Internet Newsletter for Lawyers
November/December 2003, by Delia Venables

Operation Ore: An Expert's Story
by Alistair Kelman

Having hung up my wig and gown in 2000 to concentrate on developing my e-commerce based patents and inventions I never anticipated being back in the courtroom. But today I find myself testifying as an Expert Witness in Child Pornography cases using my knowledge of computer evidence, chains of custody and the operation of the Internet. It was not work I initially sought or wanted. But the need for qualified independent Expert Witnesses in paedophilia cases is immense because of the volume of cases arising from Operation Ore. And with the nature of the Internet there is a genuine risk that people could be convicted of crimes they did not commit.

The UK "Operation Ore" grew out of "Operation Avalanche" in the USA. A U.S. postal worker had become suspicious of excess mail going to and from an address. On 8th September 1999 federal agents raided the home and offices of Thomas and Janice Reedy who operated an Internet business called Landslide Productions, which the FBI knew sold subscriptions to websites offering child pornography. The business was said to be the largest commercial child pornography enterprise ever uncovered, grossing as much as $1.4 million in just one month.

After entering Landslide's child porn site, people were offered a menu advertising selections such as "children forced to porn", "child rape" and "children of God". Each selection cost $29.95 for a month's subscription. To join up, each person needed to give their credit card details and choose a password. A separate site of "adult classifieds" included entries from fathers advertising their children for sex. The company's outgoings included payments to Russia and Indonesia, where the images originated. A USA judge sentenced Janice Reedy to 14 years in prison, and Thomas Reedy to 1,335 years in prison – reduced on appeal to about 170 years.

In the course of the raid the FBI discovered a database of the site's subscriber list, with the names and credit details of 250,000 subscribers in 60 countries. 7,272 of these were subscribers in the UK and these names are termed the Operation Ore suspects. The National Criminal Intelligence Service immediately started sifting through the UK names to prioritise who they considered were the worst offenders - an expensive and difficult task. By July, over 1,700 people had been arrested and/or questioned. Most investigations involve a raid on the home of the suspect and computer hard disks being "imaged" for subsequent forensic examination by specialist officers. The resources needed for this are immense - NCIS have said that every one of the 7,272 suspects will be investigated.

My cases tend to arise when people are charged with downloading child pornography images off the Internet. Many of them are Operation Ore suspects. If they say that they are innocent, or only looked at an image once then it is my job to ensure that the possibility that they are telling the truth is fully investigated and that the police evidence against them really does bear scrutiny. A standard personal computer running Microsoft Windows keeps very detailed system logs of all downloading activities so frequently there is damning evidence against the defendant on his own hardware giving dates and times of every activity.

The penalties for downloading child pornography images are severe and the consequences that flow from a conviction are horrific. It is however legal to download most types of adult pornography images in the UK.

A typical case

Let me outline one of my typical cases - with particular facts changed to protect all parties:

John was a Public Servant working in the Emergency Services. Using the Internet he investigated and collected a vast amount of adult pornography. Three or four years ago he became curious regarding child pornography and subscribed to a US service. In consequence his name came up as one of the Operation Ore suspects. In late 2002 the police raided his home where they found a computer connected to the Internet, which they seized, and a quantity of floppy disks relating to an earlier computer that they also seized. On these floppy disks were a few "child pornography" images. All the images found were naked teenage children in legitimate settings with no sexual activity. They were the kinds of things you might see if you walked through a public park in Berlin on a sunny afternoon. Additionally within the Internet cache of the computer the police found a few further images of naked children with no sexual activity involved. These were thumbnail images in pages that contained both nude adult images as well as pictures of nude children. There was however evidence that the defendant had clicked on a few of the thumbnail images of children to produce a larger picture. This activity alone is considered sufficient to make out the offence under the UK legislation. John, to his credit, did not keep permanent copies of any of these images.

John was charged with eleven counts of downloading child pornography. By careful scrutiny of the evidence I managed to get this reduced to 5 counts. However, because John has admitted in his taped interview that he had a few years ago become curious about child pornography and had signed up to a commercial service, there was no question that he had downloaded the images found on the floppy disks. The only question that remained in relation to these early images was whether the pictures in question were of children or were actually of young adults posing as teenage children. This was therefore going to be a jury question.

Regarding the later images found in the cache, these appeared initially to show that John had joined a commercial service that provided child pornography. All of these downloads came long after the Operation Ore database of sites had been closed down. A further investigation by me of their context showed that this "commercial service" was actually Usenet.

"Usenet" is a world-wide discussion system. "Articles" or "messages" are "posted" to the newsgroups by people on computers with the appropriate software. Some newsgroups are "moderated" where the articles are first sent to a moderator for approval before appearing in the newsgroup.

The service John had joined provided unfiltered access to Usenet, with no moderator involved. In context, what this meant was that it appeared likely that John had joined the service not to gain access to child pornography but to gain access to adult pornography images (i.e. not illegal) which he had said was the case from the start. While the evidence supported the fact that John had clicked on certain thumbnail images of nude teenage children it was clear from the system logs that within a few seconds of doing so he also clicked on thumbnail images of nude adults. The police had been highly selective in their compilation of the evidence and many adult images should have been included in the jury bundles so that the making of the child images were placed in proper context.

This was a case that a jury could well have found did not warrant convicting the Defendant. The real question was could John keep his nerve for going through a whole trial. He consulted his wife. Their joint decision, on being told by counsel that a custodial sentence was highly unlikely if he pleaded, was that he should plead guilty.

John received a fine of 500 (100 on each count). As an automatic consequence of the fine he was placed on the Sex Offences Register for five years where he has to regularly notify the police of his whereabouts including his trips abroad. He was required to pay 1,400 towards the prosecution costs. His computer system was forfeit. He may well lose his job because of his conviction.

It was John's decision not to risk a jury trial - and it may have been right for him given his then mental state. However, unlike counsel, my job as an expert does not end with the trial. I am able to put a defendant's actions in context for disciplinary hearings. I have offered to write to John's employers in his attempt to keep his job. In this letter I will be able to compare John's activities with those of real child pornographers, show that he has been fully punished for his foolishness and hope that his employer can show the mercy which is outside of the power of the court system.

Saving court costs

In other more serious cases I have been able to take apart each and every purported defence put up by the accused by examination of the technical evidence. On realising that the evidence against them is sound all the defendants have pleaded guilty and shown remorse. All are now in treatment and the public purse has been saved the cost of Crown Court trials.

I live in hope. One day I hope to find a truly innocent defendant, for example, someone who has been framed by an angry ex-wife who is trying to stop him having access to their children. But all I can do for the moment is force the police and the prosecution to "raise their game", to only proceed when the evidence is truly sound and irrefutable and to ensure that everything is within its proper context.

Alistair Kelman is a director of Telepathic Industries Limited, providing independent expert legal services on computer and Internet related matters. Until September 2001 he was also a Visiting Fellow at the LSE Computer Security Research Centre. He has an engineering degree and is a computer specialist as well as a barrister. From 1977 until 2000 he was in continuous practice at the English Bar specialising in cases involving computers which originally involved him in software copyright disputes and in dealing with disputes when computer systems did not work properly. He also became involved in criminal computing matters and successfully defended many young people in a variety of cases.

Email A.Kelman@telepathic.com

Back to Contents.