Matt Bandy Could Be You. Or ME.

Matt Bandy's story sent a chill up my spine as I read it this morning. Matthew was 16 when authorities arrested and charged him with possessing and uploading child pornography (Full Story).

Matt was the victim of at least one (and likely more than one) worm that turned his computer into a "zombie computer". To give you an idea of the pervasiveness of zombies, vnunet.com reported on a foiled botnet operation that had put 1.5 million computers and servers under its control. (A botnet is a collection of computers infected with the same worm). Botnets are used to send spam, infect other computers, and upload pornography, among other things.

Here's the thing: Zombies operate transparently. The user has no idea what his own computer is doing. That means you can be held responsible for activity originating with your computer for which you had no control, involvement or even knowledge.

This is exactly what happened to Matt. Ultimately he accepted a plea bargain on the advice of his attorneys. even though the forensic examination of Matt's computer proved the presence of malware, even though he passed two independent polygraph examinations where he flatly denied any pornography uploads, even though two independent psychological evaluations concluded that he did not meet the profile for a diagnosis of paraphilia.

The prosecutor would not back down. If a jury had convicted him, he could have spent up to 90 years in prison (This is not subject to judicial discretion -- more on that in a minute). If he accepted the plea bargain, he would have to register as a sex offender but would be sentenced to probation. After ABC's 20/20 aired a segment on his plight in January 2007, the sex offender designation was removed by order of the court.

Is this justice? How did this happen?

I. Anti-Porn Policies and Initiatives Pressure Local Prosecutors to Produce

There are certain initiatives in the halls of justice - national and state - that have top priority. Project Safe Childhood is one of those. Here is a description of the initiative from the PSC Guide:

PSC creates, on a national platform, locally designed partnerships of federal, state, local, and tribal law enforcement officers in each federal judicial district to investigate and prosecute Internet-based crimes against children.

and this:

U.S. Attorneys will coordinate the investigation and prosecution of child exploitation crimes, and the efforts to identify and rescue victims. Establishing open and formal lines of infor-mation-sharing and case referrals is imperative, so that investigators and prosecutors can use all available tools for finding offenders and selecting the most appropriate forum in which to seek convictions. And aggressive investigations and prosecutions must be accompanied by strong victim-assistance efforts.

Finally, there's this:

"For these reasons, it is important for federal investigators and prosecutors to bring all available resources to bear upon investigations and prosecutions of Internet-based crimes against children, and for federal prosecutors to substantially increase the number of prosecutions of child pornography and enticement offenses."

This is an admirable goal. I am certainly all for the prosecution of those who commit crimes against children, aren't you?

But there's a word missing from that final paragraph. An important one. The word is "legitimate", and it belongs here, so that the sentence reads this way:

"...all available resources to bear upon investigations and LEGITIMATE prosecutions of Internet-based crimes against children, and for federal prosecutors to substantially increase the number of LEGITIMATE number of prosecutions of child pornography and enticement offenses."

Common sense dictates that when the results of an investigation prove the existence of malware and worms which are linked to illegal activity OUTSIDE OF THE CONTROL of the user, a prosecution is not legitimate. Period.

Prosecutors are expected to deliver the goods, and they are measured on the NUMBER OF CASES they prosecute successfully, either by conviction or plea-bargain.

This sweeping initiative and mandate for federal, state and local law enforcement agencies creates an environment of rigidity and the need for prosecutors to give the impression of zero tolerance for pornography, regardless of its source. If you're convicted, the sentences are non-negotiable under federal and state sentencing guidelines.

II. Ignorance about Malware Left the Door Wide Open

In the Bandy case, the ignorance wasn't simply on the prosecutor's end. Matt Bandy's parents had absolutely no clue about how to secure their computer and network properly. They're not unusual. As an admitted geek, I receive calls all the time from friends and family in a panic because their computer is infected with something and they have no idea how it got that way or what to do about it.

Here's a fact: Kids can infect a computer faster than anyone else in the house. They go to game sites, game hack sites, have their Instant Messenger programs open all the time, accept files from anyone and believe what they read. They're kids. They haven't learned to be cynical yet. So when they click on the blinking "You've just won a million dollars" window, they're believers. By the time they figure it out it's too late if they're out there on the Internet with inadequate safeguards.

Here's another fact: Filters are a bandaid and nothing more. Relying on site and word filters to protect kids from pornography doesn't work for anyone. That means schools, homes, and businesses. There are too many ways around them, they can't block every iteration of the word and they give a false sense of security.

One last fact: It can happen even if you're a geek. I love computers. I'm a geek. I've been on the Internet from the early days, I've built my own computers, I maintain our home and office network and I stay updated on Internet security issues.

Yet, my 17-year old son managed to: a) Visit Internet porn sites; and b) infect his computer with 100 different flavors of malware in February of this year. This, despite what I thought was a locked-down network (he ended up on a neighbor's wifi connection), and up-to-date virus protection (his expired in January, I didn't check and he didn't tell me). As far as I can tell, it took about two surfing sessions to thoroughly infect his laptop.

Matt Bandy's story could have been mine. It could be yours. It will be someone else's. It is already someone else's.

Greater minds than mine are wrestling with this issue. Some of them participate here. While waiting to hear from them, visit the Center for Safe and Responsible Internet Use. Director Nancy Willard has some excellent information on the site about cyberbullying and keeping kids safe. Read it. And start talking about it.