State of Connecticut v. Julie Amero
Encyclopedia
State of Connecticut v. Julie Amero is a court case in the 2000s concerning Internet privacy and DNS hijacking
(specifically involving New.net
). The defendant in the case, Julie Amero (born 1967), a substitute teacher, was previously convicted of four counts of risk of injury to a minor, or impairing the morals of a child, as the result of a computer that was infected with spyware
and DNS hijacking software; the conviction was vacated on appeal.
, Connecticut
. The teacher's computer was accessed by pupils while the regular teacher, Matthew Napp, was out of the room. When Julie took charge, the computer started showing pornographic
images.
On January 5, 2007, Amero was convicted in Norwich Superior Court on four counts of risk of injury to a minor, or impairing the morals of a child. Her sentencing was delayed four times after her conviction, with both the prosecution and judge not satisfied that all aspects of the case had been assessed. The felony charges for which she was originally convicted carry a maximum prison sentence of 40 years.
On June 6, 2007, a New London superior court judge threw out the conviction of Amero, she was granted a new trial and entered a plea of not guilty.
On November 21, 2008, Julie Amero pled guilty to a single charge of disorderly conduct before Superior Court Judge Robert E. Young in Norwich., paying a US$100 charge and forfeiting her teaching credentials.
protection to prevent inappropriate pop-ups. The school used the Symantec
WebNOT filter
; however, it was not licensed for software updates and so did not block newly discovered pornographic websites.
Computer experts believe that spyware and malware
programs hijacked the machine’s browser so that it visited pornography sites without prompting and created the computer logs that helped convict Amero. According to the defense's expert witness, W. Herbert Horner, the defense at the first trial was not permitted to present prepared evidence in support of this theory. On March 6, 2007, a $2,400 advertisement appeared in the Hartford Courant signed by 28 computer science
professors who said that they think that Amero could not have controlled the pornographic pop-ups. It was eventually discovered that the uncontrollable pop-ups were spawned by a Spyware program named NewDotNet which had been installed on October 14, 2004, 5 days prior to the alleged crime.
Norwich Police Detective Mark Lounsbury is the "computer forensics expert" who was used by the prosecution to help convict her. Lounsbury testified that he solely relied on ComputerCop Professional for his forensic analysis. By the company’s own admission, the program is incapable of determining whether a site was visited intentionally or accidentally.
A paper in the 2007 Virus Bulletin Conference highlighted many other blunders. Amongst the most noteworthy, Detective Lounsbury stated in the trial that a red link proved that Amero had deliberately clicked on the link to visit a particular pornographic page. Huge blown up pictures were shown to the jury. In fact, forensic investigation showed that the link visited color for the browser was olive green. The link was colored red because there was a font tag on the page turning the link red. Further analysis of the cache on the machine and also of independent firewall logs showed that the page had never even been visited, let alone deliberately visited. Thus, one of the key pieces of prosecution evidence was actually completely technically incorrect.
An essay on the case by Nancy Willard (J.D.) at CSRIU describes Amero going for help when she was unable to prevent images popping up. At the original trial Detective Mark Lounsbury for the prosecution testified that the computer was never checked for the presence of malware. The case gained national attention when Alex Eckelberry
, then president of Sunbelt Software, championed the case on his blog and ultimate led a team of forensic researchers to examine the trial testimony and the contents of the school computer's hard drive.
DNS hijacking
DNS hijacking or DNS redirection is the practice of redirecting the resolution of Domain Name System names to other DNS servers. This is done for malicious purposes such as phishing; for self-serving purposes by Internet service providers to direct users' HTTP traffic via the ISP's own webservers...
(specifically involving New.net
New.net
New.net is an alternate DNS root system which is enabled via NewDotNet, a DNS hijacker application, which is usually bundled with legitimate software...
). The defendant in the case, Julie Amero (born 1967), a substitute teacher, was previously convicted of four counts of risk of injury to a minor, or impairing the morals of a child, as the result of a computer that was infected with spyware
Spyware
Spyware is a type of malware that can be installed on computers, and which collects small pieces of information about users without their knowledge. The presence of spyware is typically hidden from the user, and can be difficult to detect. Typically, spyware is secretly installed on the user's...
and DNS hijacking software; the conviction was vacated on appeal.
Timeline
On October 19, 2004, Julie Amero was substituting for a seventh-grade language class at Kelly Middle School in NorwichNorwich, Connecticut
Regular steamship service between New York and Boston helped Norwich to prosper as a shipping center through the early part of the 20th century. During the Civil War, Norwich once again rallied and saw the growth of its textile, armaments, and specialty item manufacturing...
, Connecticut
Connecticut
Connecticut is a state in the New England region of the northeastern United States. It is bordered by Rhode Island to the east, Massachusetts to the north, and the state of New York to the west and the south .Connecticut is named for the Connecticut River, the major U.S. river that approximately...
. The teacher's computer was accessed by pupils while the regular teacher, Matthew Napp, was out of the room. When Julie took charge, the computer started showing pornographic
Pornography
Pornography or porn is the explicit portrayal of sexual subject matter for the purposes of sexual arousal and erotic satisfaction.Pornography may use any of a variety of media, ranging from books, magazines, postcards, photos, sculpture, drawing, painting, animation, sound recording, film, video,...
images.
On January 5, 2007, Amero was convicted in Norwich Superior Court on four counts of risk of injury to a minor, or impairing the morals of a child. Her sentencing was delayed four times after her conviction, with both the prosecution and judge not satisfied that all aspects of the case had been assessed. The felony charges for which she was originally convicted carry a maximum prison sentence of 40 years.
On June 6, 2007, a New London superior court judge threw out the conviction of Amero, she was granted a new trial and entered a plea of not guilty.
On November 21, 2008, Julie Amero pled guilty to a single charge of disorderly conduct before Superior Court Judge Robert E. Young in Norwich., paying a US$100 charge and forfeiting her teaching credentials.
Controversy
The old computer, along with the school network, lacked up-to-date firewall or anti-spywareSpyware
Spyware is a type of malware that can be installed on computers, and which collects small pieces of information about users without their knowledge. The presence of spyware is typically hidden from the user, and can be difficult to detect. Typically, spyware is secretly installed on the user's...
protection to prevent inappropriate pop-ups. The school used the Symantec
Symantec
Symantec Corporation is the largest maker of security software for computers. The company is headquartered in Mountain View, California, and is a Fortune 500 company and a member of the S&P 500 stock market index.-History:...
WebNOT filter
Content-control software
Content-control software, also known as censorware or web filtering software, is a term for software designed and optimized for controlling what content is permitted to a reader, especially when it is used to restrict material delivered over the Web...
; however, it was not licensed for software updates and so did not block newly discovered pornographic websites.
Computer experts believe that spyware and malware
Malware
Malware, short for malicious software, consists of programming that is designed to disrupt or deny operation, gather information that leads to loss of privacy or exploitation, or gain unauthorized access to system resources, or that otherwise exhibits abusive behavior...
programs hijacked the machine’s browser so that it visited pornography sites without prompting and created the computer logs that helped convict Amero. According to the defense's expert witness, W. Herbert Horner, the defense at the first trial was not permitted to present prepared evidence in support of this theory. On March 6, 2007, a $2,400 advertisement appeared in the Hartford Courant signed by 28 computer science
Computer science
Computer science or computing science is the study of the theoretical foundations of information and computation and of practical techniques for their implementation and application in computer systems...
professors who said that they think that Amero could not have controlled the pornographic pop-ups. It was eventually discovered that the uncontrollable pop-ups were spawned by a Spyware program named NewDotNet which had been installed on October 14, 2004, 5 days prior to the alleged crime.
Norwich Police Detective Mark Lounsbury is the "computer forensics expert" who was used by the prosecution to help convict her. Lounsbury testified that he solely relied on ComputerCop Professional for his forensic analysis. By the company’s own admission, the program is incapable of determining whether a site was visited intentionally or accidentally.
A paper in the 2007 Virus Bulletin Conference highlighted many other blunders. Amongst the most noteworthy, Detective Lounsbury stated in the trial that a red link proved that Amero had deliberately clicked on the link to visit a particular pornographic page. Huge blown up pictures were shown to the jury. In fact, forensic investigation showed that the link visited color for the browser was olive green. The link was colored red because there was a font tag on the page turning the link red. Further analysis of the cache on the machine and also of independent firewall logs showed that the page had never even been visited, let alone deliberately visited. Thus, one of the key pieces of prosecution evidence was actually completely technically incorrect.
An essay on the case by Nancy Willard (J.D.) at CSRIU describes Amero going for help when she was unable to prevent images popping up. At the original trial Detective Mark Lounsbury for the prosecution testified that the computer was never checked for the presence of malware. The case gained national attention when Alex Eckelberry
Alex Eckelberry
Alex Eckelberry, born in Paris, France, is an American entrepreneur and technology executive. Most recently, he was vice president and general manager of the security business unit for GFI Software. Previously he was CEO of Sunbelt Software for eight years up to the sale of Sunbelt Software to GFI...
, then president of Sunbelt Software, championed the case on his blog and ultimate led a team of forensic researchers to examine the trial testimony and the contents of the school computer's hard drive.
External links
- Julie Amero's blog
- Rick Green, A Court Case Doubling As An Obscenity, Hartford Courant
- Crime and punishment and technology
- Julie Amero Trial Transcript - "intended to be a significant improvement over the Norwich Bulletin version"
- Mouse-Trapped - A forensic and legal overview of the Julie Amero trial
- Radley Balko, The Prosecution of Julie Amero, Reason Magazine