, SecurityFocus 2007-06-06
UPDATE -- A Connecticut judge granted on Wednesday a new trial for substitute teacher Julie Amero, according to media reports, saying that information discovered after her conviction has direct bearing on whether she is responsible for risking harm to her students when pornographic pop-ups appeared on a classroom computer.
In January, a jury found Amero guilty of four felony charges of risking injury to a minor or impairing the morals of a child, following a 2004 incident where her classroom PC became infected with pop-up ads that displayed thumbnails of pornographic imagery. The prosecution maintained that the pop-up ads were caused by Amero's activity on the PC and the testimony of a forensic expert that would have refuted the charges was curtailed by courtroom rules.
Superior Court Judge Hillary B. Strackbein ruled that a Norwich police detective who the prosecution presented as a computer expert had provided "erroneous" forensics testimony regarding the classroom computer at the heart of the incident, according to an article in the Hartford Courant.
"The jury may have relied, at least in part, on that false information," Strackbein said, according to the Courant.
The ruling hits the reset button on a case that has garnered an enormous amount of attention from security professionals, legal experts and the online world since the substitute teacher was sentenced on January 5. A pro bono effort by a group of independent security researchers to do a complete forensic analysis of Amero's classroom PC was delivered to her defense attorneys in April, but the group -- led by Sunbelt Software's president Alexander Eckelberry -- would not discuss the conclusions of the report until any possible new trial is resolved.
Eckelberry said that the latest ruling underscores the broader implications of the case: Prosecutors need to be aware that a person's computer can be controlled by others.
"The primary reason that I got involved was to get Julie out of this train wreck, but it was also to bring awareness to the problem of malware and forensic analysis -- it is a big problem," he said.
In the latest case, one of the school's teacher logged into the classroom computer, because Amero did not have credentials. The substitute teacher was told not to log out or turn off the computer. What happened after that has become the main point of contention.
A detective on the case using off-the-shelf recovery software argued that Amero clicked on pornographic Web links and caused the computer to display pornographic pop-up advertisements. However, the defense's forensic expert, Herbert Horner, stated that a more complete analysis showed that a harmless hairstyling Web site had actually redirected the PC's browser to pornographic sites, setting off the deluge of offensive ads.
The forensic analysis produced by Eckelberry and other independent security researchers found a large number of inconsistencies between what was said during Amero's trial and what really happened, according to the analysis of the computer's hard drive. Following the independent analysis, a state cybercrime lab produced their own study, concurring with the defense's forensic report.
Amero's defense attorneys had filed a motion on Monday, asking that the judge throw out the jury's conviction against Amero, because information discovered after the case called into question the testimony of the prosecution's expert witness.
"The State and the defense now possess additional forensic evidence concerning the history of the computer's use both before and after the alleged incident, the manner and methodology of the analysis of the computer's use, and the interpretation of the analysis," Amero's defense attorney stated in their motion for a new trial. "Had that information been available to the State at the time of trial, the State would have been precluded from urging and would not have urged the jury to reach certain inaccurate conclusions regarding (among other things) the alleged purposeful access to offensive Web sites."
Judge Strackbein granted that motion on Wednesday, before the sentencing hearing.
"I feel very comfortable with the decision," Amero said, according to an article in the Norwich Bulletin.
The prosecutor has not said whether the state will seek another trial against Amero.
UPDATE: The article was updated at 11:00 a.m. PT with comment from Alexander Eckelberry and text from the motion for a retrial.