Child Pornography caused by a Virus?

So you seize a computer because of suspected child pornography and you find it stuffed in every corner of the hard drive. Case closed. Matter resolved. Bad guy goes to jail. Move on to next case. Right? Not so fast. This guy is adamant that he did not download these images. Things just aren't adding up. So what could have happened? Is it possible that a virus has implanted itself on the bad guys computer and caused it to surreptitiously download child pornography? The simple answer is, well, yes!!

In a 2007 case from Massachusetts a workers compensation investigator had several child porn images discovered on his work computer. He was fired and spent the next 11 months trying to rebuild his reputation and life. It was later determined that a virus found on his computer was responsible for constantly searching 40 separate child pornography sites for new images/videos every minute. This could not be done by physically searching for the items. A virus had performed this feat. It was also determined that the person who had infected his computer could access his computer and actually store his child porn images on this poor guys work computer.

I realize that storing illegal images on another persons computer has its limitations. The computer must be online. The machine which stores the image may have the images deleted by the user. And there is still a digital trace between the two machines. (An experienced examiner would be able to find this connection.) That being said, child porn producing viruses are very rare. It is more probable that a user would be redirected to a child porn site while looking for a legitimate adult porn site.

WHAT CAN BE DONE?

If you have a case where you suspect that a virus may be involved, what can you do? Here are some tips for your investigation:

* Determined if the owner was even using the computer at the time of the download.
* Determine if more than one image was downloaded at a time.
* Were images downloaded or cached due to being redirected from an adult porn site?
* Check on the anti virus on the computer; Has it been recently updated?

Now these are not the only tricks to use, but its a place to start. More and more defendants are using the "Virus invaded my computer" defense. And in the large majority of the cases they are wrong. But I hope this gives you a little "heads-up" on the this possibility.