Thursday, May 10, 2007

The Scandal of Operation Ore

This week Operation Ore has been in the news again.

It was discussed on Thursday night’s ‘The Investigation’ on BBC Radio 4. To listen to the program, click here. It is only available for 7 days until Thursday 17th May 2007.

In the 1990s, US law enforcement officers were monitoring a Texas based website called Landslide. Landslide was a portal which provided online payment management services to some 1400 other sites. Most, if not all, of these client sites were providing adult content, or ‘pornography’. Police had identified that precisely 12 of these 1400 or so sites contained images of children. That was apparently the reason for the police interest.

US authorities identified the credit card details of some 7200 UK citizens on the Landslide database, and passed them on to the UK authorities. Thus began Operation Ore. All over the UK, police began breaking down people’s doors at six in the morning. Among those caught in the net were teachers, police officers, a judge, The Who guitarist Pete Townshend, Robert del Naja of Massive Attack, and Ronnie Barker’s son Adam. To date, around 2300 men have been convicted of child pornography related offences.

So what’s the problem?

The problems with Operation Ore were first brought to light by the journalist Duncan Campbell in his in-depth article for the IT trade magazine, PC Pro. Reference

A lot of those convicted were the victims of credit card fraud and identity theft. They were entirely innocent of any child abuse related crime. To date, 39 accused men have committed suicide in the UK. Hundreds, possibly thousands, more, have had their lives, families and careers destroyed.

Ross Anderson, professor of Security Engineering at the University of Cambridge, was called as a defence witness on several cases. He said “Operation Ore I think will go down in history as one of the biggest police scandals in the UK. It’s the worst we’ve had for many years.”

“Police just didn't look far and didn't understand the evidence of wholesale card fraud,"
Anderson said. In many cases, they simply refused to examine the possibility of credit card fraud.

The Radio 4 program included an excerpt from a police briefing in London in 2003. The senior officer tells his men, “What we are talking about here is child abuse. In case some of you haven’t seen what this is, we are talking about the rape of babies. We are talking about the bondage of children aged five years old”. As he rallied the troops, the emotion in his voice was palpable. To some extent this is understandable; we are all horrified by crimes like that. However his personal feelings have no place here. Yet police emotions seem to have taken over. He then proceeded to gloat to his men about the fact that these 'offenders' may not have jobs and families left by the time the police had finished with them. This is an appalling attitude from someone in that position.

Emotional hysteria makes for very bad public policy. It causes witch-hunts. That seems to be what happened here. Again.

It led to thug policing. As far as the police were concerned in Operation Ore, their job was to break down doors and capture monsters. That’s it. They thought they were being heroes.

The real problem the police were facing was a far more abstract one. PC Pro described the case as “the UK's biggest ever IT crime investigation”, and that is exactly what it was. It was primarily an IT issue. The question the police had to answer was ‘How did these UK credit card numbers apparently make their way into a Texas-based computer database?’ This is a task requiring painstaking analysis. Breaking down doors at 6:00 AM is absolutely no use whatsoever.

The method is to first get a copy of the data. Then find some forensic computer experts to analyse it. Then decide whether or not any crimes have taken place. Then – and only then – you might have to break some doors down. It seems that this investigation process was far too much like hard work for the UK police. Breaking doors down is easier and more fun.

The real answer to the problem is going to be relatively complex too. There will not just be a single cause. It is likely that person A’s credit card number is on file because they actually used their card to purchase child pornography; person B’s is there because they are a victim of identity theft and credit card fraud; person C’s is there because of an American police typing error, and in fact it was never there at all. You simply don’t know until you look. But the police couldn’t be bothered to look. They decided they just needed to put the heat on some perverts. Thirty nine innocent men committed suicide.

If the police had taken the trouble to look, they would have found a story even more exciting and macho than the one they had just made up. The truth involved international organised crime, identity theft and money-laundering.

“The child pornography site in question was one of many being used by organised crime, including the Gambino family, to steal money from 54,348 credit cards the details of which their associates had ripped off.” Reference

Organised crime gangs as far afield as South America, Russia and Indonesia set up these websites, and then take out subscriptions to them using stolen credit card numbers. Reference So they make money by taking out fake subscriptions to their own websites using other people’s credit cards.

The UK police could have found these facts out easily just by looking at the Landslide data, but it seems that no-one could stir themselves to take the trouble.

For example, of the 7200 UK citizens who had apparently signed up to this site, around 70% of them had never accessed it. So they had apparently paid for services and then never used them. One person might do that, but 70% of customers? We should immediately be suspicious. Not PC Plod, however. He just alters the charges. Instead of being charged with possession of indecent images of children – because these people clearly weren’t – they were charged with inciting others to provide such images.

The police in the US only charged those people who had actually accessed the material.

Secondly, the Landslide data contained the IP address of the original computer used to make the credit card payment. Many of these UK cards were used from computers in South America, at a time and date when the card-holder was at work in the UK. A cast-iron alibi if ever there was one. But strangely the police would not accept evidence like that. After unsuccessfully trying to prosecute a father who had been defrauded in this way, they instead turned their attention to his son, and tried to prosecute him for the completely unrelated possession of some perfectly legal manga cartoons, which you can buy on Amazon. It was only when the CPS decided that there was no chance of making it stick that PC Plod had to go home red-faced and empty-handed. It seems that the police were completely out of control.

Perhaps the problem was that Operation Ore was being treated as essentially a moral issue; the police were attempting to regulate sexual morality. That and the fact that they were responding to a tabloid frenzy about paedophiles lurking in every British suburb. It seems that the police allowed moral panic to get the better of them. If so then this is a breakdown of discipline and a serious breach of their professional duty.

The consequences of all this have been truly dire. Thousands of people’s lives have been affected. Fathers were separated from their children for two years, and then not charged with anything. Careers, marriages and reputations were destroyed. Thirty nine took their own lives.

Operation Ore was run by CEOP, the Child Exploitation and Online Protection Centre. It seems that CEOP is not prepared, even now, to hold its hands up to what it has done. "Jim Gamble, former head of the National Crime Squad who is now head of the Child Exploitation and Online Protection Centre, said: "Over 90 per cent of those involved pleaded guilty. That's not about credit card fraud." Reference

This is dishonest in the extreme. The police would offer suspects a choice. Confess to the allegations, and receive a caution, and sign the Register for two to five years. Alternatively, deny the allegations and go to trial. One man interviewed on Radio 4 told how the interviewer threatened him, with the tape running, that if he did not confess to the allegations, the police would go to his workplace, tell all his colleagues why he was arrested, and sieze all the computers for examination. Given an ultimatum like that, many people found a false confession to be the easy way out, which is exactly what the police intended.

The radio 4 program did not mention the fact that some of those affected are pursuing a ‘class action’ (to use the American term) against the police. Reference

I hope that those who were put through the ordeal of Operation Ore are compensated; I hope that Jim Gamble is given an opportunity to spend more time with his family; I hope he spends it reflecting on how lucky he is still to have one.

If we are going to learn any lessons from this then surely it is about the folly of moral panic, and its corrosive effect on public life. Unfortunately though, we don't seem to learn our lessons. This stuff just seems to keep on happening.

Further Reading


Anonymous said...

Well said! Bravo!

I think the reason we do not want to 'learn our lessons' as you put it is two fold:

1. We will have to face that fact that the boogie man doesn't really exist. That well over 90% of child sex abuse victims know their abuser very well. That the use of physical force is extremely rare in child sexual abuse. Those pictures on the internet for the most part involving torture of children are likely just as staged as when the same type of pictures are produced using adults. That the people involved never turn out to be the human incarnation of Satan that we imagine them to be. They turn out to be people - human beings - in need of professional medical and psychological help.

2. The fact that these monsters we imagine these people to be never turn out to be what the people actually are means that there really aren't any easy answers. We really can't "Hang 'em all and let God sort it out". Witch hunts have never turned out well but they are far easier then actually looking at tough questions and finding that there is no one answer. We're not even ready as a society to admit the problems aren't what we think they are let alone getting on with the tougher task of finding the solutions. We are still locked in the moral panic.

We should all look to events like this and say enough of it. WE are clearly taking the wrong approach here and we need to start rethinking things even if it means rethinking things.

How many more children were harmed by this operation - by having their fathers hauled away never to return as the person they knew before, or in 39 cases never to return again. How many families were destroyed, mothers reduced to tears, children now living in fear that at any time for no reason at all armed police officers could come and take away their loved ones. Heck, at least one child was targeted when his father was revealed to be innocent. How many more children were the targets of this operation?

I would like to know - and I hope people around the world invest the time as this single operation was global in scope and affected many thousands more people then just the 7200 in the UK - how many children were harmed on those 12 web sites in question vs. how many children were harmed by the global witch hunt that ensued. If those web pages did not contain images of thousands of children (and in all likelihood they did not) not thousands of images of only a few children, it would be safe to say that the cure for the problem of online child pornography in this case caused far more damage to children then the problem caused originally.

I'm not saying we should not try to help children who have been victims of child pornography or sexual abuse. But clearly we need to rethink our approach if the ways we are currently 'helping' are harming many more children in ways that can be just as lasting and painful.

When so few sex crimes involve violence - and arguably the mere viewing of child porn on the internet is the least violent of all sex crimes as there is no direct connection between the viewer and the victim at all - why is it that the response from authorities to situations of sex crimes always ends to involve extreme use of force and tactics that are employed by military personal who are launching an offensive against what they expect to be heavy armed resistance (6 am surprise raids)?

BrusselsLout said...

Anon -- an excellent analysis.

I take it you're American. If so, can you tell us if the American authorities generally react in the same way as the British ones have done here?

My feelings are this. In Britain, throughout the 80's and 90's, the police have been heroized by our tabloid press. This has been done in the crassest way and in diversity of scenarios. And it’s worked: I have a lot of friends and acquaintances in Britain who refuse to believe that the police are capable of doing wrong.

The eventual upshot is this. The British police no longer feel under any kind of scrutiny. They can get away with anything. So they no longer need to put any effort into their work (like the intellectual effort of checking facts first, evidently the part they find the most difficult).

This should have been BIG news in Britain. But it hasn’t been. Hardly anyone seems to care that the wrong people have been falsely arrested (in a horrifically aggressive way) and have had their lives destroyed.

Anonymous said...

Actually I am Canadian - but I live right on the boarder.

Though I have no direct experience dealing with American police I can tell you about Canadian police.

I was falsely arrested on a sexual assault charge a few years back and the police handled it extremely poorly. They arrested me at work - told all my co-workers, phones the precedent of my company - I worked (yes it cost me my career) for a Canadian Telecommunications company.

It took almost two years to get to trial where I was completely acquitted on all counts. They knew from day one they did not have enough evidence to get a conviction but that did not stop them. They tampered with witnesses , they had ZERO evidence because the things they were charging me with never occurred.

I am still fighting to get my record completely expunged years later as they refuse to take it out of the system completely because it was a sex crime. So even though I was never convicted and was innocent from day one I it would still come up if I get my license run or a security check.

So, it's pretty much the same the Western world over, the UK is not alone and I think most of it was born in the USA so they are worse.

BrusselsLout said...

Anon, let me first of all say that I'm angered by your experience, although not entirely surprised that the Canadian police are similar in character to the British.

I wish you the best of luck in getting your name cleared, and I hope you keep us posted on this site as to how it goes.

Fima Fimovich said...

I came to US as political refugee on human rights violations in former USSR
I am russian jew, and I got a lot of discrimination in USSR
But I got the worst thing in USA, never possible in communist country.
I was set up with my computer, convicted as a sex offender for computer p..rn.
Now I do not have job and can hardly survive under police database
supervision, named sex offender registration. Nobody want to hire me,
I think because of police database.
And I have family. Who cares? Dirty polititians and prosecutors are
playing their
dirty games for more power.
I would like to send you some links to publications about my criminal
case. I was forced to confess to the
possession of internet digital pictures of porn in deleted clusters of
my computer hard drive. My browser was hijacked while I was browsing
the web. I was redirected to illegal sites against my will. Some
illegal pictures were found on my hard drive, recovering in
unallocated clusters, without dates of file creation/download.

I do not know how courts can widely press these charges on people to
convict them, while the whole Internet is a mess.

My lawyer Jeff Dean is going to file a court petition next week.
CP law was unconstitutional at the time of my conviction, because
there was requirements for defendant to prove age of people on photos.
Defendant should not
prove his innocense.
DOJ must prove this. This is clear for everybody, and even
Minnesota Supreme court agreed, making unconstitutional some part of
CP law
Here are explanations with David Stanley comment
No press covered this. I am going to bring public attention to this
If I win this case it may start destroying the corrupt system DOJ.
Making unconstitutional laws, accusing ordinary people with terrible,
emotionally charged crimes is goverment crime, just like Nazi in

This is my story in There is all
information about case written by Irish writer Brian
Rothery. You can see a lot of violations of law by police

This is publication in Wired news,1377,63391,00.html

r2rknot said...

I must say, although law enforcement agencies in the US are far from excluded in making really poor choices, it seems the UK law enforcement community does pound out some really moronic ones.

And in the US, you don't see so many night time raids for our persons and children because some of us have guns :)