Highly Unlikely That a Virus Would Ever Place Images on Your Computer
By Dr. Frank Kardasz (Ed.D.), Arizona peace officer assigned to the investigations of Internet crimes against children.
Monday, November 09, 2009
With some frustration yesterday that I read a news report quoting an alleged computer forensics expert who inferred that viruses routinely plant unlawful images on the computers of innocent citizens (1). The expert is apparently making a living by promoting the “someone-planted-images-on-my-computer” defense whenever a virus is found on a defendants computer. It is probably a lucrative business given the number of offenders who now collect unlawful images and who are seeking alibis. They all want to say that some other person did it.
Here is an excerpt from yesterdays Associated Press report about a case involving a Massachusetts defendant named Fiola:
(The computer examiner), who inspected Fiola's computer, recalls a case in Arizona in which a computer was so "extensively infected" that it would be "virtually impossible" to prove what an indictment alleged: that a 16-year-old who used the PC had uploaded child pornography to a Yahoo group. Prosecutors dropped the charge and let the boy plead guilty to a separate crime that kept him out of jail, though they say they did it only because of his age and lack of a criminal record.
The preceding statement infers that a virus planted unlawful images on an innocent boys computer. The article’s headline: “Framed for child porn - by a PC virus” would have readers believe that viruses routinely plant unlawful images on the computers of unsuspecting citizens. In my nearly ten years supervising investigations into unlawful images, involving thousands of cases, we have never found this to actually occur.
Facts of the Arizona Case
For the record, and to clarify the statements above, the facts of the Arizona case were as follows:
In 2004, Yahoo found 35 unlawful images on their computer servers and reported them to the National Center for Missing and Exploited Children. Some of the images were from series of pictures involving known and identified victims of sexual molestation and depicted criminal sexual acts involving minors.
The images had been loaded into a Yahoo group titled: "beth_lard9".
The screen name used to load the images into the Yahoo group was "mrbob1980hoopdu".
The source of those images was found to be a Phoenix home and a search warrant was served at the home. A man and wife along with a 16 year old boy and his younger sister were found to reside at the home. Evidence was seized including a computer and most importantly, compact disks.
Examination of one of the compact disks seized from home revealed that the disk contained unlawful images depicting the sexual exploitation of minors.
The forensics exam (2) indicated that the date and time at which some of the images were trafficked was in the early afternoon at a time when the 16 year old was home alone and without parental supervision.
Forensics of the compact disk showed that someone had created a file on the compact disk named: kid/Lolita/goodones. Investigators know that Lolita, besides being a book written by Nabakov in the 1950s, is a popular term referring to underage girls and is often used by criminals seeking unlawful images.
Images were also found on the disk that were titled: "pthc". The letters pthc are used by offenders who seek unlawful images and refers to the words "pre-teen-hard-core".
Also in the home computer were references and links to web sites with titles referring to bestiality involving dogs and cows, rape, prostitution, sadism, murder, infantile sex, underage kiddy sex, urination, transsexualism and other acts.
During the interview the 16 year old admitted that he uses the screen name "joebean1988hoopdu". Notice the similarity between the original suspect screen name, mrbob1980hoopdu and joebean1988hoopdu. Both were likely created by the same person - the 16 year old suspect.
Plea Deal and Discussion
Anticipating the "I-am-a-virus-victim" defense, Arizona prosecutors charged the 16 year old with only the images that were found on the compact disk. The reason for this prosecutorial path was because while it might be theoretically possible for someone to plant a virus on a computer and also send images to the computer it would be impossible for the same virus to then transfer those images to a compact disk, name the file kid/Lolita/goodones, remove the disk from the computer, and place it on the nearby desk where we found it.
Computers that contain both viruses and unlawful images sometimes make for challenging prosecutions because it is easy confuse a jury into giving a guilty defendant the benefit of a doubt when the case involves complicated computer concepts.
Investigators and prosecutors were confident that the 16 year old was the correct suspect but chose to give him a light plea deal based on his youth and lack of prior offenses, not because anyone believed that someone planted images on his computer.
In the five years since this case, no new information has emerged indicating that the defendant was innocent. There has been no information about a vindictive enemy of the young man who would have had motive to infect the home computer. There has not been a rash of such cases duplicating the same effect on other computers anywhere.
Conclusion
In the interest of truth, the computer examiner mentioned in the story should discontinue inferring that the Arizona case is an example of a virus putting images on a persons computer. The examiner never proved that a virus put images on the computer in the Arizona case. The exam only showed that the suspect computer contained both viruses and unlawful images – a common occurrence in these cases. The leap in logic is unsubstantiated by the facts in this case.
While it is possible – in theory – for a virus to plant an image on a computer, in the field and in the lab we have never encountered it on a suspect’s computer. Chances of an unwitting citizen’s computer being infected with a porn-planting virus are probably equivalent to the odds of being struck by lightning.
Note to parents: For educational purposes, if the parents of the 16 year old in the Arizona case had done a better job of monitoring their child’s computer use, the entire incident might have been avoided.
Notes:
(1) Robertson, Jordan. (September 9, 2009). AP IMPACT: Framed for child porn _ by a PC virus. Retrieved November 9, 2009 from http://www.google.com/hostednews/ap/article/ALeqM5iFP7nhggkjFFeVx5PS60H2O4qeIwD9BRFQ680
(2) Reported in Phoenix Police report #2004-42357269
 |
