Seized Computers

tebbaker

HI

I am wondering if anyone knows the process that the Gardai must follow when they seize computers believed to contain child porn. I am specifically interested to know what safeguards are in place to prevent the Gardai from potentially planting evidence on a PC after they have seized it - when the owner no longer has any access or control of the PC.
It seems to me that if there was a corrupt Garda, they would have all the time in the world to seize the PC and then put whatever they want on it and claim to 'find' the evidence there - thus implicating the owner! This could then be used in court as a defense by the accused persons legal team.

I am sure that it is not as simple as this but would like to know exactly how it is done properly.

Thanks

oleras

tebbaker wrote:

HI

I am wondering if anyone knows the process that the Gardai must follow when they seize computers believed to contain child porn. I am specifically interested to know what safeguards are in place to prevent the Gardai from potentially planting evidence on a PC after they have seized it - when the owner no longer has any access or control of the PC.
It seems to me that if there was a corrupt Garda, they would have all the time in the world to seize the PC and then put whatever they want on it and claim to 'find' the evidence there - thus implicating the owner! This could then be used in court as a defense by the accused persons legal team.

I am sure that it is not as simple as this but would like to know exactly how it is done properly.

Thanks

The same could be said for drugs, stolen goods, illegal firearms. Why computers specifically ?

Hagar

oleras wrote:

The same could be said for drugs, stolen goods, illegal firearms. Why computers specifically ?

In theory I think it would be easier to plant a photo than to plant a kilo of coke or a gun where there wasn't one before.

williamb

tebbaker wrote:

HI

I am wondering if anyone knows the process that the Gardai must follow when they seize computers believed to contain child porn. I am specifically interested to know what safeguards are in place to prevent the Gardai from potentially planting evidence on a PC after they have seized it - when the owner no longer has any access or control of the PC.
It seems to me that if there was a corrupt Garda, they would have all the time in the world to seize the PC and then put whatever they want on it and claim to 'find' the evidence there - thus implicating the owner! This could then be used in court as a defense by the accused persons legal team.

I am sure that it is not as simple as this but would like to know exactly how it is done properly.

Thanks

Very simply, best practise is that the seized computer is accompanied by the owner or his representative at all times. It's never turned on, the hard disk/s are removed and copied via a specialised disk copying device. Two copies are made, and one is handed to the owner/his representative. Similar procedures apply to other storage media found (DVD's, etc). The owner's copy is sealed and left alone. If a dispute arises as to what is on the PC (owner denying that material existed), his copy is opened under controlled conditions by an independent expert and checked. If the material doesn't exist on this copy, it's reasonable to conclude it's been planted.

Note the above is international best practice, I've no idea what the Gardai actually do.

seamus

williamb wrote:

Very simply, best practise is that the seized computer is accompanied by the owner or his representative at all times. It's never turned on, the hard disk/s are removed and copied via a specialised disk copying device. Two copies are made, and one is handed to the owner/his representative. Similar procedures apply to other storage media found (DVD's, etc). The owner's copy is sealed and left alone. If a dispute arises as to what is on the PC (owner denying that material existed), his copy is opened under controlled conditions by an independent expert and checked. If the material doesn't exist on this copy, it's reasonable to conclude it's been planted.

Note the above is international best practice, I've no idea what the Gardai actually do.

Interesting to know. I can't see any reason why the Gardai wouldn't follow similar procedures.

Forensic/security specialist companies in this country do almost the same - the take a direct image of the machine's hard drive, and leave the original intact. Then they bring it back to their office, duplicate it, and store the duplicate until the job is over, while they work on the "original" copy.

\m/_(>_<)_\m/

oleras wrote:

The same could be said for drugs, stolen goods, illegal firearms. Why computers specifically ?

it would be a bit harder for computers because of the date register on a computer, one can see when these picture were put on, so i would say it is a bit harder that drugs and firearms,
i believe that is why they don't plant pictures on computers.

but as for firearms and drugs, the gardai do and have been proven to plant evidence and not only that but lie in court as well.
sure from the news yesterday, didn't this type of planting of evidance cost the tax payer over 5 million and still not one guard held responsible,
so yes it does happen

\m/_(>_<)_\m/

williamb wrote:

Very simply, best practise is that the seized computer is accompanied by the owner or his representative at all times. It's never turned on, the hard disk/s are removed and copied via a specialised disk copying device. Two copies are made, and one is handed to the owner/his representative. Similar procedures apply to other storage media found (DVD's, etc). The owner's copy is sealed and left alone. If a dispute arises as to what is on the PC (owner denying that material existed), his copy is opened under controlled conditions by an independent expert and checked. If the material doesn't exist on this copy, it's reasonable to conclude it's been planted.

Note the above is international best practice, I've no idea what the Gardai actually do.

they don't do that anyway, and I'm only suggesting this because of the Judge Curtain case.

Tom Young

Unlawful use of a Computer is generally covered by the CJ Theft and Fraud Offences Act 2001, S. 9.

Check Sections 8 and 9 of the 1998 Child trafficking and Pornography Act. Covers search and seizure in some detail.

Re: Defenses. Someone successfully raise a SOEDI defense on this back a few years ago. SODI - SomeOne Else Did It. I believe it was a solicitors PC in the porn operation that was undertaken some years ago.

Difficult defense to raise unless multiple access to the assets/PC can be shown.

My own view is that this type of matter is relatively easily proven. People who utilise Internet technologies are not generally aware of the tracing mechanisms available to law enforcement agencies on complaint. IP Addresses, AS numbers and also dial-up interface tracking.

Use of an expired warrant in the curtain case was the crux of that matter and why it failed.

Tom

purple'n'gold

Does the disk cleanup software that you see advertised really work? I mean evidence eliminator etc? Banking on line is wonderful, but if someone who knows what they are doing gets access to your computer, they could clean you out if they could retrieve data that is supposedly wiped. I would like to know.

Sully

purplengold wrote:

Does the disk cleanup software that you see advertised really work? I mean evidence eliminator etc? Banking on line is wonderful, but if someone who knows what they are doing gets access to your computer, they could clean you out if they could retrieve data that is supposedly wiped. I would like to know.

Iv only started my course in Computer Forensics, but I believe the only true way to delete data is by running a magnet (a large / powerful one) across the hard drive.

Anyway, most people who misuse computers are not computer ilterate and would not know about removing data etc. The chances of this happening are small.

As regards to earlier posts about methods used by international police forces - I do believe this is used by the Gardai. I think its called the "Chain Of Custody" or something.

seamus

purplengold wrote:

Does the disk cleanup software that you see advertised really work? I mean evidence eliminator etc? Banking on line is wonderful, but if someone who knows what they are doing gets access to your computer, they could clean you out if they could retrieve data that is supposedly wiped. I would like to know.

Yes and no.

The general rule of data security is that if someone manages to get physical access to your computer, then there is nothing you can do to prevent them from accessing your data.

There is certain software which overwrites the deleted data a certain number of times (30 I think), which theoretically makes it "CIA-standard" deleted.

The skills and equipment required to find old data which was deleted isn't all that complex. However, the older the data, the harder it is to find. Even finding relevant data which has only been deleted once can be quite time-consuming. I can't see it being worth the effort involved to scour a home PC for this stuff. All you really have to do is not store any passwords on the machine, and you've put up a huge roadblock.

It's a subject which merits 50 threads all of it's own tbh. Someone who steals a PC (be it laptop or desktop), is more than likely just stealing it to wipe and sell on. The chances of someone targetting a machine to look for specific information is so very small, that even most big corporates don't worry about it that much when a machine of theirs is stolen. In fact, as I say above, the effort involved would be better spent targetting the corporate network instead of individual clients.

amen

it would be a bit harder for computers because of the date register on a computer

easily got around

delete data is by running a magnet (a large / powerful one) across the hard drive

data can be still on the disk

the only sure way is the running a magnet across it
break the actual physical disk substrate and then incinerate!

tebbaker

I guess that there is nothing to stop a corrupt cop arriving to search your property with a CD/DVD in their pocket and then claiming to find it there in a press! I do not see any defense whatsoever against that! How on earth could anyone prove that they did not own it?

Tom Young

'Simple answer is where is your warrant Garda?' Corrupt or not they cannot search a premises without same. There are some derogations to this in terms of acts e.g., Offences Against the State and Drug Trafficing Acts but they'd really need to be coming up with something in hand.

So basically you don't let them search period without the paperwork in order.

timmywex

when anything is put on the computer, the history is stored on the computer, this stores the date and time of when it happened, so,if anything was planted, it could easily be seen as planted or not

oleras

timmywex wrote:

when anything is put on the computer, the history is stored on the computer, this stores the date and time of when it happened, so,if anything was planted, it could easily be seen as planted or not

where does it take this date and time from ? how hard is it to wind the clock back a few months ? 2 clicks !!

tebbaker

I guess I am just thinking about this from a solicitors point of view. If I had to mount a defense for someone accused by the Gardai of possessing child porn that was found on a CD/DVD on their premises, what would I focus on?

I think that this is one of the easier areas to frame an individual on so I am interested to hear from anyone who knows the Gardai search process well.

It is far easier to plant a memory card or CD with illegal pics in someones premises than it is a firearm! Surely the people who defined the search process have considered this issue to enable them to secure convictions?

johnnyskeleton

My guess, based on the Child Trafficing and Pornography Act 1998, and what I understand of general garda powers of seizure and production at trial, is:

When searching a place pursuant to a warrant, a garda can seize anything there which he believes to be evidence. He must then preserve this, and pass it on to other gardai until it makes it way to the garda technical bureau - where it is analysed. A report is then published and it is put into storage until the trial, when it, and the findings of the person who made the report, will be used as evidence in court.

For each step of the way, when the computer goes from one garda to another (even just for five minutes) there must be a statment from each garda that he had it in his custody and that it was not interfered with. As Sully pointed out, this is called the chain of evidence.

If there is a gap in this evidence then this could be attacked. eg statements that 1) A gives to B, 2) B gives to C, 3) D gives to E and 4) E examines it. The gap is what happened between 2) and 3). We can't assume that C gave to D, much less that D kept it free from interference.

However, the prosecution have to prove knowledge of the posession. You could cross examine the garda who examined the computer, and you could bring in your own expert to suggest possible alternative ways that it got onto the computer.

If the gardai take a blood sample, they must provide you with half; if there is a video tape of interview or cctv they must provide a copy. So, while I'm not sure if there is a requirement that they provide a copy of the hard disk, I would imagine that it is only a matter of time before the supreme court rules that it is required.

I don't think it is that easy to plant evidence. The absence of fingerprints would be a goog point if it was. Also, the prosecution would have to prove that the accused knew that he posessed the item. As with everything in our criminal justice system, the truth is (hopefully) found by examining and cross examining witnesses.

paulrichards

From what I can gather, tebbaker is more concerned with the fact that although planting evidence on a pc may be tricky - there is very little protection that someone would have if a cd or dvd were brought onto the premises by the search party! They would simply have to include it in the evidence and there is nothing that the person can do! It all seems a bit easy to do if you ask me.
I can imagine that a premises search would be quite a hectic affair and there would be many officers so any one of them could introduce this 'evidence' and you might not even notice! You would later say "that is not my cd" but who would believe you?

I believe that 99.9% of Gardai would never do this but if one was a little short of convictions in a month - they might be tempted given how simple it is. If there is any suspicion against someone (maybe an anonymous phone call) it would be the perfect opportunity get a warrant and plant the evidence knowning that you will not get caught because it could never be proven that you did it!

Just a thought..

johnnyskeleton

paulrichards wrote:

I can imagine that a premises search would be quite a hectic affair and there would be many officers so any one of them could introduce this 'evidence' and you might not even notice! You would later say "that is not my cd" but who would believe you?

I believe that 99.9% of Gardai would never do this but if one was a little short of convictions in a month - they might be tempted given how simple it is. If there is any suspicion against someone (maybe an anonymous phone call) it would be the perfect opportunity get a warrant and plant the evidence knowning that you will not get caught because it could never be proven that you did it!

This is why there is the presumption of innocence, jury trials, the right to cross examine, and an increasing awareness of the potential for gardai to act illegally. If this really happened, then I would hope the truth would come out in cross examination. Failing that, the jury might be persuaded by your sanguine testimony that you have never seen it before. You don't need to prove the garda planted it, and sometimes, even if you know that he did, it is better not to mention it because it is much harder to make the case of malice than it is to make the case of ignorance.

BostonB

Sully wrote:

Iv only started my course in Computer Forensics, but I believe the only true way to delete data is by running a magnet (a large / powerful one) across the hard drive....

AFAIK thats not true unless you have a seriously powerful magnet. You have to physically destroy the platters. That said we use a magnet to wipe tapes and then reformat them.

knird evol

The suggestion is that a garda is short of charges for the month (!?)
so obtains (?) child pornography and writes to disc, gets her warrant
(applies to judge, easy) for a pre selected random person and address on
suspicion they have illicit pornography, drops in 'seizes' disc, arrests total stranger for a crime that could put them away for 6/7 years destroy their
life, and then goes "whew, i thought i wouldnt make my monthly quota of
paedophile arrests and i would be sacked and working in centra next week"
any garda could walk up to anyone anywhere and put a knife, coke, cd etc in their pocket any time and charge them. luckily eneugh, they don't. otherwise would all the drug dealers and gangland figures be walking the streets right now. it would be simple to stitch them up if guards were corrupt and immoral. As for due process, i think research shows that juries will decide whether your a twisted deviant based on your appearance.
i hope the idea of this thread wasnt someone trying to build up a good legal and technical defence strategy of their cd collection, and whats on their pc hard disk. they will have picked up a couple of useful tips.