DOJ’s refusal to turn over code complicates child porn cases

SEATTLE — The Justice Department’s refusal to disclose information about a software weakness it exploited during a major child pornography investigation last year is complicating some of its prosecutions arising from the bust.

During the investigation, the FBI allowed a secret child porn website on the largely anonymous Tor network to run for two weeks while it tried to identify users by hacking into their computers. The cases highlight how courts have struggled to square technological advances with existing legal rules.

A federal judge in Washington state last month threw out the government’s evidence against one of the defendants, saying that unless the FBI detailed the vulnerability it exploited, the man couldn’t mount an effective defense.

In another case, a Virginia judge rejected a similar request in an opinion unsealed Thursday, saying even if the defendant had demonstrated a need for the full source code, that need would be outweighed by the government’s interest in keeping it secret to protect investigative techniques.

The judge suggested that even though the FBI obtained a warrant to hack into the defendants’ computers, it didn’t need one. He compared the agency’s exploiting of the software vulnerability to a police officer being able to see through broken window blinds into someone’s home — an analogy privacy and computer security experts called obviously wrong.

For starters, people know if their blinds are broken and have a chance to fix them. An officer looking through them is only observing what anyone else could observe. And “even if their blinds are broken doesn’t mean you get to go into their house and search,” said Mark Rumold, a senior staff attorney at the San Francisco-based Electronic Frontier Foundation.

“The court’s decision that you don’t have a reasonable expectation of privacy in a laptop in your own home — people should be very worried,” he said.

The DOJ has said the information is not relevant. Defendants have been offered or provided all the evidence they need, including limited source code and data streams showing what the program did, the FBI has argued.