Hacker awaits verdict in 'Back Orifice' case

By PETER GRIFFIN

A landmark computer crime court case wrapped up yesterday, almost three years after Andrew Garrett allegedly used the popular Trojan program "Back Orifice" to unlock the contents of a number of computers unlawfully.

The trial's conclusion came as Garrett's defence questioned the validity of a crown case where "Telecom is in the driving seat," going so far as to hint at a Telecom conspiracy to "pull the rug" from beneath Garrett and his small internet business The Hive.

Garrett, who faces a total of 10 counts of fraud, wilful damage and threatening to damage property, looked relaxed as the jury in the Manukau District Court retired to consider evidence.

This includes Back Orifice computer logs, e-mail transcripts and virus software programs - an electronic trail leading from Garrett's computer and a separate disk found when police enacted a search warrant at Garrett's property in March 1999.

Summing up the Crown's case against Garrett, prosecutor Michael Heron described the former web administrator as "a bit of a Trojan horse himself," who exposed the workings of his own mind through the numerous e-mails he sent hinting at his hacking activities and moves he should take to cover them up.

"Where he had access to those computers, he did all sorts of things. He did it deliberately, without authorisation. He did it dishonestly.

"The logs tell you he wasn't doing this for a good purpose ... clearly he knew it was illegal," said Mr Heron, of the Back Orifice logs which allegedly showed Garrett's attempts to communicate with the computers he had infected with Back Orifice server programs.

Later, claimed the Crown, Garrett joined a Back Orifice help group on the internet in "a case of poacher turns gamekeeper."

"It's like someone breaking into your house, copying your keys and taking five cents. Do you complain about him breaking in or taking five cents?"

And the Crown went further, suggesting Garrett hoped to gain publicity from his actions and even try to gain financially by subsequently setting himself up in the virus-protection business.

"His motives are not as pure as the driven snow. He might make some money out of it and perhaps get back at Telecom," said Mr Heron.

That dispute with Telecom drew particular attention from Garrett's defence lawyers, who questioned Telecom's level of involvement in collecting the evidence against Mr Garrett and, in particular, the presence of Telecom employees at the police search of Garrett's home.

"What was the necessity to have the Telecom terriers along for if it wasn't to drive the chase?" asked defence lawyer Barry Hart.

Drawn into the case also was Herald IT editor Chris Barton, who brought Garrett's activities to public notice in November 1998 when Garrett approached the newspaper claiming to have breached Telecom's security. That led Mr Barton to test the validity of Garrett's claims by using the passwords to successfully log onto the internet himself.

He then handed the passwords to Telecom.

Garrett's lawyers questioned why police had not brought charges against Mr Barton in a situation that was complicated further by the fact that one of the "hacked" account holders was also being accessed by friends using Back Orifice.

The defence raised questions, too, about the integrity of police evidence, which included copies of information from Garrett's hard drive which differed from evidence presented in forensic reports - claims dismissed as smoke and red herrings by the Crown.

Summing up yesterday, Judge David Harvey made it clear to the jury that Garrett was not charged with hacking, as no such laws currently existed in New Zealand. Instead, Garrett faced mainly fraud charges.

In its early stages, the case involved a great deal of debate as to whether Garrett could actually stand trial under the Crimes Act. The Crimes Amendment Bill, at present being finalised, is expected to add provisions to clarify the law relating to crimes of a digital nature.

In June, Judge Harvey ruled that a computer program and password could be classed as a document according to the Crimes Act in relation to Garrett's case, dealing his defence a serious blow and sending a clear sign that some computer crimes could be dealt with under existing laws.

The jury was still out when the Herald went to press last night.