The other day I read this article on PC World about Julie Amero, a substitute teacher convicted for exposing students to pornographic material on the computer of the teacher for whom she was substituting. In summary:
The story is short: On October, 19, 2004, Amero was a substitute teacher for a seventh-grade language class at Kelly Middle School. A few students were crowded around a PC; some were giggling. She investigated and saw the kids looking at a barrage of graphic, hard-core pornographic pop-ups.
(Follow-up stories here, here, and here, with local newspaper coverage here, here, and here.) The prosecution alleged that Amero had used the computer to visit adult web sites, while the defense countered that the computer was already infested with various malware programs that caused the illicit pop-ups. The analysis of the case is drastically different, depending upon which story is true.
The prosecution alleged that Amero intentionally visited various adult web sites, but this report by the defense’s expert computer witness refutes that claim. This expert was prepared to re-enact the events in the classroom with a clean laptop in the courtroom, but the prosecution objected to this defense, and the judge did not allow it. (And from the conclusion of the report, it appears that the judge also did not even allow the expert to present the results of his forensic examination of the computer.
This whole story appears to be a case of 1) the school using the substitute teacher as a scapegoat for its own failure to ensure the security of its students and its computer resources, and 2) the prosecutor, judge, and jury acting from a position of complete computer/internet illiteracy.
The computer in question was running Windows 98 and Internet Explorer 5, with no firewall, was infested with malware, and had outdated anti-virus signatures (according to an op-ed piece written by Alex Eckelberry). Thus, the first entity responsible for the incident is the school administration, for not having and/or following a procedure or policy for computer administration that would include ensuring that computers are protected against malware, and that antivirus signatures are maintained. In fact, the school admitted that their blacklist filter was not kept current during the time in question.
Also, school computers were allowed to be used for personal internet use, with only a blacklist filter in place. As this blog points out, this policy is a recipe for potential disaster, since blacklist filters that are not kept current are easily bypassed, and many malicious or illicit web sites intentionally use a practice called typosquatting (using typographic-error URLs in order to lure visitors who intend to go to one website but are instead directed somewhere else due to an incorrectly spelled URL – think “google” vs. “goggle”).
The prosecution alleged two things: one, that Amero intentionally visited the web sites that served the illicit images, and two, that Amero did not prevent the students from continuing to see the images by immediately turning off the computer.
The forensic evidence (which was not allowed to be presented) clearly proved that the illicit images came to the computer through clicks on what was ostensibly a hair-style web site, and were of a size consistent with pop-up ads, not intentional image downloads. This evidence proves that the computer experienced what is known as a “pop-up storm” – something with which anyone who has used a computer with software older than Internet Explorer 6 running on Windows XP Service Pack 2 (or better) is experienced. Further – and worse – the police software used to examine the computer (ComputerCOP Pro) cannot differentiate between an explicit click and a script-generated window-open. The prosecution proved that the computer made a connection to an illicit web site, but had no means whatsoever, using the police software, to prove how the site was accessed.
Also, while some hold the assertion as fact), it does not appear that the prosecution proved (or even attempted to prove) that Amero herself, and not a student or students, was operating the computer at the time that the sites in question were visited. Given that the computers internet history cache shows that kid-centric websites such as crayola and hair-styling sites were visited, the prosecution’s first argument appears to be unproven at best, and specious at worst.
The prosecution (and others) assert that Amero should have shut down the computer. This assertion makes some assumptions, namely that Amero was expert enough to know what was happening to the computer, and that Amero had the authority to remedy the situation by shutting down the computer. The prosecution proved neither. At the beginning of the day, the permanent class teacher logged onto the computer for Amero, giving explicit instructions not to log off from or shut off the computer. So, to shut down the computer – as the prosecution contended Amero should have done – would have been a direct violation of the teacher’s instruction not to do so.
Also, when the incident occurred, Amero attempted to get rid of the popups by closing each popup window. Anyone with any experience with popup storms knows that this action will only invite further popup windows, usually at a rate beyond what is possible to keep up with. Amero, who is by no means a computer expert, did make a good-faith effort to get rid of the illicit images and to prevent the students from viewing them. She even asked for help from the school administration – help that, over the course of the school day, never came. So, the prosecution’s second argument is an unproven claim based on an untrue assertion of the proper course of action in the incident.
In short, students – not Amero – were using the computer when the popup storm happened, the popups were generated by a script on a non-pornographic website, and Amero did try to prevent the students from viewing the images.
Worse than the prosecution’s ridiculous case, is that nobody involved in the case (except the defense’s expert, who was not allowed to present anything near his full testimony) has anything even resembling sufficient computer/internet literacy or expertise: the school board, the police, the prosecution, the defense attorney, the judge, the jury, or the defendant.
Perhaps I should exclude the school board; it is more likely that the board needed someone to take the fall for the incident, and chose Amero. Parents were outraged over their children being exposed to illicit images at school, and the board was forced to act. This action, of course, came after the vice principal initially told Amero not to worry at the end of the school day in question, when she went to the office for at least the second time that day, to report the incident. The first time she reported it, she was promised help, but nobody ever came to provide the promised help. If Amero’s actions had been sufficiently criminal to warrant her arrest, why did the school not call the police at the time of the incident?
The police who investigated the case didn’t even search for spyware on the computer, and the police investigator testified in the trial that an image coming from a given web site proves that someone had to intentionally go to that web site in order to see the image. This assertion is patently untrue. The defense’s expert witness had evidence that the illicit images came first through a malware javascript link on ostensibly innocuous hair style web site. Both Amero and the students testified that the images were on popup windows, not a website proper.
Even to pursue this case proves the prosecution’s lack of computer expertise. The defense attorney admitted to Alex Eckelberry that he had no computer expertise. This fact alone should be enough for an appeal – if not an outright mistrial. The judge upheld the prosecution’s objection of perfectly reasonable defense testimony, was reportedly falling asleep during trial, and reportedly gave instructions to the jury for an expedited completion of the trial. The jury clearly had insufficient computer expertise, and were reportedly violating sequestering rules by discussing the case outside the courtroom. Amero’s lack of computer expertise has already been addressed.
This case was a trial that should not have taken place, carried out by a judge, jury, and attorneys who should not have been involved, regarding a criminal charge that should not have been filed, against a completely innocent victim.
More commentary: ComputerWorld’s Preston Gralla initially lauds the conviction. Alex Eckelberry refutes his opinion, after wich Gralla issues a mea culpa, and Eckelberry praises the change-of-opinion. Eckelberry also links to an AlterNet story about the case, as well as a Digg comment storm.
If you want to help, go to this website set up by Julie Amero’s husband for information on the case and defense fund contributions.
Coverage of the Julie Amero Case:
Substitute Incrimination and Computer Injustice
Julie Amero Update