Julie Amero: 432 Days, No Resolution. Still

We're just going to re-post today's blog piece by Karoli Kuns:

Julie Amero: 432 Days, No Resolution. Still

Or, as Rick Green said so well today, Julie Amero is held hostage for 432 days.

I’m waiting for the state to admit that this poor substitute teacher should never have been arrested, tried and convicted. I’m waiting for prosecutors in Norwich to do something: come up with some real evidence and try her — or drop the charges. Amero’s supporters, who include Internet security experts from around the country, have a petition urging Chief State’s Attorney Kevin Kane to drop all charges.

Perhaps the citizens of Norwich should tie yellow ribbons around their trees. It might even be more effective for them to ask their law enforcement officials to focus on real criminals and let the innocent be.

Please sign the petition. It’s time for Julie Amero to be freed from the chains she’s worn for 432 days.

And thank you, Rick Green, for being a responsible voice for justice.

--Chip Neville (quoting Karoli Kuns blog piece from today in its entirety)

The opinions expressed in this post are those of the author and should not be interpreted as an official position of The Julie Group.

And She Still Waits

Julie Amero is still waiting for word that she will be retried or her case dismissed. Meanwhile, there is a moving piece by Wes on the Julie Amero blog here. And please don't forget to sign the petition here.

The opinions expressed in this post are those of the author and should not be interpreted as an official position of The Julie Group.

--Chip Neville

Julie Amero Petition

A plea to the Connecticut's State's Attorneys. Please sign.

Link here.

The opinions expressed in this post are those of the author and should not be interpreted as an official position of The Julie Group.

--Chip Neville

Julie Amero Still Waits

Noted security exert Alex Eckelberry and Hartford Courant Columnist Rick Green report that Julie Amero's case is still on the trial docket in Connecticut. Details are here and here. It is disappointing that 13 months after it was conclusively proved that Julie was the victim of adware and spyware, and 13 months after she was granted a new trial on this basis, the case still drags on. But the best and most optimistic scenario is that her legal team is negotiating with the State as you read this. (We don't actually know, in fact we are as much in the dark as you.) But if this scenario is correct, things may be in a delicate state right now. So we would ask bloggers to be extremely restrained in their comments. In other words, if you must blog, please follow the sage advice, "Don't PO the prosecutor, don't PO the judge."

The opinions expressed in this post are those of the author and should not be interpreted as an official position of The Julie Group.

--Chip Neville

Notes added:

The Hartford Courant has a new editorial here. California journalist and blogger Karoli Kuns has a new piece here.

The Effects of Justice Delayed

An article in the Boston Herald by Laurel J. Sweet entitled Probe shows kiddie porn rap was bogus is a sobering reminder of how certain accusations are as bad and worse than being found guilty of more pedestrian crimes.

Michael Fiola's ordeal within the justice system well documents what Julie Amero's and other's lives are like as they await her day of vindication.

The disastrous effect of rogue virues and malware on the lives of unsuspecting, innocent citizens across this country is incalculable. As you read this article, imagine a family member of yours getting caught up in a judicial system quick to punish, unwilling to seek out truth, and slow to absolve.

Nationally recognized computer forensic analyst Tami Loehrs told the Herald Michael Fiola’s ordeal was “one of the most horrific cases I’ve seen.”

“As soon as you mention child pornography, everybody’s senses go out the window,” she said.

Loehrs, who spent a month dissecting the computer for the defense, explained in a 30-page report that the laptop was running corrupted virus-protection software, and Fiola was hit by spammers and crackers bombarding its memory with images of incest and pre-teen porn not visible to the naked eye.

Two forensic examinations conducted by the state Attorney General’s Office for the prosecution concurred with that conclusion, Wark said.

Still, Fiola, 53, whose wife, Robin, described as “computer-illiterate,” wants his day in court. He intends to sue the DIA for “destroying our lives.”

“Our lives have been hell,” said Fiola, a former state park ranger now living in Rhode Island. “I hope to recover my reputation, but our friends all ran.”

- snip-

“There is no evidence to support the claim that Michael Fiola was responsible for any of the pornographic activity,” she wrote.

All the porn, she said, was located in the laptop’s cache, a computer feature that stores copies of Web pages. Consistently, Loehrs’ findings noted, there was “no apparent origin or user interaction preceding the pornographic activity,” some of which was downloaded “fast and furious.”

Citizens all over the country work on computers whose connections continue to be insecure due to expired anti-virus subscriptions or absence or lack of adequate anti-spyware and anti-malware software.

Yet in far too many cases, employers, police, and crazed fellow citizens are quick to assume that the people accused of possessing unlawful images must be guilty of something far more nefarious no matter what the evidence, their peer relationship, or common sense might indicate to the contrary.

The combination of manufactured and magnified fear, a relentless and mindless moral extremism, and poorly drafted laws that eliminate common sense are creating an ethical nightmare that threatens the very rule of law and guarantee to a fair trial for those falsely accused.

The judicial branch of government needs to reassess the concept of possession and intent in the virtual realms where the transfer and location of data and content may be wholly co-incidental to anything a real person on a given computer is actually responsible for.

Julie Amero and Michael Fiola are just two very visible examples of the need for more sophisticated law and guidance in cyberspace criminal proceedings.

The Star Simpson Resolution

A number of members of the Julie Group were paying attention to protracted case of Star Simpson. Of interest was how the judicial system in Massachusetts would handle the case of a college student sporting a decorative wearable computing device that was mistaken as a potential terrorist threat by local airport authorities.

Mit's The Tech newspaper in an article called, Star Simpson Receives Pretrial Probation
by Joyce Kwan reported,

An East Boston District Court judge sentenced Simpson to one year of supervised pretrial probation on a charge of disorderly conduct and ordered her to perform 50 hours of community service, half of which much be completed with veterans, and to publicly announce that she had made a mistake.

“I want to apologize for the results of my conduct on September 21, 2007. Although I never intended to act in a disorderly fashion, I now realize that the shirt I created caused alarm and concern at Logan Airport,” Simpson said in a statement released Monday by her attorney, Thomas E. Dwyer, Jr. “I am appreciative to the Massachusetts State Police for their diligence in protecting our citizens and apologize for the expense that was caused that day.”

And...

Simpson was originally charged with “possession of a hoax device,” a charge which would require prosecutors to show she meant to scare people with her circuit board, which contained light-emitting diodes in the shape of a star. But they “determined that they could not move forward on that count and dismissed it to the disorderly [conduct] charge,” according to a press release supplied by Wark.

Apparently this resolution is satisfactory by both sides but from the perspective of an interested observer, the public declaration that Simpson had "made a mistake" looks to be prosecutorial coercion.

Unfortunate as the incident was, Simpson had not made any mistake to speak of. While her university garb certainly frightened airport security, it is a difficult argument to make that Simpson or anyone else might know, a priori, that an LED device would be treated with near deadly force except the airport information administrator who translated teenage belligerence into a potential terrorist threat.

The feel-good one-upsmanship of the prosecution in this case is childish and demeaning to those who care about establishing civil operating procedures in sensitive public places. Simpson's apology for being young and impulsive will not prevent the next teen from being young and impulsive.

A smarter judicial system would have Simpson's community service be served at an airport educating information officers on what to look for in dangerous devices and what to ignore. And the airport itself would do well to re-examine the responses of information personnel to situations such as Simpson's.

One must also question the court's insistence that Simpson's community service "half of which much be completed with veterans". Why veterans? Why not active armed agents who can meet and talk to the person they were about to kill because an airport greeter got their nose out of joint? This would be a far more productive use of Simpson's time.

It is hard to understand why the court is establishing separate class distinctions in the defining community service. It seems to me that the community and not the courts should establish the guidelines to Simpson's service.

The final troubling footnote to this episode is that

During the time between her arrest and the June 2 hearing, Simpson was banned from Massport property, including Logan Airport, and had to fly out of other New England airports. “It also meant I couldn’t attend the international symposium on wearable computing, as it was held at the Hyatt at Logan Airport,” Simpson said in an e-mail to The Tech.

It is unclear who issued the ban. Wark said the district attorney’s office had not requested this restriction. Dwyer could not be reached by press time.

This implies that the rule of law is suspended for those who are awaiting trial even though there sufficient evidence that the incident is an unfortunate mistake by all involved.

It is of special interest to know how the rights of American citizens awaiting trial can be suspended so mysteriously.

- krasicki

Clarifying the Securing Adolescents From Exploitation-Online Act, or SAFE Act

Bob Johnston's observations:

It appears that early reporting was very misleading and undoubtedly will create urban legend. When I read the first reporting it indicated that anyone with public Wi-Fi, including you or me should we be so foolish, could be prosecuted if someone used it to transport child porn. My immediate reaction was how would someone even know without monitoring all activity? A virtual impossibility.

Later coverage makes it clear that is not the issue and I wonder why the current bill is even necessary other than raising the penalties from $150,000 to $300,000. The current law makes it clear that if anyone sees child porn wherever....that is, not only digitally but also in print, that we must report it to law enforcement or risk prosecution for failure to do so. Knowledge of this law is important for anyone within the digital computer trade whether a forensic investigator, repairman or simply being a friendly neighbor.

Yes. If you help a neighbor fix his/her computer and observe child porn you must report it. When I take a forensic case, I always advise the client of this obligation. When I help a neighbor, I do not as I do not want to offend a friend but am beginning to wonder whether I should advise them as well. Not because I suspect anyone, but just because it could happen.

Do not misunderstand...I abhor child pornography but I do question laws that hold me accountable for reporting to law enforcement what I observe while practicing my trade. I recently saw a prosecution in the State of Connecticut of an attorney who did not see but had believable knowledge of the presence of child pornography on a laptop. He took the laptop and disposed of it. He was prosecuted under the federal statute and convicted. To me that is a stretch of the statute as I understand it. He was an attorney. When will we see the common man similarly prosecuted?

By way of example...I advise a potential client of my obligation to report child porn if I see it and the client decides not to engage me. Is that "believable knowledge"?

Should I report that to law enforcement?

Can I be prosecuted if I do not?

Should I be prosecuted if I do not?

What say you?

Since Bob discussed this in the private Julie Group blog a second issue is being discussed by Declan McCullagh over at CNet:

The definition of which images qualify as illegal is expansive. It includes obvious child pornography, meaning photographs and videos of children being molested. It also includes photographs of fully clothed minors in unlawfully "lascivious" poses, and certain obscene visual depictions including a "drawing, cartoon, sculpture, or painting."

Most reasonable adults, including home Wi-Fi providers or the Web sites affected by this legislation, can figure out what actual child pornography is. But when it comes to photographs of fully clothed minors in "lascivious" poses, and overly risque cartoon anime that might be "obscene" in one area of the country and permissible in another, it becomes trickier--especially when, legally, only a jury can determine whether an image violates local community standards.

The part I find a bit unsettling is the inclusion of pieces of art in these definitions.

Don't Get Burned Twice

As Randy Abrams in his blog piece Don't Get Burned Twice points out, "The current fires in Southern California are causing misery to hundreds of thousands of people ... As is the case with all disasters there are good people rallying to help and bad people trying to exploit the situation for profit. It may be a good time to remind people about some best practices to make sure that the money you earmark for helping people goes to helping people."

He offers some sage advice about how to avoid getting scammed, "First of all, do not respond to email messages soliciting donations, even from legitimate charities. These messages often are not sent by the charity itself. If you get an email from The American Red Cross and you wish to donate to this respected organization, do not use any information in the email as it may have been sent by a scammer that will redirect you to their fake Red Cross web site. Instead, look up the phone number for the Red Cross, or open your browser yourself and type in http://american.redcross.org." He then goes on to say that if the American Red Cross is not your favorite charity, "A site that can assist you with determining the legitimacy and effectiveness of a charity is http://www.charitynavigator.org/." And above all, "do not give cash to people claiming to represent charities. At LAX or other public places a person may approach you claiming to be collecting for victims of this or other disasters. They may even have impressive documents that are easily printed on a home PC. Some of these people are undoubtedly legitimate, but unless you are a psychic you probably won’t know. Take the information about the charity they represent and look it up before you part with your money."

As he says, "A few simple precautions will help prevent you and the victims you seek to help from being victimized."

And congratulations to Randy and his fellow employees at ESET LLC for volunteering their time and money to assist victims.

The opinions expressed in this post are those of the author and should not be interpreted as an official position of The Julie Group.

--Chip Neville

PS. Fellow Julie Group blogger Karoli has a dead-on post, Attention Mainstream Media: Quit Comparing SoCa Fires to Katrina! at odd time signatures.

Should OnStar Shut Your Car Down?

There has been quite a commotion over at Slashdot about General Motors' plan to "install OnStar systems on almost 1.7 million 2009-model cars." It seems our friends at GM plan to incorporate a "feature" which will allow "law enforcement (or anyone who cracks the system) to remotely shut down vehicles." And Lauren Weinstein writes, "Ready to turn over the keys of your vehicle to the cops, or that clever hacker in the next lane? How about that creepy guy following you on a lonely country road?"

These are good points. But so is the point made by the Cal Highway Patrol Deputy Commissioner, Joe Farrow, that about 15 percent of the pursuits are at speeds of 90 miles per hour and greater, and that, "There are some high-speed chases that we have out here that we'd like to bring to a halt." You don't have to be a rocket scientist to figure out that this stuff is dangerous, and as the AP story where Farrow is quoted points out, 404 people were killed in the US last year in high speed police pursuits.

Clearly, there is a balancing act here. We, the public, need to balance the number of injuries and deaths to be prevented by installing OnStar against the certainty that those nasty folks at evil.wicked.hackers.org will try, and for a time succeed, in hacking the OnStar system.

One way to do this balancing would be to demand public hearings in states like California on this issue. And the computer security community needs to be prepared to provide timely and accurate input. Perhaps we should ask the people over at The Shmoo Group, the people who gave us AirSnort and exposed just how vulnerable the WEP encryption scheme is, to try to hack into OnStar just to find out how easy or hard it is to do.

We need some data here folks! This is too important an issue to leave to GM (or slashdot). And GM, if legitimate security researchers need your exalted permission to hack OnStar, you need to be prepared to give it.

The opinions expressed in this post are those of the author and should not be interpreted as an official position of The Julie Group.

--Chip Neville

A Welcome Court Decision

Arstechnica today reports that an Ohio judge understands the issues involved with child pornography laws, teens, and computing. In an entry called Judge bars Ohio's attempt to keep "harmful" Internet content away from minors by Nate Anderson, he reports,

The state of Ohio this week found itself on the losing end of a judicial decision that struck down a state law banning all Internet transmission of content that is "harmful to minors" if the sender should know that someone on the receiving end is a minor.
Federal judge Walter Rice issued a permanent injunction against the law after pointing out the many ways that it could restrict legitimate speech between adults. The Supreme Court has already found that Internet users have reason to believe that there are minors present in every chat room, for instance; under the Ohio law, anything deemed obscene for minors that was uttered in a chat room could therefore possibly lead to prosecution.

The law was first passed in 2002 and immediately challenged by Media Coalition, a group of booksellers, newspapers, and providers of sexual health information. The judge soon granted a preliminary injunction, and the state amended the law in order to avoid several of the original problems. Despite the changes, Judge Rice still found the bill too broad when applied to the Internet, where it can be difficult or impossible to know the ages of every person that one interacts with.

Media Coalition's executive director, David Horowitz, praised the decision. "While we should have adequate legal safeguards to shield children from objectionable content," he said, "those safeguards cannot unreasonably interfere with the rights of adults to have access to materials that are legal for them."

Today, legislators, judges, and informed citizens must insist an end to witch-hunt prosecutions of citizens, in many cases minors, for possession of material that they may encounter due to legitimate online activity.

Consenting adults enjoy broad cultural interests that will occasionally intersect the lives of others. The underlying personalization automata of the internet is indifferent to social norms. Perfectly innocent people's computers are daily assaulted by malware, viruses, and ingenious scripts that can control and contrive artificial and unwelcome content on anyone's computer. If that content comes to the attention of the authorities, the unfortunate party can find themselves accused of crimes they did not commit.

Knowing what we know about artificial intelligences influencing personal computers, we need more judges insisting on free speech who can couple that conviction with an intolerance for nuisance prosecutions based on synthetic digital realities.

- krasicki