Forensic Cases
Introduction
For over thirty five years I advised, practised and consulted on matters involving computers and law. This has involved cases of all kinds.
Paedophile Images Case #1
Mr X, a married man, had an extensive collection of music downloads. He was the subject of an arrest in December 2003 and thereafter was charged in May 2004 with various offences in relation to the possession and making of indecent photographs of children. There were six offences of making an indecent photograph and one offence of possession of indecent photographs - which was in effect a sweeping up charge. The police employed an in-house Forensic Computer Analyst with the Northampton Police Force who performed a forensic analysis of the Defendant's computer system and produced a report containing conclusions which I believed were incorrect and, in context, were not supported by the evidence.
The matter finally came to trial in May 2005, prior to which date I had prepared two expert reports which had been served on the Prosecution. Three days before the trial was due to begin the prosecution notified us that they had decided to offer no evidence. The full background to the case is set out below:
Mr X was charged with six offences of making an indecent photograph and one offence of possession of indecent photographs - which was in effect a sweeping up charge. The police employed an in-house Forensic Computer Analyst with the Northampton Police Force who performed a forensic analysis of the Defendant's computer system and produced a report containing conclusions which I believed were incorrect and, in context, were not supported by the evidence.
Mr X denied all knowledge of how the various indecent images came to be on the hard disk of his computer. Consequently a key part of my investigation and Report concerned itself with the ways in which child pornography could arrive on a computer system without the knowledge or intention of the user of that system. In short, the main issues in respect of each charge were that:
the Defendant had not himself seen the photograph and did not know, nor had any cause to suspect, it to be indecent; and
the photograph was sent to him without any prior request made by him or on his behalf and that he did not keep it for an unreasonable time.
The first feature that caught my attention in this case was the vast volume of data taken from the Defendant and, contexturally, the very small number of files of allegedly indecent images of children that were found. This was a significant matter since it genuinely raises the issue of whether the allegedly indecent images of children were, in fact, contamination of legitimate materials in the Defendant's possession. In other words the actual volume of material involved and its likely sources suggests that the Defendant did not knowingly seek out the allegedly indecent images of children.
The police prosecution expert's report chose not to give information on the volume of data involved, yet I believed that this was highly significant information. There were seven hard disk drives listed in the police prosecution expert's report; two from Mr X's current system and five from legacy systems together with 73 floppy disks, 63 CDs, 1 Zip Disk and a High8 tape. The hard disks alone constituted something in the order of 600-700 Gigabytes of storage capacity. Mr X had used this capacity for a period or nine to ten years in connecting to the Internet. Consequently the disks could, in many ways, be considered to be a reasonably comprehensive record of the ordinary activities of Mr X. He had a clear interest in music: his collection of MP3 files consisted of over 8,000 individual songs occupying some 60 Gigabytes. Substantial amounts of this material had clearly been downloaded using Kazaa, a peer-to-peer software tool with which, at the time, there were well known issues of contamination with child pornography images. Mr X also made special use of the software programme "PixcNews.Pro" to which the police prosecution expert did not refer - although its' operation was, in my view, very material to the issues in this case.
In my independent expert report on behalf of Mr X I explained that PixNewsPro was a program for downloading binaries, that is to say images, sounds and movies which were encoded as text in newsgroups. The program when running went to a newsgroup and downloaded either everything there, or just the things the user specified with keywords. The company that developed the product had said that PixNewsPro could download 1.26 Gigabytes in 13 hours. I pointed out that a download of such a size could contain in excess of twenty one thousand images each of about 50 Kbytes and that PixNewsPro performed this process automatically, without user intervention.
After serving my expert report on the prosecution a meeting took place between the police prosecution expert and me where we attempted to narrow the issues that divided us. The technical matters I cited were conceded but not my conclusions. We then set about trying to install the program PicNewsPro so that we could jointly try and confirm (or deny) my suggested analysis of how the program operated. We were unable to install it. Matters therefore continued with both parties preparing for trial.
A few weeks before the trial I decided that this was a case where the jury needed to fully understand how everything worked and what I alleged was happening. This, in my view, required me to present a short lecture (illustrated with Powerpoint slides) to the jury as part of my evidence in the courtroom.
However I was not happy with my inability (and the police prosecution expert's inability) to reconstruct the way in which PixNewsPro worked on Mr X's computer. Through my industry contacts I managed to trace the original author of the software and had a series of telephone discussions with him and an exchange of e-mails. He was able to confirm that my suspicions were correct and that in one normal implementation of the program it was perfectly possible for various images to be downloaded without specific user request. Furthermore it was the case that in these circumstances it was also perfectly possible that the user did not see and had no reason to know that these images were on his computer system.
I put this information into a brief additional report and sent it to Mr X's barrister (Patrick Gibbs - now Patrick Gibbs KC). All was prepared for a lengthy trial beginning on a Monday morning. However on the Thursday evening before the trial we got the message that the Crown had decided to offer no evidence.
Mr X walked away an innocent man and managed to get his life back. Thankfully his wife and family stood by him throughout the nightmare.
Logic Bomb #1
The Defendant was charged with an offence of criminal damage whereby he was alleged to have created and inserted a logic bomb in a software program he was maintaining for a commercial shipping company - the motive for which was alleged to be a desire by him to obtain further consultancy fees for sorting the matter out.
At the time I was junior counsel where I worked closely with our independent expert witnesses. To illustrate matters and correctly cross-examine technical witnesses I wrote programs in the computer language "C" as well as some assembler language programs. These sample programs were used to great effect in demolishing the statements of the various prosecution witnesses and experts.
After three and a half weeks in Isleworth Crown Court we made a submission of "no case" at the end of the prosecution's evidence and got the case thrown out. It is believed that the real author of the "logic bomb" was the chief prosecution witness who was seeking to get revenge for an affair between the consultant and the chief prosecution witness' wife.
Hacking
I was counsel for one of the defendants in Britain's first hacking case in the 1980s - where the Defendants were accused of hacking into the Prestel mailbox of the Duke of Edinburgh. It is a very long and interesting story - which led to the conviction being overturned by Lord Lane in the Court of Appeal and a successful defence of this appeal in the House of Lords.
For a piece on this case see here