WV Civil Rights Lawyer

Police Misconduct, Civil Rights Law

Computer Crimes and Steganography

It wasn’t that long ago that I observed that computer crime prosecutions were on the rise in West Virginia.  This morning the Charleston Gazette published an article titled “Hidden digital files may be going unnoticed by law enforcement.”  The article talks about a method of concealing messages/images/video/audio within other digital files, called steganography, which is a process of hiding one digital file within another, rendering it “literally invisible.”  This is not something that I have seen come up in West Virginia, but apparently it has been popping up elsewhere.

The West Virginia State Police does have some type of anti-steganography software, but apparently has of yet been unsuccessful in detecting any.  According to the article, anyone with access to a computer, including registered sex offenders who are being monitored, can access this method, merely by googling “information hiding.”

This will be something to look out for as time goes on.  I predict that we will start seeing some criminal prosecutions in West Virginia where incriminating information is found encrypted on some innocuous-looking files, probably on the hard-drives of registered sex offenders who are attempting to evade their overseers.  But that brings up an interesting question – can we find out who encrypted any such files, and when?  And can we be certain that if law enforcement claims to find such a hidden file, that it wasn’t in some way planted after-the-fact.  I guess we will eventually find out.

 – John H. Bryan, West Virginia Attorney.

January 27, 2009 Posted by | Computer Crimes | 1 Comment

Computer Crime Charges On the Rise in WV

The Charleston Daily Mail published a story today about another child porn bust in Kanawha County. This is proving to be an ever-expanding area of criminal law, both nationally and in West Virginia.

Robert Eugene Simmons, 32, was arrested by members of the West Virginia Internet Crimes Against Children task force after giving officers permission to search his computer, according to the criminal complaint.

The arrest comes less than a week after the first child pornography sting in the Kanawha Valley where ICAC officers used peer-to-peer file sharing to observe child pornography distribution. This type of observation has already been successful elsewhere in the state.

The article stated that: “Simmons, and others arrested for distributing child pornography, may face more charges after their computers’ hard drives are examined, said State Police Sgt. P.C. Koerner, who aided in Tuesday’s arrest.”

For any defense attorneys who have not yet faced charges such as these, here is what they have been doing: they seize the computer, it then is sealed and placed in the State Police detachment evidence room. They then have the option of doing a “live preview” of the hard drive to essentially take a peek at what could be on the hard drive. Then the computer is transported to Huntington, West Virginia, to the state’s forensic computer expert. At that point, the proper procedure is to make a “clone” of the hard drive before anything else is done with the computer.

The article further stated that “Each file shared over the Internet has a fingerprint attached to it. What we’re able to do is, we’re able to track where those files are going. As a computer forensics expert will tell you, each file has should be “hashed” which gives you this “fingerprint” – and if that is not done, then there could be some deficiencies with the evidence.

With child porn charges, defendants can be charged in state court, or they can be charged federally. The federal charges bring a minimum sentence of 10 years. If the charges are federal, it can alter your access to the evidence (i.e., computer). Federal prosecutors demand that the defendants attorneys or experts not be allowed to possess their own “clone” of the hard drive, as can be allowed if the charges only exist at the state level. I’m not sure what makes the federal prosecutors God, but for some reason the state police and defense experts are afraid to disobey the AUSA’s demands.

The protocol they use is this: they first make a clone of the hard drive, then the defense clone gets placed in a safe in the evidence room; the defense is given the only key, then when they want to analyze the computer, you are forced to do it under supervision of the state police. Now, if the charges are in state court only, then you can get an order from a circuit court judge to possess a clone of the hard drive. By the way, the feds insist on this even if no child porn has yet been found on the hard drive.

Speaking of experts, it is extremely important to retain an defense expert from the very beginning. The state has an expert are their side from the very beginning. You must have a forensic computer expert who can observe any and all manipulation of the hard drive by the state’s experts, as well as perform his or her own analysis of the hard drive. The important thing here is to prevent spoilation of evidence that could be exculpatory, and to foreclose the possibility of any manufacturing of evidence by the state, as well as to be able to give an opinion at trial regarding the reliability of the state’s procedures. If anyone is in need of an expert for computer-related charges, contact me and I can put you in touch with a very good one.

I think this is a trend we will continue to see in West Virginia, both with child porn charges, and with online solicitation charges. There is not much case law yet in this state for these types of cases, so many of the defenses have not yet been tried as they have in other states.

You can read the full article from the Charleston Daily Mail here.

– John H. Bryan, West Virginia Attorney.

June 19, 2008 Posted by | Computer Crimes, Evidence, Experts, Forensic Labs, Sex Crimes | 1 Comment