By Jim Bates - April 2004 - Computer Investigations - Operation Ore Index here >

This case produced a number of points concerning both legal and evidential matters.  While I do not normally concern myself with the legal technicalities, those mentioned by the Judge (His Honour Judge David Bentley QC) do have relevance to a certain type of prosecution currently being presented in connection with some Operation Ore cases.  So let's have a look at them first . . .

The Legal Points
The original indictment contained charges of Attempting to Incite the Distribution of indecent photographs of children.  The Judge held that in the circumstances of the case, there was only incitement (not attempted incitement).  To illustrate this he presented the following example :-

If a drug user said to a drug dealer, "Sell me a bag of heroin", regardless of the reply he has immediately committed the crime of inciting the dealer to supply a class A drug.  If the dealer says, "Yes", then they are both guilty of conspiracy and when the drug is handed over the dealer is then guilty of supplying the drug.  It does not matter whether the dealer replies or what he says if he does, the incitement offence does not alter.

Now consider if the drug user sends a note to the dealer asking him to supply drugs.  If the dealer does not receive the note, the communication is not complete and the drug user is guilty of attempted incitement because of this.

In the present case, the attempted incitement charges were associated with failed attempts to subscribe to a child pornography distribution service and these failed attempts had been recorded on the Landslide database.  It was therefore self-evident that the subscription request had been received by the intended recipient.  The offence should therefore have been specified as incitement.

The offence being incited in each count was to show or distribute indecent photographs.  The Judge held that 'show' and 'distribute' were two different offences.  In law, charging someone with two offences in a single count was not acceptable (known as duplicity).  Despite some rewrites of the indictment and several warnings from the Judge that in his opinion it was still unacceptable, the prosecution continued with the final version.  In his summing up, Judge Bentley ruled that each of the four counts were 'bad in law'.

Evidential Points
The Case in General
In essence this case was quite a simple one.  In mid 1999, Landslide Inc. in the United States had been identified as large scale distributors of child pornography.  They operated a system whereby interested users could subscribe via their credit card to gain a period of access to one of several hundred web sites dealing with this sort of material.  The user allegedly chose the site and completed an application form on-line giving their credit card information, name, address, a password of their choice and the number of days access required.  This information was stored in a database and the user was given a unique ID to gain the requested access to the indicated site.  This access facility was activated once the credit card had been validated

On 8th September 1999, an American Law Enforcement team entered the Landslide Premises and seized a number of computers.  These were subsequently investigated and amongst the recovered information was a copy of the current database.  This contained records of hundreds of thousands of subscriptions and subscription attempts.  Landslide was closed down and the principles (Thomas and Janice REEDY) were eventually charged and convicted under the Texas Penal Code.

In October 2002, a UK police officer accompanied by two civilian experts, visited the U.S. and collected copies of the relevant computer hard drives.  These were subsequently investigated and records relevant to the U.K. were extracted from the database.  These records formed the original basis for Operation ORE.  Records relating to around 7,000 or so individuals were sorted and passed to the relevant Police Forces for further action.

The Case in Particular
A total of ten records related to Dr. Paul Grout, five of these recorded successful subscriptions to a variety of sites and the remaining records showed unsuccessful attempts which appeared to have failed for a variety of reasons.  On 3rd October 2003, Dr. Grout's home, office and hospital work areas were searched and a number of computers were seized.  These were examined but no trace was found of any connection with child pornography.  Dr. Grout's bank statements were seized and examined and these showed five transactions with Landslide Inc. at around the relevant times.  These transactions involved amounts of either $24.95 or $29.95, on credit cards listed in the Landslide database.  On this evidence, Dr. Grout, was then charged with inciting or attempting to incite Thomas REEDY to show or distribute indecent photographs of children.

The Prosecution
As evidence of the alleged offences, the Prosecution produced the Landslide records and the Bank Statements.  These recorded transactions from December 1998 to July 1999.  It was suggested that since Dr. Grout had not queried the Landslide transactions with his bank this amounted to an acceptance of their validity.  A large number of statements and exhibits dealing with the Landslide websites and how they operated were also produced, but the Judge ruled most of these either irrelevant or inadmissible.  A key point seemed to be that Dr. Grout had from the date of his arrest, continually asked for details on precisely when the transactions had occurred.  As a professional man his life was well ordered and there were many independent records of his whereabouts at various dates and times.  In due course details of the Landslide records were made available to him.  However, although the Landslide records included the time of transactions (according to the Landslide computer clock), only the date was listed in the records presented by the prosecution.  The time element of each record was eventually provided only hours before the trial was due to begin.

Prosecution expert Dr. Sam Type (Celt Ltd.), had explained that the date/time value was either the time that a subscription attempt had failed, or the time that it had succeeded plus the number of days successfully subscribed to.  Once the calculation to determine the date and time of the original subscription application had been completed, the results were anomalous when compared to some of the bank transaction records.  Thus there were some occasions when the debit had been posted by the bank before the Landslide subscription had apparently taken place.  Dr. Type was unable to provide any explanation for this.  While this did not completely negate the information gained from the Landslide database, it did imply that the date/time interpretation was flawed and prevented the defendant from establishing a possible alibi.

The Judgement
In his review of the prosecution case, Judge Bentley held that the evidence of identity derived from the Landslide database was not strong enough to support a prosecution, particularly since the Crown had not been able to rule out the possibility of identity theft.  The suggestion that Dr. Grout knew of and had accepted the Landslide transactions on his bank statements simply because he had not queried them was also weak.  Such information as could be adduced from the bank statements tended to confirm that they had been poorly monitored and the accounts themselves showed haphazard management generally.  There were also indications that other unnoticed frauds had been perpetrated on these accounts.

Therefore he had decided to halt the trial for two reasons -

1. That despite numerous hints and warnings, and some redrafting - the prosecution had chosen to continue with indictments which were bad in law.
2. There was insufficient evidence to sustain a prosecution.

1. The disagreement between calculated activity times (on the Landslide web site) and bank posting times is clearly serious and must be resolved by way of some reasonable explanation.  Either the explanation given by Dr. Type is wrong for the dates in question, or the Landslide clock was wrong at intermittent times during the period involved, or the Bank posting dates were wrong.
   
    
2. The description of the operation and maintenance of the Landslide websites appears to be based upon a reconstruction of live code taken from the Landslide computers.  This reconstruction was completed using a different operating system and in some instances used code translated between systems by hand.  No evidence of any testing to confirm the accuracy of this reconstruction was presented.
   
    
3. It was explained that the Landslide systems were in the process of being upgraded when they were seized but little evidence was presented of how the operations may have altered as a result of such changes.
   
    
4. As noted above, the original Landslide records relevant to this case were presented as containing only the date information.  When the full details were requested, the nature of their presentation indicated a serious lack of knowledge concerning the technical implications involved.  This is exemplified by the presentation on a key exhibit of what appeared to be a long integer field in scientific notation.  So, a value of '918736502' when interpreted as a Universal Time, becomes 12:35:02 on 11th February 1999.  However, the same number expressed in scientific notation might appear (depending upon the column width setting) as '9.19E+08' and this could be any number between '918500000' and '919499999'.  Thus the interpretation could be anywhere between 18:53:20 on 8th February 1999 and 08:39:59 on 20th February 1999.  Clearly not a lot of use in attempting to identify any alibi evidence.
   
    
5. The question of identity theft could only be clarified if appropriate malicious code or conclusive evidence of connection was recovered from the subscribing machine.  I have seen no evidence that a search for such code has ever been conducted on a seized computer.  However if identity theft was a factor, it is possible that a comprehensive statistical analysis of the database records would show patterns of activity consistent with a single individual subscribing using a collection of stolen identity information.  As far as I am aware no such analysis has been undertaken and until it is, in the absence of any evidence to the contrary, prosecutions based solely upon the Landslide records must address the possibility of identity theft.

• Why was it undertaken in the first place?
• How much has it cost so far?  
• What additional evidence has it provided?

Precisely what benefit has been gained from it?o take Judge Bentley's example one stage further - if an observer hears someone saying to a drug dealer, "Sell me a bag of heroin." and he reports this to the Police along with his suspicion that he recognised the voice of the person involved, then the Police must investigate it.  If their investigation of the individual finds no trace of drugs, no history of drug use and an alibi for the time when the conversation is alleged to have taken place, and this is combined with the observer being unable to conclusively identify the voice then a prosecution for incitement would stand little chance of success.  If the observer then suggests that, "it could have been the day before - or the day after." this does not strengthen the prosecution case by side-stepping the alibi.  Rather it weakens it by throwing doubt upon the reliability of the observer's evidence in the first place.  The investigation was certainly necessary but the prosecution appears to have been ill-conceived, ill-prepared and poorly presented.  In short - a complete waste of public money.


© 2004, Jim Bates.