Tuesday, July 3, 2012
Friday, January 30, 2009
THE TRUTH IS SOMETIMES PAINFUL
Well, It's over. The self proclaimed "popular" substitute teacher has plead GUILTY to Disorderly Conduct and has accepted being stripped of her teaching license for, as the media put it, being the victim of a deluge of unrequested, pornographic pop-ups which appeared on the computer terminal in her classroom at the
Following her first conviction, being found guilty by a jury of her peers of committing four counts of Risk of Injury to a Minor, the Norwich Bulletin, one of very few journalistic newspapers in the USA, ran the story noting that the maximum, possible sentence associated with her crimes totaled 40 years, not that she was sentenced to 40 years. That would be absurd. Apparently, it was not absurd to the prolific number of reporters who populate this planet, writing erroneous accounts of events they know nothing about. My favorite reporter is the one and only Rick Green of the Hartford Courant. His "CT Confidential" tale of Amero's plight is Pulitzer Prize winning fictional material. Too bad he erroneously subtitles his fiction with the phrase "What's really happening." In his latest and, hopefully, final chapter, following Ms. Amero's admission of culpability, he spins a tale of vindication. Confidential? . The best quote is:
"But since that dramatic reversal, local officials, police and state prosecutors were unwilling to admit that a mistake may have been made -- even after computer experts from around the country demonstrated that Amero's computer had been infected by "spyware.""
"Spyware", I think Mr. Green means "malware". That's the stuff which infects your computer, usually after you visit those free Porn sites. Besides, the issue was not about "spyware". It was about determining the manner in which the Porn found its way to Amero's computer terminal. Was the porn requested or did it pop-up? Unfortunately the "computer experts" who include the likes of one Alex Eckelberry demonstrated nothing. None of the "computer experts" appeared or testified at Amero's sentencing hearing, prior to that event, or since that event. None of the "computer experts" have presented, published, or posted any evidence that Amero was the victim of a storm of creamy porn filled pop-ups.
The only person who testified on Amero's behalf was Mr. Herb Horner . This was during the original trial only. His testimony was limited as the defense attorney failed to disclose to the prosecution the "evidence" in Mr. Horner's possession which was collected over the course of one year. Why was there no disclosure? Why didn't Mr. Horner present the "evidence" at the sentencing hearing? He did speak of "spyware" and "adware" on the Network Performance Daily site, not "malware", however. Read it here: Attack of the Google Ad Banner and the Mysterious Curly Hairstyle Script .
Mr. Eckelberry writes of great doings, claiming responsibility for overturning the first conviction and for organizing an army of great people who did great things: The Mob Rules But, neither he nor anyone of his expert examiners ever testified in court. They would have been required to testify in order to present any evidence. Mr. Eckelberry still hasn't presented evidence. He has evidence. He wrote me concerning this document, one of many documents which make up the www.orgasm-mystery.com website, a document which was requested by clicking a link:
From: Crime Prevention [mailto:crimeprevention@norwichpolice.org]
Sent:
To: Alex Eckelberry
Subject: Re: Follow-up
Alex,
Is it a pop-up? Is it a malware generated pop-up? Or, is it a document within a site to which someone navigated? It does make a difference. Isn't the original claim that a never ending, deluge of pornographic pop-ups were launched by some nefarious script. That's the story written at Network Performance Daily.
Is the font tag for the link in the homepage source code? Is the link always red. You're right. It doesn't make a difference. It doesn't change the fact that you have one of the documents which answers the question of intent:
Click or Pop?
Mark
From:
"Alex Eckelberry" <AlexE@sunbelt-software.com>
To:
"Crime Prevention" <crimeprevention@norwichpolice.org>
Ok -- then let's seperate this out:
I guess we all agree that red means nothing as a link color, because regardless of link color, relative links, etc., the browser was set to display links in green. Any link she would have clicked on would have been green, not red. So hopefully we can put that to rest.
Now, click vs. popups? That we can discuss at length, but I'm not comfortable in any discussion until I have a forensically valid copy of that drive and the firewall logs for that day. Can you help us get this? I'm happy to fly someone up there for the day to work on the drive transfer, using a write blocker and using the correct utilities.
Alex
From: Crime Prevention [mailto:crimeprevention@norwichpolice.org]
Sent:
To: Alex Eckelberry
Subject: Re: Follow-up
OK,
As I said from the start I'm sticking with the data recovered by ComputerCop Pro until there is contrary data recovered by a more universally accepted tool. I also maintain that any such recovered data, if presented to me, will be forwarded to the prosecution without delay.
My position on the font tag usage is based on the data recovered by the software. As I said, that tag would have to be present in the source code for not only the document associated with the link but also every other document on the site. The use of the tag denotes a change in link color from the default link color. So, if you set your default links color to blue and you wanted one of those links to always be red you'd have to add the font color tag to every document containing that particular link. Well, enough of that.
Concerning the firewall logs. I have not looked at the case at all. I did not investigate this complaint. I just stepped up to the plate in the bottom of the ninth and took a fastball to the head. No good deed goes unpunished. I have read, in several blogs and news articles, that the school had no firewall (hardware and/or software) in place.? I'm sure the investigating officer's complete report has everything including any firewall logs. The defense attorney should have them already but, I will check records and will get back to you in any case. I take it that Mr. Horner has prodded the Ghosted hard drive in a less than sterile manner.
I do have a copy of FTK's Imager and would be happy to create an image for you. I do think a new request to the judge would need to be submitted by the attorney first. Another option would be for me to provide you with an exported copy of ComputerCop Pro's data. You could contact the company and inquire about their software to determine whether or not it is acceptable to you.
Mark
From:
"Alex Eckelberry" <AlexE@sunbelt-software.com>
To:
"Crime Prevention" <crimeprevention@norwichpolice.org>
It had no desktop firewall on the machine, but it did have a Raptor firewall in place. What was expired was the content filter -- WebNot from Symantec.
I'll check with the attnys.
Alex
That was the last I heard from Mr. Eckelberry. It has been close to two years. He never bothered to obtain the firewall logs OR obtain his own mirrored image of the subject drive. No one ever showed up. The document in question was http://orgasm-mystery.com/viagra-cream-for-woman.htm. It was a relative link click from the home page. The link color on the home page for this document was blue. The same link on this particular document was red. As I said in court, the link color did change. As I said, several documents from this website were requested by relative link. Most contained pornographic images. The website is still up. Go to the home page and click the blue link for "female sex enhancers" in the "Female Orgasm" link tree. This is the web document Mr. Eckelberry and I were discussing. Notice the link color is red. Why was Mr. Eckelberry not comfortable discussing the fact the document was requested, not a pop-up? Again, why did he not obtain the firewall logs and a mirrored image of the subject drive?
More evidence can be found in Mr. Eckelberry's own "Technical review of the Trial Testimony State of Connecticut vs Julie Amero", dated March 21, 2007. First, note the date. It was published 15 days after our last email exchange, the email exchange concerning the requested web document at www.orgasm-mystery.com. Secondly, he writes in his technical review:
"Hence, we are unable to complete a full forensic examination on the drive in question without having a bit-for-bit copy of the hard drive, as well as the complete firewall logs for that day (or at least for the morning of
Really, you saw the emails. The offer was made. Mr. Eckelberry had the opportunity to obtain a bit-for-bit copy of the drive in question and the firewall logs. Why did he neglect to get them so he could complete his full forensic examination and view the firewall logs? Read it for yourself at Technical Testimony .
The days browsing didn't stop or start at www.orgasm-mystery.com. It continued for the entire school day. The firewall logs exist and are available for all to see. Request your copy by contacting the Norwich Police Department's Records Division. You can also get your own copy of the case report. It contains tons of evidence which includes the following excerpt:
Evidence documents recovered include a number of document pages from the orgasm-mystery.com web site which were created on
The firewall logs show the request. Here they are:
Oct 19 10:39:18.250 cofirewall httpd[282]: 121 Statistics: duration=4.51 id=WDPwC sent=497 rcvd=26500 srcif=Vpn6 src=10.2.19.252/3629 dstif=Vpn5 dst=38.113.198.192/80 op=
Oct 19 10:39:22.033 cofirewall httpd[77]: 121 Statistics: duration=0.16 id=WDNMH sent=416 rcvd=144 srcif=Vpn6 src=10.2.19.252/3666 dstif=Vpn5 dst=38.113.198.192/80 op=GET arg=http://www.orgasm-mystery.com/images/eb3_42.gif result="304 Not Modified" proto=http rule=2
Oct 19 10:39:52.594 cofirewall httpd[282]: 121 Statistics: duration=0.55 id=WDPyr sent=337 rcvd=25233 srcif=Vpn6 src=10.2.19.252/3668 dstif=Vpn5 dst=66.28.207.155/80 op=
Interestingly enough the http://www.orgasm-mystery.com/oral-sex-technique.htm hasn't changed much, if at all, in the past five years. Visit it for yourself and notice the LINKS for the http://www.cheatinglesbians.com/t2/pps=mystery/tour1.htm porn filled document still exists. Click on one of the links (YOU HAVE TO AS IT"S NOT A POP-UP) and note that it's chock filled with large sized adult pornographic images, so many you'll need to SCROLL down the page to see them all. Just as one of the victim children testified in court, saying Amero was "SCROLLING"....
Subscribe to:
Posts (Atom)
