The Trojan Horse Defense in Cybercrime Cases

Abstract

TABLE OF CONTENTS I. INTRODUCTION II. LEGAL ISSUES A. How the Horse Defense Is Used 1. Raise Reasonable Doubt 2. Negate Mens Rea 3. Establishing the Defense B. How Can the Prosecution Respond? 1. Establish Defendant's Computer Expertise 2. Character Evidence 3. Negate the Factual Foundation of the Defense 4. Alibi Defense C. Summary III. TECHNICAL ISSUES A. Defined 1. Malware 2. The Bot 3. Summary B. The Digital Crime Scene C. Standard Operating Procedure D. What To Do When Malware Is Found E. What To Do When Malware Is Not Found F. New Skills and Technologies IV. CONCLUSION I. INTRODUCTION Aaron Caffrey walked free from Southwark Crown Court last week after being cleared of launching DdoS attack on one of the busiest ports on the United States, even though both the prosecution and agreed that Caffrey's machine was responsible for launching the attack. (1) The Trojan horse defense surfaced in 2003 in several cybercrime cases brought in the United Kingdom. A horse program, variety of malware, (2) is a program that appears to have some useful or benign purpose, but really masks some hidden malicious functionality. (3) Malicious functionality could include anything from downloading contraband files to attacking other computers. In what is perhaps the best-known of these cases, nineteen-year-old Aaron Caffrey was charged with carrying out denial of service attack on the computers of the port of Houston, Texas on September 20, 2001--less than two weeks after the 9/11 (4) The attack froze the port's webserver. (5) The denial of service attack, which was traced to computer at Caffrey's home by U.S. police, was allegedly aimed at taking South African chatroom user called 'Bokkie' offline after she had made comments on IRC attacking the United States. Caffrey allegedly took offense at the comments because his girlfriend at the time, Jessica, was American. (6) Caffrey admitted Jessica was his girlfriend at the time but denied any knowledge of the attacks. (7) At trial, Caffrey admitted being a member of hacker group called Allied Haxor Elite (8) but claimed the evidence against him was planted on his machine by attackers who used an unspecified [horse program] to gain control of his PC and launch the assault. A forensic examination of Caffrey's PC found attack tools but no trace of infection. The case therefore hinged on whether the jury accepted the defence argument that could wipe itself or expert testimony from the prosecution that no such technology (9) While the prosecution was reportedly confident as to the strength of its case, (10) the jury acquitted Caffrey--who faced up to three years in prison--after deliberating for only few hours. (11) The counsel apparently convinced the jurors that a [T]rojan horse armed with 'wiping tool' was responsible, enabling the computer to launch the DoS attack, edit the system's log files, and then delete all traces of the trojan--despite prosecution claims that no such technology existed. (12) A reporter who covered the Caffrey trial gave his assessment of why the prosecution failed: Had the jurors been technology experts, or even computer-literate, I wonder if the ruling would have been the same. I spent most of the first week of the trial in the public gallery and found it didn't take long before the jury's eyes glazed over because the technical arguments sounded like Russian version of Moby Dick that had been translated into English using Babelfish. By the third day, one of the jury members had to be discharged because of severe migraine, which was indubitably brought on by the jargon. The prosecution was confident they had enough evidence to prove their case, which in my own opinion was justified. …