Police blotter: Web cookies become defendant's alibi

"Police blotter" is a weekly CNET News.com report on the intersection of technology and the law.

What: A Texas man says the timestamp of cookies on his Web browser proves he was actually online and not where prosecutors claim he was.

When: The Texas Court of Appeals rules on Oct. 12.

Outcome: The appeals court upheld the conviction of Everett Eugene Russell.

What happened, according to court documents:

After a stormy divorce between Erin McRae and Everett Eugene Russell, a judge granted McRae a protective order requiring her ex-husband to stay away from her residence.

McRae moved to her stepfather's home in Shady Shores, Texas. Around 10 a.m. on Feb. 26, 2005, she noticed a white truck parked on the road. She and her friend Heather both claim they then spotted Russell walking down the fence line along the stepfather's house.

The two women called 911. Sgt. David Allen with the Corinth Police Department testified that he showed up at 10:47 a.m. and found nobody matching the ex-husband's description.

Russell's alibi after he was charged consisted of three portions. First, his mother said that he was at home at 9:45 a.m. that day--which, if true, wouldn't have given him enough time to drive some 45 minutes to Shady Shores. Second, his brother said that he spoke to Russell on the house phone between 10 a.m. and 11 a.m.

The third component of the alibi is what makes this case relevant to Police blotter. Russell claimed he was surfing the Web that morning, checking on an IRS income tax return and shopping online at Home Depot's and Lowe's Web sites.

He made a disk showing the Web sites that he had visited on Feb. 26, 2005, and the cookies on the disk indicated that he was on the IRS Web site at 10:29 a.m. CST. The disk also indicated that Russell was online from 10:29 a.m. to 11 a.m. and again at 1:04 p.m. (Cookies are, of course, small chunks of data saved in text files that let a Web site recognize you upon future visits.)

But prosecutors argued that the cookie file could have been altered, and a jury agreed. There's no explanation in the opinion as to why Russell's attorney didn't subpoena logs from those Web sites or his Internet service provider that--if available--could have provided a much stronger alibi. It's also unclear if Russell was relying on information in individual cookies, which would be set by each Web site, or the file system's timestamp on the entire file.

On appeal, Russell's attorney argued there was insufficient evidence to establish that his client violated a protective order. The Texas appeals court disagreed, and upheld Russell's original sentence of 365 days of confinement and a $2,000 fine.

Excerpts from the opinion by Justice Sue Walker of the Texas Court of Appeals:

Russell's mother, Charlene, testified in his defense. She explained that she left her house at 9:45 a.m. on the date in question to attend a funeral. She said that when she left, Russell was awake. Charlene testified that Russell planned to get on the Internet to obtain some prices for products from Lowe's and Home Depot for remodeling her bathroom. She testified that Russell was at home when she returned from the funeral at 4 p.m. and that his car was in the same spot as when she had left. Charlene testified that she thought Russell was at home the previous night, but she did not get off work until 11:30 p.m. or 11:45 p.m.

Russell's older brother, Travis Todd Russell, also testified on Russell's behalf. He explained that he had called his mother's house between 10 a.m. and 11 a.m. on Feb. 26, 2005, and had asked Russell to check on the status of his income tax refund. Russell took the stand and testified that he was at his mother's house at 10 a.m. on Saturday, Feb. 26, 2005. Russell said that his brother Travis called at 10:15 a.m. and that they talked for about 24 minutes.

Russell said he checked on his brother's income tax refund on the IRS Web site that morning and also checked prices on Home Depot's and Lowe's sites. Russell had made a disk showing the Web sites that he had visited on Feb. 26, 2005, and the "cookies" on the disk showed that he was on the IRS site at 10:29 a.m. CST. The disk also shows that Russell was online from 10:29 to 11 a.m., and again at 1:04 p.m. Russell testified that he did not leave his mother's house at all that morning and that he was there when his mother returned from the funeral.

With regard to the house in Shady Shores, Russell testified that he had been there once a few years ago. Russell said that the house was 27.4 miles from his mother's house and that it would have taken him 45 minutes to drive there. Russell denied knowing where McRae lived; he said that he knew only that the house on Pueblo Drive had been foreclosed on, so he knew she was not living at that location. Russell also denied owning or driving a white Suburban.

James Willingham, a felony investigator for the district attorney's office working in computer forensics, testified as a rebuttal witness. He explained that a "cookie," like the ones that Russell had copied to the disk, gets its date and time from the computer and that the computer's date and time are set by the user. Thus, he concluded that the dates and times on the disk purporting to show when Russell allegedly visited the Web sites are "valueless, absent any other context, to say when they were actually done."

More from News.com on this story's topics

Internet

Create an email alert | RSS feed

Web sites

Create an email alert | RSS feed

Law enforcement

RSS feed

See more CNET content tagged:
Police Blotter, mother, Home Depot Inc., income tax, Texas