Police blotter: Child porn blamed on computer virus

What: A former Georgia teacher blames computer viruses for altering his Web sites and uploading child porn images.

When: The 11th Circuit Court of Appeals rules on Aug 22.

Outcome: The appeals court upholds the conviction of Michael Aaron O'Keefe.

What happened, according to court documents:
Michael Aaron O'Keefe once was an eighth-grade math teacher at Lee County High School in Albany, Ga.

In addition to his day job, O'Keefe created Web sites with names like "modelquest" and "hctweens," entreating visitors to submit "hard-core images" through e-mail.

That much is clear. What remains disputed are O'Keefe's motivations. He claims to be an anti-child-pornography crusader who developed Web sites to entrap child predators in order to turn their identities over to law enforcement authorities.

Federal prosecutors, however, view him as a run-of-the-mill Internet predator. They point to no records of O'Keefe contacting police to turn in miscreants.

What makes this case relevant to Police Blotter is that O'Keefe claims his vigilante efforts were thwarted when the Web sites allegedly were hacked into and altered by computer viruses to include a selection of child porn images. Not all the details are clear from the opinion, but some kind of malware is definitely blamed.

That brings us to May 2003, when O'Keefe was busy posing as two young girls, ages 12 and 13. He posted messages on discussion groups and circulated "photos" of the children to male suitors in an attempt to set up meetings. (Incidentally, posing as a minor is a common tactic used by government agents.) In return, O'Keefe asked men to send him images of young girls of the same age range engaged in sex.

That captured the attention of federal authorities, who raided his home the next month and indicted him a year later. He was charged with the receipt, possession and advertising of child pornography.

During the trial, O'Keefe testified in his defense and claimed that he began gathering evidence against child predators on the Internet because of an incident involving a family member in 1990. After trying to report predators to the police anonymously, he claimed to have decided to strike out on his own.

As for the child porn and the malware, the defense called Jeff Fischbach, an expert witness who examined the computer. Fischbach stated that he found indications of malware on O'Keefe's computer, which the court described as permitting "another user to control the computer by remote and give the appearance that the computer's owner performed actions on the computer that the owner actually did not perform." That could describe any number of programs, including the famous Back Orifice.

Prosecutors argued that the explanation of a virus was "far-fetched" and "hypothetical." James Fottrell--part of the High Technology Investigative Unit within the Justice Department's Child Exploitation and Obscenity Section--testified that he did find two viruses on O'Keefe's computer. But, Fottrell said, they weren't capable of "downloading and uploading child pornography and sending out advertisements."

A jury found O'Keefe guilty of all counts and the trial judge sentenced him to 17 1/2 years in prison. The 11th Circuit rejected his appeal, which argued that prosecutors violated his Fifth Amendment right to remain silent by discussing O'Keefe's failure to report his activities to law enforcement and also claimed that the government engaged in prosecutorial misconduct during its closing argument.

O'Keefe is not alone in his attempt to blame malware. A British man was charged with having hundreds of illegal images; he blamed a "virus from broadband." In another British case, the defendant blamed porn sites for infecting his laptop with a virus.

Excerpts from the 11th Circuit's 3-0 opinion (click here for PDF):
On direct examination, O'Keefe testified that he began gathering evidence against child predators on the Internet because of an incident involving a family member in 1990. O'Keefe stated that he had participated in anti-child-pornography Web sites and reported information to the police anonymously, but was dissatisfied with the response.

As a result, O'Keefe decided to begin a personal crusade against child predators and began associating with others who were interested in trying to rid the Internet of child pornography. He later developed Web sites in an attempt to attract these predators so that he and his associates could eliminate child pornography on the Internet. O'Keefe claimed that the other individuals with whom he worked in developing the Web sites also had access to the sites. O'Keefe acknowledged that he created the "hctweens" Web site and survey with the intent of eliciting "hard core images" from pornographers through e-mail. O'Keefe stated that he intended to transmit the information received from the "hctweens" Web site to the Anti-Child Porn Organization. O'Keefe further stated that he had previously reported anonymously to the Anti-Child Porn Organization who in turn reports to law enforcement.

On cross-examination, O'Keefe testified that he wrote a survey containing sexually explicit questions involving children and posted the survey on one of his Web sites. O'Keefe also acknowledged that a Web site containing child pornography stories was on his computer, as well as pornographic pictures that involved children, but he maintained that he did not recall viewing the stories or pictures. O'Keefe further testified that he saved pornographic images on the floppy disks, but did not know that the images involved pictures of children....

(Defense expert) Fischbach further testified that he searched for the presence of a Trojan virus on O'Keefe's computer because the events on the computer did not appear to be consistent with a single user. Fischbach stated that he found suggestions of a Trojan virus on O'Keefe's computer, which would have allowed another user to control the computer by remote and give the appearance that the computer's owner performed actions on the computer that the owner actually did not perform. On cross-examination, Fischbach testified that he did not "find a specific Trojan virus" on O'Keefe's computer, but rather he found "only indications of a certain type of virus" and, if there was a virus, it had already been removed.

The government further argued that "(t)he defense explanations are far-fetched, hypothetical theories.... As their expert admitted, not on cross-examination, but on direct when (O'Keefe's counsel) was asking him, he was spoon-fed, and then he sat here on the stand and regurgitated his spoon-fed theories."

During the closing arguments, O'Keefe's counsel informed the jury that O'Keefe's defense "has nothing to do with being a vigilante?Our position is everything (O'Keefe) did in his quest to end pedophilia and child pornography on the Internet was legal."

The government then presented its rebuttal argument, stating: "There's no evidence (O'Keefe) ever did anything to help law enforcement. And, yet, when Special Agent Brant showed up in his house?he had nothing to say. Nothing to say. Didn't say thank God you are here, I am one of you, I am a good guy, I have been looking at these sites, I have been tracking them down. No. Never said it. The first time we ever heard about that?was in court after the trial had started where he put on his sham make-believe vigilante defense on helping law enforcement?Again, the defenses sprout up like mushrooms and none of them make any sense?When the facts are against them. The law is against them. When both the facts and the law are against you, as a defense attorney, you make something up?You make up the Trojan horse virus."