said by The Register :

---

Roger Thompson, chief of research at security firm AVG, ran across the threat months ago but held back on publishing details until Thursday. Heightened concerns about how malware infection could result in presence of image of child abuse on the PCs of non-paedophiles prompted Thompson into publishing a video of the threat (below).

The hacked website linked to the attack was a children's site and the content strictly adult porn. However, the tactic could result in child abuse images getting dropped onto the machines of surfers whose only mistake was to stray onto hacked websites, as Thompson explains.

Fortunately, LinkScanner detects the rogue-spyware aspects of this and blocks it just fine, but without LinkScanner, these images would now be in the browser cache, and it would sure look like the owner was guilty. Worse still, the images could just as easily be kiddy porn, and just being your cache would be regarded as possession, and therefore highly illegal by most law enforcement agencies.

---

quote:

---

Loehrs, who spent a month dissecting the computer for the defense, explained in a 30-page report that the laptop was running corrupted virus-protection software, and Fiola was hit by spammers and crackers bombarding its memory with images of incest and pre-teen porn not visible to the naked eye. DIA turned the matter over to state police who, after confirming "an overwhelming amount of images of prepubescent children engaged in pornographic poses" were stored on the laptop, persuaded Boston Municipal Court to issue a criminal complaint against Fiola in August 2007.

---

quote:

---

Mr. Glennon testified that there is no evidence that anyone else other than the Administrator had ever accessed the Laptop. However, a review of the computer revealed several other accounts that had been created on the Laptop prior to Michael Fiola including diauser, user, test and test2. Unfortunately, all previous accounts had been deleted, thereby eliminating potentially relevant evidence.

---

quote:

---

Glennon went on to testify that it is highly unlikely for Internet files to be on the computer without activity by the user and that there is no way for files to be in the Internet folder without browsing the Internet. A review of the Symantec logs by Mr. Glennon would have revealed the viruses and Trojans that were attacking the Laptop for four and a half months.

---

quote:

---

.. the DIA spent approximately 3 hours investigating the computer ... With only 3 hours spent on the Laptop by the DIA, they could not possibly have conducted a thorough investigation ... I have spent over 100 hours conducting a thorough forensic examination of the Laptop in order to reach the preliminary results and conclusions contained in this report and my investigation continues. It appears that the only investigation by the DIA was to copy the temporary internet files and confirm that child pornography existed on the computer when it was in Michael Fiola’s possession.

---

quote:

---

Meeting Minutes (4-11-07)

DIA SECURITY BREACH – UNAUTHORIZED USE OF CLAIMANT DATA

Mr. John Glennon, Chief Information Officer, updated the Advisory Council Members regarding the recent unauthorized use of claimant data by a DIA contractor. Mr. Glennon stated that the incident, which took place on December 19, 2006, involved internet transactions on a DIA computer. He stated that law enforcement officials have charged the contractor with crimes related to credit card fraud. Mr. Glennon explained that the DIA immediately notified all of the claimants affected by this incident. He stated that to the best of the DIA's knowledge, only three people had their identities compromised.

Mr. Glennon informed the Council that the DIA is in the process of taking actions to resolve this situation and to ensure that this will not happen again. Mr. Glennon reported that the DIA has begun redacting certain information on viewable internal forms and that they are in the process of hiring a security consultant. Mr. Glennon informed the Council that the RFP team is currently in the selection process

---

quote:

---

In 2007, Fiola’s bosses became suspicious after the Internet bill for his state-issued laptop showed that he used 4½ times more data than his colleagues. A technician found child porn in the PC folder that stores images viewed online.

Fiola was fired and charged with possession of child pornography, which carries up to five years in prison. He endured death threats, his car tires were slashed and he was shunned by friends.

Fiola and his wife fought the case, spending $250,000 on legal fees. They liquidated their savings, took a second mortgage and sold their car.

An inspection for his defense revealed the laptop was severely infected. It was programmed to visit as many as 40 child porn sites per minute — an inhuman feat. While Fiola and his wife were out to dinner one night, someone logged on to the computer and porn flowed in for an hour and a half.

Prosecutors performed another test and confirmed the defense findings. The charge was dropped — 11 months after it was filed.

The Fiolas say they have health problems from the stress of the case. They say they’ve talked to dozens of lawyers but can’t get one to sue the state, because of a cap on the amount they can recover.

"It ruined my life, my wife’s life and my family’s life," he says.

---

quote:

---

Many prosecutors say blaming a computer virus for child porn is a new version of an old ploy.

"We call it the SODDI defense: Some Other Dude Did It," says James Anderson, a federal prosecutor in Wyoming.

However, forensic examiners say it would be hard for a pedophile to get away with his crime by using a bogus virus defense

"I personally would feel more comfortable investing my retirement in the lottery before trying to defend myself with that," says forensics specialist Jeff Fischbach.

Even careful child porn collectors tend to leave incriminating e-mails, DVDs or other clues. Virus defenses are no match for such evidence, says Damon King, trial attorney for the U.S. Justice Department’s Child Exploitation and Obscenity Section.

But while the virus defense does not appear to be letting real pedophiles out of trouble, there have been cases in which forensic examiners insist that legitimate claims did not get completely aired.

Loehrs points to Ned Solon of Casper, Wyo., who is serving six years for child porn found in a folder used by a file-sharing program on his computer.

Solon admits he used the program to download video games and adult porn — but not child porn. So what could explain that material?

Loehrs testified that Solon’s antivirus software wasn’t working properly and appeared to have shut off for long stretches, a sign of an infection. She found no evidence the five child porn videos on Solon’s computer had been viewed or downloaded fully. The porn was in a folder the file-sharing program labeled as "incomplete" because the downloads were canceled or generated an error.

This defense was curtailed, however, when Loehrs ended her investigation in a dispute with the judge over her fees. Computer exams can cost tens of thousands of dollars. Defendants can ask the courts to pay, but sometimes judges balk at the price. Although Loehrs stopped working for Solon, she argues he is innocent.

---