Jury finds man guilty of child porn possession over claim of zombie computer

After nearly eight hours of deliberation, an Otoe County jury handed down a guilty verdict Friday on one of two counts of possession of child pornography against a Nebraska City man who said malicious software turned his laptop into a zombie computer.

The 4-woman and eight-man jury viewed videos prosecutors said were taken from a computer owned by Shannon Slater, 40, of Nebraska City.

Viewing the videos caused one juror to audibly cry and resulted in all jurors turning away their eyes.

Otoe County Attorney David Partsch said the videos were easily accessible on a computer found in Slater's bedroom during the execution of a search warrant March 24 in Nebraska City.

Partsch said the files had not been deleted, but had been downloaded and previewed.

He said Slater established LimeWire software on the computer on July 5, 2009. On the following day, he said, thumbnail images begin to appear that are consistent with child pornography.
He said investigators found 98 thumbnail images in the LimeWire saved folder and 190 in the incomplete folder.

Partsch said files available for file sharing from Slater's computer on Aug. 3, 2009, Sept. 9, 2009 and Sept. 27, 2009 all contained file names indicating child pornography.

Partsch said there was no evidence of a zombie computer and no evidence that there was a virus or remote user downloading pornography.

Defense attorney Steven Lefler said there are doubts about the investigation that led to the charges against Slater.

He said it was frustrating when Nebraska State Patrol investigators testified they were not familiar with the term zombie computer or so-called bot networks.

Reading from a 2003 Microsoft report, Lefler said infected zombie computers are used to e-mail spam, store pornography and extort services.

John Slater, whose military work involves elements of cybersecurity, said he was at the house when he realized the computer with his son's username "Shannon" had been hijacked.

He said no one was at the computer, but its monitor activated and it began to display pornographic images.

Slater, a retired U.S. army Lt. colonel and Vietnam War veteran, said he was alarmed and tried unsuccessfully to stop the computer by pressing "control, alt delete." He said the only way he could regain control of the computer was to unplug it.

Lt. Col. Slater said he tried to relay his suspicions to investigators and the Otoe County attorney's office, but was told the state would rely on the state patrol's expertise.

Lefler said the investigation should have included a determination about remote influences on the computer.

"I don't know if that computer was hijacked or if it was a zombie computer, but my point is that the state's experts don't know," Lefler said.

Lt. Col. Slater said the computer was hijacked on March 22, so he removed it from the main living area and isolated it on a shelf in his son's bedroom. He said he planned to have the computer examined by the military in an attempt to trace the remote user, which he called the beehive.

He said the trace was never put into place, however, because the state patrol seized the computer on March 24.
The state patrol reported the computer had seven known viruses.

Lefler said descriptions of the virus's abilities include "arbitrary code execution" and said they give the attacker the ability to execute any command on a vulnerable computer.

Partsch asked the jury not to check its common sense at the door in regard to various theories of how the pornography got on the computer.

He said videos shown to the jury came from a LimeWire folder on the computer with the user name "Shannon" in Shannon Slater's bedroom and under his control.

A taped interview between Slater and State Trooper Eric Jones  was played for the jury.
Partsch said Slater admitted to using adult pornography and indicated that he was first introduced to child pornography about five years ago. Lefler noted that the investigator used the words "introduced" and said Slater thought he was answering a question about adult pornography.

Slater testified Friday that his initial thought after police woke him up was that he had violated some copyright laws because he had heard that the music and movie industries had protested LimeWire's free file sharing.

He said he previously had used LimeWire to download adult videos.
As LimeWire can use portions of shared files from multiple computers to deliver a video to a single user, files download faster when they are found on numerous computers.

Slater said he set up LimeWire to search for files shared by the most computers because they would download the fastest. He would do a search, select the top 10 results in a group and click download.
He said it was very rare, but if a file appeared to be child pornography he deleted it.

"I never watched child porn. I have seen it, but I've never searched for it and I've never saved it," Slater said.

Slater said he reduced his LimeWire usage after he met his current girlfriend Emily Wolken.
Wolken testified that she had asked Slater to commit to praying together every day at midnight after Slater got off of work.

She said Slater was at her house at times matching time references on downloaded files.
Lefler told the jury he knows one might suspect that she is lying to help her boyfriend, but asked if she wouldn't then say he was at her house when all of the files were downloaded.

Lefler said there are no other indicators to suggest that Slater views child pornography. He said searches of his home and Wolken's home discovered no photographs or magazine or receipts for paid pornographic sites.

He said examinations of Wolken's children revealed no indications of abuse and Slater's family members testified that his interactions with children were proper and welcomed.

Lefler said the state patrol did not know John Slater had nine sons, so officers watching his house to get information for a search warrant wondered why so many men were coming and going.
"They jumped to conclusions," Lefler said.