Infallibility as the backbone of Forensic Computer Investigations: the Case of Federation v. Kirk

Imagine: you are asleep in your bed next to your spouse. It is just after 5:00 a.m., not that you would know because typically at 5:00 a.m. you are still asleep. On this particular morning, however, you awaken to the sound of a team of SWAT officers who have broken down your front door and are storming your bedroom. Before you can react, you are handcuffed, in your underwear, and taken from your home. Somewhere in the confusion of the next several hours, you are told that you are charged with possession of child pornography. Because of the specific charge, you will not be eligible for release pending trial.

Sounds like a nightmare? The truth is that scenarios similar to this occur with surprising frequency in the United States. To make matters worse, there are often no witnesses to the offense. Rather, these cases tend to be based on “forensic” experts who will testify to the material located on the computer and the time the material was downloaded. When weighed against the testimony of an expert and the evidence downloaded from the defendant’s own computer, a defense of “I didn’t do it”, even if true, rarely works.

The truth is that we live in an age where most people, which means most jurors, believe in the infallibility of technology and have lost any compassion or understanding for the wrongfully accused. Instead, a combination of the heinousness of an offense and the belief that computers do not lie is a deadly combination for a defendant expecting a fair trial. In fact, the pressure the federal government can bring on a defendant can be so great that it will often cause an innocent person to plead guilty. The reality is that a five-year sentence for a crime you did not commit is much better than a twenty-year sentence for a crime you did not commit.

One of the first trials where a computer played a pivotal role in the trial’s outcome was the famous court-martial of Captain James T. Kirk of the United Federation of Planets. Actually, the court-martial was set in the 2260’s, but the television show was produced in 1967. In the show, the Starship Enterprise encountered an unexpected ion storm. A former friend of Captain Kirk, Lieutenant Commander Finney, was attached to an exterior pod on the starship to take scientific readings when the starship encountered the storm. Because of the severity of the storm, Captain Kirk was forced to order the jettisoning of the pod containing Lieutenant Commander Finney in order to save the starship. As we all know, ion storms are extremely hazardous to starships, and in the dangerous conditions involving ion storms, the jettisoning of a pod to save the starship is the only reasonable course of action.

Except in this case. When the Enterprise docked at Star Base 11 for repairs, a review of the computer records reveals that Captain Kirk actually ordered the jettisoning of the pod before the ion storm had become dangerous thereby intentionally causing the death of his former friend. Charges are quickly preferred and referred against Captain Kirk, and in very short order, a court-martial convened to hear the case against him.

In the court-martial, the prosecutor attempted to prove that Lieutenant Commander Finney hated Captain Kirk because of an incident in the past where Captain Kirk had taken official action against him thereby damaging his career. The government theorized that Captain Kirk must have reciprocated Lieutenant Commander Finney’s hatred. It was this theoretical hatred the prosecutor argued, that drove Captain Kirk to kill a fellow Starfleet officer.

Now, as anyone who watched Star Trek over the last 50 years knows, Captain Kirk is utterly incapable of petty emotions, like hate, and he never, ever makes a mistake (except in one episode where the transporter split him into two people and one of those people made a mistake). In fact, in another episode Captain Kirk showed enormous compassion for a Gorn—a lizard person—who had attacked and destroyed an unarmed human settlement leaving no survivors. The evidence of motive is therefore flimsy and would likely have collapsed under its own weight. The government had other, more powerful, some might say infallible, evidence.

The most compelling evidence against Captain Kirk came from the Enterprise’s computer and was presented through the testimony of Captain Kirk’s best friend, Commander Spock. Spock was the starship’s science officer and was known as an extraordinarily intelligent and incorruptible Vulcan. Here is the key direct examination of Commander Spock:

• Prosecutor: Mr. Spock, you designed the current program for the Enterprise computer, yes? [apparently leading questions on direct examination are no longer objectionable in the 26^th Century]
• Mr. Spock: Yes.
• Prosecutor: In your opinion, are they capable of error?
• Mr. Spock: No. I tested them myself by playing three-dimensional chess. They are infallible.

Three-dimensional chess is really hard to play, and if the computer was able to play three-dimensional chess with Mr. Spock, then clearly, the computer was infallible. And so, with infallible evidence, the court martial had no choice but to convict Captain Kirk thereby ending the career of Starfleet’s youngest and most resourceful starship commander. As a result, Starfleet lost the upcoming war with the Klingons, and the United Federation of Planets dissolved into a patchwork of conflicting alliances after the Klingons seized the most valuable planets for their ever-growing empire.

Except that is not what happened. Turning to the ship’s infallible computer, the defense counsel has the computer access the heartbeats of all Enterprise personnel and then eliminate the heartbeats of all personnel in order. After all known heartbeats are eliminated, the heartbeat of a single person remained. A search of the ship located Lieutenant Commander Finney, who was, in fact alive. He had faked his death and reprogrammed the computer to make it look like Captain Kirk had killed him in his own effort to get revenge on Captain Kirk. In the end, the charges were dropped, Captain Kirk was restored to duty, and the Klingons were kept at bay for the entirety of the two seasons of Star Trek and for years after in its progeny.

What lessons do we learn from this famous case? First, computers are infallible. No evidence is better than computer forensic evidence. Were it not for the computer accessing the heartbeat data of all of the ship’s personnel, Lieutenant Commander Finney’s dastardly plan would never have been uncovered. Although we typically think of computer forensic evidence as government or prosecution evidence, it can also be vital to the defense. The government frequently uses cell phone tower data to show that the defendant was in close proximity to the location of a crime or computer forensic data to show that child pornography was downloaded when a defendant was present in the home. This same data, however, can be defense evidence. Cell phone tower data can be used to show that the defendant was in another city or state at the time of an alleged offense. A computer forensic examination can also show that child pornography was downloaded at a time when the defendant was known to be 2,000 miles away speaking before an audience of 300 people. There can be no more compelling evidence of innocence.

The second lesson is more important than the first. Computers are not infallible, or, at the very least, they can be manipulated. Lieutenant Commander Finney was able to manipulate the Enterprise computer. More recent (or in the distant past depending on your perspective) is the case of Julie Amero. In 2004, Ms. Amero was working as a substitute teacher when a computer she was using to teach middle school students began showing pornographic “pop-ups”. Despite Ms. Amero’s best efforts, she could not shut down the computer. As a result, dozens of pornographic images flashed before the eyes of innocent and unsuspecting middle school students who were, no doubt, scarred for life. Ms. Amero was charged with serious felony charges carrying a maximum of 40 years in prison.

In January of 2007, Ms. Amero went on trial, and the primary witness against her was Detective Mark Lounsbury of the Norwich, Connecticut Police Department. Detective Lounsbury was more than a mere police detective. He was a “forensic investigator” who conducted a forensic examination of the computer. He concluded that Ms. Aero had intentionally accessed and downloaded the pornographic images that were displayed to the students. Based upon this infallible evidence, Ms. Amero was convicted and faced serious prison time.

But there were errors, serious errors, with Detective Lounsbury’s “investigation”. One of the biggest was the fact that he used a software program known as “ComputerCop” to conclude that Ms. Amero had intentionally visited the site in question. The developer of ComputerCop, however, quickly acknowledged that the program cannot be used to determine if an individual’s visit to a site was intentional or unintentional.

After the trial, multiple experts who reviewed the evidence concluded that spyware and malware had highjacked the computer’s browser and that Ms. Amero had no ability to control the pop-ups. The computer, which was owned by the school, did not have up-to-date firewalls or virus protection software. In short, the evidence Detective Lounsbury used to arrive at his conclusions was not reliable, and his conclusions, as well as the conviction of Ms. Amero, were flawed. Ms. Amero’s conviction was set aside and a new trial ordered. In a final act of injustice, prosecutors required her to plead guilty to a minor disorderly conduct charge and pay a fine of $100. The fact that Ms. Amero was even charged was an injustice.

The great English jurist William Blackstone in his Commentaries published in the 1760’s wrote that “it is better that ten guilty persons escape than one innocent suffer”. Later, Benjamin Franklin increased this ratio by saying that “it was better for 100 guilty people go free than one guilty person be convicted”. We no longer live in that era, and it would appear that in modern America, the conviction of the innocent is no longer a matter of public concern. Police officers—like Detective Lounsbury, are viewed as “heroes”, and people place signs in their yard voicing their support for the police. You cannot count on the goodwill of your fellow citizens on the jury.

There are limitations to computer forensic analysis, but as cybercrime and the knowledge and skill of computer hackers in the world increase, the ability of a forensic analysis to find the computer hackers’ fingerprints decreases, if law enforcement even has a desire to find evidence of a hacker. It may be that in the not-too-distant future, or maybe even now, hackers will be able to enter a computer, plant “evidence” or a crime like child pornography and then leave the computer without any evidence that they were ever there. A simple tip to law enforcement would then be sufficient to a have authorities raid the targets home and arrest him or her., Ultimately, an innocent person ends up in prison.

The world can be a scary place.