Police ‘clarify’ Net pedo snooping tactics
Yesterday, an official NCS spokesman said the terms used by Detective Superintendent Peter Spindler the previous day - in conjunction with the arrest of 120 suspected paedophiles worldwide - were "misleading".
As the man in charge of Operation Landmark, Mr Spindler appeared on Radio 4's Today programme and said the NCS had requested an "image" of the server logs from ISP Demon Internet regarding paedophile sites under observation.
The term "image" means complete server details including files sent/received and traffic logs. Clearly these details are important if those arrested are to be found guilty of distribution of illegal pornography - which carries a heavier sentence than mere possession.
However, as soon as the NCS made its methods known, Net privacy advocates started asking tough questions over exactly what Demon handed over and the police's justification behind the demand.
The NCS and Demon have since come out denying the imaging implication. The NCS is now insisting that it only had access to the servers and didn't have any logs at all. The initial press release said: "With the assistance of Demon Internet and the support and guidance of the National Hi-Tec Crime Unit (NHTCU), we are able to show that those accessing these newsgroups did so regularly and with purpose."
All the sites were publicly available, so why did the police need Demon's help? If there was assistance, exactly what form did it take, if not logs? Demon told ZDNet news: "We created a direct connection between NCS and the newsgroup servers, and configured it so that they could download the messages very quickly." Plus, "we also kept the message base for longer than we would normally do so, so that they could check against old postings."
The NCS has airbrushed a press release announcing the paedophile case from its Web site. The original press release headline is there but the link feeds through to nothing. And there is a missing spot for a second press release.
The NCS sells itself as a hi-tech police force, but it doesn't appear to apply Internet forensics to its own site. Checking out the code behind the links, every press release up to the original one regarding paedophile arrests is in consecutive order.
The last one before the paedophile press release on 28 November was on 22 November and called "Men sentenced after National Crime Squad seizes £3.4m of cannabis in Stafford." The release is numbered "119.html". Then the paedo release points to "left_panel_table.html#anchor" i.e. nowhere.
The one after, on 29 November, is numbered "120.html" - the original number for the paedophile release - which has the effect of killing any external links made to the paedophile release on the Internet.
However, the release after that one, which you would think would be called "121.html" or "122.html" is actually "123.html", suggesting that there is a second missing release. Sure, enough, type in "122.html" and up pops a second press release on the paedophile arrests (but dated 28 November). We haven't kept a copy of the original but we'd be interested in seeing one for comparison. The 121 link is dead. ®
Sponsored: The Nuts and Bolts of Ransomware in 2016