuff.

Real child pornography is illegal because it damages the child. Your possession of it has, in a sense, made you complicit in its creation by giving them motivation. Basically, I think it comes down to that they're really looking for the person abusing the kids, not the deviant jerking off to it, but they need some leverage over the deviant to get to the people producing the images. Also, possession of large quantities of said pornography probably has a pretty high correlation to people that directly supported the making of it with their money or have actually perpetrated such acts in reality.

I'm not sure I agree with that stance, but it is a real tricky issue since legal minors are involved. I honestly don't know how I'd fix it.

What about me?

[telchine]

I've been doing something similar, I've been stalking around on Napster and the like since about 2000, gathering "evidence". I now have quite a healthy collection of "evidence". I wonder if this will work as a defence when the RIAA come knocking?

Does this terrify anyone else?

[zeroiq01]

This scares the crap out of me. Some third party "hacks" it to a computer of and idividual and claims he/she found child porn/terrist plots/cream cheese recipies....or whatever. Why isnt anyone yelling...... he/she might have just as well planted it themselves how are we to know? He/she had access to the computer. Seems like a real easy way to get someone in trouble they arent going to check. This is the reason the FBI and other "Gov" police agencies have rule that have to be followed. This is sick and very scary. I am not saying that they didnt do it but damn, talk about an easy way to railroad someone.

a little liberty, for a little security.

[RShizzle]

I find myself torn after reading the issue. Obviously, what hacker 1069 is doing is good and aiding the authorities by stopping the exploitation of children. However, his means are questionable as well as those of the authorities.

What if third party multinationals are allowed to hack into US systems to aid in the capture of terrorists? Obviously, there was a large amount of evidence provided that made sure the pedophiles being caught were definitely guilty, but couldn't evidence just as likely be planted?

What's even more concerning is that this person doesn't seem to be a third party hacker from Istanbul, but an American citizen (note the american telephone number). If this is the case, isn't this a message saying vigilantism (which strikes at the very base of authority, the fact that it is only the government that is allowed to use force against it's citizens) is accepted? If it is accepted in catching pedophiles, which is a pretty black and white case, what about when it enters the gray areas? What about when it starts being entangled with constitutional rights? (Due process of law seems to be a big one involved).

I believe the authorities involved might very easily have started on a slippery slope. Who knows where it will lead? How much do we value due process? How much do we value freedom? How much do we value results, irregardless of how they were gotten?

But remember:
"Any society that would give up a little liberty to gain a little security will deserve neither and lose both." - Benjamin Franklin

A quandry indeed.

Re:Does it hold up in court?

[kfg]

The real question is, will this evidence hold up in court?

The legitimate law enforcement agencies use illegally gained information on a regular basis.

How do they get away with it? They don't present that particular information in court. They leverage that information into admissible evidence by converting it into probable cause for a legitimate search. This is the very problem with widespread, illegal monitoring of the public and why the public might be inclined to support the practice, at least until they become the target.

KFG

Re:We don't need no stinking cops!

[RPoet]

I'll go rape them with a fucking shovel.

That's a very disturbing fantasy you got there. May I check your harddrive?

I think its great (preparing for flame)

[Keaster]

As I read the brief article it defiantly made me consider both sides of the story; however, in the end I side with my heart. Fuck the kid touchers, let em' rot. This guy could be doing some real garbage cracking, screwing with legit business and good people, but, he didn't. He went after the scum. I agree 100% with 1069. Go for it!

Before I get the crap flamed out of me I will remind, it's just my opinion.

Re:I think its great (preparing for flame)

[Anonymous Coward]

He went after the scum.

You forgot the little word "alleged", as in there's no evidence.

And no, a private third party coming up with incriminating stuff isn't evidence. That's what Police are for. Remember? Due process and such? You must have already heard it, although it's slowly getting rotted off over there.

Sometimes us civilized folk think you hillbillies never made it out of medieval times with witch hunts and all that. Exchange witches with pedophiles and you're right on track again. Yep, very civilized. *rolls eyes*

Re:I think its great (preparing for flame)

[RPoet]

Fuck the kid touchers, let em' rot.

There was nobody involved in this story who touched kids, as far as I understand. The alleged crime in question was storing illegal images.

Re:I think its great (preparing for flame)

[lawpoop]

Another point:

"This guy could be doing some real garbage cracking, screwing with legit business and good people, but, he didn't."

How do you know he didn't? There is nothing to stop him from doing both good *and* evil. In fact, the FBI seemed to give him a pass on his hacking activities for the good he was doing. What a great opportunity for someone who wanted to do a little evil on the side.

Re:I think its great (preparing for flame)

[DerekLyons]

As I read the brief article it defiantly made me consider both sides of the story; however, in the end I side with my heart. Fuck the kid touchers, let em' rot.

Ah yes - anything for children, rights and due process be dammed.
 
And I should note in passing, that possession of pictures != abuse of a child by possessor. Except, that legally it is - which is thoughtcrime, which is a Bad Thing. By extending the same legal principle - all those pictures of murder victims in true crime books? Possession of one should make one also responsible for the murder. But it doesn't.
 
 

This guy could be doing some real garbage cracking, screwing with legit business and good people, but, he didn't. He went after the scum. I agree 100% with 1069. Go for it!

He didn't 'go after the scum', he happened across the scum in the course of committing a crime. I don't think for an instance it's either the first or the only crime he's comitted.

Re:I think its great (preparing for flame)

[TheoMurpse]

Fuck the kid touchers, let em' rot.

And what if the Turkish guy is the kid toucher, and just put some pictures there to frame a guy? Black hats do that kind of stuff all the time, just to fuck with people (see: Freenode getting hacked, DALNet being DDoSed, random person getting their credit card numbers stolen, etc.). Sure, he may have put a Trojan on some pedo newsgroups, but then someone else packages that up as "Britney Spears Nude.scr" and forwards it to all his friends, and bam, the Turkish guy is hacking guys innocent of collecting child porn and framing them for crimes they did not commit. Vigilante justice is wrong. Always. This is why superheros like Batman exist only in comic books.

The Name of the pedophile is Bradley J. Steiger?

[Anonymous Coward]

You know, pedophilia is defined as mental illness in the ICD http://en.wikipedia.org/wiki/ICD .

And pedophilia can be treaten in non-medical and medical therapies.

I don't see a reason to disclose the Name of the pedophile. But I guess that's what infotainment is all about, right?

Unacceptable Bypass of the Law

[OnoTadaki]

The fact that the hacker was trying to catch pedophiles is the last concern when figuring out if this is lawful or not. First and foremost, he broke into people's computers and did unlawful things to illicit his information. On those grounds alone it should not be admissible in court. Imagine if you were a store owner and you arrive there one day and see that your place has been broken into and all your files have been gone through. Then you find out that it was just a rogue 'burglar' who breaks into businesses to see if they're legally filing their taxes correctly. The government sides with him and you're left with a hole in your store, thousands of dollars in damages and uncountable damages from the data he might have taken from you, etc... Is that fair or even close to legal? Sure there's lots of hatred towards pedophiles and it's VERY easy to step aside and cheer this because it's presumably dropping their numbers, but the bottom line is it's intirely immoral regardless of whether he's stopping pedophiles, rapists or tax evasion.

Ah, yes, blackhat vigilantes...

[TheNoxx]

Normally I'd agree that taking the law into your own hands is not only illegal but a very bad idea; however, there are always exceptions. 99% of vigilanteism is a bad idea, as it does not entail people taking the law into their own hands to help others in a non-violent way, but usually runs from personal matters gone awry to the militant folks that "help patrol" the U.S.-Mexico border or other groups that believe it their duty to create a mob mentality when handling real or perceived threats (I can't help but add my favorite quote, from Men in Black of all movies: "A person is smart and intuitive; people are dumb, panicky, and dangerous animals").

The difference is, when it comes to pederasty, I can't really think of many methods I wouldn't condone to cull the abomination. However, many people make a great logical fault in believing that they need to make the rules based on the exception (people that try and use pedophilia as the means to creating whatever laws they want) or in believing that the exception must fall under the same rules as all other crimes in being found and prosecuted, lest authorities create abusive legislature on the pretense of catching child molesters.
There is a middle road in all things, and vigilanteism makes a fine one for this. You don't want to give police the rights to do what a blackhat does to find a pedophile, but you want the pedophile caught.

However, the case in point is an exception. The man lives in another country and the FBI, of course, won't and couldn't file charges, but I don't believe that this constitutes "tacit approval"... although the FBI may simply be trying to send a signal to the blackhat community that reads something like "Sweet Christ, we have no fucking idea how to use computers (Database? The fuck is that?), if any of you guys wants to give us a hand in catching these guys, by all means, go ahead. Do whatever you can."
The feds can't approve of someone breaking the law, obviously, or acknowledge that someone without warrants or CARNIVORE can do the job better than the ol' FBI. But they can turn a blind eye to it, if only for the crime of pedophilia and nothing else.

If I recall correctly, wasn't there a hacker group in the U.S. that did this in the late 90's or are still doing this? I distinctly remember seeing a few adverts and hearing a few inquiries about people who wanted to join up in the old hidden IRC rooms way back when. Ah, sweet nostalgia... days of linux shell accounts, little sleep, and keeping an extra machine running only OS/2 Warp, if only out of spite, back when code came so easily. Christ, my mind has addled.

Re:Does No Good

[Dun Malg]

It doesn't matter if this evidence nets 1 or 1,000 convictions, every last one of them will be overturned on any number of grounds and the prosecuting agencies that utlizie this evidence will open themselves up to quite a bit of litigation and will probably eat some heavy judgments against them.

Nonsense. 4th amendment doesn't protect you from burglars who catch you growing pot in your basement and tip off the cops. Just like it's not a 1st amendment violation for your boss to tell you to shut up and get back to work. The convicted pedophiles are free to press trespassing charges against this guy from their jail cells, if they wish, but that's about the limit of their recourse. It's not illegal for the FBI to catch you in the act of collecting/trading child porn because the methods of the tipster are questionable. The two issues are actually unrelated.

Steiger's defense attorney must have really sucked

[John Jorsett]

My immediate reaction to this story was: if '1069' had the capability to break in to a computer to extract images, he also had the opportunity to plant the images there in the first place. A strong line of defense would be to assert that the anonymous 1069 is some sort of vigilante nut who gains access to the computers of innocent people, plants bogus evidence on them, then turns the victims in to authorities.

This whole case has so many holes that the defense could use, I'm amazed that they were able to convict. Stiger's attorney had to have blown it.

Thank you, from a real-life boogieman

[Anonymous Coward]

Thank you for being that guy. As a pedophile myself, it is very tiring to read of "pedophile-catchers" and how terribly evil pedophiles are. I did not choose to be a pedophile, and it is without my reach to change. Still, it is not hard for me to live a perfectly crimeless life. At 30, I have never had sex with anything but my palm (that statement may not have a very dramatical effect, considering this is Slashdot), and I am at peace with the prospect of dying as a virgin. Dying (and living) alone, however, is not as nice, but you make the best of the cards you've been dealt in life.

How very appropriate that the captcha Slash dealt me was "reject".

Re:Thank you, from a real-life boogieman

[Anonymous Coward]

Believe me, I find the thought of an abused child with a warped world view infinitely sad too, as does most other pedophiles (and most other people with their sanity intact). The point is that pedophilia is not illegal, because pedophilia is not an action. When you use it to depict an action, you advocate the criminalization of millions of perfectly law-abiding morally aware human beings. You are part of the process which indoctrinates these people into thinking "I am a pedophile, and all my life society has told me that pedophiles act such and such, so I guess I'm worthless and I'll act that way." No, you're not a bad person and you don't have to act that way. We have support groups telling these people that, but we don't reach everybody. You couldn't imagine the suicide rate among young pedophiles. That is another thing I find infinitely sad.

Most child sexual abusers are not pedophiles (as in they're not attracted to children, but the child is just a convenient outlet of sexual frustration), and most producers of child pornography are not pedophiles (they are the Russian mafia, stone cold cynical when it comes to making money). Most pedophiles are not child sexual abusers. Please call a spade a spade; if you mean child sexual abusers, don't say "pedophile".

Re:Thank you, from a real-life boogieman

[Anonymous Coward]

I don't think that was a joke. Here, let's run some numbers.

Something like 10% of kids get sexually abused. (Exact figures are hard to come by.) Assuming that pedophiles abuse an average of 10 kids each, that means that 1% of the public are pedophiles. Do I think that it is reasonable, given how many people browse slashdot, that we'd have a pedophile who would comment in this thread?

Hell, yeah.

Now I can comment on this from the other side. I am not a pedophile, but I was abused so I know something about it. Pedophiles are just people who are sexually wired to be interested in children. The causes of how we get wired is unclear - just look at the debates on homosexuality. But it is clear that once you are wired, it is something that can't really be changed.

The fact is that many pedophiles are horrified at their interest. For instance the one who abused me tried his darnedest to pretend that it was a consensual relationship. And what he had the most trouble with was evidence that it wasn't. Which was copious since, in fact, it wasn't a consensual relationship. I'm glad that the pedophile we had commenting has not abused yet. However sexual desire is hard to control - the odds that he will abuse some day are very high. And child abusers do not seem to be curable.

And about victims of child abuse. First of all, most of what most people know about child abuse is all wrong. It is based on reports from people with false memory syndrome. Which, despite the memories of being abused, has pretty much nothing in common with real abuse. The most obvious distinguishing characteristic is that people who were abused don't forget about it. The second is that people who were abused pretty much inevitably have some evidence of the abuse - if nothing else then their grades drop. A far more subtle sign is that people who I know have been abused had different kinds of issues around the abuse - for instance we've had to fight guilt that we were in some way responsible for our abuse. (Yes, I know it is obviously not so - emotionally it isn't so simple.)

But that said, all of the things that you list as being inevitable for abused kids simply aren't. If you do nothing about it, those will all happen. Mental health professionals (ie they are paid for their mistakes) are more likely to hurt than help. But I can verify from personal experience that abuse can be overcome and you can become a healthy adult.

Mathematically, the ends justifies the means...

[themonkman]

If your doing something illegal, you should be punished if someone other than the police finds out and reports it, regardless of how they get the information. Now, if you had to break a law in your country to prove that someone did something illegal, you should be punished for breaking that law, such as trespassing. This man from Turkey broke no laws because he is not bound to our laws. US law is not universal. If he broke a law in Turkey, then he should probably be punished in some way for breaking that law, while keeping in mind the good he did by breaking that law. He should receive a less severe punishment, such as probation. If he broke that law for his own gain or selfishness (e.g. hacking for the purpose of identity theft or fraud) then he should feel the full force of the law in his country.

While I don't advocate hacking for any other purpose other than to expose threats in an ethical manner, I feel that the good that this man did to bring these pedophiles to justice cancels out the unethical act of hacking those pedophile's computers. Let us say an unethical act like hacking could be expressed in a negative number, such as -3. Let us also say that an ethical act of bringing pedophiles to justice is expressed as a postive number, say 5. You add the sums of the ethical and unethical acts, and together you get 2. The outcome of the actions, and their final sum measured says that in the end, his acts were positivly ethical, overall. Add that to the fact that he is not bound to our laws and opinions of what is right or wrong. This should be considered when forming your opinion on whether the ends justifies the means.

Re:Mathematically, the ends justifies the means...

[Sage Gaspar]

If the U.S. government is allowed to prosecute based on the fruits of information obtained by a circumvention of their laws (whether within or without their country), their laws become worthless. Absolute governmental power has the greatest potential for massive abuse, so we agree to give up some of their protection in exchange for protection from them. We take a couple negatives to mitigate the odds on huge negatives, in your language. A child molestor might abuse a couple children and scar them for life, but the government can frame an innocent man as a child pornographer, put his kids in foster homes, and lock him in jail for the rest of his life.

Re:Sometimes vigilante justice is needed

[lawpoop]

There is nothing compelling this guy to go legit. You really think that this hacker is going to go through four years of school, studying law enforcement, and then emigrate to the US to search for pedophiles online?

All that's happened is that authorities have given a green light for hackers to go after evil people online as vigilanties with absolutely no oversight, including this guy. And you think future hackers aren't going to plant evidence on innocent peoples hard drives for notoriety, or passes from the FBI? How do we know that that hasn't happened in this case?

Vigilante 'justice' is not justice at all. It is simply retribution, and will quickly descend into gang warfare if not stopped by impartial authorities. Regular, civilized impartial justice isn't perfect, but it's far better than the alternative.

1069

[Konster]

1. Why are newsgroups such as this allowed to exist in the first place?

2. The hacker was putting trojans in a newsgroup that existed for the sole purpose of distributing child pornography, which;

3. The arrested went to on his own volition;

4. The FBI didn't contact 1069 and have him hack others' computers; he contacted the FBI with the information;

5. The FBI investigated the arrested person and discovered that not only was he in possession of child pornograph but;

6. He was involved in the manufacture of it by taking photos of himself with his victim, aged 4-6;

7. Let him rot in jail.

Re:1069

[TheoMurpse]

1. Why are newsgroups such as this allowed to exist in the first place?

That's like asking why email that carries child pornography exists, or why Freenet has child pornography on it, or why torrents of copyrighted material exist. Someone needs to read up on how Usenet works: one posts a message to one's own Usenet server, and it propagates to many other Usenet servers in the way data from a torrent propagates (namely, like a web). Blacklisting servers whose users post illegal content would be impossible without destroying Usenet altogether.

Re:If someone was in the blackmail buisness...

[ObsessiveMathsFreak]

Given the level of hatred (quite justifiably) directed against kiddie porn users, I imagine a lot of people targeted would buckle.

The level of hatred isn't really justified, considering that the crimes of rapists, murderers and slave owners(they exist), are far, far worse. People never seem to get to the same level of arousal unless pedophilia is involved in some way. It's not even that major of an issue, despite its oversell by the media.

It's the 21st century's Two Minute Hate, so we can all wax apoplectic at those evil, evil men, and gladly offer up our free society to do so.

Your heart is a liar

[Just Some Guy]

As I read the brief article it defiantly made me consider both sides of the story; however, in the end I side with my heart.

Your heart lies to you. It tells you about the good things that could be without pointing out their unlikelihood or the bad alternative outcomes.

If 1069 never went after non-pedophiles, and if he never presented false evidence, and if the FBI's use of that evidence didn't violate any rules and encourage the public to come to accept illegal activies from the police, then this could be a good thing. Break any of those ifs, though, and the result is a terrifying distopia that I want no part of.

My heart agrees with you: pedophiles are scum, and as a parent, their mass death wouldn't bother me one bit. However, my brain thinks that we need to step back and re-assess whether we want to revert to vigilante justice, and that due process and rules of evidence are far more important than any individual situation, regardless of how horrid it may be.

Re:Plausible deniability

[symbolic]

And you think future hackers aren't going to plant evidence on innocent peoples hard drives for notoriety, or passes from the FBI?

All the suspect has to do is claim that there's no way that the planted evidence is his, because all of *his* illicit material is encrypted. oops...

Creates a good "I've been hacked" defense

[Kadin2048]

I can't believe they'd ask the guy to keep "investigating." It seems to break every basic rule of police procedure and preservation of evidence.

If this guy's defense lawyer isn't a total retard, or if he doesn't blow it and confess under interrogation, he's going to walk.

All he has to say is "hey, I don't know where the porn came from -- my computer was hacked! The police even have proof that some mysterious Turkish guy was in my computer!" And what are the police going to say, ask the judge and jury to take the word of some anonymous guy on IRC, that he didn't plant the evidence?

When you do your 'investigation' that way, they're creating a hole the size of the Titanic.

Look, I don't like defending kiddy pornographers, but it seems like a pretty good defense that there's a good possibility that you're being framed, when all the evidence came to the police by way of some mysterious, psuedonymous foreigner who had the opportunity to plant the material themselves; unless Mr. Turkish Hacker is willing to come and testify, that is.

Re:It's called an informant and it's totally legal

[Sage Gaspar]

The entire point of this article is that the information was gathered by committing a crime.

Re:1069 - some answers

[etresoft]

1. Why are newsgroups such as this allowed to exist in the first place?
   Good point! Let's get rid of them. But then, they could just use alt.slashdot.flamebait instead. Better be safe and shutdown all of usenet.
2. The hacker was putting trojans in a newsgroup that existed for the sole purpose of distributing child pornography, which;
   That's what Mr. Anonymous said. He didn't say he wasn't distributing the virus through other channels as well (see below)
3. The arrested went to on his own volition;
   Well, his computer did. And we know his computer was hacked via back-door trojan by someone who trolls said newsgroup.
4. The FBI didn't contact 1069 and have him hack others' computers; he contacted the FBI with the information;
   And we know for sure that 1069 isn't an off-duty (on-duty?) FBI agent with a Turkish accent.
5. The FBI investigated the arrested person and discovered that not only was he in possession of child pornograph but;
   And we have already establish his computer had been hacked into.
6. He was involved in the manufacture of it by taking photos of himself with his victim, aged 4-6;
   Where did you get this? I didn't see that in TFA.
7. Let him rot in jail.
   That'll save those kids.

Here is an alternate scenario. A clever pedophile grabs a copy of Sub7 and sends it out into spam. They phone home and he uses those hacked computers to download porn - anonymously and for free. Poor doctor notices his computer is running very slowly and installs anti-virus, which removes Sub7. Bereft of his porn, there is now an angry, but clever pedophile. He anonymously calls the feds and gets the doctor arrested. While the feds are pursing one presumably innocent man, they don't have time to track down 1069.

All we have is a known virus-writer who claims to be doing a community service. Is writing viruses now OK? What if future pedophiles get wise and stop using those groups? Maybe I should seed alt.slashdot.flamebait with my own virus. Eventually I'll find something worth reporting. That would be OK, right?

Re:It's called an informant and it's totally legal

[Kadin2048]

There's a big difference here. Normally, when you have an informant, they either need to give the police enough information to go and do the investigation themselves and find the conclusive evidence; or, if they come up with the evidence themselves (or provide a lot of very specific information), then they usually have to go and testify in court.

In this case, the 'mystery hacker' basically came up with the evidence (he told them exactly where to find it, and he had ample opportunity to have planted it), but he's not in a position where he could easily testify. Because he had access to the defendant's computer (illegally), but can't come testify (because he's in Turkey, because the police don't know who he is, whatever), it seems like they're giving the guy a good defense that the evidence was planted.

It's just sloppy policework.

For a phyiscal-goods example, it's as if somebody dropped a dime on you and told the police that when they had broken into your car earlier in the day to steal your radio, they saw that you had a baggie of heroin in the ashtray. So the police go and arrest you, and find the bag of heroin. Without being able to track down the informant and get their testimony, or some form of physical evidence linking the bag to you in such a way that doesn't leave you with a planted-evidence defense, they have a pretty weak case. (Unless they can get you to confess, which is actually pretty common.)

I'll be interested in seeing what the outcome of this case actually is. If they guy doesn't negotiate some sort of plea deal, and the only thing they found on his computer was the porn that the hacker told them about, I think he has a pretty good chance of either getting off, or forcing the police to find some way of getting the hacker to come in and testify.

Allowing in evidence that was obtained in this manner would be a mistake, and justice wouldn't be served in the long run by it, even if the immediate consequence was letting the guy off the hook.

Re:Steiger's defense attorney must have really suc

[Konster]

I read from the court documents that the evidence collected was physical as well as digital, and that additional evidence...chains, cuffs, etcetera was collected from Steiger's home that also appeared in the photographs.

Re:Steiger's defense attorney must have really suc

[humankind]

Yes, there are several ways to tell if and when files have been modified, NONE of which can't be subverted by a capable hacker.

If this guy is clever enough to deploy trojans, he's in the business of fooling people, and your typical "forensic specialist" would be a pushover to him. Your statement does not match reality... it may get more airplay because many expert witnesses, especially in the field of technology, are more politicians than technologists and the court doesn't know better, but it won't fly here.

This reminds me of the recent publicity over the VA laptop computer that was stolen, and the feds claimed they recovered it and the data was "untouched". 90% of everyone who routinely participates on Slashdot knows that's a total load of bullshit. The VA data, encrypted or not, could have been copied without anyone ever knowing. Save those lies for people who know better.

Re:1069 is not a vigilante

[TCM]

especially because 1069 advised the police instead of taking any sort of action against the suspect.

Umm, I'd say breaking into his computer is very much taking action against him. Enough to invalidate the whole "evidence".

Re:Steiger's defense attorney must have really suc

[munpfazy]

Not true. Just like in other fields of forensics, you can tell when something has been modified. Therefore, even if the timestamps on the file were altered by the hacker, there are several ways they can still tell when the actual date was. There are alot more tools out there, software and hardware based, that can identify tampering.

Even if you can unambiguously date every file, that only makes a set up harder, not impossible.

Consider the following (rather extreme) thought experiment:

You create a trojan that downloads a bunch of child porn to some out of the way place on the infected computer and then removes itself. You selectively distribute it to individual users, so as to make discovery less likely. Perhaps you make it fairly smart, so that it hunts for directories containing legal porn and hides material there or in an analogously labeled place.

Then, ten months later, you release a very simple trojan that installs itself, looks for child porn using a very general search, and then reports what it finds. Make sure your victim gets it, and also post it to child porn usenet groups and other seemingly incriminating places in order to distribute it as widely as possible.

Then, when it finds the porn on your victim's computer, you go the FBI. Tell them what you found, and give them the source code to your new trojan. They take a close look at your victim's hard drive and find your trojan right where you said it would be, no other backdoors or exploits, and a 10 month old stash of kiddie porn.

I'm no computer forensics expert, but trying to prove that a machine has never been infected by software able to download material and then remove itself seems pretty close to impossible, at least if you don't know exactly what you're looking for. (Sure, there are security policies that would make such an identification possible, but I imagine a large number of home pc users don't employ them.)

If you're lucky enough to find a really tasty exploit in some exisiting software (like an unpatched browser) you might even be able to get by without ever writting anything (except the pornographic images) to the hard drive.

Now, I will readily agree this is a pretty extreme example. But, if it weren't for ethical constraints, I or thousands of other slashdot readers could pull this off, given a few months of work and a suitable victim (a windows user who's lazy about patches and doesn't run a good virus checker). There are plenty of personal grudges out there that would compel someone to go to this much trouble to set up a foe. And, if you are lucky enough to make friends with some organized crime types, you could probably turn a nice profit offering it as a service.

Now, if you really want to go to town and are willing to risk early discovery, you modify the user's software so that it adds a few MB of kiddy porn to every burned CD and DVD and then mounts them with a filter that removes any sign of their existence. Now the FBI finds physical media obviously burned and handled by the victim, containing child porn. Your victim is going to have a tough time explaining that he had no idea that the DVD he burned of legal porn also contained a directory called "young children" full of explicit images.

Re:1069 is not a vigilante

[TCM]

1 - 1069's action was arguably illegal but not immoral (considering intent)

Are you psychic? How can you know his intent? Because he said so?

3 - it was appropriate, surgical even, use of expertise - no tampering

Again, because he said so? Otherwise, breaking into a computer is as close to tampering as it can get.

4 - no risk to any third parties or innocents by his hack

Unless you assume the victim of the hack to be guilty in the first place, then yes, there were no innocents.

I can't think how this whole thing could be any more fishy. You jump to judging the guy and praising the hacker, because the subject is child porn; or to apply the meme: "Won't somebody think of the children!"

It's scary how you dismiss due process because the crime gets to you on a personal level or whatever.

Re:A man's computer is his castle...

[QCompson]

The NYT recently published a chilling study of Internet usage by pedophiles who did much worse than simply store dirty pictures on their hard drives.

I read the New York Times article, and it was far from "chilling". I think it would be more accurately described as sensationalistic. What exactly were the pedophiles doing on the internet that was worse than storing dirty pictures on their hard drives? Chatting with each other? Oh the horror!

A ten-year prison sentence for knowingly abetting a felony on the Internet could help

Please explain, Captain Think-of-the-children, what you mean by this statement. Are you suggesting there should be a 10 year sentence for approving of certain actions? If I say, "I approve of girls having sex at the age of 15," I should go to prison for 10 years? So much for freedom of speech.

If crime in the U.S. reaches the level it has in the former Soviet Union, there will be no Bill of Rights left to protect.

This type of statement is often used to argue, "In order to save the Bill of Rights, we have to ignore the Bill of Rights." Complete rubbish. If you want to abandon the Bill of Rights and everything the United States is supposed to stand for, just come out and say it.

Why didn;t the FBI get a warrant and log in

[DrSkwid]

As the target machines where infected with Sub7, why wouldn't the FBI get a warrant to access the trojanned machine themselves the Sub7 back door?

Gary McKinnon is "not a citizen of the United States and are not bound by our laws" and yet he was extradited to face trial in the US. He was accessing Pentagon, NASA, US Air Force and other DoD facilities in 2001 and 2002 the same time 1069 was breaking into private US citzen's systems.

As usual, it's one law for private individuals, one law for the poice.

Do you know what "paedophile" means?

[Brian Ribbon]

"My heart agrees with you: pedophiles are scum, and as a parent, their mass death wouldn't bother me one bit."

Well it would have to be a mass murder, because there are a lot of us and we aren't going anywhere. You may put a few hundred paedophiles in prison on child porn charges and some of the 10% of child sex abuses which are committed by paedophiles might result in prison sentences (and rightly so if it's sex abuse), however if you think you're going to have the 33% of people who have at least some attraction to children, or the 5-25% who are technically paedophiles killed, you're fooling yourself. It's not illegal to be a paedophile, because it is not illegal to exist, however it is illegal to abuse children and download child porn.

For the record, the huge majority of us spend time with children, without needing sexual relationships. I spend time with my younger brother's friend and I'm going to become a teacher. I don't need sex with young boys, even though I find them sexually attractive; spending time with them is enough.

People won't be able to fight paeds so hard in the future, because we're fighting back. See AN if you want an example.

And, if you're really so terrified of us, maybe you should learn more

~ BLue

a morally bankrupt response

[TomRitchford]

For all the reasons you've listed 1069 isn't performing performing any good, but a grave injustice.

Hard to believe a caring human being could hold such a morally awful position.

Looking at the facts of the case as stated, the result appears to be that two children were saved from sexual servitude or even horrible deaths and that two pederasts were jailed. If what we are told is true, justice was clearly done -- if you wish to refute me, please identify who is being unjustly treated. The childen? The criminals? The police? Please do not claim that you, as a representative of the "people", are experiencing an injustice, because you are not.

If this hacker really did present the police with information which would allow them to save two children from sexual abuse, what would you have wanted to happen?

I believe what you are actually claiming is that allowing law enforcement officials to operate in this fashion is illegal and would allow possible injustices to occur in the future. I agree that sometimes injustices must occur because of the "system", the rules that ensure fairness: this is not one of those cases.

Do you really believe that police shouldn't be allowed to use evidence gathered by criminals? Why? Exactly how do you think law enforcement works, anyway? Police routinely use informers, stool pigeons and the like -- why is this wrong? There are very specific rules on conduct, on admissability of evidence, and defence attorneys routinely and often successfully challenge the believability of such witnesses because of their poor character, but there's nothing intrinsically "unjust" in having criminals testify against other criminals, it happens every day.

In fact, it's not even clear that the hacker is doing anything that is illegal.

If the facts are as presented, the police had physical evidence linking the criminals with the children in question -- the possibly-unreliable hacker's information would be presented as corroborating evidence. It's interesting to note that the defense attorney did not in fact challenge the reliability of the evidence as gathered.

I might add that I'm very much a liberal and strongly support strict oversight of the police and limits to their powers. But this is not one of those cases I think illustrates any sort of problem, and worse, I think you seriously damage our case by screaming about "injustice" in a case where your mother or any common-sense person would see that justice was obviously done (if the facts are as presented in the short article in question).

Oh, and don't waste the Franklin quotation! It gets a little weaker each time we use it pointlessly. Save it for things where it really applies.

Re:a morally bankrupt response

[TomRitchford]

It is counterintuitive and on its face offensive, but the entire point of my post was that setting a precedent for circumvention of our legal and justice system is not justified by catching a few pederasts unlawfully.

What you said was that it was a "grave injustice". It was not: I proved it: you did not succeed in refuting that.

I'm not sure where these mentions of sexual servitude or horrible deaths are.

Why, it's in the referenced article that you didn't bother to read. The FBI investigator claimed that the hacker saved the lives of two children; the charges included "sexual exploitation of children".

That's not what the issue is here. The hacker (according to our laws, which are the ones we are trying to enforce)

The hacker is claimed by the article to be in Turkey, where this sort of activity is not illegal.

illegally intruded this downloader's computer and used it to gather evidence, that evidence was given to the FBI, and the FBI used it in court to prosecute the defendant. This is not a legal use of informant in any sense.

Sorry, you are wrong. Read hereabout the exclusionary rule: "The Exclusionary Rule is designed to provide a remedy and disincentive, short of criminal prosecution, for prosecutors and police who illegally gather evidence in violation of the Fourth and Fifth Amendments in the Bill of Rights, which provide for protection from unreasonable searches and seizure and compelled self-incrimination." Note that the Fourth and Fifth Amendments protect individuals from search and seizure by the government, not by other private citizens.

The hacker is not "acting as the agent of the FBI" -- if you'd *read the article* you'd see that he simply provided anonymous tips that were later used to apprehend the criminals. Again, this happens all the time. Cocaine dealers turn in their upstream dealers; kidnappers turn in their accomplices; thieves rat on other thieves; in each case, they got their information during the commission of a crime. In fact, police routinely outfit criminals with a wire and use them to gather information which holds up in court -- this is far closer to the idea of "acting as an agent of the FBI" than simply an anonymous tipster is.

Again, I ask you -- what would you have wanted to have happen? Should the police have ignored the information and, according to the article, allowed two children to die horribly?