Convicted sex offender let off the hook for child abuse image collection

by Lisa Vaas on January 25, 2013

Just because a neighbor saw titles for child abuse image files on an unsecured wireless network doesn't justify the law barging in and searching for the images, ruled an Oregon judge in the US.

The decision reversed the judge's previous conviction of John Henry Ahrndt, who, it turns out, was already a convicted sex offender.

In a ruling filed January 17, Senior District Judge Garr M. King said that Ahrndt's Fourth Amendment rights ensuring protection against unreasonable searches had been blown when a deputy got the go-ahead from his supervisor and clicked on one of the titles:

There is no evidence [Ahrndt] intentionally enabled sharing of his files over his wireless network, and there is no evidence he knew or should have known that others could access his files by connecting to his wireless network. [The deputy's] action of clicking on the image in [the neighbor's] iTunes directory to open the image violated Ahrndt’s Fourth Amendment rights.

Here's how the files were discovered in the first place: In February 2007, one of Ahrndt's neighbors - a woman identified as "JH" in court documents - got onto his unsecured wireless network when her own network went down.

Ahrndt's network was coming off a Belkin 54G router with a default setting of "no security".

JH opened up iTunes and noticed another user's library, called "Dad's LimeWire Tunes", available for sharing.

She then opened the folder and saw file names that got her on the phone with her local sheriff's office, pronto.

Some of the titles were very sexually explicit. Some other titles were used in conjunction with acronyms indicating age, such as "5yoa" and "8yoa".

Washington County Deputy John McCullough responded to JH's call a little less than an hour later. He wasn't sure whether he could legally open the files, so he called his supervisor, who gave him the go-ahead.

McCullough later recalled seeing the words "getting raped" and "being raped" in those file names.

Deputy McCullough opened a file and did, in fact, find images of child abuse - a search that Judge King last week deemed unreasonable, finding the evidence unsubmittable.

It's interesting to note the trail of evidence that a group of documents such as these leave on a computer.

According to Judge King's filing, Arnhdt admitted to downloading child abuse images as recently as eight months prior to law enforcement obtaining warrants and searching his home and computers. He'd subsequently deleted the files, though, he said.

Arnhdt told agents that he'd used LimeWire, a peer-to-peer file-sharing application, to download the images. If agents were capable of recovering deleted files, they'd find the images, he told them - specifically, on external hard drives that he'd converted from hard drives of old computers.

Investigators did, in fact, recover traces of the files, including:

• Advertising pages located in an "orphan" file - e.g., one whose parent file had been deleted.
• Images located in a Google Hello "scache" indicating the images had been sent or transmitted. (For a detailed look at how forensics experts find such images, check out this white paper by J. Curl: "Forensic Investigation of Google's "hello" [PDF].)
• An .mpg movie that had been viewed in Windows Explorer or by using a My Computer thumbnail or filmstrip view.
• A deleted file recovered from Ahrndt’s computer.
• Deleted files recovered from his USB flash drive.

Will Judge King's decision be upheld?

A commenter on The Wall Street Journal's coverage of the case thinks not:

joe doaks: … I believe that historically, you are free to look at any ambient electromagnetic radiation you are able to receive and decode. A couple decades back, an over-the-air HBO provider with not-very-sophisticated encryption, found this out the hard way.

I'm no legal expert, but I'd suggest that this argument misses the mark, given that it's not the legality of JH's unauthorized accessing of Arnhdt's network that was in question.

Rather, it was Deputy McCullough's opening of one of the files without a warrant that rendered the evidence unsubmittable.

Regardless of the legal technicalities, it's a good reminder that unsecured wireless networks render files sharable and readable.

This ruling is just one in many that get handed down in child abuse and unreasonable search cases.

I wouldn't count on the courts letting you off the hook if you're up to something reprehensible on an unsecured wireless network.

http://nakedsecurity.sophos.com/2013/01/25/convicted-sex-offender-let-off-the-hook-for-child-abuse-image-collection/

Editor's Note:
I don't know how to feel about this case. Not that I don't find the defendant's actions reprehensible, but it seems to me that this is a play on less security (privacy) for the sake of protecting children. Of course, if you have nothing to hide, you have nothing to fear. Right?