Electronic evidence anchors porn case

The government's prosecution of Larry Benedict, 45, is unusual because all the evidence in the case is electronic, and all of the evidence appears to have been allegedly tampered with or otherwise altered after it was in government custody.

Benedict pleaded guilty to the child pornography charges in June 2001 after being refused full access to the hard drives, floppy disks and tape backups that federal agents seized in an evening raid on his home in February 1995. Because no physical child pornography was found, the case against Benedict rests entirely on the contents of the electronic storage media.

But after a computer expert retained by Benedict unearthed evidence that pointed toward his innocence, Benedict retained new lawyers who attempted to dismiss the plea and go to trial.

Last month, U.S. District Judge David Larimer rejected Benedict's request. "Benedict repeatedly said that he understood the agreement, that he had no questions, that he was prepared to enter the plea, and he admitted without qualification the accuracy of the factual basis set forth in the plea agreement concerning Benedict's transmission of numerous items of child pornography," Larimer said in a 20-page ruling.

During a three-hour hearing Thursday, Larimer sentenced Benedict to 46 months, the maximum prison term permitted by the plea agreement, and rejected a request by defense counsel to allow Benedict to remain out of jail while an appeal is under way. Benedict is required to report to a federal prison in the next few weeks.

Larimer, a former prosecutor, also refused to hold a hearing to explore whether evidence against Benedict was fabricated. "Just because Benedict now believes his chances at trial might be more favorable than they would have been in June 2001, is no reason to allow withdrawal of the guilty plea," Larimer said.

"It shows the distance that the federal judiciary is going to have to go in order to fairly appreciate issues" involving electronic evidence, said John Swomley, an attorney for Benedict. "This judge just didn't get it. It may be that he just can't get his brain around what our evidence shows."

Benedict said before the hearing, "This is basically unbelievable. I'm innocent, and I can prove that I'm innocent. I can't believe they're going to send me to jail over this."

The U.S. Attorney's office did not immediately respond to a request for comment.

Until being fired last year after news of the plea agreement appeared in a local newspaper, Benedict was a project manager at Xerox, designing printer and copier mechanisms that churned through paper at ever-increasing velocities. He had no criminal record, and his estranged wife has said she believes the criminal charges are false.

Prosecutors have never turned over all the electronic evidence in the case to the defense team, including vital bit-for-bit copies of the tapes that allegedly contained child pornography.

But, according to court documents, the electronic information prosecutors did divulge shows that files were added and deleted from computers while they were in police custody, and it took prosecutors nearly five years to discover illegal image files on Benedict's PC in an obvious, top-level directory titled "GIF."

The government claims that Benedict was trading images of child pornography on floppy disks and magnetic tapes sent to a man in California. Benedict admits to swapping disks back and forth but says they contained Amiga computer games. His personal "wares" catalog lists 2,151 titles stretching from "A-10 Tank Killer" to "Zork Zero."

Benedict's brother George, who attended the hearing, said he expected this result. "Larry spoke for quite a while and was really passionate and all that," he said. "Everyone did everything they could do and should do. The judge, I think, had decided already before he got there and that was it."

Swomley, Benedict's attorney, said he plans an immediate appeal to the Second Circuit. "I think we have several good grounds for an appeal," Swomley said. "The question is whether we can get a panel of judges who can appreciate the computer evidence. We have evidence of actual innocence, and that's what we're going to say."

Slippery electronic evidence
Both the defense and the prosecution agree that electronic evidence was altered. They disagree, however, on how much evidence was changed, and, crucially, whether such a discovery matters after Benedict formally agreed to a plea bargain last year.

Courts are still grappling with how to deal with evidence found on computer systems, which has become increasingly important over the last decade. Electronic evidence is far more malleable than physical evidence. Erasing a date on a piece of paper and replacing it with a different one will leave a residue, yet most operating systems will allow a date to change on a computer file without recording the change.

The Justice Department started thinking through the problem of computer evidence in the early 1990s. Its "1994 Guidelines for Searching and Seizing Computers" call for a "controlled environment" when examining a PC, noting that "computer evidence is extremely vulnerable to inadvertent or intentional modification or destruction."

In this case, police inventory records show scores of files that were added to a seized hard drive while it was in police custody. Floppy disks seized from Mikel Bolander, Benedict's alleged porn-trading partner, were destroyed by police.

An analysis by Stan Kremen, a computer forensics specialist hired by the defense, concludes that "extensive changes were made to the Bolander hard drives for quite some time after the computer was in custody." That evidence--an exchange of letters signed "LB"--is key to the prosecution's case against Benedict.

Kremen says that fax software was added, image directories were modified, Adobe Photoshop was used, and so on, according to the directory tree--as recently as May 1995, when the computer was in police custody.

The government doesn't deny it. In a motion filed last December, prosecutors say that investigators had no spare computers to use for an examination.

A San Diego police officer "would testify that on Feb. 2, 1995, he restored the contents of the mailed backup tape onto Bolander's computer because his department did not have the computer forensic facilities to do it any other way," wrote assistant U.S. Attorney Martin Littefield. Bolander's computer was seized in January 1995.

Benedict's computers and floppy disks, seized during a February 1995 raid on his home in New York's Finger Lakes country, were also lost.

Prosecutors stored 27 U.S. Postal Service mailbins in the soggy basement of the Geneva, New York, post office. After a few floods, the computers had rusted and the disks were encrusted with a filmy white substance.

Benedict says that the computer hardware and his floppy disks contain vital evidence that could show a jury that he was no child pornographer--and instead merely was a video game addict who became snared in a sting operation.

In a 1988 case, Arizona v. Youngblood, the Supreme Court ruled that "failure to preserve potentially useful evidence" denies a defendant due process if police acted in bad faith.

But the government argues it was an accident. "The fact that the hundreds of disks which were being held by the Postal Service suffered water damage after five years of being held can hardly be attributed as an intentional act, let alone prosecutorial misconduct," prosecutors say in court documents.

Judge Larimer never ruled on the points raised by the defense's computer forensics experts. "A defendant's assessment that due to changed circumstances he has a better chance of winning is not an acceptable basis to allow withdrawal of the guilty plea," Larimer ruled last month before setting Thursday's sentencing date.