Evidence In Child Porn Case Thrown Out Because FBI Won’t Disclose Hacking Methods

A particularly squeamish battle in the ongoing struggle between privacy and security comes from Washington State, where U.S. District Judge Robert J. Bryan has thrown out evidence in a child pornography case because the FBI will not divulge the hacking techniques it employed to obtain the evidence.

The defendant, Jay Michaud, visited a kiddie-porn site on the “Dark Web,” the shadowy wasteland of unregistered websites that can only be visited if precise Internet address information is known. The FBI had effectively taken control of this website — known as “Playpen” — and kept it running for two weeks as a trap, infecting computers that visited the site with malware so their users could be identified.

If the name of the website didn’t already make you queasy, the FBI sting was reportedly code-named “Operation Pacifier.” We know this because someone at the Bureau evidently screwed up and left operational material online, where it could be discovered by tech journalists.

Playpen was a major child pornography operation, with some 400,000 clients around the world. In fact, one criticism of the operation was that the Bureau exceeded its authority by spying on foreign visitors to the site.

Attorneys for Michaud and others caught up in the sting also argued that the FBI went too far by effectively running a child pornography site for two weeks.

There were also complaints that innocent people could be caught up in the sting — not by accidentally blundering across Playpen, since Dark Web sites don’t appear in search engines or have domain names that could be accidentally typed by innocent Internet tourists, but rather because pedophiles have a habit of hacking into innocent peoples’ computers and using them to store pornography.

The unsuspecting host of such hidden files doesn’t know his system has been turned into a storage locker for kiddie porn until someone accidentally stumbles across the material… or the police trace Internet activity from a pedophile site back to the innocent user’s computer.

As you might imagine, proving your innocence after a huge stash of child pornography has been discovered on your computer is extremely difficult, but there are documented cases of innocent people being victimized by pedophiles looking to hide their materials. In 2009, CBS News ran a horrifying story about a man who spent 11 months and a fortune in legal fees proving his innocence after pedophiles infected his laptop computer with viruses that were scanning up to forty child pornography sites per minute. He got in trouble after his supervisors at work noticed the extremely high Internet bandwidth gobbled up by his computer.

That’s evidently the sort of case Michaud’s attorneys were trying to build, so they insisted their client should be given details of how the FBI’s Network Investigation Technique worked.

As Cnet reports, Judge Bryan and the U.S. Attorney’s office argued the merits of this request, with the U.S. Attorney saying the results of the FBI trace should be evaluated without compromising investigative techniques that will probably be needed for future cases. Also, since child pornography was found on Michaud’s cell phone and two thumb drives, the notion that he was unsuspectingly victimized by hackers is more difficult to sustain.

Nevertheless, the judge ruled that all evidence collected as a result of the FBI’s NIT must be excluded, because the FBI won’t provide the desired technical details of how its malware trap worked. The judge did not dismiss the charges entirely, although Motherboard speculates that “short of a government appeal, the Michaud case may well be over.”

“It’s hard to see how the government can secure a conviction without this key evidence,” said University of California law professor Ahmed Ghappour, as quoted by Ars Technica.

“The interesting thing about the government’s setback in this case is that the suppression does not turn on a technicality, and will not be fixed by a subsequent rule change. It looks like the judge decided to suppress the fruits of a hacking operation on due process grounds, reasoning the defendant’s right to a fair trial would be compromised if the evidence was used without disclosure of the source code,” Ghappour added.

Colin Fieman, Michaud’s defense lawyer, emailed Ars Technica to hail the judge’s decision, “because the judge had to balance the government’s national security claims against a defendant’s right to a fair trial, and in the end found that the Constitution must prevail.”

C/Net mentions that legislation to help such investigations stand up in court is being considered by Congress. A number of cases emerging from Operation Pacifier have fared poorly in court, often because the judges decided the FBI had exceeded the authority granted to it by search warrants.

Incidentally, at the time of his arrest, Jay Michaud was a middle-school teacher, who had been working for the Vancouver School District in Washington State for 20 years. Seattle PI described the material found on his system as “infant rape photos.” The FBI charged that he spent almost 100 hours surfing the child pornography network it was monitoring, over the course of four months.