Security pros work to undo teacher's conviction

Security pros work to undo teacher's conviction

What happened after that has become the main point of contention.

A detective on the case using off-the-shelf recovery software arguedthat Amero clicked on pornographic Web links and caused the computer todisplay pornographic pop-up advertisements. However, the defense'sforensic expert, Herbert Horner, stated that a more complete analysisshowed that a harmless hairstyling Web site had actually redirected thePC's browser to pornographic sites, setting off the deluge of offensiveads.

Horner, the principal at Contemporary Computer Consultants, had walked into the courtroom to discuss his analysis but was prevented from doing so in detail because the prosecution argued that they had not had full disclosure of his testimony.

In an interview with SecurityFocus, Horner voiced obvious frustration at his inability to relate all his findings to the jury.

"It is kind of like you have a fire truck and a full tank of waterand you can save everybody, but someone said you can't do that becausethe container you put the water in is against the rules," Horner said.

Prosecutors have also focused on the fact that Amero did not turnoff the computer, though she did go for help during a class break,Horner said.

Both the prosecutor in the case, state attorney David J. Smith, andAmero's attorney, John F. Cocheo, declined to comment for this story,prior to the sentencing hearing on March 2. The public filings in thecase could not obtained in time for this article.

The team of security professionals analyzing the forensic evidenceare not yet ready to release an opinion, but one thing is clear,Eckelberry said: The classroom's machine was infested with spyware andthe school did not have adequate protections in place.

It's an issue that has refocused some of the debate on administrators at Kelly Middle School. School officials recently told parents that the incident could never happen today, because the district has installed security software and a filtering system.

"This was a Windows 98 SE machine with IE 5 and an expired antivirussubscription," Eckelberry said. "It hadn't been updated since August,and there was no anti-spyware, no pop-up protection, no firewall and nocontent filters. Regardless of whatever happened, this machine was amachine that should not have been on the Internet."

This article originally appeared in Security Focus.