October 27, 2006 4:00 AM PDT

Police blotter: Web cookies become defendant's alibi

"Police blotter" is a weekly CNET News.com report on the intersection of technology and the law.

What: A Texas man says the timestamp of cookies on his Web browser proves he was actually online and not where prosecutors claim he was.

When: The Texas Court of Appeals rules on Oct. 12.

Outcome: The appeals court upheld the conviction of Everett Eugene Russell.

What happened, according to court documents:

After a stormy divorce between Erin McRae and Everett Eugene Russell, a judge granted McRae a protective order requiring her ex-husband to stay away from her residence.

McRae moved to her stepfather's home in Shady Shores, Texas. Around 10 a.m. on Feb. 26, 2005, she noticed a white truck parked on the road. She and her friend Heather both claim they then spotted Russell walking down the fence line along the stepfather's house.

The two women called 911. Sgt. David Allen with the Corinth Police Department testified that he showed up at 10:47 a.m. and found nobody matching the ex-husband's description.

Russell's alibi after he was charged consisted of three portions. First, his mother said that he was at home at 9:45 a.m. that day--which, if true, wouldn't have given him enough time to drive some 45 minutes to Shady Shores. Second, his brother said that he spoke to Russell on the house phone between 10 a.m. and 11 a.m.

The third component of the alibi is what makes this case relevant to Police blotter. Russell claimed he was surfing the Web that morning, checking on an IRS income tax return and shopping online at Home Depot's and Lowe's Web sites.

He made a disk showing the Web sites that he had visited on Feb. 26, 2005, and the cookies on the disk indicated that he was on the IRS Web site at 10:29 a.m. CST. The disk also indicated that Russell was online from 10:29 a.m. to 11 a.m. and again at 1:04 p.m. (Cookies are, of course, small chunks of data saved in text files that let a Web site recognize you upon future visits.)

But prosecutors argued that the cookie file could have been altered, and a jury agreed. There's no explanation in the opinion as to why Russell's attorney didn't subpoena logs from those Web sites or his Internet service provider that--if available--could have provided a much stronger alibi. It's also unclear if Russell was relying on information in individual cookies, which would be set by each Web site, or the file system's timestamp on the entire file.

On appeal, Russell's attorney argued there was insufficient evidence to establish that his client violated a protective order. The Texas appeals court disagreed, and upheld Russell's original sentence of 365 days of confinement and a $2,000 fine.

Excerpts from the opinion by Justice Sue Walker of the Texas Court of Appeals:

Russell's mother, Charlene, testified in his defense. She explained that she left her house at 9:45 a.m. on the date in question to attend a funeral. She said that when she left, Russell was awake. Charlene testified that Russell planned to get on the Internet to obtain some prices for products from Lowe's and Home Depot for remodeling her bathroom. She testified that Russell was at home when she returned from the funeral at 4 p.m. and that his car was in the same spot as when she had left. Charlene testified that she thought Russell was at home the previous night, but she did not get off work until 11:30 p.m. or 11:45 p.m.

Russell's older brother, Travis Todd Russell, also testified on Russell's behalf. He explained that he had called his mother's house between 10 a.m. and 11 a.m. on Feb. 26, 2005, and had asked Russell to check on the status of his income tax refund. Russell took the stand and testified that he was at his mother's house at 10 a.m. on Saturday, Feb. 26, 2005. Russell said that his brother Travis called at 10:15 a.m. and that they talked for about 24 minutes.

Russell said he checked on his brother's income tax refund on the IRS Web site that morning and also checked prices on Home Depot's and Lowe's sites. Russell had made a disk showing the Web sites that he had visited on Feb. 26, 2005, and the "cookies" on the disk showed that he was on the IRS site at 10:29 a.m. CST. The disk also shows that Russell was online from 10:29 to 11 a.m., and again at 1:04 p.m. Russell testified that he did not leave his mother's house at all that morning and that he was there when his mother returned from the funeral.

With regard to the house in Shady Shores, Russell testified that he had been there once a few years ago. Russell said that the house was 27.4 miles from his mother's house and that it would have taken him 45 minutes to drive there. Russell denied knowing where McRae lived; he said that he knew only that the house on Pueblo Drive had been foreclosed on, so he knew she was not living at that location. Russell also denied owning or driving a white Suburban.

James Willingham, a felony investigator for the district attorney's office working in computer forensics, testified as a rebuttal witness. He explained that a "cookie," like the ones that Russell had copied to the disk, gets its date and time from the computer and that the computer's date and time are set by the user. Thus, he concluded that the dates and times on the disk purporting to show when Russell allegedly visited the Web sites are "valueless, absent any other context, to say when they were actually done."

See more CNET content tagged:
Police Blotter, Texas, Home Depot Inc., income tax, prosecutor

9 comments

Join the conversation!
Add your comment
What was the convincing evidence?
It looks like they only had the testimony of two witnesses that he was at the ex-wife's step-father's house, which is countered by the testimony of two other witnesses that he was at home. No other supporting evidence in either way that is reported here. Was there something else not reported that proved beyond a reasonable doubt that he was at the ex-wife's step-father's house? Is beyond a reasonable doubt not required for this type of conviction? Anything with jail time attached should require some type of beyond reasonable doubt attached to it. What it is was bitter seperation, and this was her way of getting back at him? What if it was someone else that looked similar driving some vehicle the ex-husband had never used? Hopefully there was more to this than what was reported.
Posted by JDinKC (303 comments )
Reply Link Flag
No evidence required
In some states, accusation is enough to get you arrested, and held.
Period. And yes that completely sucks.

However this story didn't provide enough information to form an
opinion about the case. Just enough information to indicate that if
he was innocent, it's obvious that his legal counsel was inept,
because they lack a basic understanding of a cookies, computers,
and file systems.
Posted by Thomas, David (1947 comments )
Link Flag
There was none.
They could not associate the vehicle the ex-wife say with the guy, and the officer could not find anyone fitting the ex-husband's description in the area. The phone records from the mother's house should have been requested to show the the brother did indeed call. In end it sounds like they said this and they said that.
Posted by VI Joker (231 comments )
Link Flag
... ahh, the wheels of justice
"Guilty until proven innocent."
Posted by wiley14 (39 comments )
Reply Link Flag
I'm missing something here...
Obviously the cookie can be faked, and it would be very easy to 'automate' web browsing to make it look like you were home.

But that aside, I'm not seeing where there is any actual evidence that this guy did anything. I sincerely hope there's a lot more to the story than is presented.
Posted by (402 comments )
Reply Link Flag
This story is about me and you wont believe the details
This is really a very alarming case! I was home on a Saturday morning looking at a couple home improvement store's websites. While doing this I recieved a phone call from brother whom was in Orlando, FL. for work. We spoke for 24 minutes during which he asked me to log onto irs.org to check the status of his tax refund check, which I did. I had sworn statements of my whereabouts as well. So I had phone records and my computer records.

Well, the phone records were not allowed to be admited to court because my lawyer had highlighted the call w/ a yellow pen and she didnt have a complete phone bill. Prosecution said those were "tampered with" and not allowed. I gave this info to her 3 weeks prior to court date. She admitted to me that she knew nothing about computers and even less about "cookies". I repeatedly stressed to her we need to have the machine looked at and it will show that there never was any changes made to alter the harddrive. I made a copy of the cookies window and put it on a floppy disc...I didnt know whatelse to do. That, of course, was valueless w/ their forensic detective's statement. All the while the computer sat on the bench behind the defendants table. So ALL of my evidence was either not allowed or just ignored because my counsel wasnt comfortable with computers.

This is supposed to be something you read about in the newspaper....I was given 365 days and $4000 fine for something I did not do! Because I didnt have thousands of $$ to hire a "real" lawyer (I was getting over major surgery} my ineffective, incompetent and disinterested counsel I will be a statistic....and that is a real shame!

I have demanded that this lawyer pay the $4086.00 fine they gave me, $2000.00 of which was her fee, if you can believe that! I have also demanded she pay the $4800 I have spent trying to appeal this mess. The Texas Bar Association is involved and I will not....we as American's cannot, just let something like this go unnoticed. All because of a very cold, bitter ex-wife decides to put on a show for the police and make a false allegation.
Posted by everettru (1 comment )
Reply Link Flag
No facts
Cookies can be manipulated. I can think of several ways right now. Also how do we know you were the one at the computer.

Fianlly, and the story pointed this out, why not subpoena you ISP or the web pages you visited for their logs during this time? Failure to do so sounds extremely fishy to me.
Posted by SAA999 (11 comments )
Reply Link Flag
Easy things to do:
Set the phone to forward calls
Set a schedule to load a website OR change the computer's time/date
Control a computer remotely with appropriate software

So with the given information, the guy only made a joke.
Posted by hawkeyeaz1 (569 comments )
Reply Link Flag
Or maybe he's innocent
There is NOT enough evidence here to make a guilty or innocent determination. You may say that he faked this alibi, however, who is to say the women did not fake their accusation. Lying about something you saw is much easier than faking alibis that tie together multiple people, telecoms, ISPs, government websites all so you can sneak behind some bushes and watch your ex.

Let me guess, he setup an automated browser to login to his father's tax return and check the status but was too incompetent to push a stronger alibi in court? Come on!
Posted by zboot (168 comments )
Link Flag
 

Join the conversation

Add your comment

The posting of advertisements, profanity, or personal attacks is prohibited. Click here to review our Terms of Use.

What's Hot

Discussions

Shared

RSS Feeds

Add headlines from CNET News to your homepage or feedreader.