Computer data at heart of porn trial

PALMER — A former Anchorage police officer charged with downloading child pornography will face a jury after months of pretrial motions illustrated the difficulties of proving possession of electronic data.

Bryan Herrera was on parole for similar charges in 2007 when his parole officer made a routine visit to his house in Palmer. There was a laptop computer on the kitchen table, and Herrera admitted to being connected to the Internet, a violation of his parole. He also admitted to having adult pornography and erotic — but not necessarily explicit — images of children on the computer.

The parole officer performed a field search of the hard drive, also within the limits of the terms of parole. She confirmed the images Herrera referred to and found images of children in a bathtub (which turned out to be Herrera’s children). She found a website in the computer’s history that had a title indicative of child pornography.

The parole officer turned the computer over to the Alaska State Troopers, who enlisted the help of the Anchorage Police Department’s cybercrime unit. But before either performed a forensic search of the hard drive, troopers obtained a warrant to legally do so.

The forensic exam found Herrera had been using the peer-to-peer file sharing software LimeWire to download music, videos and images. The computer also had a wiper program, a piece of software designed to automatically delete all the downloaded files at a preset interval. All the cookies — bits of information stored on the computer about past Internet sites visited — had been cleaned.

Anchorage Police Detective Mark Thomas explained how each downloaded file comes with a unique and permanent tag — similar to a person’s DNA — called a SHA-1 value. Even when the file is deleted, this SHA-1 value remains on the computer in what’s called the unallocated space until it is overwritten by a subsequent file or program.

Thomas determined a number of the SHA-1 values in the unallocated space corresponded with images and videos of child pornography. The file paths on a few of the files indicated Herrera had downloaded them from LimeWire into a folder marked “Shared” for an unspecified amount of time. Thomas also testified to search terms he found on a text record all computers keep of Internet activity. The searches done from Herrera’s computer include terms known to retrieve child pornography.

Recently confirmed by a case titled Worden v. the state of Alaska, simply viewing child pornography is not a crime. To make the charges stick, the prosecution had to prove Herrera had possession of the files defined by having “dominion and control” over the material.

Arguing for the state, Assistant District Attorney Rachel Gernat said Herrera made the affirmative act to downloaded the files into a folder. Once in that folder, he was free to do what he wanted with them: hence, dominion and control.

Palmer Public Defender John Richard said the state could not prove Herrera had anything more than fleeting possession of the images, which is different than dominion and control. The “Shared” folder is the default setting for where LimeWire puts files once downloaded. There is no way to preview what’s being downloaded until you open it on your computer, Richard said. Thus, Herrera could have unknowingly downloaded the files, deleting them after he learned what they were.

Gernat rebutted that this is where the search terms come into consideration. What’s more, some of the SHA-1 values recovered from Harrera’s computer match those of files he had in his possession when he was previously convicted.

After hearing the arguments, Superior Court Judge Vanessa White returned her ruling last week.

“The bottom line is I have to make a decision to expand Worden on the way the defendant would ask me to expand it, or I can read it more literally,” White said. “I choose literally.”

White said the difference is that Herrera had the files saved on his computer. Additionally, the files were available for other LimeWire users to share off Herrera’s computer. This is beyond the Worden ruling that allows images to be view on the screen.

“Mr. Herrera’s conduct intended to exercise control to save data on his computer and dominion in that he had the power to make that data available to others,” White said in closing.

Herrera’s trial is scheduled to begin in April.

Contact Todd L. Disher at todd.disher@frontiersman.com or 352-2252.