Hello,

I've always been curious: When do I need to report a case to LE?

So I am thinking of two scenarios:

1. I stumble across some sort of illegal data (lets say CP) -- My thought is I stop what I am doing there and report it.

2. There is already suspicion of illegal activity (lets say again CP) -- My thought is that I don't even take the case and tell them to go to Law Enforcement.


Are there any specific laws surrounding this? I would love some sort of reference.  

Not sure about any law that requires it, but we have a section in our contract that basically states that if we find any contraband of any sort the evidence and devices will be turned over to LE without consulting the client. The exception of course is if we are specifically looking for that contraband as part of our duties, then that falls in our scope.  

- sgreene2991

Not sure about any law that requires it, but we have a section in our contract that basically states that if we find any contraband of any sort the evidence and devices will be turned over to LE without consulting the client. The exception of course is if we are specifically looking for that contraband as part of our duties, then that falls in our scope.

Yes and that is how we work, too. My question is based on suspicion. If we know that there is SOME chance of illegal activity -- can we legally even touch the drive?  

For a suspicion? That would be down to preference, not a requirement.

Take for instance a case we did not too long ago. A wife suspected her husband of downloading and viewing child pornography. Police did not want to investigate because they did not have enough proof for a warrant and they don't have the resources (we verified all of this with the investigating officer before we even took possession of the device). We go through it, find the material, and then police want the case. At which point we give everything to them and they run with it. When we get to court, we had all the documentation that showed an internal timeline of events and our conversations with LE. Defense counsel threw a fit over the whole situation, but the judge upheld that if police turned the case down it was fair game. And of course we have the same protocols and tools as LE, so the initial investigation by us was found to be valid and admissible.

A good thing for you to do is maybe talk to your local prosecutor or police department and see what their opinions are on the subject. They might be able to give you a broader view about what is legal and not.  

- sgreene2991

... took possession of the device ...

Isn't this in itself is a very thin line?
I mean unless the husband managed to use a device actually owned by the wife ...

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

- amathian

Hello,



1. I stumble across some sort of illegal data (lets say CP) -- My thought is I stop what I am doing there and report it.

2. There is already suspicion of illegal activity (lets say again CP) -- My thought is that I don't even take the case and tell them to go to Law Enforcement.

From a moral perspective if the suspicion is based on 'evidence' then you have a duty to report it to LE IMHO. By 'evidence' I mean things such as:

1) Wife has seen sexualised chat with minors on husbands computer........
2) Witness X has seen what they believe is Child Abuse material on Ys computer.
3) Suspect x has told witness Y that he/she has viewed Child Abuse material in the past
etc etc

If the evidence is digital and you have found it as part of an examination..... then yes.... it definitely should be reported.


If the 'evidence' is that a client is just guessing that there 'may be' and does not have a suspicion based on evidence then that would depend on a case by case basis.

Better safe than sorry. To arrest someone in the UK you only need to have 'reasonable suspicion' with the emphasis on the word 'reasonable' (Ie More than just a hunch)  

I'll say what I've been saying my whole career.

I do a lot of criminal defense work. There is a line drawn by most police with a US v. Them attitude. The government would like you to report anything you see to them and let them decide on things. Not caring if the mere accusation of something ruins your life or not.

If you KNOW that something is CP through a hash set, by all means report it. If you think something is CP, then you are in a difficult position. If you are doing work on the civil side and report something or tell the client you have to stop working on an item because of possible CP, then you will likely never work for that client again.

In addition, word travels fast, and you will likely not work for anyone in that firms circles.

You are dealing with a term that by its mere utterance sickens people.

Nothing should be swept under a rug, but going willy nilly around saying I think this is CP can create all kinds of problems.

Another reason why I think hash sets are crucial for people in this business on both sides of the law. I've built up my business and reputation over 16 years in CF, no way that I fail to do the right thing in those circumstances. Some LE though just never get the memo that we are all actually on the same side. All I do is validate their findings or find something else on the drive which raises questions which they can probably answer.
_________________
Why order a taco when you can ask it politely?

Alan B. "A man can live a good life, be honorable, give to charity, but in the end, the number of people who come to his funeral is generally dependent on the weather. "