Your rights go out the door, and your digital life probed endlessly.
It's not impossible, but it was pretty convincing to me.
ps. How would one know enough about the scene to motivate such skepticism?
https://dd80b675424c132b90b3-e48385e382d2e5d17821a5e1d8e4c86...
To me, it would be like being in a warez channel full of people saying, “I want pirated material.” That at least I have experience with, and someone saying “Where the copyright violations at?” Rather than “any good ftp’s and xdcc’s?” Would raises red flags.
Pages 3-6 detail the VM. Basically, they found a VM on his computer that was encrypted, with an encrypted file in it, that they unlocked with a password they found on his phone. In the encrypted (truecrypt) file, they found a large amount of what was unmistakenly CP. When they examined the file system, their claim is that there was evidence of a history of using that VM and moving those files around, etc., so it's not like they just appeared one day. Partial files that weren't deleted yet, caches, inode meta data, that sort of thing.
I mean, it's possible to fake, but it would be incredibly easy to fuck that up, and incredibly risky to get caught doing that. If they really wanted to make his life hell, there are easier, less risky, and even legal ways to do it without going to the effort to fabricate 8 years of computer usage that would withstand expert cross examination.
Maybe, but how hard would it be to convince a tech-illiterate jury of that? Is there a lawyer on earth that could explain the minutiae of metadata on virtual machines to one? And if they get caught, they go "oops!" and pay out a few million dollars as a sorry, at best.
Why are you convinced the presence of a VM in this is significant?
I mean, think about it: if you were the defendant, all you'd have to do is have someone examine it and find inode activity when you had a clear alibi that the government didn't know about (which would be easy, given we're talking 8 years here, he'd just have to find when he was on a date or out to dinner or something, the government isn't going to know his entire life history for 8 years), and you'd be well on your way to creating enough doubt with a jury.
Now, it's possible the government is lying, but if they're not, it strains credulity to think that they'd go to the effort, cost, and risk to fake that VM in such elaborate detail. If they wanted to ruin his life, there are hundreds of easier ways to do it than such an elaborate fraud.
What you are now saying is that it's implausible that the CIA would be able to fake logs (and that's what we're talking about with inode data) on a VM for some reason. It would absolutely not be as simple as "have someone examine it and find inode activity when you had a clear alibi" because it is very likely the guy was actually using a VM legitimately. All the CIA has to do is establish that he was in possession of child pornography. Hell, they don't even need to prove it beyond a reasonable doubt if A) the jury, defense, prosecution and / or judge is not tech savvy to understand some of these concepts, and B) if their goal is to trash this guy's life and have it be a warning to other leakers. You don't even need a conviction for that.
It does not strain credulity at all to think that the CIA would go to the effort to fake a small set of data on a VM. The "elaborate detail" is not any more elaborate than in any other instance -- it would be trivially easy to forge. If they wanted to ruin his life, this is a perfect, practical way for them to do it.
The fact that they would forge this data on a VM makes it seem even more plausible to people who don't even understand what VMs are, or how one might fabricate logs like that. It's apparently working on you right now, and you're savvy enough to know about the existence of inode data. You're apparently ready to condemn this guy despite the ludicrous amount of circumstantial evidence that maybe this guy is being set up by an organization literally dedicated to covert operations of this nature, who have even go so far as to detail exactly how they would undertake this exact kind of operation.
There are plenty of ways that happens even accidentally though, a prosecutor would be able to knock out that claim easily.
You've never seen a Linux machine write entries to the system log with the wrong timestamp? It happens all the time on machines with no RTC (Raspberry Pi) or a dead battery.
Of course, nothing says they wouldn't be cooperating in this.
Really.
Does that sound like something anyone would ever expect to return fruitful results enabling criminal activity? Does anyone imagine this being the sort of thing a person operating an encrypted server would do either deliberately or inadvertently? And what would it even mean, to have that in Google search logs?
Here on HN, to most of us, figure it means less than nothing. On some level, it might actually harm the authenticity of the prosecution's technical credibility.
I'd imagine the goal of the prosecutors though, is to select the most technically inept grandmas, to pack the jury with.
Reminds me of: https://www.youtube.com/watch?v=SYkbqzWVHZI
Oh really, and did you ask how it is that IRC logs from 2009 just happened to be sitting in someone's back pocket?
It is actually quite obvious from the conversation that "STURM" is a CI or other operative who is trying to entrap "JOSH".
If this guy was breaking the law back in 2009 why did the CIA hire him exactly?
Maybe we should be investigating how law enforcement and intel agencies use child exploitation and child pornography to entrap people, and how many of the people involved in those ops have "inclinations" that trend in that direction.
Then we might find some real criminals.
Meanwhile all of these leakers having some sort of cp charge is a significant enough to look deeper into what is going on.
Those charges were Swedish.