Tax protester faces kiddie-porn charges

Philadelphia Daily News ^ | Thu, Jun. 17, 2004 | Jim Smith

[Lurking Libertarian]

Tax protester faces kiddie-porn charges

A Montgomery County man who has publicly dared the Internal Revenue Service to arrest him for not paying federal income taxes was charged yesterday in federal court in Philadelphia with possession of child pornography.

IRS agents seized 10 computers from the Hollywood home of Larken Rose more than a year ago, but have yet to charge the tax protester with any tax crimes.

The child pornography was "inadvertently discovered" by an IRS agent who was examining one of the computer's hard drives, an FBI agent alleged.

FBI agent Beatrice A. DeFazio said the computer images contained explicit sexual situations involving underage girls.

The agent said there is "probable cause" to believe that Rose downloaded the kiddie porn from the Internet because the pictures were stored in the same computer file "where partially nude images of his wife" were also stored."

Neither Rose nor his wife could be reached last night.

[VRWC_minion]

Imagine the police impounding your car, and a month later reporting that they've just now stumbled upon 400 kilos of cocaine

If they have pictures on my auto from top to bottom (an exact copy of the disc), its pretty hard to claim there was something in the trunk.

Listen to what you are claiming and the entire sequence of events along with all the necessary changes that need to be made to the disk and need to be consistent with external data. They need to replace the original hard drive with an exact duplicate that has the tainted files. All identifying markings and numbers need to match. They need to eliminate the original copy too and make a new one from the replaced original. They need to put a time stamp on everything to match with an existing time the guy actually accessed the Internet. They need to not only insert new files and locations he accessed on his various files, they need to remove the files he actually accessed and the date time stamps need to make sense. They not only need match the time and date for a selected Internet access, they need to be sure he was present when the files were supposedly accessed.

Lots of details in order to make a trumped up charge. If they go to that length, they may as well do a dump of thousands of pictures.

[NJ_gent]

"Why would the wife "overreact" like that? Does she have any cause to think so negatively of her husband?"

I honestly don't know the woman, but I do know that he spent years working late nights 6, sometimes 7 nights a week. By late nights, I mean until 2 or 3 in the morning, and then back in there at 7 or so. I suppose it's easy to grow apart from someone under those circumstances, and perhaps even become very bitter. Not having a whole lot of help with the kids and not seeing your husband for days on end wouldn't seem to be good for a healthy relationship.

As for your own wife, I'm afraid I haven't had the pleasure of meeting her either. I'm sure she's a lovely person, but I'll bet she'd react very quickly to any perceived threat to her children. It's easy to sit down and think rationally ("hey, it's not likely that John would do this, so I won't blame him") when you're not sitting there looking at KP on the computer from some unknown source. For many parents, the mention of KP gets them downright rabid and out for blood. Until we can all think rationally all the time, there will always be overreactions - some severe.

[kylaka]

Larken does not dispute the validity of the tax laws as written either. The thing that gets the IRS's panties in a wad, is that there is no current statute under which to prosecute Rose, since he is not promoting any tax scheme or making a dime from the information he provides. IRS confiscated about 200 VHS tapes from him about 18 months ago, so he made 300,000 mini cd's, with a flashplayer presentation of his information, and indeed the flash player presentation is 100 times better than the video, and easier to understand. My guess is that Larken got the consolation prize from the IRS in the form of some planted pictures.

He shouldn't have too much difficulty defending this one, but you know, these things take money, and it doesn't take a genius to know who has the most money, and is therefore going to win a long battle.

[Arthalion]

Nope, because defrags don't always work. If you have REALLY sensitive data and the government (or a well connected NGO) really wants it, even overwriting a file isn't enough to delete it. There are devices which can magnetically read not only your current data, but also data that has been overwritten up to three times (it has to do with detecting residual magnetic fields...this stuff is out of your local LEO's league, but the CIA and FBI have the equipment to do it). To counter this technology, there are utilities designed to be run right after a file delete that will overwrite the newly cleared disk space with random hashes up to six times in order to permanently obscure any data that might have been stored in those spots.

The programs are legitimately used by businesses getting rid of old computers in order to permanently destroy any sensitive information that might have been stored on them, but they are also a favorite tool of the tinfoil hat crowd.

[NJ_gent]

"If they have pictures on my auto from top to bottom (an exact copy of the disc), its pretty hard to claim there was something in the trunk."

Why is it so difficult? The pictures of your trunk without the coke are easily disposed of, while the new and improved polaroids (now with added coke!) are easily slipped into your file folder.

"Listen to what you are claiming and the entire sequence of events along with all the necessary changes that need to be made to the disk and need to be consistent with external data."

I'm not claiming anything so much as I'm seriously doubting the story put forward by officials. All I've said about it is that it doesn't seem to add up, they really had no business searching picture files in the first place, and it wouldn't be difficult at all to place incriminating evidence there to get him into jail one way or another. I've not alleged that he's innocent, nor that he's been framed - only that something's not quite right with what we know thus far. In terms of "all the necessary changes"... etc, it's really not very hard at all. I could put transfer some files onto the computer I'm sitting in front of right now and make it look like they've been here for 10 years. Couple of files would probably take me about 20 or 30 minutes to change the things I'd need to change. There's no magic when it comes to computer forensics - you're simply looking at bits. If you go hardcore, you're imaging the platters in a clean room. In either case, the changes made would be nearly impossible to detect, and no expert on Earth would be able to sit on the stand and testify under oath with total certainty that there's been any tampering at all.

"They need to replace the original hard drive with an exact duplicate that has the tainted files."

Why? Put the files on there, change the timestamp information, make a couple changes to a handfull of log files, change their timestamps, and you've got your 'evidence'.

"They not only need match the time and date for a selected Internet access, they need to be sure he was present when the files were supposedly accessed."

You seem to think that every file ever downloaded is somehow or other recorded somewhere. Now, the NSA might have some outstanding ways of filtering this data, but I don't think they're going to be sharing information with local smokies that would put them in violation of their charter. I've already stated that the data collection necessary to verify what you're saying can be verified would be astronomical, and would be out of reach of all but the smallest ISPs. Comcast would be spending, literally, billions of dollars each year just to store what you're saying they store.

"Lots of details in order to make a trumped up charge."

If it's less than a hundred files, I could do it over a weekend.

"If they go to that length, they may as well do a dump of thousands of pictures."

For what? A handfull looks less suspicious, and is plenty to send him to jail. Aside from that, doing thousands would require a massive amount of time and effort, and would look suspicious to superiors. "Hey, Phil, why were you working 120 hours a week just before you found all those porn files?" To be sure, what I suspect is not some vast conspiracy by the IRS or the FBI, but rather a couple of agents who decided this guy was going to jail one way or another.

[agitator]

"They need to replace the original hard drive with an exact duplicate that has the tainted files. "

That's not how it works. They don't seize the physical disk, they hook up a machine and bleed the data off the disk to a disk image. All that's necessary to do is to create a new disk image which includes the planted pictures with the appropriate time and date stamps (even the IRS can figure out how to do that) and then lie about where it came from. Oh, I forgot. The IRS and FBI and any other state employee never lies. Courts assume that the govt never lies.

This is typical of what they use:

http://www.logicube.com/products/hd_duplication/solitaire_wkeypad.asp

Bottom line is that it's going to come down to a federal officer knowingly or unknowingly lying about what they allegedly found and you the defendant saying "that's not my disk and that wasn't on my disk." You produce your original disk and what good is that to you? The "proof" is going to come in the form of a doctored report from the disk extraction hardware and a federal officer swearing to it. Who is the court and the jury going to believe?

"They need to not only insert new files and locations he accessed on his various files, they need to remove the files he actually accessed and the date time stamps need to make sense. They not only need match the time and date for a selected Internet access, they need to be sure he was present when the files were supposedly accessed."

We're not talking Perry Mason here and this isn't Law and Order. We're talking about one team that has the cops, the prostitutor, the judge, *your lawyer*, and the jailer on it and Hint: you're not on that team. They have unlimited resources and you don't. They have a jury pre-disposed to hate "tax protesters" and pedophiles and they have govt officials who would be more than happy to lie. Anyone that doesn't believe govt officials will lie at the drop of a hat when it suits their purposes is not on the same planet as everybody else.

[VRWC_minion]

Why is it so difficult? The pictures of your trunk without the coke are easily disposed of, while the new and improved polaroids (now with added coke!) are easily slipped into your file folder.

This involves the entire police force as well as the impound folks. Possible but your bordering on tin foil, to put it mildly.

I'm not claiming anything so much as I'm seriously doubting the story put forward by officials.

Based on an OJ type theory.

All I've said about it is that it doesn't seem to add up, they really had no business searching picture files in the first place,

My first assumption is that an investigation requires searching all files, especialy picture files where its well known one can store information in them. I was subpeonaed for any files i had on someone. It included e-mails. They wanted EVERY e-mail I was copied on, even the ones which seemed like harmless jokes. They said the joke e-mails might contain coded messages.

and it wouldn't be difficult at all to place incriminating evidence there to get him into jail one way or another.

Why not just make up incriminating evidence for tax fraud. Wouldn't it be easier ?

I've not alleged that he's innocent, nor that he's been framed - only that something's not quite right with what we know thus far.

Assuminmg its exactly what they report. What is wrong ?

In terms of "all the necessary changes"... etc, it's really not very hard at all. I could put transfer some files onto the computer I'm sitting in front of right now and make it look like they've been here for 10 years.

Yes but you need to make them match to an internet session. The software is keeping track of sites you visit and the sequence they are visited. You not only nned to add sites and files you need to delete ones and still make it lool "normal". You also have the pesky problem of the original disk.

Couple of files would probably take me about 20 or 30 minutes to change the things I'd need to change.

I have no qualm about the file date. Show me how you change the files which contain the internet access and show me how you selectively edit them to insert new sites while deleting old sites.

There's no magic when it comes to computer forensics - you're simply looking at bits. If you go hardcore, you're imaging the platters in a clean room. In either case, the changes made would be nearly impossible to detect, and no expert on Earth would be able to sit on the stand and testify under oath with total certainty that there's been any tampering at all.

Not even if he could compare the disk to the original ?

You seem to think that every file ever downloaded is somehow or other recorded somewhere. Your computer keeps a history file. It also captures the activity in cache which remains on the hardrive.

Comcast would be spending, literally, billions of dollars each year just to store what you're saying they store.

You are not reading. They will have basic information like usuage. The files inserted will have to match a period of usuage.

If it's less than a hundred files, I could do it over a weekend.

And each change provides a chance of getting caught.

I think you need to purchase some fresh tin foil.

[VRWC_minion]

And the defense isn't going to ask for a clean copy of the original ?

[Arthalion]

Ah, but I did take that into account, and as I said, they should be working on cloned disks while doing their forensics. It's trivial to compare the evidentiary disk to the examination disk and determine if there have been any changes, and equally trivial to determine whether the evidentiary disk has been tampered with (both the disk firmware and the MBR store a timestamp showing the last time the drive was activated...if it's been activated more than once since the computers were siezed, the IRS have some explaining to do)

If the IRS didn't handle the disks properly and aren't working on an examination clone, then this guy has a 50/50 chance of getting the whole thing tossed based on evidence mishandling anyway. Any conviction of this guy will hinge on the prosecutions ability to prove that this data existed on the data drive AT THE TIME IT WAS SIEZED. If they don't have the original disk (or a sector based clone) in a state where it can be compared to the one being examined to ensure that they weren't planted, the images themselves can be tossed as evidence. No pictures = no conviction.

[agitator]

"And the defense isn't going to ask for a clean copy of the original ?"

And so what if they do? It still comes down to a govt official saying that's your data and you saying it isn't. Are you telling me that the clock isn't settable on the disk extraction device? Are you suggesting that a similar disk couldn't be had from eBay? If the disk id's don't match it's still your word against theirs and remember, govt officials don't lie and they never frame anybody. They especially never frame anybody they've been trying to get for 4 years and can't. And by the way, do you have $15,000-$50,000 for a computer forensic expert to examine their evidence and do you remember where you were on a certain day 1 year and 7 months ago and can you prove it?

[Arthalion]

"All that's necessary to do is to create a new disk image which includes the planted pictures with the appropriate time and date stamps (even the IRS can figure out how to do that) and then lie about where it came from"

Except that the faked image would contain registry data that doesn't match the PC they're alleging that it came out of.

Faking a disk image would require that everyone in the chain of evidence handling be corrupt, because they'd need full uninhibited access to all of your hardware and software to make it convincing. Could it be done? Sure, but it would have been easier for them to simply give the computers back with a back-door, plant the porn on it later, erase the back-door remotely, and then "anonymously" tip the local LEO's.

Besides, if the IRS really wanted to nail this guy by planting evidence, why wouldn't they have planted evidence related to tax fraud or evasion?

[agitator]

"Except that the faked image would contain registry data that doesn't match the PC they're alleging that it came out of."

It still comes down to your word against theirs. Who's to say that you would still have the same PC today that you had when they siezed the disk image and in any event, what difference would that make. The first thing I would do is reformat my pc anyway. Anyway, even if the disk image comes from a Seagate drive and I only had a Western Digital, it's their word against mine. And what evidence chain? The original disk image comes off the box and then sits in an evidence warehouse. When I ask for a govt evidence handler to swear that there is no way in hell that any evidence ever checked in and out of there without a record being kept, what's he going to say? "uhhhhh, oh, yeah, our record keeping sucks and 20% of our cases are no good because of it."

"Besides, if the IRS really wanted to nail this guy by planting evidence, why wouldn't they have planted evidence related to tax fraud or evasion?"

Well, that would involve third party evidence, like banking records - much harder to lie about. Right now as it is, it's just Uncle Sham vs. Peon. If they had anything to get him on taxwise, they wouldn't have had to seize his computer and use that for evidence anyway.

[AppyPappy]

No, you misunderstand me. He was using his COMPUTERS to sell a fraudulent system. That is why they were being investigated.

[asmith92008]

Yes, but if thwy have to recover the picture, that's fairly good evidence you weren't sitting there playing with yourself while looking at it.

[asmith92008]

1. If you download things from bulk e-mails, you're guilty of criminal stupidity.

2. If you don't download the kiddie porn to your pc, it's pretty hard to say you possessed kiddie porn.

[cynwoody]

I guess I've led a sheltered life, I still have no idea how you can get porn from a B-36 - we didn't stay long enough to find out either.

So I presume you are not among the "over 85 Million people" who have visited whitehouse.com?

[GrandEagle]

whitehouse.com?
Nope, not me. I didn't know that it was a porn site. I guess the correct address would be whitehouse.gov. When the first rover landed on Mars a few years ago I did find out that NASA.com was a porn site. Left there in a hurry too.

[Old Professer]

10 computers and one porn file?

[jwpjr]

Your points are well taken. The fact that the man concealed the video camera is proof to me that he knew what he was doing was wrong. I agree with you that we are a bit to uptight about nudity. Countries where it's treated more casually would appear to have fewer of the problems that beset the US when it comes to sex. I have done photo shoots at clothing optional resorts and it would seem that early and frequent exposure (no pun intended) to the opposite sex sans clothing reduces the sexuality associated with such displays.