The Trojan horse defense is a technologically based take on the classic SODDI defense, believed to have surfaced in the UK in 2003.Bowles, S., Hernandez-Castro, J., "The first 10 years of the Trojan Horse defence", Computer Fraud & Security, January 2015, Vol.2015(1), pp.5-13, page 5 The defense typically involves defendant denial of responsibility for (i) the presence of cyber contraband on the defendant's computer system; or (ii) commission of a cybercrime via the defendant's computer, on the basis that a malware (such as a Trojan horse, virus, worm, Internet bot or other program)Steel, C.M.S, "Technical SODDI Defences: the Trojan Horse Defence Revisited", DFSL V9N4 (http://ojs.jdfsl.org/index.php/jdfsl/article/viewFile/258/236 ) or on some other perpetrator using such malware, was responsible for the commission of the offence in question.Šepec, M., "The Trojan Horse Defence -- a Modern Problem of Digital Evidence", Digital Evidence and Electronic Signature Law Review, 9, (2012), p.1
A modified use of the defense involves a defendant charged with a non-cyber crime admitting that whilst technically speaking the defendant may be responsible for the commission of the offence, he or she lacked the necessary criminal intent or knowledge on account of malware involvement.Brenner, S., Carrier, B., Henninger, J., 'The Trojan Horse Defense in Cybercrime Cases' (2004) 21 Santa Clara Computer and High Technology Law Journal 1, page 18. See the case of Eugene Pitts (2003)
The phrase itself is not an established legal term, originating from early texts by digital evidence specialistsŠepec, M., "The Trojan Horse Defence -- a Modern Problem of Digital Evidence", Digital Evidence and Electronic Signature Law Review, 9, (2012), page 2 referring specifically to trojans because many early successful Trojan horse defenses were based on the operation of alleged Trojan horses.Brenner, S., Carrier, B., Henninger, J., 'The Trojan Horse Defense in Cybercrime Cases' (2004) 21 Santa Clara Computer and High Technology Law Journal 1, p.11. Due to the increasing use of Trojan programs by hackers, and increased publicity regarding the defense, its use is likely to become more widespread.Kao, DY., Wang, SJ., Huang, F., 'SoTE:Strategy of Triple-E on solving Trojan defense in Cyber-crime cases' (2010) Computer Law and Security Review 26, p.55.
Legal basis of the defense Excluding offences of strict liability, criminal law generally requires the prosecution to establish every element of the actus reus and the mens rea of an offenceLaird, K., Ormerod, D., "Smith and Hogan's Criminal Law" 14th Edition, page 59 together with the "absence of a valid defence".Laird, K., Ormerod, D., "Smith and Hogan's Criminal Law" 14th Edition, p.59 citing Landham, D., Crim LR 276 Guilt must be proved, and any defense disproved, beyond a reasonable doubt.Brenner, S., Carrier, B., Henninger, J., 'The Trojan Horse Defense in Cybercrime Cases' (2004) 21 Santa Clara Computer and High Technology Law Journal 1, page 12
In a trojan horse defense the defendant claims he did not commit the actus reus.Brenner, S., Carrier, B., Henninger, J., 'The Trojan Horse Defense in Cybercrime Cases' (2004) 21 Santa Clara Computer and High Technology Law Journal 1, pages 16-17 In addition (or, where the defendant cannot deny that they committed the actus reus of the offence, then in the alternative) the defendant contends lack of the requisite mens rea as he "did not even know about the crime being committed".Šepec, M., "The Trojan Horse Defence -- a Modern Problem of Digital Evidence", Digital Evidence and Electronic Signature Law Review, 9, (2012), page 4
With notable exception, the defendant should typically introduce some credible evidence that (a) malware was installed on the defendant's computer; (b) by someone other than the defendant; (c) without the defendant's knowledge.Brenner, S., Carrier, B., Henninger, J., 'The Trojan Horse Defense in Cybercrime Cases' (2004) 21 Santa Clara Computer and High Technology Law Journal 1, page 18 Unlike the real-world SODDI defense, the apparent anonymity of the perpetrator works to the advantage of the defendant.Brenner, S., Carrier, B., Henninger, J., 'The Trojan Horse Defense in Cybercrime Cases' (2004) 21 Santa Clara Computer and High Technology Law Journal 1, page 17
Prosecution rebuttal of the defense Where a defense has been put forward as discussed above,Brenner, S., Carrier, B., Henninger, J., 'The Trojan Horse Defense in Cybercrime Cases' (2004) 21 Santa Clara Computer and High Technology Law Journal 1, page 14 the prosecution are essentially in the position of having to "disprove a negative" by showing that malware was not responsible. This has proved controversial, with suggestions that "should a defendant choose to rely on this defense, the burden of proof (should) be on that defendant".Starnes, R., "The Trojan Defence", Network Security, Volume 2003, Issue 12, December 2003, page 8 If evidence suggest that malware was present and responsible, then the prosecution need to seek to rebut the claim of absence of defendant requisite mens rea.
Much will depend on the outcome of the forensic investigative process, together with expert witness evidence relating to the facts. Digital evidence such as the following may assist the prosecution in potentially negating the legal or factual foundation of the defense by casting doubt on the contended absence of actus reus and/or mens rea:Brenner, S., Carrier, B., Henninger, J., 'The Trojan Horse Defense in Cybercrime Cases' (2004) 21 Santa Clara Computer and High Technology Law Journal 1, page 26- Absence of evidence of malware or backdoors on the defendant's computer.Ghavalas, B., Philips, A., "Trojan defence: A forensic view part II", Digital Investigation (2005) 2, 133-136, page 134 Where malware absence is attributed by the defense to a self wiping trojan, evidence of anti-virus/firewall software on the computer helps cast doubt on the defense (such software can result in trojan detection rates of up to 98%Overill, R.E., Siloman, J.A.M., "A Complexity Based Forensic Analysis of the Trojan Horse Defence", 2011 Sixth International Conference on Availability, Reliability and Security, Aug. 2011, pp.764-768, page 765) as does evidence of the absence of wiping tools, as "it is practically impossible that there would be no digital traces of [...] the use of wiping tools".Šepec, M., "The Trojan Horse Defence -- a Modern Problem of Digital Evidence", Digital Evidence and Electronic Signature Law Review, 9, (2012), page 7 Evidence showing that any located malware was not responsible, or was installed after the date/s of the offences.Steel, C.M.S, "Technical SODDI Defences: the Trojan Horse Defence Revisited", DFSL V9N4, page 51 Incriminating activity logs obtained from a network packet capture.Haagman, D., Ghavalas, B., "Trojan defence: A forensic view", Digital Investigation (2005) 2, pp.23-30, page 28 In cyber-contraband cases, the absence of evidence of automation - e.g. of close proximity of load times, and contraband time/date stamps showing regularity. Volume of contraband is also relevant. Corroborating digital-evidence showing defendant intent/knowledge (e.g. chat logsSee for example Regina v Aaron Caffrey, Southwark Crown Court, 17 October 2003). Such properly obtained, processed and handled digital evidence may prove more effective when also combined with corroborating non-digital evidenceŠepec, M., "The Trojan Horse Defence -- a Modern Problem of Digital Evidence", Digital Evidence and Electronic Signature Law Review, 9, (2012), page 6 for example (i) that the defendant has enough knowledge about computers to protect them; and (ii) relevant physical evidence from the crime scene that is related to the crime.Brenner, S., Carrier, B., Henninger, J., 'The Trojan Horse Defense in Cybercrime Cases' (2004) 21 Santa Clara Computer and High Technology Law Journal 1, page 47
The role of computer forensics Whilst there is currently "no established standard method for conducting a computer forensic examination",Carney, M., Rogers, M., "The Trojan Made Me Do it: A First Step in Statistical Based Computer Forensics Reconstruction", International Journal of Digital Evidence Spring 2004, Volume 2, Issue 4, page 2 the employment of digital forensics good practice and methodologies in the investigation by computer forensics experts can be crucial in establishing defendant innocence or guilt.Everett, C., 'Viruses Bottleneck Prosecution' (2003) Mayfield Press, Oxford, Computer Fraud & Security This should include implementation of the key principles for handling and obtaining computer based electronic evidence - see for example the (ACPO) Good Practice Guide for Computer-Based Electronic Evidence. Some practical steps should potentially include the following:- Making a copy of the computer system in question as early as possible to prevent contamination (unlike in the case of Julie Amero where the investigator worked directly off Amero's hard drive rather than creating a forensic image of the drive. Mounting as a second disk onto another machine for experts to run a standard anti-virus program. Correct handling of volatile data to ensure evidence is acquired without altering the original.Haagman, D., Ghavalas, B., "Trojan defence: A forensic view", Digital Investigation (2005) 2, pp.23-30, page 27-28 If a Trojan is found, it is necessary to examine the totality of the circumstances and the quantity of incriminating materials. Including a "network forensic approach" e.g. by way of legally obtained packet capture information.Haagman, D., Ghavalas, B., "Trojan defence: A forensic view", Digital Investigation (2005) 2, pp.23-30, page 28
Cases involving the defense Aaron Caffrey The first heavily publicised case involving the successful use of the defense,Bowles, S., Hernandez-Castro, J., "The first 10 years of the Trojan Horse defence", Computer Fraud & Security, January 2015, Vol.2015(1), pp.5-13, page 7 Aaron Caffrey was arrested on suspicion of having launched a Denial of Service attack against the computer systems of the Port of Houston,Meyers, M., Rogers, M., "Computer Forensics: The Need for Standardization and Certification", International Journal of Digital Evidence, Fall 2004, Volume 3, Issue 2, pages 2-3 causing the Port's webserver to freezeRasch, M., "The Giant Wooden Horse Did It", Security Focus, at
http://www.securityfocus.com/columnists/208 (Jan. 19, 2004). and resulting in huge damage being suffered on account of the Port's network connections being rendered unavailableŠepec, M., "The Trojan Horse Defence -- a Modern Problem of Digital Evidence", Digital Evidence and Electronic Signature Law Review, 9, (2012), page 3 thereby preventing the provision of information to "ship masters, mooring companies, and support companies responsible for the support of ships saling and leaving the port". Caffrey was charged with an unauthorised modification offence under section 3 of the Computer Misuse Act 1990 (section 3 has since been amended by the Police and Justice Act 2006 creating an offence of temporary impairment.