The case involving Julie Amero was decided the day after Thanksgiving. For those that are not familiar, Amero is the substitute teacher in Connecticut that was convicted last year of 4 felony counts of “Risk of Injury to a Child” stemming from a 2004 incident involving porn popups displaying on a classroom computer while students were present.

During the trial witnesses for the State of Connecticut testified that evidence showed that Amero had to have purposely clicked on the linked for the porn sites. The defense’s expert was not given the opportunity to testify but it was his theory that the computer was infected with malware from a hair website that caused the porn popups. Both theories were wrong. According to a report released by Alex Eckelberry, et. al., who examined the computer’s hard drive after the conviction, the computer was infected with newdotnet, spyware that was installed one week prior to the instance bundled with a Halloween screensaver.

This conviction was thrown out but this has proven all for naught though as Amero has accepted a plea agreement for her new trial due to health problems related to stress. The plea agreement resulted in a $100 fine and revocation of her teaching credentials. So she is essentially being punished though she is clearly innocent. This case drives home something that is of the utmost importance in cases involving electronic evidence – both the prosecution and the defense must utilize qualified experts do a thorough examination of the evidence. Had the prosecution thoroughly examined the drive in a forensically sound manner, they would have no doubt found exculpatory evidence related to this case. Had the defense thoroughly examined the drive, they would have been able to defend against the prosecution presenting actual evidence instead of theories. The best way to counter electronic evidence is not with testimony, demonstrations and shaky theories but with electronic evidence.

In addition to having qualified computer forensic experts, it’s also important to have counsel that is not only computer-literate but also understands electronic evidence. Such counsel on either side would be able to recognize misleading testimony.

With Jammie Thomas’ copyright infringement case, I originally felt that qualified experts were not used because of cost but in both cases, it seems that the reason was more likely lack of awareness of computer forensic experts. In the case of Julie Amero, help from computer forensic experts was received after the case was already in full swing when it was too late. The experts became involved because of the media coverage of the case. How many other cases are involving electronic evidence are going on that aren’t receiving media coverage?

Not only is it a lack of awareness on the part of people who need computer forensic experts but also we (computer forensic experts) don’t seem to make our existence known. To that end, here are some places to find computer forensic experts. Looking at the websites, some don’t seem to focus on people who need to find an expert. The HTCIA, however, has recently created a Computer Forensic Examiner locator.

• International Society of Forensic Computer Examiners
• International High Technology Crime Investigation Association (members are not allowed to work on criminal defense cases unless approved and on a pro-bono basis)
• SANS Institute – Certified Computer Forensics Analysts
• International Association of Computer Investigative Specialists (members are law enforcement)
• High-Tech Crime Cops (mostly law enforcement)

It is important to note that members of some of these organizations don’t do criminal defense work but that does not mean that they wouldn’t given the right case. Nevertheless these organizations are a good starting point for looking for qualified computer forensic services.

While I use computer forensics to identify unethical and illegal behavior, I don’t think anyone should be punished due to misinterpretation of evidence or because a thorough examination of that evidence was not done.

You might also be interested in:

• Koobface Comes to Twitter: Are You Protecting Yourself?
• CheckFree: A Case of Phishing, Pharming and Drive-Bys
• Capitol Records, et. al. v. Jammie Thomas