[funsec] Police blotter: Web cookies become defendant's alibi
Richard M. Smith
rms at computerbytesman.com
Fri Oct 27 08:07:56 CDT 2006
A few quick comments. a). An IE cookie files contains an internal time stamp
which is much harder to fake than file timestamps. b). Regardless of the
timestamp of the cookie files, it is unknown who was at the keyboard whent
the cookies files were made or accessed. c). A more complete investigation
may have found other files on the hard drive in the timeframe of interest.
What: A Texas man says the timestamp of cookies on his Web browser proves he
was actually online and not where prosecutors claim he was.
What happened, according to court documents:
After a stormy divorce between Erin McRae and Everett Eugene Russell, a
judge granted McRae a protective order requiring her ex-husband to stay away
from her residence.
McRae moved to her stepfather's home in Shady Shores, Texas. Around 10 a.m.
on Feb. 26, 2005, she noticed a white truck parked on the road. She and her
friend Heather both claim they then spotted Russell walking down the fence
line along the stepfather's house.
The third component of the alibi is what makes this case relevant to Police
blotter. Russell claimed he was surfing the Web that morning, checking on an
IRS income tax return and shopping online at Home Depot's and Lowe's Web
He made a disk showing the Web sites that he had visited on Feb. 26, 2005,
and the cookies on the disk indicated that he was on the IRS Web site at
10:29 a.m. CST. The disk also indicated that Russell was online from 10:29
a.m. to 11 a.m. and again at 1:04 p.m. (
_cookie&siteId=3&oId=2100-1047-6129993&ontId=1040&lop=nl.ex> Cookies are, of
course, small chunks of data saved in
html&siteId=3&oId=2100-1047-6129993&ontId=1040&lop=nl.ex> text files that
let a Web site recognize you upon future visits.)
But prosecutors argued that the cookie file could have been altered, and a
jury agreed. There's no explanation in the opinion as to why Russell's
attorney didn't subpoena logs from those Web sites or his Internet service
provider that--if available--could have provided a much stronger alibi. It's
also unclear if Russell was relying on information in individual cookies,
which would be set by each Web site, or the file system's timestamp on the
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the funsec