Electronic evidence anchors porn case

A Rochester, N.Y., federal judge on Thursday sentenced a former Xerox engineer accused of trafficking in child pornography to nearly four years in prison.

The government's prosecution of Larry Benedict, 45, is unusual because all the evidence in the case is electronic, and all of the evidence appears to have been allegedly tampered with or otherwise altered after it was in government custody.

Benedict pleaded guilty to the child pornography charges in June 2001 after being refused full access to the hard drives, floppy disks and tape backups that federal agents seized in an evening raid on his home in February 1995. Because no physical child pornography was found, the case against Benedict rests entirely on the contents of the electronic storage media.

But after a computer expert retained by Benedict unearthed evidence that pointed toward his innocence, Benedict retained new lawyers who attempted to dismiss the plea and go to trial.

Last month, U.S. District Judge David Larimer rejected Benedict's request. "Benedict repeatedly said that he understood the agreement, that he had no questions, that he was prepared to enter the plea, and he admitted without qualification the accuracy of the factual basis set forth in the plea agreement concerning Benedict's transmission of numerous items of child pornography," Larimer said in a 20-page ruling.

During a three-hour hearing Thursday, Larimer sentenced Benedict to 46 months, the maximum prison term permitted by the plea agreement, and rejected a request by defense counsel to allow Benedict to remain out of jail while an appeal is under way. Benedict is required to report to a federal prison in the next few weeks.

Larimer, a former prosecutor, also refused to hold a hearing to explore whether evidence against Benedict was fabricated. "Just because Benedict now believes his chances at trial might be more favorable than they would have been in June 2001, is no reason to allow withdrawal of the guilty plea," Larimer said.

"It shows the distance that the federal judiciary is going to have to go in order to fairly appreciate issues" involving electronic evidence, said John Swomley, an attorney for Benedict. "This judge just didn't get it. It may be that he just can't get his brain around what our evidence shows."

Benedict said before the hearing, "This is basically unbelievable. I'm innocent, and I can prove that I'm innocent. I can't believe they're going to send me to jail over this."

The U.S. Attorney's office did not immediately respond to a request for comment.

Until being fired last year after news of the plea agreement appeared in a local newspaper, Benedict was a project manager at Xerox, designing printer and copier mechanisms that churned through paper at ever-increasing velocities. He had no criminal record, and his estranged wife has said she believes the criminal charges are false.

Prosecutors have never turned over all the electronic evidence in the case to the defense team, including vital bit-for-bit copies of the tapes that allegedly contained child pornography.

But, according to court documents, the electronic information prosecutors did divulge shows that files were added and deleted from computers while they were in police custody, and it took prosecutors nearly five years to discover illegal image files on Benedict's PC in an obvious, top-level directory titled "GIF."

The government claims that Benedict was trading images of child pornography on floppy disks and magnetic tapes sent to a man in California. Benedict admits to swapping disks back and forth but says they contained Amiga computer games. His personal "wares" catalog lists 2,151 titles stretching from "A-10 Tank Killer" to "Zork Zero."

Benedict's brother George, who attended the hearing, said he expected this result. "Larry spoke for quite a while and was really passionate and all that," he said. "Everyone did everything they could do and should do. The judge, I think, had decided already before he got there and that was it."

Swomley, Benedict's attorney, said he plans an immediate appeal to the Second Circuit. "I think we have several good grounds for an appeal," Swomley said. "The question is whether we can get a panel of judges who can appreciate the computer evidence. We have evidence of actual innocence, and that's what we're going to say."

Slippery electronic evidence
Both the defense and the prosecution agree that electronic evidence was altered. They disagree, however, on how much evidence was changed, and, crucially, whether such a discovery matters after Benedict formally agreed to a plea bargain last year.

Courts are still grappling with how to deal with evidence found on computer systems, which has become increasingly important over the last decade. Electronic evidence is far more malleable than physical evidence. Erasing a date on a piece of paper and replacing it with a different one will leave a residue, yet most operating systems will allow a date to change on a computer file without recording the change.

The Justice Department started thinking through the problem of computer evidence in the early 1990s. Its "1994 Guidelines for Searching and Seizing Computers" call for a "controlled environment" when examining a PC, noting that "computer evidence is extremely vulnerable to inadvertent or intentional modification or destruction."

In this case, police inventory records show scores of files that were added to a seized hard drive while it was in police custody. Floppy disks seized from Mikel Bolander, Benedict's alleged porn-trading partner, were destroyed by police.

An analysis by Stan Kremen, a computer forensics specialist hired by the defense, concludes that "extensive changes were made to the Bolander hard drives for quite some time after the computer was in custody." That evidence--an exchange of letters signed "LB"--is key to the prosecution's case against Benedict.

Kremen says that fax software was added, image directories were modified, Adobe Photoshop was used, and so on, according to the directory tree--as recently as May 1995, when the computer was in police custody.

The government doesn't deny it. In a motion filed last December, prosecutors say that investigators had no spare computers to use for an examination.

A San Diego police officer "would testify that on Feb. 2, 1995, he restored the contents of the mailed backup tape onto Bolander's computer because his department did not have the computer forensic facilities to do it any other way," wrote assistant U.S. Attorney Martin Littefield. Bolander's computer was seized in January 1995.

Benedict's computers and floppy disks, seized during a February 1995 raid on his home in New York's Finger Lakes country, were also lost.

Prosecutors stored 27 U.S. Postal Service mailbins in the soggy basement of the Geneva, New York, post office. After a few floods, the computers had rusted and the disks were encrusted with a filmy white substance.

Benedict says that the computer hardware and his floppy disks contain vital evidence that could show a jury that he was no child pornographer--and instead merely was a video game addict who became snared in a sting operation.

In a 1988 case, Arizona v. Youngblood, the Supreme Court ruled that "failure to preserve potentially useful evidence" denies a defendant due process if police acted in bad faith.

But the government argues it was an accident. "The fact that the hundreds of disks which were being held by the Postal Service suffered water damage after five years of being held can hardly be attributed as an intentional act, let alone prosecutorial misconduct," prosecutors say in court documents.

Judge Larimer never ruled on the points raised by the defense's computer forensics experts. "A defendant's assessment that due to changed circumstances he has a better chance of winning is not an acceptable basis to allow withdrawal of the guilty plea," Larimer ruled last month before setting Thursday's sentencing date.

[estrin59]

witch hunt

I would like to send you some links to publications
about my criminal case. I worked for Mitsubishi
Electric Automation in Vernon Hills, IL, USA.
My case are getting public attention now as an example
of miscarriage of justice. I could not defend myself,
because I did not have enough money for computer
expert. I was forced to confess for possession of
child porn. I got browser hijackers while browsing the
web. I was redirected to illigal sites against my
will. Some illigal pictures were found on my hard
drive only after
recovering in unallocated clusters, without dates of
files creation/download.
I do not know how can courts press widely on people to
convict them, while whole Internet is a mess.

This is my story in inquisition21.com. There is all
information about case written by Irish writer Brian
Rothery.

http://www.inquisition21.com/article~view~7~page_num~3.html

This is publication in Wired news

http://www.wired.com/news/infostructure/0,1377,63391,00.html

This is publication in Theregester

http://www.theregister.co.uk/2004/05/13/browser_hijacking_risks/

Article in Globe and Mail newspaper
http://ctv.globetechnology.com/servlet/story/RTGAM.20040617.gttwhijac17/tech/Technology/techBN/ctv-technology

Article in ZDnet
http://zdnet.com.com/2100-1105_2-5344831.html

This is article in Washington Times, May 22, 2004
There is information about my case.

http://www.cato.org/cgi-bin/scripts/printtech.cgi/dailys/05-30-04.html

Article in Crime research center:

http://www.crime-research.org/news/07.22.2004/506/

Article in Dallas, TX Newspaper

http://www.zwire.com/site/news.cfm?newsid=13614767&BRD=1426&PAG=461&dept_id=528214&rfi=6

The problem for me now is to find lawyer, who can
review the case. When I pleaded guilty, there were no
any publications, like in wired news. This article was
posted on hundreds sites, published in newspapers,
discussed on many boards, and translated to many
languages.
I think the problem with my confession was prosecutors
pushed case to trial without any thoughts about
computer experts. Judge answered NO for any requests.
Prosecutor promised couple years in prison. My lawyer
came to me and said 'You must answer in next 5
minutes, after that they call jurors for trial'. 100%
you will get conviction, no doubt.
100% to get conviction, and go to prison for couple
years. This was opinion of very experienced lawyer.
Going to prison with child sex conviction, there were
possibilities to get raped, bitten, or even killed.
These were real, very real.
So it was pressing like criminals pressing on victim.
I am political refugee from Soviet Union, and in my
understanding, there are no difference between
prosecution, court, police and criminals. I got
another prove of this.
People are silent in this country because charging
with any crime is very easy, but defence costs huge
money. Most people do not have $15,000 for lawyer, but
this is not enough. I think $200,000 is not enough to
defend yourself. So police and and procecution enjoy
abusing of power, like masters with slaves.
I just tryed to explain why there was plea agreement.
Some people do not understand this. They asking
questions like why admitted something you are not
guilty of. Josef Stalin victims admitted to any crime
just to exchance for easy death. Also you probably
read Orwell '1984'

Fima.