The Trojan horse defence – a modern problem of digital evidence

Abstract

The Trojan horse defence is an important aspect of the investigation of crimes involving digital evidence. In raising this defence, the accused claims that they are not responsible for some or all of the digital evidence that forms the offence, but by someone else who has abused their computer system with a Trojan horse or other malicious code. The prosecution must refute such claims with certainty, otherwise the court (or the jury) will have to find the defendant innocent of the crime.To avoid the Trojan horse defence, law enforcement agents will also, in addition to presenting digital evidence (which must not only prove the existence of a crime, but also the absence of malicious codes and other offenders who could be involved in the offence), use traditional forms of evidence, such as physical evidence, witnesses, motive, and the computer knowledge of the accused. The stronger the connection between digital and other forms of evidence, the lower the probability of using a Trojan horse defence as a diversion with the intent to confuse the court and the jury.The article presents theoretical and practical dilemmas of a Trojan horse defence, offering some solutions for law enforcement agents when dealing with such a defence within the context of Slovenian criminal law.

What a Law Society Should Be A Response to the Law Society of Upper Canada's Alternative Business Structures Discussion Paper of September 24, 2014

“…Also, the ability to detect defects and the implanting of malicious software is very poor. The following quotation is from an article dealing with the, "Trojan horse defence," i.e., defences against accusations of illegal materials found stored in a computer that assert that a malicious program, secretly contained within an obtained acceptable program was the cause of the implanting: 59 Daniel Bilar explains how antivirus programs work, and points out that a lot of malicious codes are not recognized by antivirus software that is not updated regularly. Between 26 and 31 per cent of malicious software is not detected on antivirus programs that are not up-dated for a week (this percentage is only valid for better antivirus programspoor quality antivirus programs can miss up to 80 per cent of malicious codes).…”