[00:00.000 --> 00:10.960]  It was highly controversial and didn't seem to have ever been covered at any other hacker conference that we wanted to turn it into a panel with an attorney and maybe someone from the EFF.
[00:11.440 --> 00:12.540]  So that's what we did.
[00:12.660 --> 00:19.880]  But what we didn't expect was it to be so difficult to find people who'd be willing to participate in this panel because of the controversial nature of the topic.
[00:20.020 --> 00:21.920]  I talked to, I think, about eight different attorneys.
[00:22.340 --> 00:24.900]  They didn't want to touch it with a 10-foot pole.
[00:26.480 --> 00:28.340]  Alex Muentz from Philadelphia has balls.
[00:28.340 --> 00:34.220]  So he can explain why he decided to do this.
[00:34.340 --> 00:38.680]  But bottom line is I thank him for being on this panel because it's a worthwhile topic.
[00:39.320 --> 00:49.740]  And then Seth Schoen from EFF, a technologist, and has dealt with a lot of cases where... seen a lot of the legal side of cases.
[00:50.140 --> 00:53.360]  Even though he's not a lawyer, he's seen a lot there at EFF.
[00:55.040 --> 01:04.080]  And we had original... after the panel was put together, we got contacted by one of the... the wife of one of the defendants in one of the cases.
[01:04.100 --> 01:05.140]  It's going to be discussed here.
[01:05.920 --> 01:06.840]  Robin Fiola.
[01:07.360 --> 01:08.600]  What's your husband's first name?
[01:08.900 --> 01:11.480]  Michael Fiola's wife.
[01:11.900 --> 01:15.580]  She contacted us, was very interested in somehow helping out with this.
[01:16.660 --> 01:18.220]  And she was all set to come.
[01:18.360 --> 01:23.760]  But then after a long discussion with her husband, he decided it was probably not a good idea for her to talk about it.
[01:24.700 --> 01:28.180]  He has a gag order even though he was... all the charges were dropped.
[01:28.500 --> 01:34.560]  He was sort of more or less forced to sign a gag order in exchange for the government not prosecuting him.
[01:34.560 --> 01:36.700]  So she's not under that restriction.
[01:36.960 --> 01:38.960]  But he... he had a nervous breakdown.
[01:39.280 --> 01:42.160]  He's had a heart attack during his... during his case.
[01:42.500 --> 01:45.780]  And he just didn't need additional stress from the coverage.
[01:45.960 --> 01:49.440]  But it's... it's worth covering because this could happen to anybody, as they say.
[01:50.100 --> 02:01.060]  So without any more delay, I'm going to introduce Joe Cicero, Seth Schoen, and Alex Muentz, who will be talking about the need for a computer crime innocence project.
[02:05.510 --> 02:06.190]  Thank you.
[02:07.870 --> 02:08.510]  All right.
[02:09.690 --> 02:11.450]  I've been... this is my first hope.
[02:11.590 --> 02:13.570]  And I noticed that not a lot of people were doing bios.
[02:13.770 --> 02:15.150]  So I have three bio sheets.
[02:15.610 --> 02:17.870]  You've probably seen Alex and Seth talk.
[02:18.010 --> 02:19.530]  So we'll just go through the bios there.
[02:21.230 --> 02:24.530]  Thanks to Bernie for talking about the talk that almost wasn't.
[02:24.710 --> 02:30.470]  One thing he didn't mention was that the HOPE Selection Committee even contacted a innocence project.
[02:30.470 --> 02:35.670]  And they weren't interested in coming and talking about the need for a computer crime innocence project.
[02:35.830 --> 02:37.470]  So very controversial subject.
[02:38.430 --> 02:43.770]  My schedule for my part of the presentation, you know, the disclaimer that everybody does.
[02:44.150 --> 02:47.350]  I want to... I want to talk about whether or not a problem exists.
[02:47.390 --> 02:49.970]  And if it doesn't, we're... we're in for a very short talk today.
[02:50.930 --> 02:53.910]  Some cases in the news that you might be aware of or might not.
[02:53.910 --> 03:02.290]  A research project that I recently did that prompted me in the belief that we need a computer crime innocence project.
[03:02.630 --> 03:03.790]  Cost of the defense.
[03:04.030 --> 03:07.110]  And there's a lot of just not monetary costs.
[03:07.390 --> 03:10.250]  I'll do a little review of what I talked about and then Alex is going to take over.
[03:11.470 --> 03:12.070]  All right.
[03:12.230 --> 03:16.110]  The views expressed during my portion of the talk are my views alone.
[03:16.110 --> 03:22.810]  They don't necessarily represent the views of Alex or Seth or the HOPE Selection Committee or the HOPE Conference or my employer.
[03:23.050 --> 03:24.010]  So there's my disclaimer.
[03:24.390 --> 03:25.490]  I like this quote.
[03:25.490 --> 03:28.010]  I'm going to just do it verbatim.
[03:28.230 --> 03:33.230]  I'm not in favor of imprisoning the innocent, but I'm not enthusiastic about freeing the guilty.
[03:33.770 --> 03:37.930]  This talk is not about how to mask downloading your kiddie porn with malware.
[03:37.930 --> 03:50.610]  This talk is about how you can use proper forensics to find out what really happened on a system so that innocent people don't get convicted of crimes they didn't commit.
[03:51.710 --> 04:00.870]  Another good quote out on the web I found was, Call me naive, but I believe that two competent, diligent computer forensic examiners acting in good faith will usually agree upon the digital evidence.
[04:01.050 --> 04:06.430]  And what I found in my experience and what I found doing my research on the web is that never happens.
[04:06.430 --> 04:07.950]  And that's disappointing.
[04:08.330 --> 04:13.370]  You would think that two competent forensic examiners would say, Yes, I agree.
[04:13.370 --> 04:14.830]  That's what happened on the computer.
[04:15.010 --> 04:18.210]  But the defense and the prosecution rarely have that happen.
[04:19.610 --> 04:20.330]  All right.
[04:20.470 --> 04:21.550]  So does a problem exist?
[04:22.030 --> 04:29.630]  It doesn't matter whether... in my limited experience, it doesn't matter whether you work for the defense or the prosecution.
[04:29.650 --> 04:34.430]  I believe there are a lot of forensic examiners out there that are incompetent.
[04:34.430 --> 04:39.310]  They claim to know what they're doing, but they really don't know what they're doing.
[04:39.650 --> 04:50.090]  And I'm not saying that either side commits perjury, but if you are not a competent expert and you testify, what you testify becomes expert opinion.
[04:50.090 --> 04:53.890]  And it's up to the jury to decide whether or not you know what you're talking about.
[04:54.050 --> 04:58.890]  And I want you to think about the average 12 people on a jury and highly technical information.
[05:02.870 --> 05:06.530]  Oh, I guess I am saying that some experts do commit perjury.
[05:08.910 --> 05:09.630]  All right.
[05:09.910 --> 05:13.690]  Here I have two quotes out on the web.
[05:14.230 --> 05:19.150]  One of them is from an expert who runs a forensic company.
[05:19.150 --> 05:22.890]  And the other one is from an Oregon detective.
[05:22.890 --> 05:29.290]  The first one is, of the computer forensic experts I've encountered, 95% are dangerous.
[05:29.490 --> 05:33.190]  This is somebody who runs a forensic company.
[05:33.670 --> 05:44.650]  Now, what I would hope that if you get convicted or not convicted, if you get prosecuted for a computer crime, I'm sure that the other 5% will be who you run into.
[05:45.510 --> 05:50.690]  The other quote was, viruses couldn't make folders and save favorite images and catalog them.
[05:50.810 --> 05:53.830]  That was by an Oregon detective who was a forensic expert.
[05:54.310 --> 06:00.470]  Well, we all know that viruses and malware could do those things.
[06:00.530 --> 06:03.370]  So here's somebody who's an expert who says, well, that just can't happen.
[06:03.530 --> 06:10.630]  And if you went to the talk yesterday about crimeware, you know that a botnet could easily make that happen on your system.
[06:12.010 --> 06:12.610]  All right.
[06:12.670 --> 06:14.130]  Here's some great court transcript.
[06:14.130 --> 06:18.490]  This court transcript is actually from the Julia Merrow case, which we'll be discussing.
[06:18.970 --> 06:20.390]  Some good questions in it.
[06:20.450 --> 06:25.050]  The question was, does spyware and adware generate pornography?
[06:25.330 --> 06:28.410]  And the expert's answer was, I'm not aware that they do.
[06:28.750 --> 06:34.130]  Now, we can have a long discussion about whether or not the attorney's question was proper.
[06:34.510 --> 06:37.610]  Does spyware and adware generate pornography?
[06:37.610 --> 06:44.110]  What he really meant to ask was, does spyware and adware cause pornography to appear on your screen?
[06:44.470 --> 06:52.730]  Now, I'm sure that the 12 people that might be on your jury are going to understand the difference when an attorney asks a question like that.
[06:53.730 --> 06:57.910]  Another question, were there viruses, adware, spyware on the computer?
[06:57.910 --> 07:02.630]  And the expert's answer was, to the best of my knowledge, there was none of that on the PC.
[07:02.810 --> 07:08.910]  Yet, just before he was asked that question, he had testified that he didn't even look for spyware and adware.
[07:08.910 --> 07:20.090]  But I'm sure that a jury, where you're being prosecuted, will understand, but he just said something else, that they won't be asleep when the experts are talking.
[07:21.050 --> 07:23.110]  Okay, so where do these cases happen?
[07:23.310 --> 07:25.810]  Is this something that's just going on in the United States?
[07:25.810 --> 07:26.130]  No.
[07:26.410 --> 07:31.950]  Here's a case, this one was Julian Green.
[07:32.790 --> 07:38.470]  Julian Green had 172 indecent images on his system.
[07:39.050 --> 07:42.830]  A defense forensic examiner found that there were 11 Trojans on his computer.
[07:43.110 --> 07:49.410]  And the quote I found on the web was that they were capable of downloading the images.
[07:49.670 --> 07:54.030]  Well, I would think that a forensic examiner would know whether or not...
[07:54.030 --> 07:58.310]  would say whether or not they did it or they didn't do it.
[07:58.310 --> 08:13.730]  Now, I don't know if the person who wrote the article changed the word from we found evidence that these... that the malware actually downloaded these images or that the defense said, well, there were... there was malware on the system and the malware might have done it.
[08:13.790 --> 08:18.190]  I don't know that because I don't have any inside knowledge on this case.
[08:18.310 --> 08:21.950]  But when I read the word capable, I thought, well, that's interesting.
[08:21.950 --> 08:24.170]  So he was eventually acquitted.
[08:26.270 --> 08:29.410]  Here's another case many of you will probably be familiar with.
[08:29.510 --> 08:30.930]  It was the case of Julia Merrow.
[08:31.050 --> 08:35.170]  Julia Merrow was a substitute teacher who went into the classroom.
[08:35.170 --> 08:38.190]  I believe she was told not to turn the computer off.
[08:38.730 --> 08:46.270]  Some students either logged in or used the computer, and all of a sudden there was porn pop-ups that were on her system.
[08:46.490 --> 08:52.370]  She was actually convicted of impairing the morals of a child.
[08:52.370 --> 08:57.750]  She was convicted because her system had porn pop-ups on it.
[09:00.550 --> 09:03.430]  We previously heard some of the testimony in her case.
[09:03.550 --> 09:14.150]  Now, luckily, her sentence was delayed four times, and she was... she had a new trial, and then she ended up pleading that trial, and I believe it was for disorderly conduct.
[09:14.630 --> 09:20.510]  We're going to talk about what happened to her and how many problems she had during the whole course of this at the end of my presentation.
[09:21.750 --> 09:22.590]  Here's a case.
[09:22.730 --> 09:24.930]  This was the one that Bernie talked about earlier.
[09:25.750 --> 09:27.650]  This was the case of Michael Fiola.
[09:28.250 --> 09:31.150]  His laptop, I believe, his laptop had...
[09:31.150 --> 09:34.150]  something had happened to his laptop, and they reissued him another laptop.
[09:34.630 --> 09:38.490]  And that laptop ended up having child pornography on it.
[09:39.310 --> 09:47.890]  Defense Forensic Examiner, after he was being prosecuted for this, went in and found that there was all kinds of weird stuff going on on this laptop.
[09:48.710 --> 09:55.650]  Very interesting, I found out on the web, that two exams by the State Attorney General Office concurred with the defense forensic experts.
[09:55.790 --> 10:02.670]  So here's a time where, oh great, the prosecution and the defense agree on the evidence.
[10:02.670 --> 10:09.110]  The problem is how long that took to happen, and what happens to somebody's life when it takes so long.
[10:09.110 --> 10:15.670]  The court ended up concluding that he was not... the court ended up expunging him, his case.
[10:16.610 --> 10:19.150]  Another case, this case is Matthew Bandy.
[10:19.530 --> 10:22.710]  And this was really tried in the media.
[10:24.750 --> 10:37.170]  Matthew Bandy ended up having... or I don't know how many images he had, but I guess the prosecution was for nine images, which in Arizona is nine felony counts, which could be 90 years in prison.
[10:37.390 --> 10:41.270]  Now this might be a case of an overzealous prosecution, I don't know.
[10:41.950 --> 10:46.290]  But it was very adversarial from the beginning.
[10:46.990 --> 10:57.350]  The Arizona Supreme Court had to rule against the county attorney's office that didn't want to allow the defense to do an analysis of the computer.
[10:57.550 --> 11:06.630]  So right away, the county attorney's office that didn't want to allow the defense to examine the computer started being adversarial.
[11:06.850 --> 11:15.070]  The family went out and got Bernstein Crisis Management to build a website to start discrediting the county attorney's office.
[11:16.910 --> 11:18.570]  It was just a back and forth.
[11:18.570 --> 11:24.650]  In fact, you might have seen a 2020 report on this exact case.
[11:24.850 --> 11:40.930]  Now, I did a lot of research on this case, found a lot of information out on the web, and since then, the prosecutor has reexamined the system at least two more times, and there's a lot of information out on the web that really points to Matthew was guilty.
[11:41.090 --> 11:44.290]  But again, I didn't have any inside knowledge on this.
[11:44.350 --> 11:45.710]  It's only what I've read out on the web.
[11:46.510 --> 11:47.070]  All right.
[11:47.410 --> 11:48.770]  So a little bit of my background.
[11:49.010 --> 11:50.830]  Every year, I do a yearly research project.
[11:50.950 --> 11:51.810]  I like to stay busy.
[11:52.030 --> 12:00.550]  And some of my research projects have included penetration testing educational software, analyzing malware, and using forensic products to test security.
[12:01.810 --> 12:08.070]  When I did my analyzing malware project, I learned a bunch of things.
[12:08.070 --> 12:12.910]  Some of them I used in the last project I did.
[12:13.150 --> 12:20.490]  That, first of all, just because there is malware doesn't mean that it downloaded certain things.
[12:20.490 --> 12:21.830]  We should all be aware of that.
[12:21.910 --> 12:28.750]  There's all different types of malware, and just because there's malware on our system does not necessarily mean that it downloaded illegal content.
[12:29.210 --> 12:35.450]  More importantly, just because you didn't find malware doesn't mean there isn't any on your system.
[12:35.450 --> 12:38.550]  And again, I'll point to the presentation yesterday about crimeware.
[12:39.130 --> 12:45.210]  There's very easy ways to make your malware be able to be installed on a computer and not find it.
[12:45.250 --> 12:59.030]  So if a prosecutorial forensic expert says, I searched for malware on your system, and I didn't find any, so there's not going to be any, in Europe they call it the THD defense, or the Trojan horse defense.
[12:59.230 --> 13:03.410]  And in the United States they call it the Saudi defense, or some other dude did it.
[13:03.890 --> 13:06.970]  All right, I didn't find malware, so there's not going to be that.
[13:07.030 --> 13:08.330]  Well, that's not the case.
[13:08.470 --> 13:16.790]  It's quite possible, using normal ways to find malware, anti-virus, that you might not find the malware on the system.
[13:17.550 --> 13:35.850]  I'm going to show you, in my malware presentation, I actually, what I was trying to find out was, I had heard that if you download a screensaver out on the Internet, this was about two years ago, that nine out of ten of them have a virus, or are malware.
[13:36.190 --> 13:38.650]  So I thought, that's interesting, I'm going to prove that.
[13:38.810 --> 13:49.110]  So I went out and I downloaded this Dolphin screensaver, and I shot it out to VirusTotal, and at this time VirusTotal would search it with 39 different virus protection packages.
[13:49.710 --> 13:53.070]  And one of the 39 found something wrong.
[13:53.270 --> 13:54.630]  And what did it find wrong?
[13:54.790 --> 13:56.150]  It said, the file is damaged.
[13:56.350 --> 14:00.230]  So how many of you, when you saw this, would just go ahead and install it?
[14:00.850 --> 14:01.210]  Right?
[14:01.610 --> 14:06.830]  39 different anti-viruses say, this application is fine, I'll go ahead and install it.
[14:07.150 --> 14:11.210]  After analyzing it, I found that it was doing something on my system.
[14:11.210 --> 14:19.150]  I went ahead and did a Wireshark capture, and it was encrypting data off my system, and sending it off to somebody outside.
[14:19.310 --> 14:22.290]  Now it was a nice test system, so I wasn't concerned about what it was sending off.
[14:22.530 --> 14:27.670]  And in this particular project, I actually figured out what it was sending off.
[14:27.810 --> 14:34.630]  And if you're interested in hearing about what this, what it was, was a botnet, was doing, you can talk to me after this talk.
[14:35.350 --> 14:35.830]  All right.
[14:35.990 --> 14:38.450]  So has that defense ever been used?
[14:38.450 --> 14:42.590]  Has somebody said, yeah, but you're not going to find malware on my system?
[14:42.610 --> 14:45.950]  And yes, I agree my system was used to hack.
[14:46.550 --> 14:56.250]  Certainly, in the case of Aaron Caffrey, his system, both the prosecution and the defense agree, his system was used to attack, I think it was the Port of Houston.
[14:57.430 --> 15:04.090]  Well, the case hinged on whether or not the jury would believe that someone else had taken over his system.
[15:04.090 --> 15:06.930]  And indeed, they ended up believing that, and he was acquitted.
[15:09.490 --> 15:10.070]  All right.
[15:10.290 --> 15:12.870]  So, the latest project I've worked on.
[15:13.510 --> 15:16.190]  I was asked to come in and do a forensic analysis.
[15:16.510 --> 15:18.550]  I took the prosecutorial report.
[15:18.570 --> 15:21.730]  I read the entire report, and I found this quote.
[15:21.930 --> 15:24.670]  And I read this quote, and it just didn't seem right to me.
[15:24.670 --> 15:39.490]  The quote is, it is unknown if any of these virus files were allowed to run on the system prior to being caught by the Norton antivirus software, or if any of them were in any way responsible for any of the child pornography files located on the suspect's computer.
[15:39.490 --> 15:45.230]  If I'm the computer forensic examiner, if I'm the expert, I should know these answers.
[15:45.450 --> 15:47.510]  I shouldn't be writing this in a report.
[15:47.510 --> 15:56.810]  I should be able to say that these viruses infected the system after this pornography was placed on the system, or before the system was placed on the system.
[15:56.930 --> 16:02.450]  So, I went to the defense attorney I was working for, and I said, I've never really done this.
[16:02.450 --> 16:07.890]  If it turns out that the malware downloaded this, I'm not your guy.
[16:07.890 --> 16:16.930]  But I can tell you that I'm going to instantaneously start working on how I would do this if I needed to prove that malware was the problem.
[16:17.390 --> 16:29.370]  So, my latest project is researching if it is possible to tell whether malware or the computer user downloaded files in question on the system.
[16:31.250 --> 16:33.470]  So, I started by going out on the Internet.
[16:33.790 --> 16:45.410]  And there's all kinds of information on the Internet on how you might go about proving whether or not malware downloaded illegal files on the system, or the computer user downloaded files on the system.
[16:45.570 --> 17:00.190]  But no one, I could find nowhere that someone would tell me I actually infected a system, and I conducted a computer forensic exam, and these are the steps I took, and this is how I proved that the malware did it.
[17:00.790 --> 17:07.490]  Those of you that are big into reading, there was a book a while back called Hackers Challenge, and that's what Hackers Challenge did.
[17:07.730 --> 17:13.850]  It gave you all the log files, and it would bring you to this is what happened, and this is how you could have proved what happened.
[17:13.970 --> 17:15.110]  So, that's what I was looking for.
[17:15.290 --> 17:16.590]  I couldn't find that.
[17:16.590 --> 17:18.890]  So, I decided, you know what I'm going to do?
[17:18.970 --> 17:21.530]  I'm going to send out emails to a bunch of industry professionals.
[17:21.650 --> 17:23.910]  And if I said their names, that you'd know them.
[17:24.170 --> 17:26.430]  And basically, I asked three questions.
[17:26.690 --> 17:33.670]  First was, are you aware of any documentation that discusses what downloader malware looks like from a forensic examiner's point of view?
[17:33.690 --> 17:35.670]  And if you do, could you tell me where it is?
[17:36.370 --> 17:40.650]  And the other question was, if you don't, do you think this would be a worthy project?
[17:41.230 --> 17:49.630]  Now, I was disappointed, just like we had so many people who decided, we're not going to touch this with a ten-foot pole.
[17:49.790 --> 17:54.330]  I wonder how many of these forensic examiners said, I don't even want to be involved in this project.
[17:54.330 --> 17:56.030]  And that's why I didn't get a response.
[17:56.310 --> 18:00.830]  But of the replies I got, no one could point me to any documentation.
[18:00.930 --> 18:03.350]  So, I thought this would be good documentation to write.
[18:03.350 --> 18:07.290]  And some respondents thought, and that would be a worthy project.
[18:08.170 --> 18:14.390]  Other respondents that said, I'm not aware of any of that documentation, thought I should do some other project.
[18:14.390 --> 18:21.830]  They said, but why don't you do this instead of analyzing whether malware or the computer user project?
[18:22.770 --> 18:24.370]  So, I work for a college.
[18:25.370 --> 18:28.110]  And normally when I do these projects, I do them on my own.
[18:28.350 --> 18:31.290]  And then I go to the college and I say, I would like to present at DEFCON.
[18:31.290 --> 18:33.390]  I would like to present at this technology conference.
[18:33.510 --> 18:34.490]  I would like to present at HOPE.
[18:34.730 --> 18:42.250]  Do you want me to present as independent researcher Joe Cicero or Northeast Wisconsin Technical College instructor Joe Cicero?
[18:42.370 --> 18:47.730]  And always in the past, the college has said, no, you can do it as an employee of NWTC.
[18:48.230 --> 19:00.490]  But because I was going to do this project on an NWTC computer, and I would be installing malware on an NWTC computer, which is against policy, I thought it better that I ask permission to do this one.
[19:00.490 --> 19:08.790]  So, I sent off an email to my executive leadership team, that's what ELT stands for, requesting permission to do this project.
[19:08.810 --> 19:11.170]  And I asked them three simple questions.
[19:11.490 --> 19:18.110]  Can I conduct the research as an NWTC employee, which I always ask after the fact, but this time I was asking before.
[19:18.550 --> 19:21.690]  Can I get an exemption to the acceptable use policy?
[19:21.690 --> 19:29.370]  I'm going to install malware on one of your computers, which is against your acceptable use policy, and I need an exemption for that.
[19:29.890 --> 19:32.270]  And, can I publish all the communications?
[19:32.450 --> 19:37.990]  Because if I can't publish the communications between us, then I won't do this project as an NWTC employee.
[19:38.370 --> 19:40.710]  This is part of the research project.
[19:40.710 --> 19:45.010]  If somebody wants to go on with my research, they might want to know what the steps I took.
[19:46.470 --> 19:53.210]  The executive leadership team's response was, you have the support to go ahead and do this project.
[19:53.390 --> 19:58.550]  Now, I want to make it clear, all I asked them for was, I'm going to install malware.
[19:58.650 --> 20:00.710]  I didn't say anything about what the malware would do.
[20:01.330 --> 20:03.470]  So, they said, go ahead with your project.
[20:03.510 --> 20:04.950]  And I thought, great, now I can start.
[20:05.790 --> 20:07.670]  My next call was to the EFF.
[20:08.450 --> 20:13.630]  Great organization, if you haven't given, if you've got an extra couple of bucks, just go down and give it to them.
[20:13.630 --> 20:16.830]  If you've got 20, 40, 60, 100, go give it to them.
[20:18.370 --> 20:22.230]  I can't say enough about how nice it is to make a phone call to an attorney.
[20:22.370 --> 20:24.750]  I spent about a half an hour on the phone with Jennifer Granick.
[20:25.750 --> 20:26.810]  Just a wonderful organization.
[20:28.170 --> 20:29.850]  So, I made a phone call.
[20:30.170 --> 20:37.590]  One of the first things I told Jennifer was, I haven't told my executive leadership team that this malware might download illegal content like child pornography.
[20:37.870 --> 20:42.250]  And the words out of Jennifer's mouth were, you're going to tell them that, right?
[20:42.250 --> 20:49.710]  I said, yes, but I wanted to back up everything that I was about to send them in an email by talking to an attorney first.
[20:50.310 --> 20:53.950]  Out of that conversation, two primary outcomes came.
[20:54.110 --> 21:01.790]  First of all is that the law, in regards to child pornography, states knowingly with the regards to possession.
[21:01.790 --> 21:09.110]  So, as long as I don't become aware of the child pornography on a system, I haven't broken that law.
[21:09.310 --> 21:12.230]  So, I could do a forensic exam and never look at an image.
[21:12.350 --> 21:13.670]  I don't need to look at the image.
[21:13.670 --> 21:15.370]  I'm looking at all the metadata of the image.
[21:15.450 --> 21:17.170]  So, I thought, that's very easy to do.
[21:17.170 --> 21:31.210]  The other thing that I had not thought about, and this is why you discuss these things with attorneys and other IT professionals, was you should probably address what will happen if you do become aware of the illegal content.
[21:31.530 --> 21:35.230]  They might have policies and procedures already in place, but they might not.
[21:35.230 --> 21:39.410]  So, in the event you become aware, you want to have that in your protocol.
[21:39.410 --> 21:40.370]  That was very important.
[21:41.030 --> 21:47.110]  So, after I had that conversation, I did an executive leadership team re-request.
[21:47.310 --> 21:58.270]  I sent off an email, and I said, do you want to revoke my approval based upon the possibility that the malware I install on your computer might download illegal content?
[21:58.530 --> 22:00.770]  An example would be child pornography.
[22:01.190 --> 22:09.150]  The second question was, do you want to review the protocol I write before I conduct this research, so that there's other eyes on it?
[22:09.410 --> 22:17.130]  And another question was, do you already have policies in place should someone become aware that there's child pornography on a system?
[22:17.410 --> 22:21.870]  I sent that email off to my executive leadership team, and what do you think happened?
[22:23.810 --> 22:25.950]  I work for a great organization.
[22:26.970 --> 22:35.750]  My executive leadership team said, Joe, we back you, and we're going to allow you to proceed, but we're going to do it with caution.
[22:35.750 --> 22:37.810]  How many of you have an employer like that?
[22:39.930 --> 22:40.370]  Yeah.
[22:40.590 --> 22:41.510]  I think they do.
[22:42.810 --> 22:43.730]  Here's a college.
[22:43.870 --> 22:47.070]  You want to talk about a college that allows their instructors some leeway.
[22:47.270 --> 22:53.810]  They didn't say, no, we're not getting involved with this, like all the attorneys and the Innocence Project here in New York.
[22:53.930 --> 22:57.910]  They said, this is a worthy project, and we're going to just proceed with caution.
[22:58.530 --> 23:01.730]  So, what they wanted to do is consult with their own attorneys.
[23:01.730 --> 23:03.670]  So, the next thing we did, and I love meetings.
[23:03.890 --> 23:08.890]  Sorry, Alex, but meetings with attorneys are not on my high regard.
[23:12.830 --> 23:16.110]  I had a meeting with the attorney.
[23:16.250 --> 23:17.970]  Now, this was very interesting to me.
[23:17.970 --> 23:25.190]  The school's attorney said, you know, Joe, courts can lower the standard of knowingly to should have known.
[23:25.430 --> 23:27.150]  And you're a computer expert.
[23:27.390 --> 23:33.210]  I can easily see a court saying, Mr. Cicero, you should have known.
[23:33.210 --> 23:38.850]  So, we're going to go forward with that understanding.
[23:39.530 --> 23:42.390]  Additionally, they said, you know, there might be safe harbor and exemption.
[23:42.610 --> 23:44.590]  There might be a safe harbor exemption.
[23:45.310 --> 23:47.790]  So, we might have something that we can work on.
[23:47.950 --> 23:50.450]  And you can do this project and we don't really have to worry about it.
[23:50.850 --> 23:56.070]  They also said, we should talk with the people we deal with with anti-virus.
[23:56.070 --> 23:57.610]  They're anti-malware vendors.
[23:57.890 --> 24:00.990]  And we should say, hey, how do you guys deal with this?
[24:01.010 --> 24:04.050]  Because if it's going on, it must happen on your computers.
[24:04.110 --> 24:08.090]  And there might be a procedure or protocol already in place for how to handle it.
[24:08.690 --> 24:16.990]  And then they said, you know what, we're going to schedule a follow-up meeting with another attorney who does computer forensics and gets some of his thoughts.
[24:18.010 --> 24:21.230]  So, the answers to those key points before that meeting happened.
[24:21.410 --> 24:23.270]  They couldn't find a safe harbor exemption.
[24:23.270 --> 24:27.950]  The anti-malware vendors were unwilling to tell us how they conducted testing.
[24:28.070 --> 24:29.330]  Now, I want you to think about that.
[24:31.390 --> 24:41.890]  It happens, we know it happens, that malware, whether it's a botnet or virus or Trojan or whatever, has downloaded illegal files.
[24:42.210 --> 24:47.950]  Well, that means that all these anti-virus vendors have to have systems where that's happening.
[24:47.950 --> 24:53.610]  They were unwilling to tell us the protocol that they use to handle when that happens to them.
[24:54.930 --> 24:59.010]  They contacted other colleges to say, do you have any instructors doing this type of research?
[24:59.050 --> 25:00.130]  And how do you handle it?
[25:00.510 --> 25:05.770]  And the colleges got back with my college and basically said, let us know how that goes.
[25:06.490 --> 25:09.710]  Or, are you sure you want to allow this instructor to do that?
[25:09.710 --> 25:13.670]  So, again, other colleges really not doing this type of research.
[25:13.950 --> 25:16.190]  And, of course, there was a follow-up meeting scheduled.
[25:16.950 --> 25:25.950]  Now, prior to the follow-up meeting, the attorney that was going to be called in to meet with me on the follow-up meeting said, you know what, I want to have a meeting before that meeting.
[25:25.950 --> 25:29.570]  So, now, lucky me, I get to have meetings about meetings.
[25:31.190 --> 25:45.290]  I get called into this meeting and this attorney, who's also a forensic examiner, said, you know what, I would not be able to render an opinion on this until I had a formal research proposal and the protocol written.
[25:46.170 --> 25:51.010]  So, I looked at him and I said, what do you need in the formal research proposal and the protocol?
[25:51.150 --> 25:52.670]  Just tell me and then that's what I'll write.
[25:53.230 --> 25:55.970]  And he said, no, I'm not going to go for that.
[25:56.170 --> 25:58.870]  So, we ended that meeting and I went back to my office.
[25:58.890 --> 26:02.510]  And if I do say so myself, I wrote a very nice formal research proposal.
[26:02.950 --> 26:04.830]  And I started writing the protocol.
[26:05.050 --> 26:08.310]  But what I felt was, I was kind of in a catch-22.
[26:09.550 --> 26:11.910]  The formal research proposal was easy to write.
[26:12.070 --> 26:15.690]  You know, all kinds of information in it and sightings.
[26:16.050 --> 26:25.510]  But the protocol, every time I thought about how I do a forensic exam, I realized that I do a lot of things exactly the same.
[26:25.850 --> 26:28.110]  But then what I end up with is new search leads.
[26:28.770 --> 26:31.370]  So, I title this new search lead, new search lead.
[26:31.750 --> 26:34.710]  And then I have to go analyze those new search leads.
[26:34.810 --> 26:37.870]  All right, I saw this, I'm going to go on and I'm going to find out what happened there.
[26:37.870 --> 26:45.770]  And what the realization I had is when I write down these new search leads, I'm then going to have to write a new protocol for them.
[26:45.950 --> 26:48.290]  I'm going to have to submit them to an attorney.
[26:48.390 --> 26:55.110]  I'm going to have to wait for that attorney to make a decision because I can't vary myself from this protocol at all.
[26:55.390 --> 26:57.490]  This is going to take forever.
[26:58.230 --> 27:04.770]  I won't be able to conduct this research in years because it has to then go back to the executive leadership team.
[27:04.770 --> 27:07.010]  It then has to be approved and come back to me.
[27:07.190 --> 27:09.310]  And it would just take forever to do this.
[27:09.410 --> 27:13.190]  So, I basically scrapped the idea of installing the malware.
[27:13.490 --> 27:15.710]  But I still wanted to conduct my research.
[27:16.270 --> 27:18.050]  So, what's a guy to do?
[27:18.730 --> 27:22.950]  Hey, use my own industry standard malware.
[27:23.490 --> 27:44.070]  So, I made the decision, rather than writing my own virus, what I'll do is I'll go find out how people are doing things like botnets, learn how to do a botnet, create my own botnet, and then I'll just upload my own inert images, images of cars, and I can still conduct my research because I don't care what the image is.
[27:44.070 --> 27:49.430]  I care whether or not you can tell what put it there, the malware or the computer user.
[27:49.610 --> 27:55.410]  So, I spent a considerable amount of time, 30 or 40 hours, learning how to create a botnet.
[27:56.310 --> 27:57.990]  I was able to create a botnet.
[27:58.170 --> 28:03.070]  I'm able to upload image files now to my test computer, and my research continues.
[28:03.450 --> 28:10.520]  Now, I did not... I don't have anything officially written yet, but what I've done so far, the evidence points me...
[28:11.810 --> 28:16.910]  What I found is that the lack of evidence is the evidence itself.
[28:17.210 --> 28:26.690]  If you find these images on your system, but you don't find any other relation to that evidence, then it was probably malware that put it there.
[28:26.790 --> 28:31.850]  Remember, I want to be able to analyze a system and not know whether or not malware exists.
[28:32.770 --> 28:33.370]  All right.
[28:33.570 --> 28:35.110]  So, why is this going on?
[28:35.370 --> 28:36.770]  Well, if you go out...
[28:36.770 --> 28:39.770]  Why are experts having problems with determining this?
[28:40.190 --> 28:42.650]  Well, I found this quote out on the web.
[28:42.830 --> 28:45.410]  There's a two-year time limit before your soul dies.
[28:45.430 --> 28:51.550]  This was an article, I believe it was on Forensic Focus, written by a gentleman who deals with child pornography on a regular basis.
[28:51.790 --> 29:06.190]  And he basically says, people who do this on a daily basis, either after two years, their heart is black, and they can ignore the terrible things that they see on their screen, or they just can't take it anymore.
[29:06.450 --> 29:16.250]  Now, I want you to think about a forensic expert that's prosecuting you, or that's dealing with the prosecution, that has less than two years' experience.
[29:17.790 --> 29:21.990]  How expert were you when you had less than two years' experience?
[29:22.490 --> 29:30.850]  So, that might be one of the reasons for the previous quote, 95% of the forensic experts that that gentleman met were dangerous.
[29:32.090 --> 29:35.430]  Additionally, I found a quote, law enforcement agencies are on a steep learning curve.
[29:35.490 --> 29:36.390]  Now, I want you to think about this.
[29:36.390 --> 29:41.870]  I was involved in a case last year that was Windows 98.
[29:43.270 --> 29:50.070]  So, I have to know Windows 98, Windows XP, Windows Vista, Windows 7.
[29:50.370 --> 29:53.710]  If you're a small shop, you have to know everything.
[29:53.710 --> 30:04.450]  Now, think about how many small forensic shops, even police and forensic examiner shops there are, where there's one or two guys.
[30:04.550 --> 30:12.710]  Are they going to know Linux, Macintosh, all the different versions of Macintosh, all the intricacies of Vista and 7 and XP and 98?
[30:12.710 --> 30:16.130]  So, law enforcement agencies are on a steep learning curve.
[30:16.690 --> 30:18.990]  Alright, so what's the cost of the defense?
[30:19.710 --> 30:25.510]  There's a cost that goes way beyond monetary cost.
[30:26.170 --> 30:28.090]  Julia Merrow miscarried her baby.
[30:28.310 --> 30:30.090]  She was hospitalized for stress.
[30:30.590 --> 30:32.850]  They can barely afford to keep their home.
[30:33.290 --> 30:36.150]  Her case took four years of her life.
[30:36.510 --> 30:38.850]  This is all over porn pop-ups.
[30:39.870 --> 30:46.330]  She lost her teaching license, and she lost at least one job because her employer didn't like her arrest record.
[30:47.550 --> 30:48.470]  Matthew Bandy.
[30:48.770 --> 30:52.050]  It was reported that there was a quarter million dollars in legal costs.
[30:52.070 --> 30:55.530]  He was on probation for 18 months and it was a two-year nightmare.
[30:57.470 --> 30:58.510]  Michael Fiola.
[30:59.310 --> 31:02.470]  He was fired from his job, received death threats.
[31:02.890 --> 31:05.650]  This case cost him a quarter million dollars in fees.
[31:05.790 --> 31:09.870]  They had to liquidate their savings, take a second mortgage, sell their car.
[31:09.870 --> 31:11.030]  They lost friends.
[31:11.470 --> 31:13.210]  And what was the...
[31:13.830 --> 31:16.830]  Do you remember what I found out on the web?
[31:16.830 --> 31:19.950]  That the prosecutor...
[31:19.950 --> 31:26.450]  There were two exams or something like that, that agreed with the defense forensic exam.
[31:26.950 --> 31:28.550]  This is what it cost him.
[31:31.050 --> 31:32.870]  There's a cost to the taxpayers, too.
[31:32.970 --> 31:36.410]  I don't want you to think that prosecution is free.
[31:36.690 --> 31:40.230]  The prosecutors that are prosecuting people, they...
[31:40.230 --> 31:41.570]  That costs you money.
[31:42.030 --> 31:43.830]  There's a belief in the legal system.
[31:44.030 --> 31:50.990]  I think we all probably have an understanding that you might get a raw deal if you end up in the legal system.
[31:50.990 --> 31:53.870]  And then there's the cost that guilty people go free.
[31:54.590 --> 32:00.010]  I am not in favor of anybody who deals with child pornography going free.
[32:00.170 --> 32:01.510]  I want them prosecuted.
[32:03.010 --> 32:03.670]  All right.
[32:03.730 --> 32:07.370]  So, how many of you have a quarter million dollars for your defense fund?
[32:08.170 --> 32:08.730]  Right?
[32:09.010 --> 32:11.930]  These people, they had that kind of money.
[32:13.230 --> 32:14.790]  I don't have that kind of money.
[32:14.790 --> 32:16.430]  So, what can you do?
[32:16.590 --> 32:20.810]  Well, defendants can ask courts to pay, but sometimes the judge bulks at the price.
[32:21.650 --> 32:23.230]  Forensic examiners are not cheap.
[32:23.730 --> 32:26.770]  And a really good attorney is probably not going to be cheap.
[32:26.910 --> 32:29.770]  So, this is going to cost you a lot of money if you're innocent.
[32:31.410 --> 32:31.990]  All right.
[32:32.270 --> 32:33.510]  So, does a problem exist?
[32:33.650 --> 32:35.130]  Yeah, I think a problem exists.
[32:35.330 --> 32:40.370]  And I think a way to handle this problem is a computer crime innocence project.
[32:41.410 --> 32:44.290]  Innocent people are being prosecuted and convicted.
[32:44.290 --> 32:46.630]  And guilty people are not being punished.
[32:46.870 --> 32:48.410]  They're saying, hey, the malware did it.
[32:48.530 --> 32:53.050]  And an incompetent forensic, prosecutorial forensic examiner is saying, I can't defend that.
[32:53.150 --> 32:53.630]  Maybe it did.
[32:54.270 --> 32:55.890]  And somebody who's guilty goes free.
[32:57.170 --> 33:03.210]  If you are interested in conducting this type of research, hopefully some of my preparation work, some of my prep work is done.
[33:03.490 --> 33:06.790]  And you don't have to start where I started learning all this.
[33:06.890 --> 33:12.310]  You can start where I ended and say, all right, I need to get all these different types of things, all these different types of information.
[33:12.970 --> 33:16.690]  And not everyone has the capability of a quarter million dollar defense.
[33:17.450 --> 33:21.110]  I want to thank Alex and Seth because I wouldn't have been able to talk at this year's HOPE.
[33:21.230 --> 33:24.750]  Without them, I want to thank the HOPE Talk selection committee.
[33:25.150 --> 33:29.870]  I want to thank my NWTC executive leadership team for allowing me to conduct the research.
[33:29.870 --> 33:32.210]  And I want to thank those of you who attended.
[33:32.630 --> 33:34.190]  And now we'll have Alex come up.
[33:48.270 --> 33:49.830]  That's about as close as I'm going to get to a bio.
[33:53.630 --> 33:53.970]  Okay.
[33:55.650 --> 33:59.850]  Most of the crime we're going to be talking about is possession or distribution of child pornography.
[34:00.690 --> 34:02.370]  I'm citing federal law.
[34:02.550 --> 34:08.650]  Of course, given that we are a federal republic, there are 50 states out there that have their own slightly different rules.
[34:08.810 --> 34:11.790]  But the federal law is a nice kind of overview.
[34:13.530 --> 34:14.010]  Okay.
[34:14.450 --> 34:15.690]  When I'm talking about...
[34:15.690 --> 34:23.250]  When lawyers talk about elements of an action or elements of a crime, each of these has to be met for there to be a crime.
[34:23.250 --> 34:31.350]  So, the child porn law is you knowingly... and knowingly doesn't mean knowingly.
[34:31.510 --> 34:33.910]  There is a term called constructive knowledge.
[34:34.870 --> 34:44.350]  Which is, you should have known, given what you knew, that you were acting in such a way or you were doing such a thing.
[34:45.030 --> 34:51.090]  Possession is generally a knowledge-based crime in that you have to know that you are holding contraband.
[34:51.630 --> 34:55.750]  Usually, the example for constructive knowledge, we talk about drug offenses, is...
[34:55.750 --> 35:02.210]  I'm going to give you $1,000 to take this box and run it across town and give it to Vinny.
[35:02.770 --> 35:06.350]  You don't pay $1,000 to run a box across town if it's legitimate.
[35:06.630 --> 35:09.090]  So, therefore, you have constructive knowledge that something is wrong.
[35:10.130 --> 35:10.490]  Okay.
[35:10.850 --> 35:18.570]  So, you have to knowingly transport, receive, distribute, possess, solicit for, offer, or duplicate child pornography.
[35:18.570 --> 35:25.570]  And it has to, for federal law, it has to use or affect interstate commerce.
[35:26.290 --> 35:30.470]  Now, the Internet is interstate commerce.
[35:30.710 --> 35:35.370]  Even when it is two machines in the same state.
[35:40.430 --> 35:42.210]  Because... I'll explain later.
[35:43.030 --> 35:49.350]  Actually, it's because... the rule is, if it can affect interstate commerce, it affects the feds.
[35:49.470 --> 35:53.170]  It affects the... it fits the interstate commerce clause in the Constitution.
[35:53.510 --> 35:58.350]  And we... because the federal government is allowed to regulate interstate commerce.
[35:58.850 --> 36:03.950]  85% to 90% of federal laws base... are based out of that clause.
[36:03.950 --> 36:11.110]  So, interstate drug laws, firearms laws, tobacco and explosives.
[36:11.310 --> 36:13.270]  We'll just, you know, do the whole... the whole agency.
[36:14.630 --> 36:16.510]  Step out of that one clause.
[36:18.570 --> 36:19.090]  Okay.
[36:19.510 --> 36:21.190]  So, what is child porn?
[36:22.590 --> 36:28.250]  Child pornography means any visual depiction, including photograph, film, video, blah, blah, blah.
[36:28.250 --> 36:29.470]  So, basically an image.
[36:30.010 --> 36:35.970]  Where the production of the visual depiction is a minor in sexually explicit conduct.
[36:37.890 --> 36:39.090]  And... great.
[36:41.810 --> 36:47.170]  Basically, it's... sexually explicit conduct is used in the image or the image is of.
[36:47.490 --> 36:51.450]  And I... I was trying to work a hypo where I have a cardboard box.
[36:51.970 --> 36:53.670]  Inside is a child being molested.
[36:53.910 --> 36:55.450]  And it's a photograph of the box.
[36:55.570 --> 36:56.810]  Would that be child porn?
[36:56.810 --> 36:59.270]  And then it's like, why am I talking about this?
[36:59.350 --> 37:00.330]  That's never gonna happen.
[37:01.150 --> 37:01.570]  Okay.
[37:02.010 --> 37:02.490]  But...
[37:03.350 --> 37:06.490]  All these go to sexually explicit conduct.
[37:07.610 --> 37:08.610]  What is that?
[37:08.990 --> 37:12.030]  And... I've read numerous cases where they discuss this.
[37:12.150 --> 37:14.010]  It's like, I'm gonna sum this up as...
[37:14.890 --> 37:17.870]  Well, you know what sex... you know it when you see it.
[37:18.430 --> 37:21.190]  It does not have to be actual sex.
[37:21.350 --> 37:24.170]  It could be just a pose that is sexy.
[37:25.850 --> 37:32.810]  When I teach a class in computer crime, I will often show pictures of child beauty pageants.
[37:33.290 --> 37:35.090]  And say, is this child born?
[37:35.310 --> 37:37.250]  Because, you know, there's an image of a kid.
[37:37.390 --> 37:42.710]  And I don't know many 4-year-olds that look like dancers at a Las Vegas review.
[37:42.970 --> 37:43.690]  That's not normal.
[37:44.270 --> 37:46.510]  And is that an exhibition of the genitals?
[37:46.730 --> 37:48.270]  Is that sexy?
[37:49.650 --> 37:50.370]  Okay.
[37:51.410 --> 37:58.010]  Thankfully, they came out with a nice, long test to determine whether or not an image of a child is child pornography.
[37:58.810 --> 38:00.170]  It's called DOST.
[38:01.690 --> 38:03.310]  Notice it's really vague.
[38:03.530 --> 38:04.490]  Because it's...
[38:04.490 --> 38:09.910]  We balance all these factors to determine whether or not this image is child pornography.
[38:11.890 --> 38:16.530]  Now, how many people have seen nude photos of themselves when they were a child?
[38:17.570 --> 38:17.990]  Okay.
[38:18.470 --> 38:19.550]  Is that child pornography?
[38:20.910 --> 38:21.390]  Probably...
[38:21.390 --> 38:22.810]  If you had them printed at Walmart.
[38:28.370 --> 38:29.250]  Not necessarily.
[38:29.450 --> 38:29.930]  Under the law.
[38:30.070 --> 38:39.190]  Now, of course, going to get to this step, as we've seen before, just because this is a defense doesn't mean it's not cheap to get to this point where you're debating this.
[38:39.610 --> 38:50.470]  In fact, that's hideously expensive because you have experts dueling over, is the image, the focus of this image, is it meant to excite the prurient interest?
[38:50.470 --> 38:53.110]  Or is it a picture of a kid in a bathtub?
[38:56.620 --> 38:59.440]  So, what really isn't child pornography under the law?
[39:00.940 --> 39:03.000]  Young-looking actors are actresses.
[39:03.300 --> 39:05.660]  And you look for the 2257 seal of approval.
[39:07.220 --> 39:08.580]  2257 is the...
[39:08.580 --> 39:14.040]  Well, those of you who look at pornographic websites may notice that there's an 18 U.S.C. 2257 rule in the bottom.
[39:16.420 --> 39:21.660]  It's a registry of everyone who appeared in this, if you saw their junk, we have their names.
[39:24.460 --> 39:26.520]  Anime is not child pornography.
[39:27.400 --> 39:33.260]  It could be obscene and thus illegal anyway, but it is not inherently child porn.
[39:34.900 --> 39:38.680]  Photoshopping is not a wholly generated computer image.
[39:39.080 --> 39:49.600]  It is... if I use a child's head on an adult body doing something, that is still child porn, because there's a... you can point to a child's image in the photo.
[39:51.380 --> 39:58.640]  Your baby photos are not necessarily... are not child porn, or at least I hope they're not, because the focus and the intent of the photo was not to get anyone off.
[39:59.260 --> 40:01.320]  If they were, I'm really, really sorry.
[40:02.360 --> 40:04.380]  And Sears catalogs.
[40:04.560 --> 40:06.520]  I make... this is not actually a joke.
[40:07.020 --> 40:22.400]  A child-born case I worked on, they cited my guy for images of child porn, several of which were from like a mid-70s Sears catalog of kids in underwear.
[40:23.800 --> 40:26.620]  And it's like, well, wait a minute, this is actually... because, you know, like...
[40:26.620 --> 40:32.820]  And I'm talking to the forensic person on the other side, and he's saying, well, it's a scan out of the Sears catalog.
[40:34.260 --> 40:36.040]  Okay, how's that child pornography?
[40:36.840 --> 40:38.140]  And he wouldn't answer me.
[40:39.740 --> 40:43.020]  Okay, so how do you defend against a child porn case?
[40:43.500 --> 40:44.900]  You can attack the elements.
[40:45.360 --> 40:45.720]  Knowledge.
[40:46.000 --> 40:48.380]  I didn't know that child porn was there at all.
[40:49.300 --> 40:51.420]  And therefore, you did not legally possess it.
[40:51.420 --> 40:55.680]  You had it, but you didn't legally possess it because you didn't know it existed on your hard drive.
[40:56.320 --> 40:58.340]  You didn't know it was real child porn.
[40:58.480 --> 41:00.160]  You thought it was just regular tentacle porn.
[41:01.640 --> 41:03.320]  You didn't know it was child pornography.
[41:04.700 --> 41:07.460]  It was... it's an... you know, it's an image.
[41:07.680 --> 41:08.540]  I mean, it's not an image.
[41:08.660 --> 41:10.020]  It's like, I didn't know it was... it was...
[41:10.020 --> 41:11.340]  I thought it was regular porn.
[41:12.140 --> 41:19.220]  You can defend on, yes, I knew the porn was there, but no actual children were used in the manufacture of this.
[41:20.520 --> 41:28.000]  Now, under federal law, there's this unconstitutional rule that says it's up to you to prove that they aren't actually children.
[41:28.300 --> 41:29.940]  This is unconstitutional.
[41:29.940 --> 41:31.840]  I don't know if it's been tested yet.
[41:32.120 --> 41:38.280]  Because it's the prosecution's burden to show all the elements.
[41:38.280 --> 41:46.480]  So you have to show you knew you had it, you knew it was a child, and that they are actually children.
[41:47.200 --> 41:58.100]  They switched this in federal law to say, you have to raise the defense, you have to inform us before you raise it, and it's your burden to me.
[41:58.400 --> 42:05.540]  Now, the problem is, how do you prove that the image is not that of a child?
[42:05.700 --> 42:16.040]  You would have to either name the child, and it's really then a defense for the pornographer, because it's like, well, you know, here's all our 2257 numbers.
[42:16.900 --> 42:18.300]  That person's 19.
[42:18.660 --> 42:19.740]  Therefore, we're okay.
[42:20.100 --> 42:26.600]  But for the person charged with consuming or possessing, it's really hard to find the name of the person.
[42:26.600 --> 42:42.000]  So you instead have to do an expert witness to say, that's, you know, that's an adult, that's not a kid, because, you know, proportion, height, weight, you know, breast development, whatever.
[42:42.000 --> 43:10.700]  There's also this really strange good faith affirmative defense, which seems to be a cutout for people who are IT people, since a large significant block of child porn arrests come out of people working at Best Buy or other retail computer outlets, because a person with child porn comes in saying,
[43:10.960 --> 43:12.080]  my machine doesn't work.
[43:13.080 --> 43:17.880]  I have been that IT guy, not with child porn, but my computer isn't working.
[43:18.080 --> 43:18.780]  What's wrong with it?
[43:18.820 --> 43:20.140]  It's because it's chock full of porn.
[43:20.760 --> 43:22.700]  You know, there is no space for swap anymore.
[43:22.900 --> 43:23.760]  It's all porn.
[43:25.660 --> 43:27.240]  That's why you can't burn a CD.
[43:27.420 --> 43:28.460]  There's no space left.
[43:28.600 --> 43:29.900]  Delete some of your porn, sir.
[43:32.800 --> 43:34.860]  I didn't leave that on the message to his wife.
[43:34.960 --> 43:35.780]  That would have been awesome.
[43:35.780 --> 43:47.840]  But for the affirmative defense, though, you have viewed or identified less than three images.
[43:48.000 --> 43:48.980]  So you get two bites.
[43:49.340 --> 44:01.980]  And at that point, you have either made reasonable effort to delete those documents, or you have prevented anyone else from viewing them and have called the cops.
[44:01.980 --> 44:04.060]  And you only permit the police to see it.
[44:04.300 --> 44:06.880]  So it's effectively saying, I don't have it.
[44:07.000 --> 44:08.540]  I'm stepping away from the PC.
[44:08.820 --> 44:10.180]  I'm not touching anything.
[44:10.640 --> 44:18.320]  I kicked everyone else out of the lab, or out of the shop, waiting for the cops to arrive.
[44:19.160 --> 44:21.380]  Which is why, generally, the safer thing is just delete it.
[44:21.460 --> 44:22.820]  I made a reasonable effort to delete it.
[44:22.840 --> 44:23.420]  It's gone.
[44:24.260 --> 44:26.320]  And maybe then call the cops.
[44:26.500 --> 44:27.040]  Maybe not.
[44:27.040 --> 44:28.420]  I'm not really sure on that.
[44:28.520 --> 44:31.440]  It really depends on whether or not the police already know.
[44:33.600 --> 44:34.160]  Okay.
[44:35.260 --> 44:38.460]  Another way of defending the child porn case is you attack the evidence.
[44:38.680 --> 44:41.020]  The way you collected it was bogus.
[44:41.380 --> 44:43.660]  The way you analyzed it was bogus.
[44:44.860 --> 44:46.480]  Your conclusions are broken.
[44:47.160 --> 44:49.280]  This is a dueling expert problem.
[44:49.860 --> 44:52.460]  Each side has their forensics expert.
[44:52.660 --> 44:55.500]  Each side is tearing apart the other person's report.
[44:56.820 --> 45:01.780]  Each side is... And then the problem with this is, one, it's expensive.
[45:01.840 --> 45:05.660]  Because you just billed your forensics person out for a bunch of hours.
[45:05.860 --> 45:07.280]  They billed theirs out.
[45:09.360 --> 45:19.540]  And you're going to... If you actually go to a jury trial, you're going to have that person in a... In the witness box for anywhere from a day to a week.
[45:20.640 --> 45:26.640]  If you ever watch a jury watching really detailed technical evidence, five-minute rule.
[45:27.080 --> 45:29.300]  If it's more than five minutes, they're asleep.
[45:29.540 --> 45:31.860]  I've watched jurors fall asleep during this.
[45:32.260 --> 45:40.080]  It's like, so really, unless you've... Unless you have an expert witness that's interesting enough that they're going to listen or they crack jokes.
[45:40.660 --> 45:43.520]  And really, I can't... I look for good child porn jokes.
[45:43.600 --> 45:44.280]  There just aren't any.
[45:44.420 --> 45:45.160]  It's not good material.
[45:48.760 --> 45:49.640]  I'm not... Okay.
[45:49.860 --> 45:56.000]  Just to be safe, because I know this is going to be in a DVD and this will be, you know, brought up in some disciplinary action later with the bar.
[45:56.840 --> 45:59.900]  I am in no way making light of child porn.
[46:00.100 --> 46:01.200]  Very, very serious.
[46:01.460 --> 46:01.860]  Bad.
[46:04.840 --> 46:06.280]  That's as well as I can be sincere.
[46:06.620 --> 46:06.880]  Okay.
[46:07.040 --> 46:07.720]  So, experts.
[46:08.000 --> 46:09.300]  How are we experts?
[46:09.300 --> 46:15.700]  How do we... How do we promul... How do we put you forward or someone forward and say, I'm a computer forensics expert?
[46:17.260 --> 46:19.640]  To be an expert in... Under U.S.
[46:19.720 --> 46:24.060]  law, you have to be... Have to have specialized skill, training, or experience.
[46:24.420 --> 46:27.140]  You can be an expert witness about cars.
[46:27.820 --> 46:30.660]  And you say, well, sir, how are you an expert?
[46:31.000 --> 46:35.060]  Well, I've been working as a car mechanic for 18 years.
[46:35.380 --> 46:36.700]  Here are my certifications.
[46:36.700 --> 46:37.980]  Here's where I've worked.
[46:38.220 --> 46:38.660]  Bang.
[46:38.900 --> 46:40.760]  You can then be put forward as an expert.
[46:41.180 --> 46:46.780]  The way this is done is, the side that wants to push you forward as an expert asks a certify.
[46:46.940 --> 46:48.280]  We want to certify Bob.
[46:49.720 --> 46:52.480]  Each side can kind of... will question the person.
[46:54.100 --> 46:58.200]  Now, it's not just the expert is put on test.
[46:58.420 --> 47:03.760]  The expert's field is put on a test to say, is this actually a field of expertise?
[47:04.020 --> 47:06.300]  Is it relevant to our case?
[47:08.060 --> 47:13.620]  So, putting forward, you know, the automotive expert and going, that's great, but we're talking about child porn.
[47:13.900 --> 47:17.060]  The fact that you know the difference between a Buick and a Chevy, irrelevant here.
[47:17.260 --> 47:17.720]  Go away.
[47:18.940 --> 47:23.340]  Now, the advantage is, once you get certified as an expert in a field, it's really, really easy.
[47:23.460 --> 47:29.340]  Because, you know, judges will say, well, you know, judge so-and-so, you know, in the Western District certified you.
[47:29.340 --> 47:30.460]  Good enough for me.
[47:33.300 --> 47:33.820]  Okay.
[47:34.900 --> 47:37.560]  I'll quickly go through the standards for experts.
[47:38.020 --> 47:44.180]  The DoeBear standard is, they test the science, which is, is it testable?
[47:44.320 --> 47:45.300]  Is there an error rate?
[47:45.440 --> 47:54.280]  Is there some way of determining that you have done a method that's acceptable, and you've done it correctly, and you know the chances that you screwed it up?
[47:56.180 --> 47:57.660]  How accepted is it?
[47:57.660 --> 47:59.440]  How many times has it been done?
[48:01.760 --> 48:04.960]  And has it been correctly applied to the case at hand?
[48:05.200 --> 48:10.220]  So, your, what theory you're putting forward, is it, has it ever been done before?
[48:11.480 --> 48:14.160]  There's also an older standard, which we call the Fry standard.
[48:14.380 --> 48:15.880]  It's a lot looser.
[48:16.620 --> 48:21.220]  It's, is there a general scientific acceptance of the field, of the method you used?
[48:21.840 --> 48:31.780]  And while most of their law review articles about how Fry is stupid and all that, it's the law in ten states, including New York, Pennsylvania, California.
[48:32.100 --> 48:33.460]  So, it's still really, really important.
[48:35.020 --> 48:35.580]  Okay.
[48:36.140 --> 48:39.800]  Um, I've seen a couple cases where they use experts in child porn.
[48:40.260 --> 48:43.800]  One is, um, proving that the images are of children.
[48:43.820 --> 48:45.420]  And they're still kind of broken.
[48:45.560 --> 48:48.820]  Because some, some states are like, you don't need an expert to prove it.
[48:48.820 --> 48:52.440]  I can see that they're kids, they're kids, don't need to put it, put someone forward.
[48:52.860 --> 48:57.540]  Others are, no, you actually have to go through some, like, a bunch of hoops about it.
[48:57.720 --> 49:03.940]  Which is, I have a doctor, who, evidently, their specialty is determining whether or not people are kids.
[49:04.360 --> 49:05.760]  Got to be a weird specialty, but hey.
[49:07.720 --> 49:08.120]  Okay.
[49:08.620 --> 49:21.580]  Um, prosecution, when they put forward their expert, they're putting forward, I'm explaining what I did, I'm explaining what I saw, and if they're really good, they're going to foreclose potential defenses that the defense would possibly raise.
[49:22.180 --> 49:24.100]  Um, usually they don't, though.
[49:24.360 --> 49:26.420]  Usually they're just like, this is, this is the truth.
[49:26.660 --> 49:28.760]  Came from God, to me, to you.
[49:29.680 --> 49:30.920]  Of course they didn't screw it up.
[49:31.000 --> 49:33.140]  I'm not going to discuss what they might argue.
[49:33.500 --> 49:39.700]  The defense's job is to come up with an alternate explanation for the facts, are to critique it and say, you didn't get the facts.
[49:41.480 --> 49:43.880]  And one quick aside before I sit back down.
[49:43.880 --> 49:47.960]  Um, child porn cases are different in about the evidence.
[49:48.160 --> 49:53.440]  Any other case, the defense gets all the evidence the prosecution has, and they can go out and collect more.
[49:53.720 --> 50:03.800]  In child porn, because child porn itself is illegal to have, you can't just give it over to the defense and say, there you go.
[50:04.120 --> 50:05.400]  Because it's child porn.
[50:05.620 --> 50:08.860]  That would make the prosecutor distributor of child porn.
[50:09.000 --> 50:12.880]  That would make you a possessor of child porn, Mr. and Mrs. Forensic Expert.
[50:14.380 --> 50:19.300]  Feds came up with a really bizarre rule, which is, it stays in the hands of the prosecution.
[50:20.320 --> 50:30.540]  You, Forensic Expert, go to the FBI field lab, use their equipment, and we promise we won't listen in when you're talking to the lawyer.
[50:30.540 --> 50:35.860]  Or, if the lawyer's there, and I don't know, I get a little itchy around cops.
[50:36.120 --> 50:44.500]  I can imagine talking with my forensic expert or being the forensic expert talking to the lawyer, and it's like, Officer Friendly, would you mind not listening in to our defense strategy?
[50:44.780 --> 50:46.140]  That would be really nice.
[50:47.680 --> 50:52.160]  However, I've seen where this has also helped the defense in a really odd way.
[50:54.580 --> 50:58.780]  I worked on the New Jersey versus Lawrence series case.
[50:59.060 --> 51:04.000]  This was a guy who got caught up in a perverted justice kind of sting.
[51:04.400 --> 51:08.560]  He had child porn, or he allegedly had child porn on his hard drive.
[51:08.860 --> 51:18.400]  When we raised the defense to say, we want to see the forensic analysis, we want to see how it was done, and we want to see the images to determine whether or not they're child porn.
[51:18.620 --> 51:23.880]  The prosecution said, yeah, we're just going to leave it as, you know, attempted child molestation.
[51:24.040 --> 51:24.940]  Screw this, child porn.
[51:25.180 --> 51:27.220]  And they kind of had our guy dead to rights anyway.
[51:39.500 --> 51:43.000]  I don't have any slides, so I'm just going to say a couple things.
[51:44.840 --> 51:50.820]  One thing is that I don't have a lot of first-hand experience with working on this issue with EFF.
[51:50.820 --> 52:05.020]  One reason is that until EFF relatively recently hired Jennifer Granick, who is really one of the world's leading computer crime defense lawyers, EFF had never undertaken any criminal defense of anyone.
[52:05.840 --> 52:10.780]  We have a large legal team, but their expertise was all civil litigation.
[52:11.580 --> 52:14.660]  And so we just had a policy that we don't do criminal cases.
[52:15.500 --> 52:19.580]  Now that we have Jennifer working with us, we are able to do some criminal representation.
[52:20.080 --> 52:23.420]  So that's really cool, but it's a really recent development for EFF, actually.
[52:24.680 --> 52:29.760]  In the past, we always had to refer all of the criminal cases to other people outside of our organization.
[52:31.200 --> 52:48.460]  But the other thing is that still, because we're a nonprofit and we have so much work, so little lawyer time, we try to do generally a strategy called impact litigation, where we try to do things that will set an important precedent.
[52:48.680 --> 52:51.320]  It's also the strategy that ACLU generally uses.
[52:52.100 --> 52:54.760]  And that means to try to economize our lawyers' resources.
[52:55.140 --> 53:03.520]  We generally try not to get involved in cases where we think there's going to be a big factual dispute, where the sides will have to fight back and forth about what happened.
[53:03.520 --> 53:07.980]  We generally try to get involved in cases where it's pretty clear what happened.
[53:09.680 --> 53:11.740]  And there's a dispute about the law.
[53:12.100 --> 53:13.920]  What's the legal standard that applies to this?
[53:14.040 --> 53:15.560]  And then we can try to set a precedent about that.
[53:15.940 --> 53:18.860]  So that's not really what we're talking about on this panel.
[53:18.900 --> 53:22.800]  So it's a little unusual as far as our experience over at EFF.
[53:22.800 --> 53:38.200]  I have to say that the malware defense issue, or the idea that what you think you found on my computer isn't really something that I did because computers are insecure, is really not something that's limited to child porn cases.
[53:38.780 --> 53:41.920]  I consulted on a case in Brazil.
[53:44.080 --> 53:46.860]  It was actually a criminal case about defamation.
[53:46.860 --> 53:50.860]  It sounds really weird in a U.S. legal context.
[53:51.060 --> 53:56.700]  But in Brazil, defamation can be a criminal offense and you can go to prison for defamation.
[53:57.440 --> 54:13.860]  And I consulted on a case where the defendant was presenting this defense that someone else had done it and that perhaps their computer was infected with malware and that they hadn't actually written the allegedly defamatory things that they were being threatened with prison time for having written.
[54:14.560 --> 54:21.600]  And the difficulty, which is very typical, is that they couldn't afford a forensic examination on the defense side.
[54:22.480 --> 54:27.280]  So the prosecutor had contracted for a forensic examination.
[54:27.900 --> 54:36.260]  The defendant was fairly well off, but even so couldn't really afford the fees that the forensic examiners would have charged.
[54:37.700 --> 54:44.140]  And I think in all countries around the world, certainly in the United States, this is a real problem.
[54:44.480 --> 54:49.400]  Both of the panelists have mentioned that proper forensic work can be extremely expensive.
[54:50.100 --> 54:57.940]  Criminal defendants typically don't have the resources to go through with that, whether it's a child porn matter or any other kind of criminal defense matter.
[54:58.620 --> 55:01.040]  And so in that case, I was looking at a report.
[55:01.740 --> 55:17.240]  Basically, as in the cases that were mentioned before, the forensic examiners said, well, we think that this person wrote this stuff because we found this stuff on their computer and we didn't find any particular reason to think that they didn't write it.
[55:17.820 --> 55:21.280]  There wasn't any report on the other side, so ultimately the person was convicted.
[55:23.140 --> 55:35.700]  One of the difficulties there, I think, was that the court had a difficult time understanding why someone would have written malware that would have put this material on the defendant's computer if the defendant hadn't written it.
[55:36.060 --> 55:39.180]  Like, what's the motive to put the thing on the person's computer?
[55:40.600 --> 55:47.120]  And I think to varying degrees in different cases, that's a difficulty that courts have with the concept of malware.
[55:47.400 --> 55:54.980]  You can say that computers are incredibly insecure and they've been infected left and right and people have malware and spyware and adware and viruses and botnets.
[55:55.600 --> 55:57.460]  But why did it put the thing on the computer?
[55:57.880 --> 56:04.260]  Of course, one possibility is that someone's using the computer as storage, cloud storage, super cheap cloud storage, really.
[56:05.600 --> 56:06.800]  Zero dollars per gig.
[56:08.920 --> 56:13.460]  Another possibility is that someone is intentionally trying to frame someone and I guess there are other possibilities yet.
[56:15.100 --> 56:19.360]  But basically, I think that economics are a real challenge for getting forensic work done.
[56:20.300 --> 56:32.000]  We were talking just before the panel about the issue that a cursory examination might find files on a computer without really establishing how the files got there.
[56:32.920 --> 56:39.960]  One point that we're talking about is that a website could inline images that would never even be displayed to a user.
[56:41.400 --> 56:43.460]  Scale them to one pixel by one pixel.
[56:43.760 --> 56:45.160]  Maybe do this from JavaScript.
[56:45.440 --> 56:46.600]  Maybe do this in an iframe.
[56:47.340 --> 56:49.440]  And then the images end up in someone's cache.
[56:49.660 --> 56:58.060]  And a forensic examiner could be trained to always look through someone's browser cache and they might find the images and say, look, I found these images in the browser cache.
[56:58.420 --> 57:07.780]  And nonetheless, it could be true that the user never intentionally downloaded them and they were never actually displayed, rendered in the browser user interface in a way that the user could see them.
[57:08.340 --> 57:28.980]  And so a challenge is that, as the other panelists have mentioned, we don't necessarily have standards in forensics examination that would make it clear what a forensics examiner needs to do to establish intent, to establish how these images came to be there,
[57:29.100 --> 57:33.360]  whether they were displayed to the user, whether the user attempted to download them, and so on.
[57:34.000 --> 57:37.980]  And I think that challenge is a challenge for forensics in general.
[57:38.540 --> 57:41.180]  Computers are very complex beasts.
[57:43.340 --> 57:48.300]  It's not just something about one kind of criminal case, but something about the forensics profession as a whole.
[57:49.120 --> 57:52.160]  We get a lot of calls over at EFF, people in a lot of trouble.
[57:52.560 --> 57:53.540]  They need help.
[57:53.680 --> 57:54.520]  They don't have money.
[57:55.400 --> 58:03.580]  So I think this panel has just identified another way in which the process of getting people a fair trial can be quite difficult.
[58:04.180 --> 58:04.620]  Thanks.
[58:07.420 --> 58:08.520]  Do we have any time?
[58:09.180 --> 58:11.100]  Do we have any time left over for questions?
[58:11.560 --> 58:13.720]  We got a couple of minutes for questions.
[58:13.720 --> 58:14.780]  If anybody has any questions?
[58:17.790 --> 58:20.510]  You're all afraid as the attorneys we asked.
[58:21.770 --> 58:22.330]  All right.
[58:22.450 --> 58:22.850]  Well, thank you.
[58:22.910 --> 58:23.410]  Have a great hope.
[58:26.630 --> 58:34.350]  I want to say that the panelists are going to be available outside the room here, where the DVDs are made for a few minutes, if you want to talk to them privately.
[58:35.650 --> 58:36.630]  So thanks for coming.