Soliciting some advice on a computer-related legal issue 10

[SantaMufasa]

I know that probably none of us are lawyers (and we don't even play one on TV), but I invite your advice here (since this is the "Ethics..." forum).

I am acquainted with a fine young man (age 26). He and a roommate (Roommate #1) sublet an extra room in their home that they own to another fellow (Roommate #2) some time back. Roommate Number #1 owned a computer that they kept in the living room of the apartment. Roommate #2 occasionally surfed the web on the machine.

Roommate #2 subsequently moved out.

Recently, law enforcement officials showed up on their doorstep, had a warrant for (and confiscated) the computer. They had IP-address records linking the computer to child-porn downloads. Subsequently, the officials apparently resurrected (deleted) child porn images from the disk drive, dated during the period when Roommate #2 was there.

Neither this young man nor Roommate #1 knew anything about the images. Roommate #2 has disappeared.

The law-enforcement officials have shown no interest in locating the apparent perpetrator. Roommate #1 is facing prison time for the images since the machine is his. The two apparently innocent roommates face loss of their home and bankruptcy over this issue. They can affort only an overworked public defender that is simply going through the motions and not mounting any real defense. The police officer in charge is apparently "The Cop From Hell" that you see on TV shows and movies that pursues the wrong guy because he has enough evidence to convict.

I know that no one should ever allow someone else to use their machine for just exactly this type of risk, but when you consider how many times we might have allowed someone besides ourselves to use our computer, I can say, "There, but for the Grace of God, go I."

I hate to see either of these young men have their lives badly damaged and suffer consequences that they do not deserve.

Any advice?


Mufasa
(aka Dave of Sandy, Utah, USA)
[I provide low-cost, remote Database Administration services: www.dasages.com]

 

[Grenage]

I believe there is a lot of 'hype' at the moment regarding a lack of understanding of computers and their workings. The "Ah well it's on the computer, so you must have put it there" stance isn't 'supposed' to cut it any longer.

Even so, by not chasing up Roommate #2, how the hell can the police claim to have performed a thorough investigation. That's like finding a body in someone's back garden and saying "The current occupants put it there, regardless of when it was buried". I would have thought the police would 'have' to track down Roommate #2 and speak to him, especially if the file dates match his occupancy.

No doubt even the cheapest lawyer will provide better advice, but that would most likely be my stance.

I wish your friend the very best of luck, and hope justice prevails.

Carlsberg don't run I.T departments, but if they did they'd probably be more fun.

 

[chiph]

Not tracking down roommate #2 would (in my mind) introduce significant doubt into the case.

But at the same time, just being accused of this crime is horrible. Even if they have to go into debt, they need to find a better lawyer.

Chip H.


____________________________________________________________________
If you want to get the best response to a question, please read FAQ222-2244 first

 

[58sniper]

Having worked with forensic guys, including law enforcement, in the past leads me to recommend finding the previous roommate. They can't prove who was at the computer at the time the materials were downloaded or viewed. But showing that many people had access to, and used that computer, goes a long way. Especially if the computer was in a common area of the house.

However, I think there is more to the story than you're telling us. The police don't sit on stuff like that and worry about it weeks or months later. They typically act on things fairly quickly.

So - either the roommate just moved out, or there has been other activity on the computer recently. Or, the person responsible had communications with someone else who has recently been apprehended, and that lead to this computer.

And I'll say this - there's WAY more info on computers to show who was likely at the computer (at the time) than most people think. It's all "connect the dots".

Pat Richard, MCSE MCSA:Messaging CNA
Microsoft Exchange MVP
Want to know how email works? Read for yourself -

http://www.ietf.org/rfc/rfc2821.txt

 

[Demonpiggies]

SantaMufasa,
Though no one has really said it maybe their public defender believes his client(s) are guilty. If he is "just going through the motions" then he may very well not care about your friends or even trying to get them jailed for some personal/moral reason. I agree with the idea that they should get a new lawyer ESPECIALLY if they can prove that that computer was easily and regularly accessed by (at least) the missing roommate. It sounds like they (the police) shut down (or watched) one of those (f**king horrible) sites and recorded the IP's of past and present users. They have probably hit a few accidental surfers (people who got redirect or just hit the wrong link). I would also try and make at least some of this public because as it stands now if they are innocent their lives are completely ruined (forever). So if they are cleared they should have it publicized that they were suspected wrongly and are completely innocent. Good luck.

 

[SantaMufasa]

Thanks to all who have posted for your universally excellent advice. I am contacting these young men, via e-mail, with your great suggestions.

Mufasa
(aka Dave of Sandy, Utah, USA)
[I provide low-cost, remote Database Administration services: www.dasages.com]

 

[johnherman]

All the more reason to password protect your computer, even at home.

-------------------------
The trouble with doing something right the first time is that nobody appreciates how difficult it was - Steven Wright

 

[LadySlinger]

was roommate #2 monitored at all? Or did he have free reign of the computer at all times?

Perhaps the way that the computer owner can clear himself is by providing times when he was out of the apartment (i.e. work, vacation, etc) with the times that the child pornography occurred.

How long was the time between roommate #2 leaving and the cops showing up? Hours? A day or two? Weeks? Months? I think that will depend on how innocent the computer owner is. If the cops missed #2 by a day or two, that's one thing. If they missed him by a couple of weeks then that's a little different story that leads me to believe that the computer owner may not be as innocent as we think.

Either case though child pornography is popular among police. They're just trying to sentence someone ASAP to make themselves look good. If the computer owner is truely innocent then he should hire a lawyer...then turn around once he wins and slap a lawsuit on the cop for harassment (just kidding...I know the cop is just doing his job).

 

[kmcferrin]

I know this is old, but there are a lot of issues like this that have come up in the popular media, and here are some of the defenses that make a lot of sense.

1. You can't positively trace an IP address that was used at some time in the past to a computer today. IP addresses can change. Most ISPs might be able to connect an IP address with a subscriber or their cable/DSL modem, but proving which PC was using the connection at that time is more difficult. That introduces reasonable doubt. This is especially true if the Internet connection passes through a wireless access point that could be hacked or accessed from outside the home. The fact that they were able to recover deleted images from the PC undermines this argument to an extent, but it's worth throwing it out there.

2. Even if you can absolutely prove that a specific porn image was downloaded from a specific site by a specific IP, and that IP was used by Mr. X's cable modem, and a copy of that image was found on Mr. X's computer, you still haven't proven that Mr. X is guilty. Especially in a case where there was also a Mr. Y and a Mr. Z who lived in the house and had access to the PC. Now you have three suspects, and if those suspects shared a single logon to the PC there is effectively no way to tell who is guilty.

3. Even if there were only a single person who had access to the PC, or you were able to trace the activity in question to a specific user account, you still can't be absolutely positive that the user in question is guilty. It's possible that the PC had been infected with some sort of spyware/malware that downloaded the image or sent it to the user as pop-ups (which would then be cached on the hard disk). There was a recent case of a substitute teacher who was prosecuted for showing porn to minors because her classroom computer displayed pornographic popup ads that were sent from some form of malware.

All three of the points above should introduce some degree of reasonable doubt. But the fact that there was a third resident who has been ignored by the police even though his dates of residency coincide with the criminal activity is very poor police work. At the very least he should be questioned as a suspect. Assuming that there is actual evidence of him having lived/rented there, that should present an even bigger cloud of reasonable doubt. If you have a halfway decent lawyer (and I highly recommend getting one) they can probably get background check on this mysterious roommate. If it turns out that he has any sort of a record linked to sexual abuse or children, then the case will get much easier to get dismissed. That at the very least is worth a look.

The cop is irrelevant at this point. There should be a detective or prosecutor handling the case. Admit nothing, and try to direct everything onto the missing roommate. If your prosecutor has any sense, he'll probably realize that his case isn't as strong as it appears on the surface and possibly push for more investigation.

 

[SantaMufasa]

K, Your advice, along with the advice of the others, above, has been excellent. I have forwarded all suggestions to the young man to help him understand how to fight this battle.

Mufasa
(aka Dave of Sandy, Utah, USA)
[I provide low-cost, remote Database Administration services: www.dasages.com]

 

[Stevehewitt]

If it wasn't too long ago, then something as basic as IE history is a good indicator. If one minute you see a "roomate#2@hotmail.com Inbox" page and 5 seconds later you see a child porn page/site in the history, coupled with another 5 seconds later a hotmail email is loaded up then again it's another small bit of evidence (albeit weak) to add to the pile.

As suggested above, get the times and dates of when the sites were acessed and see if you can prove that you were not even there.



Steve.

"They have the internet on computers now!" - Homer Simpson

 

[Diancecht]

Maybe people on the forensics forum can give some more light into the issue: they know how to know what happened on a computer.

The forum is Security, hacker detection & forensics

Cheers,
Dian

 

[SantaMufasa]

Great idea, Dian. I hadn't even been aware that we had such a forum.

I'll check status with the friends for whom this is an issue and determine if they want me to press forward on the Security, hacker detection & forensics forum.

Thanks.

Mufasa
(aka Dave of Sandy, Utah, USA)
[I provide low-cost, remote Database Administration services: www.dasages.com]

 

[pinkgecko]

Santa
Do you have an update on how your friend is doing, or are they still investigating?

[blue]Never listen to your customers. They were dumb enough to buy your product, so they have no credibility. - Dogbert[/blue]

 

[SantaMufasa]

Thanks for checking...I have passed along to the young men the excellent advice from this thread. The last update I had was that the attorney that they had engaged for their defense had hired a private investigator to track down evidence in their behalf, but that the investigator had a personality conflict with the young men, he did not dispatch his duties in good faith, thus causing a problem between the young men and the attorney.

They young men then had to engage another attorney, thus wasting the money that they had spent already on Attorney #1. I hope that the misstep with Attorney #1 does not put them at extreme disadvantage with the court.

I'll keep you posted as more developments arise.

Mufasa
(aka Dave of Sandy, Utah, USA)
[I provide low-cost, remote Database Administration services: www.dasages.com]

 

[spi200]

Hi

The fact the computer was shared and not secured is enought for me to say they have no case at all. If this is all you needed for a conviction then I could go over to a persons PC at work after hous and surf the web and that would be the end of him - it just does not work that way.
They need proof beyond resonable doubt and this means user id, credit card details of purchases made and matching receipts\downloads of the offending material.
The cops have no idea how it all works and are just feeling their way, they think its your PC and its got bad stuff on it so its your fault. If this was the case then every internet cafe in the world would be found guitly.

Good luck

David
Lan Administrator
CNA,CNE,VCP,MCP,LCP,ITIL

 

[aarenot]

Remember to in court have the investigating officer testify as to how he gained access to the PC. Was the home secured when you arrived? Was the PC in a secured area inside the home? Did access to the PC require knowing a valid user ID to be input by you. Did the user ID require a valid password to be input by yourself? If so, how did you aquire this information, was it on a post it note on the monitor screen? How many people had access to the home that you are aware of? Would anyone who had access to the home have had access to the PC in the same way you did?

Was the PC being accessed by remote software such as netmeeting, or compromised by a trojan allowing remote access?

 

[SantaMufasa]

Spi200 and Aarenot,

Thanks for your contributions. I have forwarded them to my contact point between the two roommates.

An update: (Not really good news) The roommate who was the focus of the investigation had, as a term of his "own recognizance" freedom, a stipulation that he be gainfully employed. When his employer found out that he was under investigation, the employer terminated his employment. At that point, he was taken into custody to await trial.

With that roommate in custody, without employment, this forced the other roommate (who is my contact point between the two of them) to sell their home (which closes escrow on Tuesday). My contact point is also selling one of their two vehicles (a 2005 Hyundai Accent in mint condition, with 22K miles for $8,995, way under Kelly Blue Book value. Let me know if you know someone who needs a good deal on a vehicle.)

This is a sad situation, regardless of the incarcerated roommate's culpability, or lack thereof.

Thanks for everyone's contributions. You are an amazing group of people. One thing for sure: Tek-Tips "Ethics in the Workplace" forum has, a remarkable group of helpful members.

Mufasa
(aka Dave of Sandy, Utah, USA)
[I provide low-cost, remote Database Administration services: www.dasages.com]

 

[Bandenjamin]

Dave,

Been a couple months and I was wondering if there has been any news. This scares me to no end as I keep my personal home PC rather "unlocked" most of the time and freely let just about anyone use it

Thanks,


--Dan
Whenever you find yourself on the side of the majority, it is time to pause and reflect.
Mark Twain

 

[SantaMufasa]

Based upon your inquiry, Dan, I just phoned my contact in the case. He gave me the following briefing:

The defense attorney went to a pre-trial briefing with the prosecution. She determined that the prosecution was planning to pull out all the stops and go for the maximum penalty (20+ years). Apparently the prosecution's case (notwithstanding the excellent advice that you all have offered here) was enough to scare the focus roommate into accepting a deal: nine years with opportunity for release in 7 years.

Mufasa
(aka Dave of Sandy, Utah, USA)
[I provide low-cost, remote Database Administration services: www.dasages.com]