Gallery

Operation Ore exposed

Posted on 1 Jul 2005 at 11:08

Good evidence was found in many cases. Even if after three years there was no record of original transactions with Landslide on the seized computers, there might be subdirectories filled with clearly prepubescent images, and Internet search histories on Google or elsewhere into which the user had typed incriminating terms.

Computer forensics

Evidence from good computer forensics is frighteningly compelling. Encase, the most widely used software search tool, can plunder a hard disk for incredible amounts of buried and lost detail left behind by Windows. Original directories in a reformatted drive can be recreated, long lost Internet histories brought to life, and cache images once glimpsed years earlier served up. On any computer connected to the Net, especially without competent protection, illegal child images can just turn up. In two cases where I worked as a computer forensic expert, the police found a handful of child images. This was prima facie evidence. Both men were committed to Crown Court for trial.

But Encase can work for both sides. Pull down the timeline of the thousands of indexed fragments it finds and you may discover the HTML code that carried the offending pictures. Look back a few seconds and you could find previous HTML and within it the window open commands that can mark unwanted pop-ups. When this was pointed out, the Crown Prosecution Service withdrew its case.

But by this time, the innocent and acquitted were immensely harmed in their private and personal lives, perhaps having lost employment, income, friends and reputation. Many Ore defendants have not been fortunate enough to be well advised, legally or technically. Under pressure to get results and to get on, many police forces asked defendants to plead to minor charges or accept a caution. With no prison sentence, not even a fine, it may sound like an easy way out. But with every caution or conviction comes mandatory membership of the Sex Offenders' Register, and with that the certainty of stigma and the enduring fear of public exposure.

Operation flawed

The clues to the flaws in the evidence were there for those with the eyes to see. Look again at the image on p152, exhibit 'SAN/1'. It is a slightly blurred photograph (not a screen grab) of a Windows 98 machine running Internet Explorer. Look at the right-hand side. There is a slider bar, showing that what is being seen is less than one-third of the full page. The top and most of the contents are missing. The image has been cropped, concealing most of the page.

Look again, this time at the web address space below the toolbar. The front page address for Landslide was www.landslide.com. This is not it. Whatever is there in the blur, it is too long to be the Landslide front page address. When I saw this image a year ago, I knew something was very wrong with the evidence.

Unknown to the Texas detectives, there is another place where you can get at the Internet's historical truths. The Internet Archive, also known as the Wayback Machine (www.archive.org), is a not-for-profit foundation based in San Francisco. The Archive's computers have been crawling the Web since 1996, building a huge, searchable historical archive. The Archive, I found, had recorded what the Landslide website really looked like in 1999.

From the Archive, I retrieved a series of front pages from Landslide's beginnings in 1996 through to April 1999, just before the police investigation began. There were no 'child porn' buttons nor any place where one could be. I also found the real page that had, one occasion only, displayed the notorious banner. Located at www.avs.landslide.com/avs/index.html, it was an internal page for Landslide's adult AVS service. At the very bottom of the page were two advertising spaces, controlled by a third-party banner swap service. Whatever banners appeared there were not - could not - have been part of Landslide or Keyz.