Slashdot Mirror
Man Fired When Laptop Malware Downloaded Porn
Geoffrey.landis writes "The Massachusetts Department of Industrial Accidents fired worker Michael Fiola and initiated procedures to prosecute him for child pornography when they determined that internet temporary files on his laptop computer contained child porn. According to Fiola, 'My boss called me into his office at 9 a.m. The director of the Department of Industrial Accidents, my immediate supervisor, and the personnel director were there. They handed me a letter and said, "You are being fired for a violation of the computer usage policy. You have pornography on your computer. You're fired. Clean out your desk. Let's go."' Fiola said, 'They wouldn't talk to me. They said, "We've been advised by our attorney not to talk to you."' However, prosecutors dropped the case when a state investigation of his computer determined there was insufficient evidence to prove he had downloaded the files. Computer forensic analyst Tami Loehrs, who spent a month dissecting the computer for the defense, explained in a 30-page report that the laptop was running corrupted virus-protection software, and Fiola was hit by spammers and crackers bombarding its memory with images of incest and pre-teen porn not visible to the naked eye. The virus protection and software update functions on the laptop had been disabled, and apparently the laptop was 'crippled' by malware. According to Loehrs, 'When they gave him this laptop, it had belonged to another user, and they changed the user name for him, but forgot to change the SMS user name, so SMS was trying to connect to a user that no longer existed ... It was set up to do all of its security updates via the server, and none of that was happening because he was out in the field.' A malware script on the machine surfed foreign sites at a rate of up to 40 per minute whenever the machine was within range of a wireless site."
It just seems immensly more likely that he got infected by malware from surfing porn sites, than getting infected by porn from having malware.
Good to know they researched heavily before firing him. At my company when re-deploying hardware like a laptop it is standard to wipe it completely and load a ghosted image. Who WOULDN'T do at least as much?
case where you can't help but think "this can't be right".. making certain types of information illegal to possess just doesn't make practical sense in the context of the Internet, no matter how morally objectionable we find it.
If people hadn't jumped to conclusions and had done a more thorough investigation, this man would not have lost his job and reputation.
I've heard of people getting screwed by their bosses before but this is ridiculous.
If he hadn't had the resources to hire his own expert, he would be in prison and branded a sex offender for life, all because his boss didn't practice safe hex.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
This is a tough lesson learned for Mr. Fiola, but the lesson is, always request a clean build when receiving new equipment in the workplace. That would have eliminated the malware and given him a clean system to work on.
--I like turtles...
Not that Linux (or OSX, or any of 'em for that matter) are 100% crack-proof, but putting one's career at the mercy of common malware and the only safety net is a sharp eye at the IT department?
OTOH, I suspect this guy (if he plays his cards right and has a sharp lawyer on retainer) may never have to work another day in his life.
Quo usque tandem abutere, Nimbus, patientia nostra?
Julie Amero and the Porn Pop-Ups all over again?
The real crime here is that the charges were dropped thru "insufficient evidence".... Why is this loophole allowed to prosecutors? How about. "We are sorry we should never have arrested you, fired you and will will formally erradicate all your arrest process so it never happened and give you backed dated pay and legal expenses".
I am a lawyer, but this is not legal advice. If you need legal advice, the attorney in this story might be a good choice . . . (but I cannot endorse him).
This, in a nutshell, is why lawyer's represent guilty scum.
Sometimes, it turns out, they are neither . . .
Personally, I'm skeptical about the idea of malware that secretly downloads and hides kiddie porn--why would the malware developer do that? I really can't fault the emploeyr for not considering such an idea and investigating it.
The defense attorney, though, is to advocate for his client, even if the client claims seem far-fetched.
hawk, esq.
So expecting them to ask for a clean build is asking to much. Their IT department should have known better and done this automatically.
"As soon as you mention child pornography, everybody's senses go out the window, she [the computer forensics expert] said."
Sounds too familiar. What's really fucked up is that his former employers "stand by their decision", namely to fire the guy. The bare minimum would be a public excuse, an offer to let him work there again, and probably a hefty compensation if he refused. But that's not likely to happen since by definition, the government knows best.
The grass is always greener on the other side of the light cone.
DIA spokeswoman Linnea Walsh confirmed Fiola "was terminated," but declined to say if any internal discipline has been meted out as a result of his name being cleared in court.
"We stand by our decision," she said. So now the DIA is trying cover it's own ass for giving him "a ticking time bomb" and then firing him for it and ruining any social life he had.
The worst part is that the assholes at DIA responsible for the horrible "roll-out" of a replacement laptop, and the PHB's responsible for firing him w/o doing proper research into the issue will not be punished in any way. THEIR lives won't be ruined. Even if he wins a lawsuit. It'll be money from the DIA, but no real punishment to the people involved.
Somebody find all their names and contact info (I'm too lazy) and post it. Let's send the info to Russia with requests for Viagra and child porn.
Seriously though, The Office is funny on TV, but tragic in real life. These people should be arrested for harassment and criminal negligence at the least.
What kind of laws can we enforce (and/or pass) to truly punish the individuals responsible for shit like this? Lawsuit money from the organization isn't even close to justice.
Operator, give me the number for 911!
I was even fooled by it once. I found pr0n bookmarks under a cute girl's login and I was thinking "Daaamn this girl is a freaky.." for a few seconds until I realized what it was. I could easily see how people would jump the gun and over react when they find actual material on a computer and not just bookmarks however they should at least ASK the person if they're guilty and send it for investigation first.
Liberty.
* to disrupt society
* to provide a plausible alibi for any of his perverted friends
* to drive up the cost of prosecuting this type of crime so prosecutors will have less money to prosecute his brother-in-law who runs an organized crime family
* kicks/jollies/juvenile reasons
* someone paid him to do it
* Why ask why
* He wanted his work to get on CowboyNealBoard, er, I mean Slashdot
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Because the sites the malware connects through pay via click through.
What that bit of malware probably did was go around to a bunch of sites that the author gets fees from and makes it look like someone is browsing them.
Get a botnet of 1,000 computers going and it looks like hacker X convinced 1,000 people to view the site over and over.
Live today, because you never know what tomorrow brings
It's better to be the foot on the boot than the face on the pavement. ~~ tkx Kadin2048
I would say that the scripts surf a list of shady sites to get hits on banner ads. I imagine that, even though they don't stay up as long, kiddie porn sites may have ads too...
The fact the he was charged with child porn. I've been following this case in the news because it is such an odd case. As TFA says, they eventually figured out it was viruses and malware doing the downloading of images (over the web, BTW). Ok, fair enough.
...or did they find real kiddie porn on there?
However, another article (can't find the link, sorry) was interviewing one of the detectives involved with the case. What he said was something along the lines of "there was a LOT of porn on the computer. 99% of it was just gross stuff, not illegal. But we did find a few pics of young girls.". Which makes me wonder --- how, exactly, do they define child porn?
Are they just arresting people because pictures look young?
It just seems odd that all of a sudden there is all this kiddie porn out on the publicly available internet and it does not draw attention. I would presume, with Tor, Freenet, etc all of that activity would be driven underground (ie: encrypted). Is there really "spam" and popup based kiddie porn still going on in the WWW?
I ask because I have...err...my friend has not seen it since the early early days of the internet. Back then, you truly could stumble across it accidentally. It hasn't been that way for a long long time though, in my experience.
It's called Farm Sluts. Hilarious! Well not for the guy in real life.
"You'll get nothing, and you'll like it!"
Personally, I'm skeptical about the idea of malware that secretly downloads and hides kiddie porn--why would the malware developer do that?
I've actually seen this sort of thing a couple times... not for kiddie porn luckily. Just movies (hollywood) and warez back before p2p.
As you can imagine finding servers to host and distribute this sort of stuff can be difficult. So why not compromise some random persons laptop, setup an ftp server, irc, dynamic dns, and whatever else... and then use it as a free and 'anonymous' remote host and storage.
It wouldn't surprise me in the least that this could be in use for kiddie porn distribution.
I really can't fault the emploeyr for not considering such an idea and investigating it.
When dealing with any case of child abuse including kiddie porn, one should ALWAYS be extremely cautious. Because whether he is innocent or not, people will never look at him the same way again.
From my (admittedly cursory) read of the article, I gather they claim the malware was trying to pop up the images to a broken account. I.e., the malware downloaded the images (hence their being in the temp directory) and tried to display, but then failed. Thus, the user never saw that the laptop was doing this, or else he could've gone, 'uhm, something is very wrong with this machine.'
If this is true, though, the real question then becomes how they didn't notice the virus on the machine when reconfiguring things (poorly) for the new user. At that point, if the defense argument is accurate, the malware should have still been able to display this stuff, and you'd think the IT guys would have noticed...
--Rachel
* To create mirrored websites to ensure availability of the material.
It happens with malware spreading sites, why not illegal porn?
If the malware can run a distributed dynamic dns based site, it will achieve a highly distributed network that would be hard to shut down easily.
No sig
Get child porn on your enemy's computer as long as he runs Windows (or whatever else), total deniability because there's so much malware out there. This scares the bejeezus out of me.
Probably, the malware itself is a temporary webserver to help distribute the load of an illegal kiddie porn pay site. Look up Fast Flux (http://en.wikipedia.org/wiki/Fast_flux) spammers use it all the time and it is very simple to set up.
Your skepticism is mis-placed.
There is more than one kind of malware.
One kind sends Phishing Spam / Viagra spam / etc.
Another performs DDoS attacks.
A third acts as a distributed FTP/Fileshare server so that the guilty have a place to hide & share their wares and not have a single point of being shut down by the authorities. Whether this be lists of CC numbers or kiddie porn is immaterial.
-nB
whois gawk date unzip strip find touch finger mount join nice man top fsck grep eject more yes exit umount sleep dump
Personally, I'm skeptical about the idea of malware that secretly downloads and hides kiddie porn--why would the malware developer do that? The malware wasn't downloading and hiding kiddie porn From the article: "Loehrs found a script file that was set to go out and run its own searches on foreign Web sites, she said. "And once you get into some of these foreign sites, you'll get all kinds of stuff you don't want to see. "Actually, the child pornography was just a very small portion of it. The majority was just bizarre porn. He was being hit with everything," she added." The malware author was probably running a pay per click scam by using his malware to visit a bunch of sites and making it seem a bunch of visitors were browsing the site.
From a purely technical point of view, a clean install is good advice in this situation (and many others!) But it's not something an ordinary user can do. This guy certainly doesn't have the expertise, not if he was using such a thoroughly compromised system. So he has to turn it over to the IT department, which then charges his department $100 or more for the service. That's approaching the total value of the laptop if its been around for any length of time.
zero tolerance laws produce an extreme disincentive to properly and discretely investigate such things before slinging around an accusation which will ruin somebody's life.
"Megan's law"s punish people after the official debt to society has been paid. If you are so sure pedophilia is an incurable, life-long disease, than imprison them for life or develop a house arrest program, but you can't simply toss these sex offenders out, put a big neon "child molester" sign over their head, and pretend they have the same rights, or are not in danger of vigilantism.
VLC FOR MAC IS DYING! IF YOU DEVELOP, PLEASE SAVE IT!!
I'm involved in investigating things like this in my line of work. The argument I've worked on the most was that X worker was on eBay at 6am, and then there is a record of X on at 12pm, so we fired X for waisting time spending 6 hours of their day on eBay. Everyone of the cases I've helped investigate the employee was a few months from reaching a big pay increase or increase in retirement benefits.
Their team also loves to hand us data that their forensic person has pulled from Windows without giving us access to the original drive. When questioned on how he obtained the data it was clear that their certified forensic expert didn't make a locked copy of the drive but logged in and poked around. The certification their contractor has is from IACIS http://www.cops.org/certifications
None of them so far has gone to a judge AFAIK but I know my PHB has testified for an arbitrator and the arbitrator ruled there was insufficient evidence for a dismissal.
Indeed. they should extend the indictment requirement required by the constitution for capital offenses to these sorts of crimes. Being falsely accused of molestation is much worse than being falsely accused of murder in terms of social repurcusions. (assuming one was eventually declared innocent of both).
http://notanumber.net/
Amendment 8 - Cruel and Unusual Punishment. Ratified 12/15/1791.
Excessive bail shall not be required, nor excessive fines imposed, nor cruel and unusual punishments inflicted.
Frankly, zero-tolerance doesn't seem like what the Founders had in mind, nor does torturing people you don't like for the rest of their natural (and now probably shortened) lives. Granted, I suppose this depends upon your interpretation of "cruel and unusual", but if this can be applied to sex offenders it can be applied to any group of people if you can manage to vilify them sufficiently.
The higher the technology, the sharper that two-edged sword.
http://www.geoffreylandis.com
Yes, Megan's law is obviously intended to incite mob 'justice'. Executions are expensive and socially messy. It is much simpler to 'think of the children', publish the addresses of sex offenders, and hope that some other sicko takes care of the problem for you.
Firing people based on things that happened on an infected PC is the modern equivalent of shouting burn the witch!
The truth is that this can happen. The truth is that so many corporate desktop and laptop systems are p0wn3d by th3m that it isn't even funny.
The truth is that event logging on these networks and systems are insufficiently detailed as to demonstrate conclusively which actually happened. Any logging that does take place on a system probably can't show you wether the user was responsible, or if an automated program pretending to be the user was responsible. Any corporation that gives a users a typical Windows system and then holds that user responsible when something untoward happens on that system ought to be opening themselves up to a lawsuit.
The truth is that even the the lawyers who advised not to talk about the reasons for dismissal don't recognize this. They prohibit discussion of the details regarding the dismissal of the employee for reasons entirely unrelated to the issue of being entirely unable to conclusively substantiate any accusations which would be made. (It's standard dismissal policy at all of the Fortune 500 to not give any reason). In general, employees, managers, lawyers and judges are completely unprepared to assess the details which would expose the fact that nobody can actually prove that this unfortunate person was probably the victim of some botmaster's prank. People should be surprised that this doesn't happen more often.
That said, there are things one can look at to determine what was *likely* to have happened on that box, and one can assess to some degree what things were relatively more likely than others. If the box was running malware, though, the most likely outcome is that one cannot demonstrate beyond a reasonable doubt that the user was guilty. However, one can, in some cases, demonstrate innocence, by showing, for example, that a given download occurred when the user was away from the keyboard.
It's important to note that the converse is not true. The malware can easily mimic user behavior by performing user style tasks only when the user is logged in. Malware may, for example, have incentive to operate only when a real user is logged in, because certain operations in certain environments are unlikely to succeed if the user is not logged in (being stopped, and identified as likely malware behavior by a 3rd party heuristic detection system, for example.) Malware often does change its behavior based on instructions from the outside, based on the day or the time, based on all sorts of things, and may not behave the same in an isolated test lab as it does "in the wild" so it can be difficult or impossible to demonstrate the full capability of a given strain, even if you have a copy of it.
If you mod me down, I shall become more powerful than you could possibly imagine.
As long hes a decent guy...
By bringing it to his attention
1) You save the company a competent employee
2) Discourage him from doing it again
3) You demonstrate your personal loyalty to an up and coming executive.
The question you have to answer, is did the employees actions harm the company
in a non-trivial manner? I assume the answer is no. There are many things users
do that waste time, most of which are trivial and do not actively cost the company money.
If the cost of stopping these trivial things exceeds the benefits then you tolerate it and move on.
I would be more concerned about the use of a "firewall/lan bypass device" than the content itself.
We had an earlier article about a guy who was listed as a sex offender for raping a 30-40 year old woman, and when he moved a crazy neighbor killed him in a week "because I want my daughter to be safe." Preemptive removal of potential child rapist.
Note his daughter was 11. He saw him on the sex offender list and thought "kiddy fucker" immediately, not "rape" or "mild sexual harassment" (which can get you there too, with a little work).
Support my political activism on Patreon.
Personally, I'm skeptical about the idea of malware that secretly downloads and hides kiddie porn--why would the malware developer do that?
;-).
Why would it matter whether you believe someone might have a motive? I don't understand why people might commit all sorts of crimes, because I'd never do that. But some people commit those crimes anyway. Lots of people have motives to frame others for crimes.
In any case, on to methods. I have a demo on my web site of how to do "preloading" in javascript. Is javascript enabled in your browser? If so, my demo shows how I can create a web page that quietly downloads images from arbitrary URLs, without showing them to you. This may be used to load those images into your browser's cache. It has valid uses, such as to speed up subsequent downloading of other pages from my site which use those images. But I can just as easily fill your browser's cache with porn. Unless you know how to scan your browser's cache (or have the sense to purge it frequently), you'll never know what I've done to you. My code (actually my web server) also tells me your IP address, which I can use to send the authorities in to examine your browser's cache.
I'd be willing to testify in court how easy this is. And give the court a copy of my code (though they could easily download it from my web site
And yes, I usually do browse with scripting disabled. This was typed into a Firefox 3.0 window, which has the NoScripts extension installed. My demo code won't work against me.
Those who do study history are doomed to stand helplessly by while everyone else repeats it.
Maybe it was not visible to the naked eye because he deleted it. I don't know, but I can easily see a situation where some script kiddie creates a bot which trolls chatrooms and which sends random users child porn and then sends the feds after them.
It probably would not take a lot of time to write such a bot, or to trick the typical horny middle aged male to accept a picture of what they think is an adult woman, only to find out later it's child porn. But whats he supposed to do? his computer has been infected.
So now he has to reformat his entire computer. I can see this being the new WinNuke.
Look, we are here on slashdot discussing this as if we don't have the technical skill to use CP as a weapon to get people fired. It's really simple write a bot, and then upload your enemy list in encrypted form to that bot server in whatever location and have that bot send a bunch of child porn to all the people you dislike.
9 times out of 10, most men will accept any photograph of what they think is a hot chick, not knowing what it is before they open it, it could be child porn, it could be a virus, they don't know. The problem is once the child porn is on their computer then they get reported and their computer gets checked for child porn.
They then undelete everything and find that one photo was on the computer for a split second.
This alone is enough to get a person fired. Personally, in my opinion, unless a person has LOTS of child porn, I don't think it's right to report them over one image found somewhere on their drive.
If we go by those standards then only the most paranoid of internet users will be able to avoid being infected with child porn. The situation is messed up but I wont label pedophile so easily.
In my opinion you did the right thing. It's becoming way too easy to label someone a pedophile, at this point any hacker can get just about all of their enemies labeled a pedophile by simply hacking into their enemies computers, uploading the child porn, storing it in some secret hidden directory they can't see, and then alerting the proper authorities.
It's fucked up, but just like there were people writing viruses which would destroy computers, there will be people who spend all their time trying to destroy peoples lives using child porn as a weapon to get people mislabeled into a pedophile.
If all it takes to get labeled a pedophile is to be caught with child porn on your computer, how hard will it be to make you look like a pedophile?
You probably wont have to look for child porn or search for it or anything, I doubt the authorities check search records in these cases to see if the person was searching for child porn, they probably just see the pictures on the computer and scream pedophile.
For company/government controlled computers people should not forget that network/computer administrators can quite readily take over users computers and use them for what ever nefarious activities they want to and then blame the poor end user. In this case the administrator really and I mean really fucked up, I mean they found the child porn but missed the viruses et al, what, does the admin get such of kick looking for porn on there users computers that they forget to fulfil the security functions that they are actually paid for.
While the end user is certainly in the clear, the admin is in real trouble as now somehow they have to prove their innocence as the actual administrator of the infected (by whom ?) computer. Also the admin should be subject to criminal negligence charges as they bore false witness against the user as the admin should have detected the viruses et al prior to bearing witness against the end user, so some really serious stuff and the end user and their lawyer can really go to town on them.
So the real question for the future is, is it the end user's computer or the system administrator's computer, who has the greater control and hence who has the greater ownership? Running a far more secure OS like Linux will certainly do more to protect computer administrator's from future prosecutions, something to really think about.
Chaos - everything, everywhere, everywhen
How about stop going around being so trigger happy about sacking and prosecuting people for such "crimes"?
How about actually following the money trail? Are the malware authors and people putting those images up really doing such stuff for free? Someone must be paying for those ads, the creation of child porn sites etc.
There are more serious crimes than possession of some image file, especially an image file that is likely to be downloaded by malware.
Lastly, Linux isn't going to help. The real problem is mass hysteria - lots of people suddenly turning their brains off when they hear a trigger phrase. Sure child porn is bad, but if you really want to fix it, follow the money to the bitter end. Not go around starting stupid witch hunts. The way they do things, I figure it's just a tool for cynical manipulation of a mindless populace.
I'm seeing a fascinating parallel with the old-time witch trials. People who didn't know much about anything, but were filled with fear and confusion, were always happy to find a scapegoat. Nothing cheers you up as much as kicking the shit out of Bad People. If you can hang them, or burn them alive, that's a bonus.
So these regular folks would notice that somebody (often a lonely old woman) acted a bit oddly. Instead of using a bit of imagination and charity to understand why, they leaped to the conclusion that she was consorting with the Devil. Just as some Native American tribes got their fun from torturing prisoners to death - life was DULL in those days - torturing and killing a witch just made their year. (Another possible parallel is that those who informed on "witches" often did a deal with the state whereby they split the victim's - often considerable - possessions between them).
Nowadays it's not quite respectable to torture people or burn them alive (unless they're foreign Bad People). But these here pedophiles... we should string 'em all up.
There seems to be a type of mentality that doesn't even want to understand how nasty pictures can wind up on someone's laptop, without the owner's knowledge or consent. It's just a great chance to get someone down and kick him, kick him, kick him...
I am sure that there are many other solipsists out there.
When something bad happens, and you fire somebody you are, by the strictest interpretation of the words, "doing something about it." It might not be anything effective, but if you don't know what is effective, then "doing something" sounds a lot better than "doing nothing."
Out of all the ineffective ways of of "doing something", firing somebody is the most attractive, because it localizes the blame in a person who is, or at least in short order will be, outside the organization. It is the solution that shifts the most blame. Since the person is outside the organization, he can't defend himself.
Unless he lawyers up.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
The point here is that an innocent man has been through hell because IT screwed up and didn't set up SMS correctly so his computer had numerous security holes. The summary doesn't convey this, of course, resulting in the stupid (and, actually, offensive) comments from those who assume that he was guilty based on the summary. Folks, this is a real story about a real person, not something from xkcd. You should not be so quick to judge, especially when you didn't RTFA.
The guy might be rotting the the slammer somewhere if it weren't for his wife who rounded up the competent resources to find out what really happened.
I am infuriated because of the occasional poor summary posting that Slashdot seems to be proud of. If I see another story about an air-powered car again, I am going to puke and stop reading.
If I used a sig over again, would anyone notice?
"Lastly, Linux isn't going to help"
Linux would have helped, instead of having a sophisticated network system where you need a valid login/pass to get access to the updates for your computer system... all the updates needed come from trusted repositories, no password or login needed, oh and, if the end user isn't given permission to install software, instead of having a dumb script on the system that logs in to a server, there can be a central server that runs a script that logs in as the admin user on each system to force updates, without having to create a new login/pass every time a new user grabs a linux laptop.
linux doesn't fix the dancing pigs problem, but by being a inherently secure platform, remote administration isn't a joke feature thrown in as a 'buzz' word to movie more copies and try to avoid loosing important corporate customers to more secure products.
Linux would have solved All the problems this company ran into. As a matter of fact, i've run across compromised windows systems where even after a format with a DOD level file system erase were automatically reinfected by malware that had corrupted the bios of the motherboard. the only thing that worked, was switching those machines to linux, and reflashing the bios (because it kept having problems with stability until the bios was reflashed)
and if you think, well security software must have caught up by now, the sad truth is that about 3% of malware and rootkits released in 2006 are Actually protected against by security suites. the problem is, the way windows lets any administrator process to re write almost any file instantly, and any file with a reboot.
once the software infects, disinfecting a system is very hard, doing a complete wipe, and flash of all programmable chips (optical drive, the main bios, there are even viruses that can infect the memory of a HDD's internal controller, which isn't normally accessible to the end user) a lot of people just throw computers away when the malware comes back, after a format.
windows really really pisses me off more and more everyday because of how the way windows was designed, despite decades of end user knowledge in developing secure UNIX systems for college campuses, all because windows was completely managed by greedy, profiteers who didn't care a whit about how things were designed as long as they were number one, and had no serious competitors.
oh and hey, even if the guy was running linux, and it wasn't auto updating, since it was a desktop and not a server, it probably wouldn't have run any of the popular programs hackers who target linux target.
https://www.gnu.org/philosophy/free-sw.html