The 21 year-old college student charged with hacking former Alaska Governor Sarah Palin's Yahoo e-mail account was using a compromised computer that was secretly logging and reporting information without his knowledge, his lawyers say.

In court filings attorneys for David Kernell say that the Acer notebooks that U.S. Federal Bureau of Investigation agents seized from Kernell's Knoxville, Tennessee, apartment last year apparently contained spyware. "The program, which was installed by an unknown method before the computer ever came into Mr. Kernell's possession,uses sophisticated technology to record and report personal information without the user's knowledge," his attorneys state, in a Nov. 30 motion.

Although the court documents do not identify the program, they indicate that the software was reverse-engineered and analyzed within the five forensic reports the U.S. Government produced for this case.Those reports have been filed under seal because they contain personal information.

Kernell is facing a possible five-year prison sentence on a one-count felony computer hacking charge.Prosecutors say that he accessed Palin's personal e-mail account in Sept. 2008, while she was running as a vice-presidential candidate, and used Yahoo's password reset feature to gain access to her mail. Thee-mails were posted online and an anonymous member of the 4chan discussion board named Rubico claimed responsibility for the act.

In her recent autobiography, Palin described the incident as the"most disruptive and discouraging" event of her losing 2008 campaign.

It's not uncommon for computers to be infected with malicious software that logs personal information, said Paul Ferguson a security researcher with anti-virus vendor Trend Micro. In fact, he guesses that one in five PCs have some sort of malicious program on them, giving backdoor access to cyber-criminals.

David Kernell is the son of Democratic Tennessee state representative Mike Kernell. His trial is set to begin on April 20.

Security firms on police spyware, in their own words

By Declan McCullagh and Anne Broache
Staff Writers, CNET News

In a case decided earlier this month by the 9th U.S. Circuit Courtof Appeals, federal agents used spyware with a keystroke logger torecord the typing of a suspect who used encryption to scramble hiscommunications.

But would that government spyware used in that investigation actually be detected by security software? Or would security companies intentionally fail to report it?

To answer that question, CNET News.com performed the following survey.We asked three questions of 13 security companies, ranging from tiny ones to corporations like Microsoft and IBM, and the results are below.

When there is no answer listed for a specific question, the company chose not to answer it. In some cases we followed up with additional questions. We began the survey last Tuesday and asked the final questions on Monday.

AVG/Grisoft

Responses from Fran Bosecker, spokeswoman for Grisoft, which publishes the AVG Anti-Virus, AVG Anti-Spyware, and AVG Anti-Rootkit programs, many of which are free. Grisoft has offices in the United States, Czech Republic, and Cyprus.

Question: Has Grisoft/AVG ever had any discussions with any government agency about not detecting spyware or keystroke loggers installed by a police or intelligence agency?

Answer: Not to the best of my knowledge in the U.S. or Europe.

Question: Is it Grisoft/AVG's policy to alert the user to the presence of any spyware or keystroke logger, even if it is installed by a police or intelligence agency?

Answer: So far this is the policy, also based on the valid legislature.

Question: Do these policies vary depending on the country (the U.S. vs. others, for instance)?

Answer: Yes. Current AVG policy is to flag Trojans that exhibit these types of actions. With that said, AVG will of course consider all laws, regulations and compliance rules set forth by the nations and/or local governments to the best of our abilities.

Question: We understand that you have to comply with applicable laws and regulations. But do any laws and regulations currently require security companies to ignore spyware/malware/key loggers placed onc omputers by governmental agencies?

Answer: None that we're aware of in the U.S. or Europe, or at least no law enforcement or agency has asked that we ignore any.

Question: Have you ever received such a court order signed by a judge requiring you to cooperate with law enforcement authorities int erms of not detecting government-installed spyware or delivering government spyware to your users?

Answer: No

Check Point

Responses from Allison Wagda, director of public relations at Check Point Software, which makes the ZoneAlarm security software, including a Vista version announced last month. Other Check Point products provide disk encryption, firewalls and intrusion detection.

Question: Has Check Point ever had any discussions with any government agency about not detecting spyware or keystroke loggers installed by a police or intelligence agency?

Answer: No, we've never been approached with such a request.

Question: Is it Check Point's policy to alert the user to the presence of any spyware or keystroke logger, even if it is installed by a police or intelligence agency?

Answer: Our goal is to detect malicious software. ZoneAlarm does so by detecting certain behaviors (such as keystroke logging) and alerting the user. We do have a policy whereby legal, legitimate software programs from any third-party vendor can be "whitelisted" from detection upon request. We would afford law enforcement the same courtesy.

Question: In a follow-up conversation, we asked Check Point under what circumstances they would afford that "courtesy."

Anwser:We've never been in the situation, but if the request fell outside of our typical parameters for whitelisting (i.e. having a signed certificate, among other things), then we'd consider on a case-by-case basis.

Question: Have you ever received such a court order signed by a judge requiring you to cooperate with law enforcement authorities in terms of not detecting government-installed spyware or delivering government spyware to your users?

Answer: Not to our knowledge.

...................

From Cnet News