Incident: Josh Duggar's Computer System Compromised for Child Pornography Access

Published Date: 2021-12-02

Postmortem Analysis
Timeline 1. The software failure incident involving the discovery of child pornography on Josh Duggar's computer occurred in May 2019 [121915].
System unknown
Responsible Organization 1. Josh Duggar - He allegedly created a secret domain on his computer to access the dark web for illegal files, and had installed programs for peer-to-peer file sharing on encrypted networks [121915].
Impacted Organization 1. Josh Duggar 2. FBI's High Tech Investigation Unit 3. Jurors 4. Homeland Security 5. TLC 6. Wholesale Motors 7. Bobye Holt 8. Jim Bob Duggar 9. Rick Santorum 10. Anna Duggar 11. Victims of child pornography 12. Church community 13. Defense lawyers 14. Potential witnesses (Jed Duggar, Jill Duggar) [121915]
Software Causes 1. The failure incident involved the use of visualization software to replicate the exact desktop on Duggar's seized work PC, revealing incriminating evidence related to child pornography [121915]. 2. The failure incident involved the installation of programs like uTorrent and Tor Browser for peer-to-peer file sharing on encrypted networks, indicating an attempt to remain anonymous [121915]. 3. The failure incident involved the presence of tell-tale signs on the computer, such as thumbnail images and cached file names related to child pornography, despite efforts to hide the operator's identity [121915]. 4. The failure incident involved the discovery of an encrypted list of recently viewed files on the desktop's media player, which were identified using FBI databases as alleged child porn videos [121915]. 5. The failure incident involved the use of expertise to retrieve deleted pictures from the computer, which were discreetly shown to jurors as evidence [121915].
Non-software Causes Unknown
Impacts 1. The software failure incident involving Josh Duggar's computer led to the discovery of disturbing files such as 'Jailbait,' 'Pedo Mom,' and 'Daisy's Destruction' containing child pornography [121915]. 2. The incident resulted in the identification of a video featuring a young infant being tortured with hot wax, causing distress to the veteran investigator and potentially traumatizing jurors [121915]. 3. The software failure incident allowed the operator to access the dark web anonymously through the installation of programs like uTorrent and Tor Browser for peer-to-peer file sharing on encrypted networks [121915]. 4. Despite attempts to hide his identity, the software failure incident left behind tell-tale signs such as thumbnail images and cached file names related to child pornography, leading to the discovery of incriminating evidence [121915]. 5. The incident led to the retrieval of dozens of deleted pictures and the identification of numerous alleged child porn videos through the desktop's media player, further incriminating the accused [121915].
Preventions 1. Implementing strict access controls and monitoring mechanisms to prevent unauthorized access to sensitive data and illegal activities on company computers [121915]. 2. Regularly conducting thorough security audits and checks on all computer systems to detect any suspicious activities or unauthorized software installations [121915]. 3. Enforcing strong password policies and ensuring that employees do not reuse passwords for sensitive systems like internet banking and work computers [121915]. 4. Providing cybersecurity training and awareness programs to employees to educate them on the risks of engaging in illegal online activities and the consequences of such actions [121915].
Fixes 1. Implement stricter access controls and monitoring on the computer systems to prevent unauthorized activities like accessing the dark web and downloading illegal content [121915]. 2. Enhance cybersecurity measures to detect and prevent the installation of programs like uTorrent and Tor Browser for peer-to-peer file sharing on encrypted networks [121915]. 3. Improve data encryption and security protocols to safeguard sensitive information and prevent the storage of illegal content on the system [121915]. 4. Conduct regular audits and forensic examinations of computer systems to identify and address any suspicious activities or files [121915].
References 1. James Fottrell, Director of the FBI's High Tech Investigation Unit [Article 121915] 2. FBI databases [Article 121915]

Software Taxonomy of Faults

Category Option Rationale
Recurring unknown The provided news article does not contain information about a software failure incident happening again at one organization or multiple organizations.
Phase (Design/Operation) design, operation (a) The software failure incident in the articles can be attributed to the design phase. Specifically, the failure was due to contributing factors introduced by system development and procedures to operate or maintain the system. The articles mention that the accused, Josh Duggar, had allegedly created a secret domain on his computer where he accessed the dark web to hunt for files related to child pornography. He used visualization software to replicate the exact desktop on his seized work PC, and the system was running two parallel operating systems, Windows and Ubuntu, with the Linux partition being protected by a password. Additionally, programs like uTorrent and Tor Browser were installed for peer-to-peer file sharing on encrypted networks, and despite efforts to remain anonymous, tell-tale signs were left on the computer, including cached file names related to child pornography [121915]. (b) The software failure incident can also be linked to the operation phase. The failure was due to contributing factors introduced by the operation or misuse of the system. Despite attempts to cloak his location and remain anonymous while accessing the dark web for illegal content, the operator of the computer, Josh Duggar, left numerous tell-tale signs on the system. These signs included thumbnail images and cached file names related to child pornography, as well as an encrypted list of recently viewed files that were identified as alleged child porn videos. The desktop's media player also contained an encrypted list of recently viewed files, which were identified using FBI databases as alleged child porn videos. Additionally, the FBI investigator was able to retrieve deleted pictures from the system, which were discreetly shown to jurors during the trial [121915].
Boundary (Internal/External) within_system (a) within_system: The software failure incident in the article is primarily within the system. The failure occurred due to Josh Duggar allegedly downloading and possessing child pornography on his computer. The incident involved the use of visualization software to replicate the exact desktop on Duggar's seized work PC, revealing how he accessed the dark web to hunt for files marked 'Jailbait,' 'Pedo Mom,' and 'Daisy's Destruction' [121915]. The failure was related to the setup of two parallel operating systems on Duggar's computer, with one being a Linux partition that required physical access to boot and was protected by a password [121915]. Additionally, the installation of programs like uTorrent and Tor Browser for peer-to-peer file sharing on encrypted networks contributed to the failure [121915]. The failure was further exacerbated by the presence of tell-tale signs left by the computer's operator, such as thumbnail images and cached file names related to child pornography [121915].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in this case seems to be primarily related to non-human actions. The failure was due to the use of visualization software by James Fottrell, the Director of the FBI's High Tech Investigation Unit, to replicate the exact desktop on Josh Duggar's seized work PC. This visualization software was used to demonstrate how Duggar allegedly created a secret domain to access the dark web and hunt for files related to child pornography [121915]. (b) However, human actions also played a significant role in the software failure incident. Josh Duggar was charged with downloading and possessing child pornography, and it was his actions that led to the creation of a secret domain on his computer to access illegal content. Additionally, the use of encryption tools like uTorrent and Tor Browser for peer-to-peer file sharing on encrypted networks was a human action that contributed to the failure [121915].
Dimension (Hardware/Software) hardware, software (a) The software failure incident related to hardware: - The article mentions that James Fottrell, Director of the FBI's High Tech Investigation Unit, used visualization software to replicate the exact desktop on Josh Duggar's seized work PC [121915]. - Fottrell found that Duggar's computer was running two parallel operating systems, regular Windows plus a second called Ubuntu, a setup classed as a Linux partition [121915]. - The alternative Ubuntu workspace was downloaded on May 11, 2019, and could only be accessed by physically restarting the computer and hitting F9 as it rebooted [121915]. - Fottrell also mentioned that the Linux side of the computer was protected by the password intel1988, the same password prosecutors say Duggar used for his internet banking [121915]. (b) The software failure incident related to software: - Fottrell found that two programs called uTorrent and Tor Browser had been installed for peer-to-peer file sharing on encrypted networks [121915]. - Despite cloaking his location, the computer's operator had left numerous tell-tale signs, including thumbnail images and cached file names such as ‘ultra hard pedo pedophilia' [121915]. - The desktop's media player also contained an encrypted list of recently viewed files, which were identified using FBI databases as alleged child porn videos [121915]. - Fottrell was eventually able to use his expertise to retrieve dozens of deleted pictures from the computer [121915].
Objective (Malicious/Non-malicious) malicious, non-malicious (a) The software failure incident in this case is malicious. The failure was due to Josh Duggar allegedly creating a secret domain on his computer to access the dark web and hunt for files containing child pornography. He used visualization software to replicate the exact desktop on his seized work PC, where he had files titled 'Jailbait,' 'Pedo Mom,' and 'Daisy's Destruction' ([121915]). (b) The software failure incident is also non-malicious. It involved the use of peer-to-peer file sharing programs like uTorrent and Tor Browser for encrypted networks, which were installed for anonymous file sharing. Despite efforts to remain anonymous, the computer operator left tell-tale signs such as thumbnail images and cached file names related to child pornography ([121915]).
Intent (Poor/Accidental Decisions) unknown The articles do not provide information related to a software failure incident caused by poor decisions or accidental decisions.
Capability (Incompetence/Accidental) accidental (a) The software failure incident in this case does not seem to be related to development incompetence. The incident was primarily about the discovery of child pornography on Josh Duggar's computer, which involved detailed analysis by the FBI's High Tech Investigation Unit using visualization software to replicate the exact desktop on Duggar's seized work PC [121915]. (b) The software failure incident appears to be accidental in nature. The incident involved the accidental discovery of child pornography files on Josh Duggar's computer, which were found through detailed forensic analysis by the FBI's High Tech Investigation Unit. The files were titled 'Jailbait,' 'Pedo Mom,' and 'Daisy's Destruction,' and the investigation involved identifying torrent files that provided instructions to locate illegal content on the dark web [121915].
Duration temporary The software failure incident described in the articles is more likely to be temporary rather than permanent. This temporary failure was due to contributing factors introduced by certain circumstances but not all. The incident involved the use of visualization software to replicate the exact desktop on Josh Duggar's seized work PC, showing how he allegedly created a secret domain to access the dark web for illegal files [121915]. Additionally, the incident involved the identification of specific files and activities on the computer, such as the installation of programs for peer-to-peer file sharing on encrypted networks and the presence of tell-tale signs despite attempts to remain anonymous [121915]. These factors indicate a temporary failure caused by specific actions and circumstances related to the illegal activities conducted on the computer.
Behaviour value, other (a) crash: The software failure incident in the article did not involve a crash where the system lost state and did not perform any of its intended functions. The incident was related to the accused individual's actions and activities on his computer, particularly involving child pornography. [121915] (b) omission: The software failure incident did not involve the system omitting to perform its intended functions at an instance(s). The focus was on the accused individual's activities and the content found on his computer. [121915] (c) timing: The software failure incident did not involve the system performing its intended functions correctly but too late or too early. The incident was centered around the accused individual's actions and the content discovered on his computer. [121915] (d) value: The software failure incident did involve the system performing its intended functions incorrectly, as it was related to the accused individual allegedly downloading and possessing child pornography on his computer. [121915] (e) byzantine: The software failure incident did not involve the system behaving erroneously with inconsistent responses and interactions. The incident primarily focused on the accused individual's activities and the content found on his computer. [121915] (f) other: The software failure incident in the article involved the accused individual using visualization software to replicate the exact desktop on his seized work PC, creating a secret domain to access the dark web, and downloading and possessing child pornography. The behavior of the system was related to facilitating these actions rather than a traditional software failure as described in the options. [121915]

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, theoretical_consequence, unknown (a) unknown (b) unknown (c) unknown (d) People's material goods, money, or data was impacted due to the software failure [121915] (e) unknown (f) unknown (g) unknown (h) There were potential consequences discussed of the software failure that did not occur [121915] (i) unknown
Domain information (a) The failed system in this incident was related to the production and distribution of information. The software failure incident involved the trial of Josh Duggar, who was charged with downloading and possessing child pornography. The incident included the use of visualization software to replicate the exact desktop on Duggar's seized work PC, demonstrating how he harvested and hid an alleged stash of warped video and images [121915].

Sources

Back to List