Detective Mark Lounsbury comments on the Amero case

Network Performance Daily gives Detective Mark Lounsbury the opportunity to comment on the evidence the prosecution presented against Julie Amero, the substitute teacher facing up to 40 years in prison for exposing her students to unsolicited internet porn.

Lounsbury's essay is very general discussion of how the police might go about investigating a suspect's computer. He doesn't address the central points of contention in the Amero case. Perhaps he is not at liberty to do so, as Julie has not yet been sentenced.

You can also read the commentary of the defense's expert witness here.

I hope to write more on these two commentaries later today. In the meantime I encourage readers to compare the two commentaries for themselves. Remember that Lounsbury testified that he did not check the computer Amero was using for malware.

Comments

[Jim]

From the article: "It's these "typed URLs," gleaned from the registry, which are identified - not pop ups."

Methinks the gentleman either doesn't know what he's talking about or has misunderstood something.

The "registry" (I think he means browser history here as the Registry has nothing to do with it) records visited pages and does *not* record how they were invoked:- typed directly by the user (which is very uncommon anyway - how often do you directly type a URL?), via clicking , or via pop up. No matter how you visit a page - voluntary or not - it ends up in the browser history without distinction.

That's a hell of a misunderstanding to base a case necessarily involving a persons *actions* let alone their intent on.

> "I'm not an expert ... so I rely on ComputerCop"

No sir, you are not, not even close. Relying on the supposed delphic knowledge of commercial software is no substitute for expertise either.

And launching felony prosecutions on the basis of "the computer says so" is criminal incompetence.

[Randy Abrams]

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs is in the registry.

Your bad.

Randy

[amclint]

Aye, typedurls do show...but he did say in his testimony during the case that he didn't check for malware/spyware on the computer. If that's the case there could have easily been a program putting the text into the url box and hitting enter to load a page. I'm not saying that's the case here, but it's more than feasible as I've done it before using macro software to test websites.

The case is still a joke, sad state of affairs in this country. Although to our benefit we now have the internet to speak out about it.

[Randy Abrams]

That typedurls exist in the registry is still not evidence. Any malware could very easily add entries to the typedurls key. It is completely trivial. Lounsbury also did not say what he found in typedurls. The reason would be that there was nothing incriminating.

This is clearly a case of a prosecuter through gross incompetence or deliberate malice refusing to keep his oath the pursue justice. This was simply a witchhunt in which the court, the DA, and the police willingly consipired to gain a conviction that they knew was not just. If the jury had a tiny amount of computer literacy they would have seen how fabricated the prosecution was.

[Angelina]

from the time immemorial
[url=http://evita-dimitrova.ratemygirls.info/08-2006-29-dimitrova-evita.php]08 2006 29 dimitrova evita[/url] 08 2006 29 dimitrova evita

[Jeff]

I have a new computer and I have been trying like heck to get something to show up in my "TypedURLs" key.

I set up my computer about a week ago. Soon thereafter, I created a non-admin user as a compromise between convenience and security.

As far as I can tell, all entries under this key predate my user switch.

Here are my entries, plus //comments.

url1 --- REG_SZ --- opera
//I like to have a browser choice...

url2 --- REG_SZ --- http://www.firefox.com/
// ditto...

url3 --- REG_SZ --- http://go.microsoft.com/fwlink/?LinkId=69157
//Huh??? I don't remember typing this! I don't even know how to SPELL fwlink...

PS. Does anybody know how to find the modification times of registry entries?