Join Us!

Procedure for CP ev...
 
Notifications
Clear all

Procedure for CP evidence?  

Page 1 / 6
  RSS
OldDawg
(@olddawg)
Active Member

I think I have some CP images in a case I'm working on. I've been in touch with the po-po and will be providing them with a CD of the images in a face-to-face meeting. So how does this work?

Let's say they determine that the images are indeed CP. Do they then take my DD image disk as well as seize the original computer? How do I then provide evidence for the original case which has nothing to do with CP?

Maybe I should get a honkin big external drive and export everything EXCEPT the suspect images to it?

Inquiring minds want to know…

Quote
Posted : 09/02/2007 11:20 pm
keydet89
(@keydet89)
Community Legend

I'm in a corporate consulting position and I find CP, it's stop, drop, and roll. Stop the examination, drop everything, and roll all data back to the client, with a strong suggestion that they contact local law enforcement.

ReplyQuote
Posted : 10/02/2007 1:21 am
az_gcfa
(@az_gcfa)
Active Member

How the incident or case proceeds will really depend upon the local LE and the amount/quanity of content, likelyhood of distribution and if any Federal agency become's involved.

I have not been involved with any activity of this nature as a consultant in the private sector.

However, several of my college instructors in Forensics are active members of "Child Exploitation Task Forces". From our discussions they will take whatever you offer them and if they need more, they will ask or get a search warrant! They can ask you without alerting anyone, since you have an image of the hard drive. I would guess that after they have verified the CP, they will issue a search warrant for the original drive.

I would contact my lawyer as a CYA! Just to insure that you know exactly what your legal obligation are concerning local or state regulations and to insure that you are not violating any NDA or other contractual restrictions.

NJ court held that corporations/business are responsible for investigating and reporting CP incidents (victims parents used the corporation that employed the person with CP). A lot of schools and universities are required by state law to report things of this nature.

As a hired consultant for a company or entity, does your state consider your consulting services independent of the company activities, or are you considered a restricted agent of the company?

These are some of the questions I'm going to revisit with my lawyer – real soon!

Thanks for posting! Things that I thought were cut and dry became awful fuzzy when I stated running this to ground!

ReplyQuote
Posted : 10/02/2007 8:58 am
Jamie
(@jamie)
Community Legend

az_gcfa's advice to take legal advice is undoubtedly sound, there are a number of issues which need to be considered as soon as you suspect that CP has been detected and from a legal perspective there may be things that you are obliged to do and things you are strictly forbidden from doing. As important are your own views about your moral obligations in this kind of situation (it is sometimes forgotten that CP is evidence of a serious crime, regardless of how it came to be on the device in question). Finally, private sector workers need to consider the commercial implications of their actions or inactions (note I am certainly NOT suggesting that commercial interests take any kind of precedence over legal or moral obligations - far from it - simply that is wise to be aware of any likely impact).

OldDawg, I note you talk about creating a CD with the images. I'm not familiar with the relevant legislation in your location but I would strongly advise you to take legal advice before creating any further copies of the material in question.

Jamie

ReplyQuote
Posted : 10/02/2007 12:39 pm
keydet89
(@keydet89)
Community Legend

Just an FYI…my response was based on already having contacted corporate counsel and received my manager's advice.

If I have to analyze a drive that is suspected to have CP on it, I will perform as much analysis as I can without looking at images…identifying the locations of image or movie files, etc…all without looking at the image in Gallery mode.

Speaking of impact…if I were to take an image and go straight to the police with it, there would be significant impact…my employer could be sued, I may be sued, and I most definitely will be fired.

Harlan

ReplyQuote
Posted : 10/02/2007 6:10 pm
psu89
(@psu89)
Active Member

In my one and only experience with CP, we called the corporate atty, who called the FBI. They came and seized the suspect laptop, the external drive that contained the image of the laptop and the CD I burned my report to (which contained CP images).

I was able to keep my forensic workstation only by running an eraser program (DOD 7 pass) on the report files and free space. This was done under the supervision of the FBI agent.

ReplyQuote
Posted : 10/02/2007 9:04 pm
deckard
(@deckard)
Member

FWIW;
In my contract with my clients, in my Confifentiality clause, it states that in the event of CP appearing during my exam, the confidentiality claused is waived without notification to the client and LE will be contacted and ALL client materials turned over to them.

This is because I had this happen once. The Feds I dealt with made it clear that if II had returned items to the client, I would have been charged with coveyance of CP. So wise thing for me is to have it in the contract upfront.

Bill

ReplyQuote
Posted : 10/02/2007 9:08 pm
dcso
 dcso
(@dcso)
Junior Member

Speaking of impact…if I were to take an image and go straight to the police with it, there would be significant impact…my employer could be sued, I may be sued, and I most definitely will be fired.

Is there any law that requires you to report this to police? I believe some states have enacted legislation to address repair shops, service techs, and I assume CF.

It seems odd that reporting a crime would get you sued. I can somewhat understand why, but still seems odd. )

ReplyQuote
Posted : 10/02/2007 9:20 pm
armresl
(@armresl)
Senior Member

You are surely led to believe that if you know of "any" crime that has been committed the FBI would like you to report it to them.

If you are in the private sector the ramifications of doing this and possibly being wrong are monumental. You can 100% forget doing any more work in this field. I have been around hearings where a person such as a worker in a large retail type outlet called the FBI on what he though was CP. Turned out it wasn't and the guy got reamed bad. While you think you may be getting a new friend in a G-Man, you may also open yourself up to a civil lawsuit in which you did nothing wrong but find you need to defend yourself and pay large attorney costs.

First one would ask what would make you able to be an expert in the area of CP to be able to tell that the images were in fact illegal? Then one would wonder if there were any agreements or contracts signed between you and the client where there are privacy issues or issues of privilege.

You can also look at the charge on it's face and say that CP possession is CP possession regardless of where you got it from. Don't think that people who examine hard drives and stumble upon contraband haven't been charged and subjected to the stigma that goes with that type of a charge.
I in fact worked on a case where a person dropped off media to a computer shop operator and the worker discovered it contained problem material, he called the FBI and they arrested him, charged him, and convicted him (with mandatory minimums he did some time in Fed system) on possession charges.

OF course this is all IMHO and your counsel, my counsel, an AUSA, Judge, or other counsel might all have different opinions on what should be or should have been done.

ReplyQuote
Posted : 10/02/2007 10:48 pm
wilber999
(@wilber999)
Junior Member

I am a bit confused (or I misunderstood some posts).

I have read here to call your lawyer, examine around the CP, go straight to the FBI, and don't go straight to the FBI to avoid a civil suit if you are wrong.

The post by armresl concerns me the most about a repair guy getting convicted and doing time after calling the FBI. Is there more to the story than they found CP while servicing a computer and called the FBI?

It is starting to sound like my chosen career is like playing Russian Roulette with these hard drives.

Can someone clarify what to do if we run across it?
My contract states that I "will immediately cease its examination and advise CLIENT and appropriate law enforcement authorities of the nature of the materials found". Is this wrong?

ReplyQuote
Posted : 11/02/2007 1:29 am
armresl
(@armresl)
Senior Member

Actually, it wasn't CP, that is why I used "problem material" it was a case of suspected terrorism and the person accused was a white American, never been in trouble before for anything and ran a very successful business for lots of years.

I have witnessed cases though where there were low level tech guys from large nationwide retail chains where the charges were for CP.

It's a judgment call on you and your counsel's part.
Several people are going to have several different answers, that doesn't make mine or anyone else's right for your situation.

Just trying to provide you with information from experiences I have had.

ReplyQuote
Posted : 11/02/2007 1:53 am
armresl
(@armresl)
Senior Member

I am a bit confused (or I misunderstood some posts).

I have read here to call your lawyer, examine around the CP, go straight to the FBI, and don't go straight to the FBI to avoid a civil suit if you are wrong.

The post by armresl concerns me the most about a repair guy getting convicted and doing time after calling the FBI. Is there more to the story than they found CP while servicing a computer and called the FBI?

It is starting to sound like my chosen career is like playing Russian Roulette with these hard drives.

Can someone clarify what to do if we run across it?
My contract states that I "will immediately cease its examination and advise CLIENT and appropriate law enforcement authorities of the nature of the materials found". Is this wrong?

Advise client and appropriate LE can be rather vague. Who is the appropriate LE? Who makes the decision on who is the appropriate LE?
Do you act the same in every instance of this? Based on the following wording you just have to contact any law enforcement agency, doesn't even have to be in your home state. But that is their wording and what you have differs from that.

If you look at the code, you probably don't fall under those guidelines.
BEGIN CUT AND PASTE

"Creates a mandatory reporting requirement for electronic communication service providers, Internet Service Providers, and remote computing service providers to report violations of federal child pornography laws to any law enforcement agency and/or the National Center for Missing and Exploited Children."

You may want to look up 2252(a)(4) and 2252A(a)(5)

ReplyQuote
Posted : 11/02/2007 2:05 am
mark777
(@mark777)
Active Member

keydet

Read your reply with interest re your procedure and I realise that we are in different legal jurisdictions but I am interested to know you views on the following if you could

If you find CP images and stop your examination and give the drive back to the client what happens if the client is the person who put them there. They are not gonna contact LE. Do you have any procedures in place to ensure that LE becomes aware or indeed can you inform LE without the clients permission.

I notice you mention being sued in certain instances but what would be the outcome if you gave a disk back to a client who was the perp and he (or she) subsequently abused a kid and it come out about your drive and CP and nothing had been done about it. Would that leave you open to action being taken against you?

Also, in this country, if as a LE officer I discovered that a private practice investigator had come across CP on a drive and returned it to a client without informing LE then in all probability he/she would be arrested for distributing illegal images of children. Is there nothing like that over there you are leaving yourself open to.

All in all I do not envy you the position that you would find yourself in.

Please understand I am not making any criticism of any of your policies, I am just interested in how you deal with the problem you have as a private sector investigator when you come across someone who may be or have evidence of child abuse.

ReplyQuote
Posted : 11/02/2007 2:23 am
ddow
 ddow
(@ddow)
Active Member

Mark,

This particular scenario starts many lively discussions in which the differences are really centered on jursidiction. The best advice of all so far was to consult your own attorney before even taking a case.

Cheers

ReplyQuote
Posted : 11/02/2007 3:22 am
wilber999
(@wilber999)
Junior Member

I appreciate everyone's conversation and would like to say that I enjoy the conversation, but I do not like the topic of CP and admire (and thank) those that work with it daily to protect help protect my family.. Below is the complete section of my contract on CP

To the event that a forensics examination reveals the existence of possible child pornography on the examined media, COMPANY will immediately cease its examination and advise CLIENT and appropriate law enforcement authorities of the nature of the materials found. Before proceeding with further forensic examination, CLIENT will secure a court order or take such other legal action as may be necessary to prevent both COMPANY and CLIENT from being subject to any legal charges regarding the possession or distribution of child pornography.

Not that it makes it any better, but this section came from an ABA published book on electronic discovery in which the authors run a well respected Forensics company.. I agree with each of you to consult counsel and check my local laws and restrictions.

Everyone have a good weekend..

armresl… your post on people getting busted for what appears to be the "right thing" still concerns me 😯

ReplyQuote
Posted : 11/02/2007 5:17 am
Page 1 / 6
Share: