Electronic evidence raises questions in porn case

By Declan McCullagh, CNET News, 30 August, 2002 14:24

NEWS

A New York federal judge on Thursday sentenced a former Xerox engineer accused of trafficking in child pornography to nearly four years in prison. The US government's prosecution of Larry Benedict, 45, is unusual because all the evidence in the case is electronic, and all of the evidence appears to have been allegedly tampered with or otherwise altered after it was in government custody. Benedict pleaded guilty to the child pornography charges in June 2001 after being refused full access to the hard drives, floppy disks and tape backups that federal agents seized in an evening raid on his home in February 1995. Because no physical child pornography was found, the case against Benedict rests entirely on the contents of the electronic storage media. But after a computer expert retained by Benedict unearthed evidence that pointed toward his innocence, Benedict retained new lawyers who attempted to dismiss the plea and go to trial. Last month, US District Judge David Larimer rejected Benedict's request. "Benedict repeatedly said that he understood the agreement, that he had no questions, that he was prepared to enter the plea, and he admitted without qualification the accuracy of the factual basis set forth in the plea agreement concerning Benedict's transmission of numerous items of child pornography," Larimer said in a 20-page ruling. During a three-hour hearing on Thursday, Larimer sentenced Benedict to 46 months, the maximum prison term permitted by the plea agreement, and rejected a request by defence counsel to allow Benedict to remain out of jail while an appeal is under way. Benedict is required to report to a federal prison in the next few weeks. Larimer, a former prosecutor, also refused to hold a hearing to explore whether evidence against Benedict was fabricated. "Just because Benedict now believes his chances at trial might be more favourable than they would have been in June 2001, is no reason to allow withdrawal of the guilty plea," Larimer said. "It shows the distance that the federal judiciary is going to have to go in order to fairly appreciate issues" involving electronic evidence, said John Swomley, an attorney for Benedict. "This judge just didn't get it. It may be that he just can't get his brain around what our evidence shows." Benedict said before the hearing: "This is basically unbelievable. I'm innocent, and I can prove that I'm innocent. I can't believe they're going to send me to jail over this." The US Attorney's office did not immediately respond to a request for comment. Until being fired last year after news of the plea agreement appeared in a local newspaper, Benedict was a project manager at Xerox, designing printer and copier mechanisms that churned through paper at ever-increasing velocities. He had no criminal record, and his estranged wife has said she believes the criminal charges are false. Prosecutors have never turned over all the electronic evidence in the case to the defence team, including vital bit-for-bit copies of the tapes that allegedly contained child pornography. But, according to court documents, the electronic information prosecutors did divulge shows that files were added and deleted from computers while they were in police custody, and it took prosecutors nearly five years to discover illegal image files on Benedict's PC in an obvious, top-level directory titled "GIF." The government claims that Benedict was trading images of child pornography on floppy disks and magnetic tapes sent to a man in California. Benedict admits to swapping disks back and forth but says they contained Amiga computer games. His personal "wares" catalogue lists 2,151 titles stretching from "A-10 Tank Killer" to "Zork Zero". Benedict's brother George, who attended the hearing, said he expected this result. "Larry spoke for quite a while and was really passionate and all that," he said. "Everyone did everything they could do and should do. The judge, I think, had decided already before he got there and that was it." Swomley, Benedict's attorney, said he plans an immediate appeal to the Second Circuit. "I think we have several good grounds for an appeal," Swomley said. "The question is whether we can get a panel of judges who can appreciate the computer evidence. We have evidence of actual innocence, and that's what we're going to say." Both the defence and the prosecution agree that electronic evidence was altered. They disagree, however, on how much evidence was changed, and, crucially, whether such a discovery matters after Benedict formally agreed to a plea bargain last year. Courts are still grappling with how to deal with evidence found on computer systems, which has become increasingly important over the last decade. Electronic evidence is far more malleable than physical evidence. Erasing a date on a piece of paper and replacing it with a different one will leave a residue, yet most operating systems will allow a date to change on a computer file without recording the change. The Justice Department started thinking through the problem of computer evidence in the early 1990s. Its 1994 Guidelines for Searching and Seizing Computers call for a "controlled environment" when examining a PC, noting that "computer evidence is extremely vulnerable to inadvertent or intentional modification or destruction." In this case, police inventory records show scores of files that were added to a seized hard drive while it was in police custody. Floppy disks seized from Mikel Bolander, Benedict's alleged porn-trading partner, were destroyed by police. An analysis by Stan Kremen, a computer forensics specialist hired by the defence, concludes that "extensive changes were made to the Bolander hard drives for quite some time after the computer was in custody." That evidence -- an exchange of letters signed "LB" -- is key to the prosecution's case against Benedict. Kremen says that fax software was added, image directories were modified, Adobe Photoshop was used, and so on, according to the directory tree -- as recently as May 1995, when the computer was in police custody. The government doesn't deny it. In a motion filed last December, prosecutors say that investigators had no spare computers to use for an examination. A San Diego police officer "would testify that on Feb. 2, 1995, he restored the contents of the mailed backup tape onto Bolander's computer because his department did not have the computer forensic facilities to do it any other way," wrote assistant US Attorney Martin Littefield. Bolander's computer was seized in January 1995. Benedict's computers and floppy disks, seized during a February 1995 raid on his home in New York's Finger Lakes country, were also lost. Prosecutors stored 27 US Postal Service mailbins in the soggy basement of the Geneva, New York, post office. After a few floods, the computers had rusted and the disks were encrusted with a filmy white substance. Benedict says that the computer hardware and his floppy disks contain vital evidence that could show a jury that he was no child pornographer -- and instead merely was a video game addict who became snared in a sting operation. In a 1988 case, Arizona v. Youngblood, the Supreme Court ruled that "failure to preserve potentially useful evidence" denies a defendant due process if police acted in bad faith. But the government argues it was an accident. "The fact that the hundreds of disks which were being held by the Postal Service suffered water damage after five years of being held can hardly be attributed as an intentional act, let alone prosecutorial misconduct," prosecutors say in court documents. Judge Larimer never ruled on the points raised by the defence's computer forensics experts. "A defendant's assessment that due to changed circumstances he has a better chance of winning is not an acceptable basis to allow withdrawal of the guilty plea," Larimer ruled last month before setting Thursday's sentencing date.

See the Net Crime News Section for the latest on fraud, crime, child protection and related issues. Have your say instantly, and see what others have said. Go to the Security forum. Let the editors know what you think in the Mailroom.

Post your comment

In order to post a comment you need to be registered and logged in.

You can also log in with Facebook. Log in or create your ZDNet UK account below

By signing up for this service, you indicate that you agree to our Terms and Conditions and have read and understood our Privacy Policy. Questions about membership? Find the answers in the Community FAQ

ZDNet UK Live

Nice review and very informative. One thing I'd like to add (in reply to whs001's 1st question), the main reason to have the same interface from...

1 hour ago by GrueMaster on A tale of two distros: Ubuntu and Linux Mint

I'be been using Mint 12 since the RC came out, and I am far more happy with the Cinnamon, the Mate, and, yes (with extensions), theGnome 3...

2 hours ago by Frederick Wrigley via Facebook on A tale of two distros: Ubuntu and Linux Mint

Excellent article. One small correction, though--although a fresh installation of Linux Mint 12 will, indeed, provide the user with a version of...

3 hours ago by bdantas on A tale of two distros: Ubuntu and Linux Mint

In related news, the ISPs club together to get the members of the Home Affairs Select Committee (ya goofed on that part, ZDNet UK) copies of "The...

3 hours ago by Alan Ralph via Facebook on MPs urge ISPs to take down terrorist material

In related news, the ISPs club together to get the members of the Home Affairs Select Committee (ya goofed on that part, ZDNet UK) copies of "The...

3 hours ago by Alan Ralph via Facebook on MPs urge ISPs to take down terrorist material

For Gnome 2 die-hards, it is possible to add icons to the bottom panel (or top top panel, if you prefer) which provide the exact Gnome 2...

4 hours ago by Moley on A tale of two distros: Ubuntu and Linux Mint

Your comments would seem pretty naive and immature. Your 'solution' appears to be, "gee, let's all just give in to the hackers and give them...

4 hours ago by ramwellian on Cloud computing security: no more oxymoron?

"Interesting thought ... If you installed Win7 as a dual boot on a machine that previously only had Linux, and it wrecked your Linux installation,...

5 hours ago by BugStalker on Windows 7 Declares War on GRUB

This is an excellent summary of Ubuntu and Mint and the interface differences between them. Most such articles take a very partisan position for...

5 hours ago by whs001 on A tale of two distros: Ubuntu and Linux Mint

@ewallace. Not so clear. Anyone can obtain the text, for example from here http://www.ustr.gov/webfm_send/2379. I support ACTA so long as it and...

5 hours ago by Moley on ACTA: Facts, misconceptions and questions

I think WinRT is fantastic. I just wish it was an option for people that didn't want to go through Microsoft's App Store with its attendant...

8 hours ago by 45283 on Why Windows 8 needs architectural hygiene for WOA

Nine people? £30m? Who's back pocket is that lot going in? And IF they say it is for new buildings, what about all the ones the government has...

9 hours ago by Burn-IT on Police set to launch three £30m e-crime hubs

Just to be clear, nobody knows what is in the text of ACTA, here is a photograph of the text of ACTA http://twitpic.com/8h9iju as submitted to the...

9 hours ago by ewallace on ACTA: Facts, misconceptions and questions

Unfortunately main issue is that ASUS is refusing to accept that they make some mistake on this version of asus Transformer prime. 1 - GPS sensor...

10 hours ago by fgvrg56 on Asus Eee Pad Transformer Prime Wi-Fi & GPS problems?

@Marcus A fair question. Just talked with Archos which said it was working on an announcement for next week....

11 hours ago by Ben Woods on Archos confirms G9 Ice Cream Sandwich update schedule

Any update on this, considering the claimed "first week of February"?

13 hours ago by Marcus Karlsson via Facebook on Archos confirms G9 Ice Cream Sandwich update schedule

Bill Goodrich : Just as al_langevin pointed out, with Windows Server 2008 there is no Services for Macintosh anymore. It's gone, not available....

21 hours ago by apexwm on Windows Server 2008 drops the ball for Mac compatibility

Replying to an old topic that I'm currently facing with my CEO (who is on a Mac). Our servers are primarily Windows Servers, office is about...

1 day ago by txtrainguy on Windows Server 2008 drops the ball for Mac compatibility

Sure, that makes perfect sense. Pay wrong-doers money and thank them for breaching your security and pointing out your flaws, that would surely...

1 day ago by k0tcs3 on US indicts Romanian over NASA climate change hack

I think he's referring specifically to Android apps, as Apple do regulate their App Store, but Google seem to let any old crap onto the Android store!

1 day ago by Random_Error on RIM: BlackBerry will keep 'garbage' apps out of store

Featured white papers

Latest jobs

Electronic evidence raises questions in porn case

Daily Newsletters

Topics

Related stories

Encryption foils Internet child porn prosecutions

Net closes on thousands of UK paedophiles

Ofcom to make it easier to change broadband service

Google set to build backbone of its 1Gbps fibre network

Nicira reveals network virtualisation details

Post your comment

ZDNet UK Live

Latest in Networking

Ofcom to make it easier to change broadband service

Google set to build backbone of its 1Gbps fibre network

Nicira reveals network virtualisation details

Featured white papers

Latest jobs

Test Analyst - Business Intelligence /Data Warehousing

Test Analyst - Business Intelligence /Data Warehousing

Technical MI Manager - 50-60k - Leeds

Inside ZDNet UK

A tale of two distros: Ubuntu and Linux Mint

2012 Predictions: VCE FastPath, VI SAN Probe & Hadoop

BlackBerry Bold 9790

Case study: How cloud enables growth

Ten factors that make Ubuntu 11.10 a hit

Toshiba Portégé Z830-10P Review

BT's archive: Pictures from the vault

News & Analysis

Reviews

Blogs

Resources

About Us

Member Services

Special Features

Advertising Features

ZDNet UK / News and Analysis / Infrastructure / Networking

Electronic evidence raises questions in porn case

Daily Newsletters

Topics

Related stories

Post your comment

Get ZDNet UK's daily newsletter

Enter your email address to sign up

ZDNet UK Live

Latest in Networking

Featured white papers

Latest jobs

Inside ZDNet UK

Resources

About Us

Member Services

Special Features

Advertising Features