COMPUTER FORENSICS

A 40-year-old substitute teacher was almost jailed for 40 years in prison for allegedly
exposing her seventh-grade class to pornography. From the prosecution account, it was claimed
that on the morning of Oct. 19, 2004, Julie Amero showed her students pornographic
advertisements during class (Eckelberry etal, 2007). Amero’s is reported to have displayed
images of men and women in various stages of undress, couples in sexual acts, and “bodily
fluids.” The teacher was charged with four felony counts of posing injury to or impairing morals
of children under her charge (Eckelberry etal, 2007). Since each count carries a maximum
sentence of 10 years, she would have been liable to a penalty of up to 40 years. What was
alarming about the case was that owing to improper application of forensic techniques, an
innocent woman was almost sent to prison.
Amero’s case drew a lot of attention from IT professionals because of the inefficiencies
in the investigation that nearly resulted in a miscarriage of justice. Most IT security experts
thought malware was likely responsible for the pop ups since she had no previous record. The
investigating officer in Amero’s case admitted under cross-examination that he never even
checked the computer for malware (Eckelberry etal, 2007). While the prosecution’s IT expert, a
police officer, had to follow a simplified investigative algorithm, those responsible for evaluating
his reports were not tech-savvy enough to be able to place his findings in the proper context. A
further analysis of the cache on the machine and independent firewall logs revealed that the page
had never been visited on Amero’s machine, deliberately or otherwise (Eckelberry etal, 2007).
Moreover, the software system the police used to audit the alleged perpetrator’s computer was
ill-suited for the particular line of investigation. ComputerCOP Pro, while automated and a user-

COMPUTER FORENSICS 3
friendly tool search tool was designed for routine monitoring and was thus not able to
definitively distinguish between user-generated clicks and the effects of malware.
Software developers who make malicious code are getting more sophisticated by the day
while the law enforcement officers meant to police them are not making efforts to keep up
(Beckett & Slay, 2011). What is alarming about Amero’s near conviction is the prosecution’s
inability to distinguish between an intended mouse click and an unintended redirect on an
infected computer caused by DNS hijacking. Too often, even the so-called experts cannot tell the
difference between deliberate criminal activity and the unexpected after-effects of malware
infestation in a computer (Beckett & Slay, 2011). To ensure no repeats occur, it is essential that
the staff that is charged with the investigating computer-based crimes are proficient with the IT
security best practices. Further, the prosecutors who take on the case should be able to make
sense of the investigation data so as to ensure only guilty parties are prosecuted. Moreover, the
software system used in the inquiry should be improved upon, at the very least to ensure that it
can detect the effects of malware on a system. In this way, cases such as this will not happen in
future.
In conclusion, forensic techniques should be applied judiciously. Amero’s case is a clear
indication that it is not just important to use forensic techniques in investigating cases of
computer crimes, but also to apply the tools and technology correctly. Also, the case raises
concerns about how able the current staple of information security professionals are at handling
hacking incidents. In your opinion, do the current information system auditors have the
necessary skills and training to investigate successfully and deter cases of computer crime?

COMPUTER FORENSICS 4

References

Beckett, J., & Slay, J. (2011). Scientific underpinnings and background to standards and
accreditation in digital forensics. Digital investigation, 8(2), 114-121.
Eckelberry, A., Dardick, G., Folkerts, J., Shipp, A., Sites, E., Stewart, J., & Stuart, R. (2007).
Technical review of the trial testimony State of Connecticut vs. Julie Amero.