I know that probably none of us are lawyers (and we don't even play one on TV), but I invite your advice here (since this is the "Ethics..." forum).

I am acquainted with a fine young man (age 26). He and a roommate (Roommate #1) sublet an extra room in their home that they own to another fellow (Roommate #2) some time back. Roommate Number #1 owned a computer that they kept in the living room of the apartment. Roommate #2 occasionally surfed the web on the machine.

Roommate #2 subsequently moved out.

Recently, law enforcement officials showed up on their doorstep, had a warrant for (and confiscated) the computer. They had IP-address records linking the computer to child-porn downloads. Subsequently, the officials apparently resurrected (deleted) child porn images from the disk drive, dated during the period when Roommate #2 was there.

Neither this young man nor Roommate #1 knew anything about the images. Roommate #2 has disappeared.

The law-enforcement officials have shown no interest in locating the apparent perpetrator. Roommate #1 is facing prison time for the images since the machine is his. The two apparently innocent roommates face loss of their home and bankruptcy over this issue. They can affort only an overworked public defender that is simply going through the motions and not mounting any real defense. The police officer in charge is apparently "The Cop From Hell" that you see on TV shows and movies that pursues the wrong guy because he has enough evidence to convict.

I know that no one should ever allow someone else to use their machine for just exactly this type of risk, but when you consider how many times we might have allowed someone besides ourselves to use our computer, I can say, "There, but for the Grace of God, go I."

I hate to see either of these young men have their lives badly damaged and suffer consequences that they do not deserve.

Any advice?

Mufasa
(aka Dave of Sandy, Utah, USA)
[I provide low-cost, remote Database Administration services: www.dasages.com]

I believe there is a lot of 'hype' at the moment regarding a lack of understanding of computers and their workings.  The "Ah well it's on the computer, so you must have put it there" stance isn't 'supposed' to cut it any longer.

Even so, by not chasing up Roommate #2, how the hell can the police claim to have performed a thorough investigation.  That's like finding a body in someone's back garden and saying "The current occupants put it there, regardless of when it was buried".  I would have thought the police would 'have' to track down Roommate #2 and speak to him, especially if the file dates match his occupancy.

No doubt even the cheapest lawyer will provide better advice, but that would most likely be my stance.

I wish your friend the very best of luck, and hope justice prevails.

Carlsberg don't run I.T departments, but if they did they'd probably be more fun.

Not tracking down roommate #2 would (in my mind) introduce significant doubt into the case.

But at the same time, just being accused of this crime is horrible.  Even if they have to go into debt, they need to find a better lawyer.

Chip H.

____________________________________________________________________
If you want to get the best response to a question, please read FAQ222-2244: How to get the best answers first

Having worked with forensic guys, including law enforcement, in the past leads me to recommend finding the previous roommate. They can't prove who was at the computer at the time the materials were downloaded or viewed. But showing that many people had access to, and used that computer, goes a long way. Especially if the computer was in a common area of the house.

However, I think there is more to the story than you're telling us. The police don't sit on stuff like that and worry about it weeks or months later. They typically act on things fairly quickly.

So - either the roommate just moved out, or there has been other activity on the computer recently. Or, the person responsible had communications with someone else who has recently been apprehended, and that lead to this computer.

And I'll say this - there's WAY more info on computers to show who was likely at the computer (at the time) than most people think. It's all "connect the dots".

Pat Richard, MCSE MCSA:Messaging CNA
Microsoft Exchange MVP
Want to know how email works? Read for yourself - http://www.ietf.org/rfc/rfc2821.txt

SantaMufasa,
Though no one has really said it maybe their public defender believes his client(s) are guilty.  If he is "just going through the motions" then he may very well not care about your friends or even trying to get them jailed for some personal/moral reason.  I agree with the idea that they should get a new lawyer ESPECIALLY if they can prove that that computer was easily and regularly accessed by (at least) the missing roommate.  It sounds like they (the police) shut down (or watched) one of those (f**king horrible) sites and recorded the IP's of past and present users.  They have probably hit a few accidental surfers (people who got redirect or just hit the wrong link).  I would also try and make at least some of this public because as it stands now if they are innocent their lives are completely ruined (forever).  So if they are cleared they should have it publicized that they were suspected wrongly and are completely innocent.  Good luck.

Thanks to all who have posted for your universally excellent advice. I am contacting these young men, via e-mail, with your great suggestions.

Mufasa
(aka Dave of Sandy, Utah, USA)
[I provide low-cost, remote Database Administration services: www.dasages.com]

All the more reason to password protect your computer, even at home.

-------------------------
The trouble with doing something right the first time is that nobody appreciates how difficult it was - Steven Wright

was roommate #2 monitored at all? Or did he have free reign of the computer at all times?

Perhaps the way that the computer owner can clear himself is by providing times when he was out of the apartment (i.e. work, vacation, etc) with the times that the child pornography occurred.

How long was the time between roommate #2 leaving and the cops showing up? Hours? A day or two? Weeks? Months? I think that will depend on how innocent the computer owner is. If the cops missed #2 by a day or two, that's one thing. If they missed him by a couple of weeks then that's a little different story that leads me to believe that the computer owner may not be as innocent as we think.

Either case though child pornography is popular among police. They're just trying to sentence someone ASAP to make themselves look good. If the computer owner is truely innocent then he should hire a lawyer...then turn around once he wins and slap a lawsuit on the cop for harassment (just kidding...I know the cop is just doing his job). ;)

I know this is old, but there are a lot of issues like this that have come up in the popular media, and here are some of the defenses that make a lot of sense.

1.  You can't positively trace an IP address that was used at some time in the past to a computer today.  IP addresses can change.  Most ISPs might be able to connect an IP address with a subscriber or their cable/DSL modem, but proving which PC was using the connection at that time is more difficult.  That introduces reasonable doubt.  This is especially true if the Internet connection passes through a wireless access point that could be hacked or accessed from outside the home.  The fact that they were able to recover deleted images from the PC undermines this argument to an extent, but it's worth throwing it out there.

2.  Even if you can absolutely prove that a specific porn image was downloaded from a specific site by a specific IP, and that IP was used by Mr. X's cable modem, and a copy of that image was found on Mr. X's computer, you still haven't proven that Mr. X is guilty.  Especially in a case where there was also a Mr. Y and a Mr. Z who lived in the house and had access to the PC.  Now you have three suspects, and if those suspects shared a single logon to the PC there is effectively no way to tell who is guilty.

3.  Even if there were only a single person who had access to the PC, or you were able to trace the activity in question to a specific user account, you still can't be absolutely positive that the user in question is guilty.  It's possible that the PC had been infected with some sort of spyware/malware that downloaded the image or sent it to the user as pop-ups (which would then be cached on the hard disk).  There was a recent case of a substitute teacher who was prosecuted for showing porn to minors because her classroom computer displayed pornographic popup ads that were sent from some form of malware.

All three of the points above should introduce some degree of reasonable doubt.  But the fact that there was a third resident who has been ignored by the police even though his dates of residency coincide with the criminal activity is very poor police work.  At the very least he should be questioned as a suspect.  Assuming that there is actual evidence of him having lived/rented there, that should present an even bigger cloud of reasonable doubt.  If you have a halfway decent lawyer (and I highly recommend getting one) they can probably get background check on this mysterious roommate.  If it turns out that he has any sort of a record linked to sexual abuse or children, then the case will get much easier to get dismissed.  That at the very least is worth a look.

The cop is irrelevant at this point.  There should be a detective or prosecutor handling the case.  Admit nothing, and try to direct everything onto the missing roommate.  If your prosecutor has any sense, he'll probably realize that his case isn't as strong as it appears on the surface and possibly push for more investigation.

K, Your advice, along with the advice of the others, above, has been excellent. I have forwarded all suggestions to the young man to help him understand how to fight this battle.

Mufasa
(aka Dave of Sandy, Utah, USA)
[I provide low-cost, remote Database Administration services: www.dasages.com]

If it wasn't too long ago, then something as basic as IE history is a good indicator. If one minute you see a "roomate#2@hotmail.com Inbox" page and 5 seconds later you see a child porn page/site in the history, coupled with another 5 seconds later a hotmail email is loaded up then again it's another small bit of evidence (albeit weak) to add to the pile.

As suggested above, get the times and dates of when the sites were acessed and see if you can prove that you were not even there.

Steve.

"They have the internet on computers now!" - Homer Simpson

Maybe people on the forensics forum can give some more light into the issue: they know how to know what happened on a computer.

The forum is Security, hacker detection & forensics

Cheers,
Dian

Great idea, Dian. I hadn't even been aware that we had such a forum.

I'll check status with the friends for whom this is an issue and determine if they want me to press forward on the Security, hacker detection & forensics forum.

Thanks.

Mufasa
(aka Dave of Sandy, Utah, USA)
[I provide low-cost, remote Database Administration services: www.dasages.com]

Santa
Do you have an update on how your friend is doing, or are they still investigating?

Never listen to your customers.  They were dumb enough to buy your product, so they have no credibility. - Dogbert

Thanks for checking...I have passed along to the young men the excellent advice from this thread. The last update I had was that the attorney that they had engaged for their defense had hired a private investigator to track down evidence in their behalf, but that the investigator had a personality conflict with the young men, he did not dispatch his duties in good faith, thus causing a problem between the young men and the attorney.

They young men then had to engage another attorney, thus wasting the money that they had spent already on Attorney #1. I hope that the misstep with Attorney #1 does not put them at extreme disadvantage with the court.

I'll keep you posted as more developments arise.

Mufasa
(aka Dave of Sandy, Utah, USA)
[I provide low-cost, remote Database Administration services: www.dasages.com]

Hi

The fact the computer was shared and not secured is enought for me to say they have no case at all. If this is all you needed for a conviction then I could go over to a persons PC at work after hous and surf the web and that would be the end of him - it just does not work that way.
They need proof beyond resonable doubt and this means user id, credit card details of purchases made and matching receipts\downloads of the offending material.
The cops have no idea how it all works and are just feeling their way, they think its your PC and its got bad stuff on it so its your fault. If this was the case then every internet cafe in the world would be found guitly.

Good luck

David
Lan Administrator
CNA,CNE,VCP,MCP,LCP,ITIL

Remember to in court have the investigating officer testify as to how he gained access to the PC.  Was the home secured when you arrived?   Was the PC in a secured area inside the home?   Did access to the PC require knowing a valid user ID to be input by you.   Did the user ID require a valid password to be input by yourself?   If so, how did you aquire this information, was it on a post it note on the monitor screen?   How many people had access to the home that you are aware of?   Would anyone who had access to the home have had access to the PC in the same way you did?   

Was the PC being accessed by remote software such as netmeeting, or compromised by a trojan allowing remote access?

Spi200 and Aarenot,

Thanks for your contributions. I have forwarded them to my contact point between the two roommates.

An update: (Not really good news) The roommate who was the focus of the investigation had, as a term of his "own recognizance" freedom, a stipulation that he be gainfully employed. When his employer found out that he was under investigation, the employer terminated his employment. At that point, he was taken into custody to await trial.

With that roommate in custody, without employment, this forced the other roommate (who is my contact point between the two of them) to sell their home (which closes escrow on Tuesday). My contact point is also selling one of their two vehicles (a 2005 Hyundai Accent in mint condition, with 22K miles for $8,995, way under Kelly Blue Book value. Let me know if you know someone who needs a good deal on a vehicle.)

This is a sad situation, regardless of the incarcerated roommate's culpability, or lack thereof.

Thanks for everyone's contributions. You are an amazing group of people. One thing for sure: Tek-Tips "Ethics in the Workplace" forum has, a remarkable group of helpful members.

Mufasa
(aka Dave of Sandy, Utah, USA)
[I provide low-cost, remote Database Administration services: www.dasages.com]

Dave,

Been a couple months and I was wondering if there has been any news. This scares me to no end as I keep my personal home PC rather "unlocked" most of the time and freely let just about anyone use it

Thanks,

--Dan
Whenever you find yourself on the side of the majority, it is time to pause and reflect.
Mark Twain

Based upon your inquiry, Dan, I just phoned my contact in the case. He gave me the following briefing:

The defense attorney went to a pre-trial briefing with the prosecution. She determined that the prosecution was planning to pull out all the stops and go for the maximum penalty (20+ years). Apparently the prosecution's case (notwithstanding the excellent advice that you all have offered here) was enough to scare the focus roommate into accepting a deal: nine years with opportunity for release in 7 years.

Mufasa
(aka Dave of Sandy, Utah, USA)
[I provide low-cost, remote Database Administration services: www.dasages.com]

I need help keeping this straight.  Was the "focus roommate" the same as "Roommate #1" (the allegedly innocent PC owner), or "Roommate #2" (the person suspected of having downloaded the porn)?  If the former, then that is indeed very sad.

What are the takeaway lessons here?  Based on this situation, what do we think are prudent steps to protect ourselves from similar issues?

And one other question, is your friend off the hook? or was he the "focus roommate"?

This makes me even more disgruntled at our current legal system.

--Dan
Whenever you find yourself on the side of the majority, it is time to pause and reflect.
Mark Twain

The "focus roommate" is the person suspected of having downloaded the porn and is also the PC owner.

It is a very sad situation.

I had a virtually similar situation happen to me a few weeks ago while I was travelling with friends in the Philippines: I was the only traveller with an Internet-accessible PC. Everyone of the group asked me if they could use my PC to "check their e-mail".

One of the borrowers was the 19-year-old boyfriend of the 18-year-old daughter of the family with whom I was travelling. I woke up one morning to find two windows left open that contained hardcore video playing on repeating loops.

I was furious that someone would compromise me and my corporate PC in such a way...And the stupidity of leaving things in plain view was remarkable to me.

It didn't take me long to figure out who did it. I had a heart-to-heart talk with the perp, explaining to him that my job was at risk since my company monitors illicit navigations on corporate equipment.

At first he denied it. I went through the list of people that had access to my machine, including his girl friend, and I asked him if he wanted me to gather everyone around and confront all of them on this breach of my trust. With a deer-in-the-headlights look, he admitted his misbehaviour. (I guess the silver lining to the access was that it was not "kiddie porn" and that it was only live-action intercourse from a site featuring adults. )

I had him write and date a letter "TO WHOM IT MAY CONCERN", relating what he had done and apologising for his misbehaviour. I'm keeping it in case my company confronts me about the incident.

But this shows how otherwise-innocent-looking accesses of our machines could heavily compromise us.

Amongst the "take-aways" from these experiences of letting someone use your machine are:

• Allowing such access is like giving a person your debit card and PIN. If you wouldn't loan your debit card, then don't loan your computer, even to family and friends.
• Create password-only access to log in to your personal or corporate PCs...Don't leave your machine unlocked, even if you get up to get a bite to eat or go to the restroom.
• Unless you've decided to personally participate in porn sites, install "Nanny-watch" protective software on your machine
• If you decide that there is a reason to let someone use your machine, check the web-browsing "History" and "Cache" after others' uses. If either has disappeared, then that is a red flag that perhaps the user cannot be trusted with your machine in the future. Also, document in a spreadsheet, the dates/times and names of anyone using your machine. (If all of this seems a hassle to you, then consider the hassle of a 7-20-year prison term, for you or for them.)...Just say "No".

Mufasa
(aka Dave of Sandy, Utah, USA)
[I provide low-cost, remote Database Administration services: www.dasages.com]

The defense attorney went to a pre-trial briefing with the prosecution. She determined that the prosecution was planning to pull out all the stops and go for the maximum penalty (20+ years).

Bad things sometimes happen to good people, but in this case, it seems to me that the "focus roommate" either found himself a very bad lawyer, or was not as innocent as he said he was.

A good lawyer would probably know how to defend a person that is really innocent, find experts in the appropriate field to testify, find other ways/people/proofs that might help, and probably try to talk the guy into at least trying to go to trial and prove that he is innocent and get away a free person. They seemed to not even consider that. Wouldn't they be able to make that deal during the trial, if they see that there is no way to get out?  

So it is either 20 yers, or admit that you are guilty and take 7 to 9 years? Not even a chance to prove his innocence? Something is wrong with this picture.
A lawer doesn't feel she could do anything at all to an innocent guy, or maybe she knows something we don't know (that he is not that innocent), or the guy doesn't trust the lawer he hired to defend him, or all of the above.
Weird. And scary.

Or they plan to file an appeal?
 

At this point, Stella, you know what I know.

If it were I, even if there was a truckload of circumstantial evidence against me, and even if I knew that the investigators/prosecutors were "out to get me", I would rather fight and lose than admit to something I didn't do.

Mufasa
(aka Dave of Sandy, Utah, USA)
[I provide low-cost, remote Database Administration services: www.dasages.com]

I agree.  I would rather fight and risk losing than to admit something that wasn't true.  But then I don't know this person's circumstances.  Or the lawyer.  I suspect that facing the potential of 20 years looks pretty grim when you could just get it over with by taking 1/3 the time.  If you're fairly young (heck, I'm only 33), I could do 7 years and still have a decent amount of time ahead of me to have a family, travel, and generally life.  But 20 years...

Not to mention court costs.  I suspect that just accepting the plea deal cost thousands of dollars in court an attorney's fees.  Fighting it could cost many times that, and since it's a criminal case there's nobody to collect lawyer's fees from if you're acquitted.  So even if you win, you might be tens of thousands of dollars in debt (which is still better than being in prison).

But all of those decisions do weigh I suspect.

I happen to be married, and my wife and I do share our PC and laptop.  But I do have separate accounts set up for each of us, and we don't know each other's passwords, and there are additional accounts for frequent houseguests (mostly in-laws).  Hopefully that would be sufficient to segregate things enough that if something happened to us, we would be able to rule in/out certain suspects.

Quote (kmcferrin ):

If you're fairly young (heck, I'm only 33), I could do 7 years and still have a decent amount of time ahead of me to have a family, travel, and generally life.

You got to be joking. After serving a jail time, with this kind of conviction, all other possible issues aside (and there would be many, including psychological, family, health, etc.) do you think you would be able to  get a job good enough to have money for travel? You will need many more years to get back on your feet.

Quote (OriginalPost):

They can affort only an overworked public defender that is simply going through the motions and not mounting any real defense.

That's probably the main problem here. Heck, after hearing that the prosecution is out to get him a maximum of 20 years, before accepting any bargain plea deals, he should have fired his public defender, reach out to family and friends and ask them to hold a fundraiser for him in order to get a proper lawyer. He than could have a real chance to be free and clear of all the charges, even though severely indebted. It is very well worth it.

Quote:

Or they plan to file an appeal?

IANAL.  That said, to accept a plea-bargain you must plead guilty.  And there's no appealing that.

I thought of that, too.
I really don't know, it might not be called appeal, it can be called something else, but can they argue that he was coerced to make that plea, or something to that effect? Because a prospect of spending next 20 years in jail can scare daylight out of anyone, and cloud one's judgment, or even make them lose all brains at all (as it probably happened in this case) and admit to anything, just to get a (seemingly) lesser term.

He'll pay for this for the rest of his life even after he gets out as he is now labeled a sex offender. He'll have to register his whereabouts forever and his neighbors will be able to look him up online and then object to him living intheir neighborhood and pressure him to leave. A sad case all around.

"NOTHING is more important in a database than integrity." ESquared

Quote:

can they argue that he was coerced to make that plea, or something to that effect? Because a prospect of spending next 20 years in jail can scare daylight out of anyone, and cloud one's judgment,... and admit to anything, just to get a (seemingly) lesser term.

Not in the US.  One of the reasons you have an attorney is to keep you from doing anything insane, such as admitting to a crime you didn't commit.  Your attorney also is supposed to protect you from coersive methods.  One can always appeal on the grounds of incompetent counsel, but having admitted guilt it's unlikely such an appeal would be heard.

Quote:

Not in the US.  One of the reasons you have an attorney is to keep you from doing anything insane, such as admitting to a crime you didn't commit.  Your attorney also is supposed to protect you from coersive methods.  One can always appeal on the grounds of incompetent counsel, but having admitted guilt it's unlikely such an appeal would be heard.

And for a good example, look at Senator Craig who pled guilty to the bathroom shennanigans.  Once the news broke he tried to take back the plea and they wouldn't let him.  Of course, he was also a lawyer and he entered the plea by mail long after the fact, so he didn't have much of an argument of coercion.

Now, if it were a case where the cops picked you up and intimidated/coerced you into confessing to something without you having seen a lawyer, that's a different story, and that sort of thing certainly does happen sometimes.  But entering a plea in court with counsel isn't even close to the same thing.

After reading all of this I get the impression that I should not let anyone use any of my computers period. And that includes "trusted" friends and family.

Kaptlid,

Yep...that's the lesson that I'm taking from this tragedy. If you wouldn't give your bank PIN to someone, then don't give access to your computer, either.

Mufasa
(aka Dave of Sandy, Utah, USA)
[I provide low-cost, remote Database Administration services: www.dasages.com]

I do allow friends to use my laptop often, but never ever under my login. I never have done actually.

Fee

The question should be Is it worth trying to do? not Can it be done?