Wednesday, June 3, 2015
Operation Ore is the UK's biggest ever IT crime investigation, but expert witness Duncan Campbell reveals that many prosecutions were founded on falsehoods
Operation Ore exposed expert witness Duncan Campbell reveals that many prosecutions were founded on falsehoods!
They arrive without warning at six in the morning. Drowsily rising, Adam Smith finds two polite, suited men. 'Police. May we come in?'
The scene starts to shift. 'I am arresting you on suspicion of possessing and distributing child pornography. We have a search warrant.' Behind their backs, Smith sees a flurry of others moving in. They are firm but not aggressive - they know they are dealing with a middle-class, educated professional with no criminal history.
A female officer corners his wife and asks her if she knew her husband was a paedophile. Would she please make up an excuse for the kids not going to school today? A family social worker will be coming over to interview them - in case her husband has been abusing his own children.
Politeness is maintained at the police station. Booked in, interviewed. They ask him to confirm his credit card number and the email addresses he used in 1999. They show him a copy of a credit card bill they have already got from his bank. They point to a payment to Landslide Productions. 'You paid for child pornography; that's what that is.' He says 'no' and that he's never heard of that company.
The facts they put so confidently seem to fit, except that Smith has never had any interest in children other than being a good dad.
In one day, for no cause he can understand, Smith has become a pariah, one of the most hated, baited people in the country, a suspected child-molesting paedophile. In the months ahead, it will only get worse.
Even if his computer is eventually found to contain nothing more sexually unusual than the proportions of Samantha Fox, he faces months of fearing trial, stigma and possible jail, accused merely of 'inciting' the sale of child porn, based solely on computer data found years ago in a Texas office block.
Operation Ore launched on British TV screens on 20 May 2002. The BBC led on 'mass arrests over online child porn'. Thirty-six people were arrested, with promises of thousands more to follow. It made for compelling television, and provoked a rash of tabloid activity, but it also led to increased pressure on the police to bring the remaining thousands to justice.
Unfortunately, not all the evidence presented was quite as clear cut as it seemed. Clearly visible on the bulletin was a computer screen displaying Exhibit One of Operation Ore. In the middle of the screen were the words 'Click Here CHILD PORN'.
According to witness statements sworn by the US detective Steven Nelson and US Postal Inspector Michael Mead, this was the front page of Landslide Productions Inc, a company at the centre of child porn allegations. To go further, they testified, those prosecuted must have clicked on 'Enter'. They would then be taken to a page that proclaimed itself as 'the most controversial site on the Web ... no legal content ... phedophilias [sic]... all sick, all sex maniacs'. Click on and they would be taken to 'Lolita World', and from there, said Nelson, to a host of child porn websites offered by Keyz, a separate service offered by Landslide.
The Metropolitan Police Paedophile Unit let the BBC cameras in on the planning process for Operation Ore raids for a series shown a year ago: 'Police Protecting Children'. At the start of the show was a PowerPoint briefing for the raiding teams. Slide 1 showed the 'Click here' banner, with the legend 'First they are into an adult site. And choose to go to a child site'.
To British police and prosecutors, this was killer evidence. It meant everyone who had been to Landslide had knowingly chosen to access child porn. It meant that everyone who had subscribed to the site must automatically be guilty.
However, this most critical computer evidence produced in Operation Ore, I have found, was flawed. On 2 October 2002 in Fort Worth, Texas, incorrect evidence was handed to a British police officer by Nelson. He swore it as true evidence and was backed up by Mead. The evidence was then distributed throughout Britain, shown on TV and paraded in courts up and down the land.
The objective of Operation Ore was the protection of vulnerable children from adult abuse and harm. But the mistakes meant huge quantities of police, technical and social work resources were misdirected to some futile and ill-founded investigations. The worse result was damage to innocent lives, and the welfare of families and children.
In Britain to date, 4,283 people and their families have had experiences similar to 'Adam Smith', and another 3,000 computer users still on the Operation Ore target list could face similar treatment.
If any one of these people has not been broken by the experience, no-one I know is aware of them. Many have contemplated self harm under the toxic pressure of these investigations, and some have seen it through. On 8 January 2005, Royal Navy commodore David White, commander of British forces in Gibraltar, took a one-way trip into his swimming pool. He was the 33rd such victim of Operation Ore.
Britain's experience has not been alone. The same events have been repeated around the world. In Ireland, Canada, and Australia, similar tragedies and deaths have occurred.
Their common cause was a 1999 police operation in Fort Worth, Texas. Billed as the exposure of the world's largest 'paedophile ring', America's 'Operation Avalanche' had swelled by 2002 to a global crusade.
The entire investigation depended on computer evidence. What was on the Internet, who logged in to it, when and how? On this digital sword, many lives and careers would be tested and some would end.
Landslide goes down
Detective Constable Sharon Girling of the National Crime Squad, honoured with an OBE in the 2005 New Year's honours list, is a stalwart police footsoldier in the investigation of paedophile activity on the Internet. Her first big computer case, Operation Cathedral in 1998, involved an unquestionably savage group of men who exchanged images and videos of children being abused and violated. DC Girling was employed to track down some of the child victims. And it was this work that led to her being given a starring role in the 2000 Texas trial of Thomas and Janice Reedy, who founded Landslide in 1996.
Ironically, Landslide was set up in response to the US Communications Decency Act of 1996, which seeks to prevent minors from seeing sexually explicit adult material on the Net. The industry came up with a simple, effective answer: blocking access to adult sites except for people who could prove they were old enough to have a credit card. Subscribers paid a small annual fee to one of these merchants and were given a password and ID for a range of porn or sex chat sites. Generally called Adult Verification Services (AVS), they continue to flourish.
Late in 1998, Landslide branched out to new porn services with a service called Keyz. With AVS, people might buy six months' access to over 5,000 sites for about $50. With Keyz, they paid for access to only one site, perhaps for as little as a week. By the time Landslide was closed down, there were nearly 400 sites available through Keyz: some were adult, and some were clearly about children.
In the spring of 1999, the National Center for Missing and Exploited Children (NCMEC) complained to the US Postal Service (which polices the Internet in the US) that Landslide's Keyz service was providing access to child porn sites.
NCMEC's complaints were accurate and in May 1999 Dallas Detective Steven Nelson began a covert investigation. During the summer, he bought 12 subscriptions in a false name. After getting his passwords, he hooked his computer up to a simple spider program called Web Buddy. He filled his drive with the contents of each site, at least to the extent that the links worked. Then, with the assistance of Postal Inspector Michael Mead, Nelson prepared to raid Landslide. This was Operation Avalanche.
On 8 September 1999, the Feds hit Landslide's offices at Seaman Street, Fort Worth. They seized two Sun computers and everything digital in sight. Initially released on bail and bullish, the Reedys protested their innocence and carried on trading in adult porn. They hadn't been supplying child images themselves, they said, but had only provided a portal to other sites. The actual suppliers - the child porn webmasters - were beyond the reach of the USPIS, in south east Asia, Russia or its republics. When Landslide closed, they took their sick trade elsewhere. They were never apprehended, whereas the Reedys were convicted of 89 offences of possession and distribution of images of children. Eight months later, a Texas court sentenced Reedy to 1,335 years of imprisonment - 15 years consecutive imprisonment for each image and video that Nelson had grabbed with his Web Buddy software (although the sentence was later reduced to 180 years).
A matter of record
On examining the Landslide computers, the USPIS found that Landslide had kept a record of hundreds of thousands of transactions in its databases. There were also gateway links to 5,700 websites around the world. Of the 390,000 subscription transactions, 35,000 related to the US itself. The rest were spread around the world, including 26,462 transactions with 7,272 individuals in the UK. Landslide only operated one SQL database, so subscribers to the adult verification service were lumped in with those who had paid for or requested Keyz sites, of whatever kind.
With Reedy incarcerated, the US cops set about sharing the data they had found. The names of subscribers to every site were sorted by country and sent out through Interpol. Each package contained details about Landslide that suggested that all those identified were to be treated as suspect child abusers.
The US government approached its citizens differently from Britain. Instead of branding every name on the list as a paedophile, officials carefully profiled and investigated selected individuals against whom there was fresh evidence of making indecent images of children or of actual abuse. In respect of the 35,000 US records, only 144 houses were searched and 100 people charged with the trafficking of child pornography through the mail and via the Internet.
When the USPIS packets reached Britain, the National Criminal Intelligence Service (NCIS) launched Operation Ore, a large, costly, high-profile police operation and Britain's biggest ever computer crime case. Fraud, even murder cases, had sometimes to take second place to the tide of potential child porn filth to be checked.
Except, all too often, it wasn't. After days or weeks of imaging hard disks, enduring home videos, and scrolling through recovered images and fragments, there might be nothing. Or, after all that work, they might find images of a few girls in a porn trove of thousands of pictures, whom a court might think under rather than over 16. Perhaps some deleted thumbnails of actual children that had been delivered, unknown to the user, as pop-ups from a malicious page they chanced to visit.
Good evidence was found in many cases. Even if after three years there was no record of original transactions with Landslide on the seized computers, there might be subdirectories filled with clearly prepubescent images, and Internet search histories on Google or elsewhere into which the user had typed incriminating terms.
Evidence from good computer forensics is frighteningly compelling. Encase, the most widely used software search tool, can plunder a hard disk for incredible amounts of buried and lost detail left behind by Windows. Original directories in a reformatted drive can be recreated, long lost Internet histories brought to life, and cache images once glimpsed years earlier served up. On any computer connected to the Net, especially without competent protection, illegal child images can just turn up. In two cases where I worked as a computer forensic expert, the police found a handful of child images. This was prima facie evidence. Both men were committed to Crown Court for trial.
But Encase can work for both sides. Pull down the timeline of the thousands of indexed fragments it finds and you may discover the HTML code that carried the offending pictures. Look back a few seconds and you could find previous HTML and within it the window open commands that can mark unwanted pop-ups. When this was pointed out, the Crown Prosecution Service withdrew its case.
But by this time, the innocent and acquitted were immensely harmed in their private and personal lives, perhaps having lost employment, income, friends and reputation. Many Ore defendants have not been fortunate enough to be well advised, legally or technically. Under pressure to get results and to get on, many police forces asked defendants to plead to minor charges or accept a caution. With no prison sentence, not even a fine, it may sound like an easy way out. But with every caution or conviction comes mandatory membership of the Sex Offenders' Register, and with that the certainty of stigma and the enduring fear of public exposure.
The clues to the flaws in the evidence were there for those with the eyes to see. Look again at the image on p152, exhibit 'SAN/1'. It is a slightly blurred photograph (not a screen grab) of a Windows 98 machine running Internet Explorer. Look at the right-hand side. There is a slider bar, showing that what is being seen is less than one-third of the full page. The top and most of the contents are missing. The image has been cropped, concealing most of the page.
Look again, this time at the web address space below the toolbar. The front page address for Landslide was www.landslide.com. This is not it. Whatever is there in the blur, it is too long to be the Landslide front page address. When I saw this image a year ago, I knew something was very wrong with the evidence.
Unknown to the Texas detectives, there is another place where you can get at the Internet's historical truths. The Internet Archive, also known as the Wayback Machine (www.archive.org), is a not-for-profit foundation based in San Francisco. The Archive's computers have been crawling the Web since 1996, building a huge, searchable historical archive. The Archive, I found, had recorded what the Landslide website really looked like in 1999.
From the Archive, I retrieved a series of front pages from Landslide's beginnings in 1996 through to April 1999, just before the police investigation began. There were no 'child porn' buttons nor any place where one could be. I also found the real page that had, one occasion only, displayed the notorious banner. Located at www.avs.landslide.com/avs/index.html, it was an internal page for Landslide's adult AVS service. At the very bottom of the page were two advertising spaces, controlled by a third-party banner swap service. Whatever banners appeared there were not - could not - have been part of Landslide or Keyz.
I wasn't the first person to spot this. In January 2003, as the Ore raids mounted into the thousands, the National Crime Squad in London received copies of all the computer files used for the 1999 US investigation. Among the computer files were copies of web pages recorded by Nelson. One file was a copy of the real Landslide front page, dominated by the company's logo.
On 5 February 2003, Detective Constable Girling circulated a short witness statement, setting the record straight and producing the real Landslide front page.
NCS passed the US computer files to a specialist computer forensic company called CELT, with instructions to rebuild the Landslide and Keyz web pages. At CELT, expert Dr Sam Type found more contradictions to the American evidence. Nelson and Mead had both sworn statements that Keyz websites could be reached from the Landslide homepage. 'Absolutely no way,' reported Dr Type. After rebuilding the Texas website, she dismissed the idea that Keyz was a service devoted to child porn.
In a further report in November last year, Dr Type confirmed that the 'Click here' child porn advertisement was never seen on the Landslide front page. It was 'actually the AVS front page', she wrote. The 'child porn' banner ad, she found, wasn't on any of Landslide's computers; it had come from elsewhere.
This February, a British court required Mead's attendance for an Operation Ore case. He gave evidence by means of a satellite video link from Texas to the Crown Court in Derby. On oath, Mead stated that he and Nelson had only ever seen the 'Click Here Child Porn button' appear once, at the very start of their investigation. He accepted that the photograph only showed part of the page. 'The child porn link was at the bottom,' he said.
He was asked: 'In June 1999, it is likely that the 'Click here for child porn' was not on the Landslide's homepage?'
'Correct,' he replied.
The Derby jury found the defendant not guilty. Although his barrister forbore to say so, Mead's admissions took apart the impression Nelson had given two years before. Mead had previously backed up Nelson's story. In a sworn statement given to a British police officer in 2 October 2002, Mead had said: 'During the time we monitored the website, the banners did not alter in any way.' He had changed his story.
Trial of the mind
Establishing these errors does not mean that everyone suspected in Operation Ore was falsely and unfairly accused. Far from it. But the issues revealed above have been combined with carelessness, a media rabble and a tabloid-feeding frenzy to produce systematic injustice.
My work so far has led to three Ore defendants being acquitted and to all the American evidence being ditched in respect of a fourth. But even for those never charged, or acquitted before trial, the experiences are so scarring that no-one wants to talk.
The sole exception I have encountered is a man who runs his own computer-programming company. Like many men, from time to time he would signed up for adult images on the Net. In the summer of 1999, he saw that his credit card details had been used over and over again on the Landslide website. He complained quickly, got a full refund and thought no more of it. Until the knock on his door three years later.
'It is a trial of the mind,' he said. 'I lost mine at the time. If people are guilty, they can say to themselves, yes, been there, done that. But if you have not, then it is impossible to make sense of what is happening to your life.'
When he proved to the police that the information he would given for adult access had been stolen and then reused at Landslide to send money to child porn merchants, he was told that he was innocent. He would had to wait, but 'it was less than two months, investigated, cleared, no issue'.
The records suggest that because of the media and police enthusiasm to hunt down supposed Internet paedophiles, important questions about the evidence were never asked, or asked in time. As recently as last December the police were still unwilling to admit to the House of Commons that thousands of names on the Landslide list were not paedophiles and were known to have paid only for adult material.
Through no fault of their own, many people and their families will never recover from the false stigma of having been associated with child pornography. They are the victims of a combination of technical naivety and fear, fed by a media circus demanding fast results and the exposure of big names. As the Internet continues to become more transparent, the risk is that the stage may be set for a 21st century witch-hunt.
The report of the police raid on Adam Smith is fictitious but based on many similar accounts.
Duncan Campbell is an investigative journalist specialising in privacy, civil liberties and secrecy issues. His best known investigations, including uncovering the existence of the GCHQ, have led to major legal clashes with successive British governments. Here he writes exclusively for PC Pro following his involvement as an expert witness in a number of Operation ore investigations. Email: firstname.lastname@example.org