• On The Insider: Bruno Film Edited Due to Jackson's Death
June 17, 2008 10:55 AM PDT

State worker cleared on child porn charges that were due to malware

by Elinor Mills

A fired Massachusetts state worker has been exonerated of a charge of possessing child pornography after computer forensics showed that his work laptop was infected with malicious software that was surreptitiously visiting illegal Web sites.

Michael Fiola, 53, was fired as a worker's comp fraud investigator with the Massachusetts Department of Industrial Accidents in March 2007 after IT administrators found cached images of child porn in the temporary Internet files in his browser, according to the Dark Reading security news site.

Fiola, described as being "computer illiterate," hired a forensics expert who found the evidence that was used to convince the court to drop the case last week. He remains unemployed and plans to sue the agency over his firing.

"Our lives have been hell," Fiola, a former state park ranger now living in Rhode Island told the Boston Herald. "I hope to recover my reputation, but our friends all ran."

His laptop initially attracted attention because its wireless usage was four times higher than that of his co-workers. But because the IT department hadn't properly configured the agency laptop and antivirus software wasn't working on the machine, it was riddled with Trojans and viruses, in addition to the malicious software that was bringing up the porn sites.

Elinor Mills covers Internet security and privacy. She joined CNET News in 2005 after working as a foreign correspondent for Reuters in Portugal and writing for The Industry Standard, the IDG News Service, and the Associated Press. E-mail Elinor.
Recent posts from News Blog
Neil Young Archives Blu-ray: Rip off?
Acronis revises survey results about backup habits
Acronis miscalculates data on users' bad backup habits
Flickr co-founder presses beta button
Comcast, Sony open retail store
Cox to try coaxing the Internet into submission
Was InfoWorld's CTO of the Year award a year late?
VMWare VI4 renamed to vSphere
Add a Comment (Log in or register) Showing 1 of 2 pages (53 Comments)
by krosavcheg June 17, 2008 11:27 AM PDT
Looks like looking first, then leaping here is the lesson. Don't assume someone is guilty until you actually start doing your homework first. Wireless access of any sort should always have the caveat of who else might me attached or using it. I hope he gets millions.
Reply to this comment
by Lerianis June 17, 2008 2:39 PM PDT
This is going to be more and more of a problem as time goes on. Simply time to legalize and regulate child pornography, just like we do with adult pornography, and add some more protections even to ADULT pornography, like mandatory mental health checkups a few times a year.
by Dalkorian June 18, 2008 10:32 AM PDT
Your "answer" couldn't be more wrong Lerianis. I'd rather they made it illegal to use winblows, which makes attacks like this easy. Legalizing child porn protects no one, children will still get exploited for profit and pleasure and the next trojan problem will be with terror sites instead. Nothing solved, more problems caused. The ultimate bad solution.
by Thomas, David June 17, 2008 11:53 AM PDT
Sounds to me like the IT staff should be fired
Reply to this comment
by n4zhg June 22, 2008 8:18 AM PDT
But they won't. Union rules. Now maybe this guy can sue them for official oppression under color, defamation of character and other things. Let's see if the state has the stones to shield them.
by The_Decider June 17, 2008 12:25 PM PDT
Need anymore reasons to not use Windows? Before you idiots start braying about AV software, OSX and Linux don't need those cycle stealing, memory hogging programs to run safely.
Reply to this comment
by allen b--2008 June 17, 2008 12:41 PM PDT
Umm, yeah they do. You will not find an Apple press release that says, "you don't need AV." The only difference is that there aren't as many malicious applications that target these OS's. But once they overtake MS as the top OS, then there will be. Just watch.
by The_Decider June 17, 2008 2:05 PM PDT
Wrong, there are no in the wild exploits that can propagate itself. Your argument is sheer idiocy, security through obscurity has been debunked so many times. Market share and security have nothing to do with each other. Care to explain why Windows Server is a minor player with the vast majority of the exploits? Because windows products are easier to exploit.
by kkohnen June 17, 2008 12:27 PM PDT
Nah. Post naked pictures of the IT staff on the internet.
Reply to this comment
by n4zhg June 22, 2008 8:19 AM PDT
A sure substitute for ipecac...
by thedreaming June 17, 2008 12:38 PM PDT
You're supposed to be innocent before proven guilty, not the other way around. I hope he wins his case and sues them out of business!
Reply to this comment
by n4zhg June 22, 2008 8:20 AM PDT
Unfortunately it isn't possible to sue Massachusetts out of business, but we can hope.
by Seaspray0 June 17, 2008 12:50 PM PDT
"OSX and Linux don't need those cycle stealing, memory hogging programs.." Only according to you, Decider. You CAN'T prove OSX and Linux are 100% free from security holes, therefore they DO need protection. On the other hand, I can prove that the are not 100% free... if they were, then there would have never been written security updates for either. Therefore, they DO need protection. I can't beleive anyone would be stupid enough to believe their OS is 100% safe. Let me guess, you work for an IT department in the state of Massachusetts?
Reply to this comment
by The_Decider June 17, 2008 2:07 PM PDT
Sheesh, idiocy abounds here. There is a difference between a security hole and an exploit. No one but you MS shills claim that people say OSX is 100% secure. This would have never, ever happened on a Linux or OSX laptop, that is fact.
by The_Decider June 17, 2008 2:14 PM PDT
Put a default configured windows machine next to a default OSX and Linux box. Connect them to the internet. Come back in 24 hours. Guess which box will be loaded with trojans, rookits and backdoors. Guess with two won't. People do this several time a year and every time Windows get owned.

I never said they don't need protection, I said they don't need AV software. Nice attempt at a strawman. I wouldn't expect this level of idiocy from you, your comments are exactly what vegetablehead, future guy, jean and suyts would blather about.

Again no one said that linux and OSX are 100% secure, you are this stupid to believe I did.
by alegr June 17, 2008 2:22 PM PDT
All THREE won't. The problem with Windows is between the chair and the keyboard. Unattended system will be OK. Why don't you do such an experiment? I can't believe you can't find a copy of XP SP3 or Vista SP1.
by The_Decider June 17, 2008 2:33 PM PDT
@alegr: Wrong again. There are many studies showing just that. An unattended default Windwos install will get owned fast. Go do a search on this subject. Seriously, are you being paid my MS or are you really this stupid. Windows is SIMPLE to exploit, WITHOUT any user intervention. Enjoy your delusions.
by jkoskovics June 17, 2008 1:09 PM PDT
You know, it's real easy for an arrogant individual to take advantage of a person and make them a victim...again, rather than pay attention to the real story.
The issue is responsibility of the employer who failed in their required dilligence and as a result, create a victim out of someone they should have protected, educated, and respected.

A lesson to users not to be so trusting, especially of the "experts" who set them up...litterally! But as for the rest of his life, he may never regain the trust and respect of those who gave value to his life...his friends. That's a little more important than a petty, childish attitude about an operating system. It's not about a platform, and it's not about data...it's about something more important.
Reply to this comment
by n4zhg June 22, 2008 8:22 AM PDT
And that's why this guy shouldn't settle for anything less than $25 million. Maybe when the taxpayers learn they have to cough up, there will be torched and pitchforks around the governor's mansion demanding accountability.
by protagonistic June 17, 2008 1:11 PM PDT
I have to say you are both right and wrong, but then the post you replied to is also wrong. As someone who no longer runs Windows, but rather uses OS X and PC-BSD and occasionally Linux I can speak from experience.

Anyway, no OS presently out there will keep a determined idiot at the keyboard from malware. Some OSs do better than others at this but they all have security holes. That being said, it is a whole lot easier to secure OS X, BSD and Linux than it is to secure Windows. Your odds of getting infected with malware with a default setup are much higher with Windows.

I do monitor my systems for any unusual activity because the only secure system is one that is locked in a vault and has no power applied. Even with those precautions someone will eventually figure out a way to access it. :-)
Reply to this comment
by alegr June 17, 2008 1:31 PM PDT
It's very easy to secure Windows. Change the user type to "Limited User" (and get rid of those programs that arrogantly require administrative privileges). That's what's by default in OS X.
by The_Decider June 17, 2008 2:08 PM PDT
@alger, that is not enough to secure windows. Getting elevation of privigedges is not hard on windows. Don't even try to compare the limited user account in windows with the multi-user setup in *nix. They are not even close to the same thing and all it does is show your ignorance.
by The_Decider June 17, 2008 2:09 PM PDT
Some applications need root access to function, that is not arrogance, that is fact.
by alegr June 17, 2008 2:25 PM PDT
Decider,
Only those functions need admin privileges that perform privileged actions. Normal user software doesn't need that. I know Windows in and out. Can you cite an example of something that unnecessarily need elevated privileges?


And, by the way, limited used account is no worse that non-root account in Unix. Is you think otherwise, feel free to tell.
by The_Decider June 17, 2008 2:30 PM PDT
The account system in Windows is a half-assed after though. The system used in *nix isn't. There are no comparisons between the two, and claims others shows you have little technical knowledge. I have written many desktop apps that need admin privileges. Lets see you write security software, for example, without it.
by alegr June 17, 2008 2:38 PM PDT
The account system in NT-based Windows is no worse than in U*X. In Win9x, it's an afterthought, but in NT it's NOT. I see you have little knowledge in Windows, beoynd Win9x. You sure don't know its kernel and usermode API. While I do know both Win32 and POSIX.
by miltor June 17, 2008 4:47 PM PDT
Wow. Decider is pretty arrogant. And wrong. Funny how those go hand-in-hand.

The fact is, the DEFAULT config in Windows is to download and install updates automatically AND to turn on the firewall. So, if I leave this brand new Vista box I'm building all alone for a few minutes, it'll get all of the updates, install them, and reboot.

Oh, the Server 2008 machine I'm running at home is my DMZ box, running with with no AV...guess what? All that internet traffic is pouring in, and it's virus and malware-free. Did I mention it's running in the default config? Firewall...Auto-updates...You know, things that a good sys admin utilizes. The defaults.

Now, please stop spewing garbage until you know what you're talking about.
by grinningevild June 17, 2008 1:17 PM PDT
And I thought Massachusetts was moving towards adopting open source applications on everything.
Reply to this comment
by n4zhg June 22, 2008 8:21 AM PDT
It was until Bill Gates had the CIO fired.
by Penguinisto June 17, 2008 1:22 PM PDT
While no OS is 100% safe from malware, I can say with certainty that if the guy used a Mac or Linux machine, he wouldn't have experienced this mess. OTOH, I'm fairly sure that the guy will likely never have to work another day of his entire life once his lawyers get done with the employer(s).
Reply to this comment
by alegr June 17, 2008 1:32 PM PDT
Good luck suing gvernment employer. They might be immune...
by Lerianis June 17, 2008 2:48 PM PDT
Not from this lawsuit, they are not immune. They should have scanned the computer for malware BEFORE saying to that person "You are under arrest for having child pornography!"
by sanenazok June 17, 2008 3:29 PM PDT
Maybe the lawyers won't have to work, but he almost certainly will. If he was a minority then it would be different thing all together...
by Penguinisto June 17, 2008 1:38 PM PDT
While no OS is 100% safe from malware, I can say with certainty that if the guy used a Mac or Linux machine, he wouldn't have experienced this mess. OTOH, I'm fairly sure that the guy will likely never have to work another day of his entire life once his lawyers get done with the employer(s).
Reply to this comment
by unknown unknown June 17, 2008 1:48 PM PDT
That's the problem with sex crimes, especially ones that involve children, everyone assumes someone is guilty the moment they're accused. It doesn't help we have people like Nancy Grace whipping people into child predator hysteria, and proclaiming them guilty on national TV. It is a very serious problem when it ruins innocent lives.
Reply to this comment
by sanenazok June 17, 2008 3:31 PM PDT
Re: Lerianis

You're headed to a tropical climate where you'll have a chance to say hi to Hitler!

by The_Decider June 17, 2008 2:36 PM PDT
What the hell is wrong with these idiots:

'OSX is 100% secure so it is as vulnerable as windows and therefore needs AV'

"No one has ever put a default Windows install on the INTERNET that got exploited"

"The only time Windows gets exploited is when the user does something stupid,."

It would be funny if it wasn't for the fact that this fan boys truly believe it.
Reply to this comment
by Lerianis June 17, 2008 2:50 PM PDT
Actually, Decider, that is true. 99% of the time when someone's computer is infected with malware, they have done something stupid: running without a firewall, running without antivirus, not anti-spyware scanning once a month or more, etc.
by itguy2003 June 17, 2008 3:48 PM PDT
I think you are the fanboy... http://www.youtube.com/watch?v=Pe6clRUYTE0
I guess you were right about mac's not being able to be exploited. Sure if you put a PC on the internet with no updates it will be exploited, thats what updates are for and Apple has em too, same with *nix .
by sanenazok June 17, 2008 3:32 PM PDT
I agree that this would not have been a problem if the government decided to use Macs. It would be simple: they would only be able to afford one or two computers, at the most and this would have never happened.
Reply to this comment
by itguy2003 June 17, 2008 3:50 PM PDT
No they would have had six :) , but it wouldnt have happened because they wouldnt have been able to use any usefull programs so they would have stayed in off mode.
by itguy2003 June 17, 2008 3:42 PM PDT
They found the pictures in his temporary Internet files ? So what were browser windows of child porn flying around on his screen and he did not notice or think to tell anyone. He probably was looking at the child porn. Alot of porn websites have viruses and malware on them. So just because he had some malware on his PC he is innocent??? He got off on a technicality. Old perv was looking the **** up himself.
Reply to this comment
by wpcallaghan June 17, 2008 5:18 PM PDT
The browser window probably never displayed the photos. Someone just used the cache as a temporary location for storing the files. The gist of the story was that the employee had to pay someone big bucks to prove that he never downloaded or viewed the material.

It is fairly easy to use other computers for illegal activities if they are not protected with properly configured firewalls. It doesn't even take a lot of computer savvy.
by n4zhg June 22, 2008 8:26 AM PDT
There's a reason why they are called "script kiddies".
by russkeller June 17, 2008 3:47 PM PDT
You got a point. No matter what though justice was lost in this one. Either a bad guy got away or an innocent guy had his life destroyed living with that stigma.
Reply to this comment
by Advacery June 17, 2008 3:54 PM PDT
This is not about Operating Systems. I use several of them. One person bashing another persons Operating System in childish.

This is about someone being terminated by an employer before there was a competent investigation into wrongdoing according to a court. Then there is the issue of the long term consequences of the unjustified termination which has yet to be decided.
Reply to this comment
by wpcallaghan June 17, 2008 5:09 PM PDT
I don't know anything about Massachusetts labor laws, but in a lot of states the employer is perfectly in their right to fire an employee for having porn on their computer, regardless of whether or not they had any knowledge of it. In a case like this, there would be no recourse for the employee and no compensation, as long as the company followed proper procedures.
Reply to this comment
by Advacery June 18, 2008 3:26 PM PDT
wpcallaghan,

It appears he wasn't just fired. You don't end up in court charged with something when you're fired. The company must have turn over their suspicions to a prosecutor.
by n4zhg June 22, 2008 8:28 AM PDT
You people keep calling this a "company" and it is not. It is DIA, a government agency. They were the ones that turned over the data to the police. Of course, the police are about as computer literate as the poor slob they tried to railroad.
by wpcallaghan June 17, 2008 5:09 PM PDT
I don't know anything about Massachusetts labor laws, but in a lot of states the employer is perfectly in their right to fire an employee for having porn on their computer, regardless of whether or not they had any knowledge of it. In a case like this, there would be no recourse for the employee and no compensation, as long as the company followed proper procedures.
Reply to this comment
by Pause2Reflect June 17, 2008 10:07 PM PDT
Here's what will change as a result of this sad story: zip. Also, zilch, squat, and nada.

Prosecutors adore child porn cases. They enrage the public (justifiably) and appeal to the prurient subconscious, bringing more attention than any other type of case to the prosecutor -- along with a nice "child protecting hero" veneer. Add to this, over the past twenty years (and especially since 9/11) Americans have been tripping over each other in a non-race to see who can be more complacent about the disintegration of civil rights. The drivers for prosecution continue to firmly favor "shoot first, act questions later (or never)."

Maybe you're next. But of course, odds are you won't be, so don't worry about it.
Reply to this comment
Showing 1 of 2 pages (53 Comments)
advertisement

Making sense of Windows 7 upgrades

faq The basics and the fine print on Microsoft's options for those eyeing the next operating system from Redmond.
• Full Windows 7 coverage

Road Trip 2009: Big Sky Country

CNET News reporter Daniel Terdiman takes his car full of gadgets to the Rockies and the Great Plains in search of tech, science, nature, and more.
• America's Fortress: Cheyenne Mountain

About News Blog

Recent posts on technology, trends, and more.

Add this feed to your online news reader

advertisement
advertisement

Inside CNET News

Scroll Left Scroll Right