Tuesday, March 12, 2013


I love my day job. It can be a lot of fun. I used to say that one of the reasons I enjoyed my work is that no lives were at stake. It wasn't like I worked for a hospital or the military. Then I saw a call for help in a computer security forum. Life has a funny way of making a point.

Back in the olden days of 2007 computer forensics practitioners like me were discouraged from working at the defense table in a courtroom. One of the best known industry groups at the time flat-out rejected the application of anyone who had ever worked against a plaintiff or prosecution in any jurisdiction. Thus, when I saw a plea by Alex Eckelberry, a respected name in security circles, I knew he faced an uphill battle in his quest. I jumped at the opportunity to right not only the wrong that Alex set out to fight, but also what I felt to be a breathtakingly misplaced bias among industry peers. Scratch that. I didn't "feel" it, I knew. I came to technology from a litigation background. I worked almost exclusively for defense attorneys and I knew what evil lurked in the hearts of men and hard drives. As I advanced through the digital forensics field, a few among us talked about the day when computer evidence wrongly interpreted would send an innocent person to jail. The State of Connecticut vs. Julie Amero proved us prescient.

Julie Amero was a substitute teacher who had been convicted in a 6-day trial and faced 40 years in prison for multiple counts of impairing the morals of a minor. How did she allegedly accomplish this fiendish feat? Porn-related pop-ups on a classroom computer.

In  January 2007, Alex helmed an anti-malware company and read about the case in a newspaper. That was how most people got their news back in those days. He knew, without even knowing the details, that such a porn storm was the hallmark of certain families of malicious programs. These programs almost never got onto a computer with users' knowledge much less intention. The sentencing was to take place in March so Alex put out the call. He needed people who could help him free her. Fast.

If anyone asked, I would tell them we worked on the case for at almost a year. Going back through my notes and email it turns out that it all happened in a little over two months. The team was assembled in February, the evidence analyzed, the sequence of events recreated and presented in a summary document to the Connecticut State Attorney in March. None of us were paid. That was never the point. Someone's life was at stake. Hell, one life had already been lost - Julie had been pregnant when she was arrested. The emotional strain took a physical toll and she lost the baby. Our team did our damnedest to free her from further suffering at the hands of amateurs and the uninformed.

We won. Sort of. The original conviction got vacated but the AG had political aspirations. He pushed for a new trial. Julie's health continued to be pummeled, along with her reputation throughout her ordeal. She eventually copped a misdemeanor plea to end it. You can read the forensic team's report here. Alex blogged about the case case here; this post links back to many others. You can see the Good Morning America post script here.

So, yeah, I love my job. I change lives. Once in a while, I'm honored to save one.