Can a virus put porn on your PC?

A 'Trojan' virus may be embedded in your personal computer and be receiving child porn, writes Jamie Smyth, Technology Reporter

Julian Green was preparing to take his seven-year-old daughter to a firework display on the day the police came to his home and arrested him on suspicion of possessing child pornography. The 45-year-old father of three didn't know it then, but he wouldn't see his youngest child again for more than three months. Taken into custody for questioning overnight, Green was told that 189 illegal images of child pornography had been found on the hard drive, the brain, of his personal computer.

"I didn't have an answer when they asked me how they got there," says Green, who was a computer novice at the time. "I just kept telling them I didn't know." He was sent to Exeter jail for nine days, where he was placed on suicide watch in the prison hospital. He spent a further three months in a bail hostel in what he describes as the "bleakest period of his life".

Green, who had recently appointed a solicitor to fight for custody of his daughter when his marriage broke up, was arrested on the strength of an anonymous tip-off. He later ásked the same firm to defend him against the child pornography charges. His solicitor hired computer experts, Vogon International, to examine the hard drive. The result paved the way for a successful nine-month legal battle to clear his name.

"My solicitor rang me up and said he had some great news. They had found Trojans on my computer's hard drive. At the time I didn't have a clue what it meant, but they were responsible for what happened."

Trojans, which are named after the Trojan Horse of Greek mythology, are malicious pieces of software code that enable hackers to gain a back door into a person's computer. Typically, they gain access when someone opens spam or unsolicited e-mail or clicks on a link on an unknown Internet site. They attempt to take remote control of a person's computer, often without their knowledge.

The British-based computer consultancy Vogon International found 11 different "Trojans" embedded on Green's hard drive.

As an expert witness, the firm argued that it was these malicious pieces of software code that had infiltrated Green's computer without his knowledge that were responsible for the illegal images of child pornography.

"In this case it was possible to clearly identify how the Trojan infection had affected the computer," says Tony Dearsley, of Vogon International, who says that the British police had not scanned Green's computer for the presence of Trojans. Indeed, if legal aid of several thousands pounds had not been granted to pay for the forensic examination of the computer by Vogon International, Green would probably have gone to jail.

Presented with this technical evidence, the judge acquitted Green in 2002 in what has become a landmark case for the growing numbers of people charged with possession of child pornography on their computer systems. So if computer viruses can be responsible for hijacking a computer, is it possible that innocent people have been sent to jail or will go to jail?

"In rare situations this is possible," says Cormac Callanan, director of INHOPE, a group that coordinates the work of Internet hotlines that receive complaints about alleged illegal content on the Internet in Europe.

"The challenge of defending an accusation relating to computer technology can be very difficult for many non-technical people. Proving innocence, even for innocent people, can be sometimes impossible," he says.

Securing the services of a technical expert is expensive, costing between €1,000 and €2,000 a day and, until the recent high-profile Judge Curtin case in Ireland, external experts for the defence were refused access to the computer and technology involved except in a controlled room in Garda HQ which made such analysis almost impossible, says Callanan, who understands this policy has changed on a case-by-case basis.

Paul Lambert, a technology lawyer for the Irish firm Merrion Legal, has concerns about the procedures that apply in Garda investigations.

"In Ireland, it is often unclear what procedures apply to police investigations, particularly technical investigations. . . certainly, the extent to which experts dealing in Ireland do not have at least equivalent explicit rights and procedures to other jurisdictions is a failure of the system. It is conceivable that injustice could occur in that relevant evidence is not made available to the defence," says Lambert.

The Irish Times contacted the Garda to get a response to Lambert's comments, but no statement was offered before the deadline for this article.

Garda statistics (see table) show that few cases are prosecuted on indictment because they are dealt with via a guilty plea in the District Court. Few cases are fought on the legal and technical points in a trial but there are signs that the "Trojan defence" will soon be raised in an Irish court.

Last month in the Dublin Circuit Criminal Court, Seán Foley, a former solicitor at the Chief State Solicitor's office, was acquitted on a charge of possessing illegal pornographic images of children on his computer.

During the trial Foley said he had never seen the illegal images that were stored on his computer and that he never "did any downloading".

During an interview with the Garda, he said he was aware that websites could send a "cookie" to the computer's hard drive or "leave a fingerprint". The case was dismissed before his defence team could present the full defence, but it is possible that the "Trojan defence" would have been employed by his counsel, who would not comment when contacted by The Irish Times.

The consequences of being accused of possession of child pornography are undoubtedly huge. More than 30 people in Britain charged with possession of child pornography arising from the Landslide Productions investigation in the US have been unable to cope with the shame of the allegation and have committed suicide. That same US investigation, of a Texas-based Web portal, led to the Garda's Operation Amethyst against more than 100 credit-card holders here.

Some experts are now proposing changes to the legal system. "Because the court case has such major ramifications on the victim and the perpetrator I believe that it would be best for all for the names of the people to be withheld until a prosecution has been achieved," says Callanan.

Unsurprisingly, Green agrees, and he also highlights the importance of granting legal aid to defendants to allow them to undertake forensic studies of the computer equipment to check for "Triojans". Otherwise, you can say goodbye to your freedom for 10 years, says Green, who has now thrown out his computer.

The Trojan Threat

What are Trojans and cookies?

Trojans and "cookies" are small pieces of software code that can attach themselves to a user's computer without his or her knowledge. In their most benign form, this software can help a website remember a particular user. But it can also

spy on a computer user's online activity, or worse, redirect their Internet settings to access automatically offensive or child pornography.

Where do Trojans hide?

Typically, hackers embed Trojans on music-file-sharing networks, pornographic websites and online gambling websites in order to gain access to people's computers. But computer experts estimate that most home computers have some form of rogue software installed on them without their owner's knowledge, although most rogue software would not install child pornography on a user's machine.

How can you protect your PC?

The ingenuity of some hackers means they are generally one step ahead of Internet security firms. But no one should connect to the Internet without a firewall (Windows

XP has one but it must be turned on), and an annual subscription to a reputable anti-virus firm is recommended.

Is it legal to surf the Web for pornography?

Pornography is one of the biggest revenue generators on the Web and it is legal to click on adult websites from Ireland. But do so at your peril. It is often impossible to tell if a particular Web portal contains illegal material of children which you could click into without knowing.

Are child pornographers using Trojans as a legal defence?

British-based computer consultancy Vogon International says it has come across people guilty of possession of illegal images deliberately placing Trojans on their computers to cover their tracks. But a proper forensic examination of the computer should determine if this has been done.