Julie Amero: More Info

After reading through all of the info, I’ve revised my original appeal for help for Ms. Amero — anyone who posts a legitimate comment or pingback (no spammers, please), whether or not they donate to her fund, will generate an additional $1 from me to her defense fund.  No requirement to give is necessary.

Here are some additional resources to highlight what a major travesty this case is (and I’ve removed the ability to click through to the links which accessed malware):

From Techrepublic.com, an incredibly enlightening thread which includes this:

We obtained a copy of the PC hard drive from Officer Lounsbury who was most cooperative and at our office we created several copies, preserving the original.

During the copy process we received several “Security Alerts!” from our antivirus program. We analyzed the activity log and noted that there were spyware/adware programs installed on the hard drive. We ran two other adware/spyware detection programs and more spyware/adware tracking cookie/programs were discovered. Out of the 42, 27 were accessed or modified days if not a month before October 19, 2004. We also noted that there was no firewall and there was an outdated antivirus program on the PC. The PC was being tracked before October 19, 2004 by adware and spyware.

(Continued…)

We examined all internet related folders and files before October 19, 2004, during October 19, 2004 and after October 19, 2004. Most significantly, we noted freeze.com, screensaver.com, eharmony.com and zedo.com were being accessed regularly.

On October 19, 2004, around 8:00 A.M., Mr. Napp, the class’ regular teacher logged on to the PC because Julie Amero being a substitute teacher did not have her own id and password. It makes sense that Mr. Napp told Julie not to logoff or shut the computer off, for if she did she and the students would not have access to the computer. The initial user continued use of the PC and accessed Tickle.com, cookie.monster.com, addynamics.com, and adrevolver.com all between 8:06:14 – 8:08:03 AM. During the next few moments Julie retrieved her email through AOL.

hair-styles.org was accessed at 8:14:24 A.M., based upon the hair style images uploaded to the PC we were led to believe that there were students using the computer to search out hair styles. The user went to http://www.crayola.com at 8:35:27 A.M. The user continued accessing the original hair site and was directed to new-hair-styles.com. This site had pornographic links, pop-ups were then initiated by pagead2.googlesyndication.com. There were additional pop-ups by realmedia.com, cnentrport.net, and by 9:20:00 A.M., several java, aspx’s and html scripts were uploaded. A click on the curlyhairstyles.htm icon on the new-hair-styles.com site led to the execution of the “curlyhairstyle” script along with others that contained pornographic links and pop-ups. Once the aforementioned started, it would be very difficult even for an experienced user to extricate themselves from this situation of porn pop-ups and loops.

All of the jpg’s that we looked at in the internet cache folders were of the 5, 6 and 15 kB size, very small images indeed. Normally, when a person goes to a pornographic website they are interested in the larger pictures of greater resolution and those jpgs would be at least 35 kB and larger. We found no evidence of where this kind of surfing was exercised on October 19, 2004.

Testimony and Trial

We asked the prosecution to arrange for the defense to have unfettered access to the internet so that we could reenact the events of October 19, 2004. It was not granted. I went to court with two laptops and a box full of reference material prepared to very clearly illustrate what happened to Julie Amero. But, the prosecution objected because they were not given “full disclosure” of my examination. I was allowed to illustrate two screens, that of the www.hair-styles.org , and www.new-hair-styles.com sites.

Conclusion

This was one of the most frustrating experiences of my career, knowing full well that the person is innocent and not being allowed to provide logical proof.

If there is an appeal and the defense is allowed to show the entire results of the forensic examination in front of experienced computer people, including a computer literate judge and prosecutor, Julie Amero will walk out the court room as a free person.

Let this experience stand as a warning to all that use computers in an environment where minors are present. The aforementioned situation can happen to anyone without fail and without notice if there is not adequate firewall, antispyware, antiadware and antivirus protection. That was not provided by the school administration where Julie Amero taught.

And this:

Posted by: Gerald Gibson Jr | January 25, 2007 09:04 PM

[This post has been edited --ed.]

Shortly after reading the article I decide to check on http://new-hair-styles.com/
It looked like a regular page until I click on the Image with the text “new-hair-styles.com” and on the main image of the website, and to my surprise instead of taking me back to the Home page as expected. It took me to: [a .ru porn site]

I wish there was some other way to help Julie Amero.

There are many, many other comments in the same vein.

Additional information links:

• Washington Post Blog
• Norwich Bulletin Article, including a timeline of events.
• Court TV article
• ThePeaceTrain.org’s coverage and commentary.
• PC Magazine Security Watch: Free the Norwich 1!
• Security Focus’ coverage and commentary on the case. This article is especially interesting because it reports a similar case where a network administrator was convicted in 2002, but the case was overturned on appeal after prosecutors admitted they made a mistake in prosecuting him at all.
• Additional analysis by Security Focus
• Lockergnome: Comments by Catherine Forsythe, Director of Operations, Flying Hamster
• Gideon, at a Public Defender, has excellent legal commentary on the case.
• Alex Eckelberry refutes the “Twinkie Defense” accusation.
• Steve Bass’ full article for Computerworld
• CyTRAP Labs’ analysis and additional links
• John C. Dvorak’s analysis and commentary

I was hoping to find court documents online, but no luck with that, unfortunately. It’s too bad — Court TV covers all sorts of crappy trials, but this one really should have been covered and wasn’t. If you think this case is a travesty, then get ready because Ted Stevens and Co are ready to make more criminals out of innocent people (and bar kids from ALL social networking sites in the process) with DOPA Jr.

Please post a comment or blog about my original post (3 down from this one) so that I can donate an additional $1 to her defense fund for each comment and trackback.

Technorati Tags: Julie Amero, network security, spyware, malware, crime

Tagged as: Education, Julie Amero, News