The difficulty for gardaí now is to find the necessary corroborating information, writes Karlin Lillington
The months that have passed since Interpol alerted gardaí about two Irish suspects in the Austrian internet child pornography case will make it much harder to seize needed evidence.
"Clearly the gardaí would want to ensure they have the broadest and most complete body of evidence in these cases," said Andy Clark, head of forensics at Detica, a UK-based information intelligence consultancy firm.
This would likely include images and other corroborating information seized from individual computers, as well as internet-usage information and credit card details that would link an individual to the crime of possessing or distributing child pornography.
"Surely, the gardaí will be disappointed that they didn't have as much time as they could have had to secure evidence," he said.
Interpol alerted gardaí in August, and Austrian police say most countries asked for files relevant to the case at that time.
Clark, an internationally-recognised computer forensics expert who has worked with global law enforcement agencies, including the Garda, says it typically takes several months - "quite some substantial amount of time" - to gather enough information to secure a search warrant in this type of case. But this can be highly variable. Much depends on the evidence that will be given to gardaí by Austrian authorities.
Austrian police obtained credit card details and IP addresses - the individual address a computer uses while connected to the internet - after being alerted by an Austrian internet service provider that eight pornographic videos had been uploaded to one of its servers, a computer that serves as a data repository for internet users.
An IP address would be linked to an individual premises, but not necessarily an individual computer. If the location is a business or university, for example, hundreds or thousands of people could share an IP address.
Depending on how much network data is retained by the business and for how long, investigators could determine which computers have images, seize them and conduct a formal examination to retrieve evidence. But this takes time.
If an IP address resolves to a residence, the search is usually faster and easier, says Clark. "A home typically has just two to three machines." Even if several people live at the address, credit card details, indications of who logged on to a machine and the location of images and other details mean it can be easy to link images to the relevant individual.
Clark says police forces are very careful about obtaining corroborative evidence before seeking a warrant to seize computers.
The difficulty for gardaí now is that the corroborative evidence may be much harder to find, and suspects may have been alerted about the case - although it is equally possible that, given the secrecy of such websites, the Irish individuals will not realise the site they purchased images from is the one in the news.