Beyond a shadow of a pornographic doubt, don't rush to judgment

Have you seen this man?

Known only as "Vico," Interpol is apparently looking for him. According to the Register:

Interpol says he appears in about 200 photographs of child abuse taken in Vietnam and Cambodia. His face had been "swirled" in the pictures in a bid to conceal his identity.

Interpol Secretary General Ronald Noble said the images of the man abusing young boys had been circulating on the internet for years. International inquiries have failed to identify him, however, and it's the first time the agency has made such an appeal.

"We have very good reason to believe that he travels the world in order to sexually abuse and exploit vulnerable children," he said.

My wife and I have watched TV documentaries of the sex slave trade and recently saw one on 48 Hours that involved children. Before I had children of my own, stories like these might have saddened me. But once you come to understand the depth of child's innocence through the eyes of your own children as I have through my three kids, it's hard to hold back the tears. As I write this right now, somewhere, living in absolute fear of what will happen next are hundreds if not thousands of children being victimized by a global sex trade.

So, when I read the news on The Register's Web site and determined to some degree of my own personal satisfaction (based on the information provided) that the digital trail left behind by this "Vico" person was indeed a smoking gun, I thought it would be worthwhile to help the cause (by reprinting his pictures).

But at the same time, this story should serve as a reminder that not all digital trails are equally incriminating, beyond a shadow of a doubt. In "Vico's" case, there are apparently pictures of him with his victims. If proven authentic, these proverbial smoking guns can serve as irrefutable evidence that the man they're looking for is probably guilty of the crimes he's accused of.

In other cases however, it's not so black and white. In 2004 for example, I told the story of immigrant whose life was ruined because of the graphic images found on his computer at work. He lost his job, was incriminated as a sex offender and threatened with deportation. The courts were unsympathetic. When the possibility of child pornography consumption is raised, the court system slips into some sort of guilt-until-proven innocent trance. Given how reviling child pornography is, it's not hard to understand why. In the last year or so, I heard from him again; depressed, disenfranchised -- his life completely destroyed by the entire episode. He lost everything. The man -- who only identified himself to me as Jack -- had been asking me to tell his story for quite some time when a another story regarding some disciplinary action taken by an government organization in the UK surface. Back then, I wrote:

Last week, the Register reported that "More than 200 civil servants in the [UK] Department of Work and Pensions (DWP) have been disciplined for surfing the Web for porn during office hours. In the last eight months the staff accessed over 2 million pornographic images, including 18,000 involving child abuse." Nineteen of the staff members were fired, according to a commentary by ZDNet UK editor Andrew Donoghue.

In this particular case, the DWP was also looking to downsize. Was the timing coincidental ("We need to downsize...let's look for people with porn on their systems first")? It's hard to say. But in Jack's case, he swore to me that was innocent of the crimes he was convicted of and explained how there were those he worked with who had the motive and the means to place incriminating evidence on his PC. Was his PC guarded 24 hours a day? No. Is it easy to get something onto a PC's filesystem without the right credentials? A piece of cake (scary, but very true). Can malware play a role in loading a system with questionable material? Absolutely. If any of this happened surreptitiously to your system, would you know to even look for it? Except for the most anal of us techies, probably not.

Is Jack's case an isolated issue? Last week, News.com's Declan McCullagh reported on a similar story involving David Farr, a respiratory therapist at St. Francis Hospital in Indianapolis, Ind. Wrote McCullagh:

In July 2005, Farr's supervisor informed him he was suspended from work because pornographic entries were found in his "Favorites" file, apparently a reference to Web sites bookmarked. Farr denied being responsible and said he was rebuffed when he asked for details about the allegations.

Farr was fired in August 2005. An e-mail message from the hospital's lawyer at the time claims to "have evidence that provides us with reasonable belief that he was accessing pornographic Web sites on his work computer."

After losing his job, Farr went through the formal grievance process listed in the hospital handbook and met with no success. He filed a lawsuit after the grievance committee upheld his termination in December 2005.

What makes this case relevant to Police Blotter is that Farr claims that "St. Francis failed to install and update effective antivirus protection on its computers" and that any pornographic bookmarks were inserted by malicious software. He also claims that antivirus software was required by Health Insurance Portability and Accountability Act.

Farr even retained a computer forensics specialist who concluded: "No one had intentionally loaded the list of Web sites on the computer. Rather, the list was placed on the respiratory therapists' computer by a common and well-known Internet virus that promotes fee-generating pornographic sites."

That is plausible. One of the malicious programs known to inject porn bookmarks is CoolWebSearch, also called CWS or CoolWWWSearch, and it's been around since 2003. Some reports have estimated that 5 million sites are infected with it and that more than 60 strains of it exist.

McCullagh goes on to write about the story of Julie Amero, a substitute teacher who was arrested and convicted after a computer she and her students had access to started to display porn ads. It sounds almost like a modern day story out of Salem, Massachusetts and it was. Thankfully, Amero's conviction was overturned and she was granted a new trial in June.

McCullagh ends his report with excerpts from the Judge's opinion in the case of David Farr and although I'm not a lawyer, it appears as though Farr made some legal mistakes in trying to connect his discharge with the hospital's failure to comply with a provision of the Health Insurance Portability and Accountablity Act (HIPAA). Even so, it doesn't change the chances that he may have been wrongfully terminated if the basis of that termination was the appearance of pornographic material or linkage on his PC.

If you're an employer, these cases should serve as reminder that not all digital trails are created equal and that the Devil (no pun intended) is so much in the details of those trails that your first thought should be "restraint" before jumping to conclusions when you discover potentially incriminating digital evidence. Some action is of course required in all cases. Particularly given the legal exposure (re: statutes regarding sexual harassment in the workplace) should employees become offended by content that turns up on someone's PC or in the corporate e-mail system.

But, sooner or later, the legal system will wisen up to the realities of hooking PCs to the Internet and the likelihood that nefarious activity could be just as much if not more to blame for the appearance of questionable material than the user itself. When that happens, some precedents will be set and the stakes in terms of wrongful termination suits will be raised to the point that you won't want your own rush to judgment to trigger a series of catastrophic legal events that puts an end to your business (or causes a significant financial setback). At some point in the future, it very well could.