Although the defendant ends up with a guilty plea, the discovery issue is granted in the Defendant's favor. The defense team does not ends up with an image of a hard drive containing child pornography on it. Following stipulations including not downloading or removing the child pornography, cleaning the slack space of the examination drive, non-disclosure agreements, etc, the defense team.
I am not saying it's ok or not ok to examine CP as non-law enforcement, but this 26 page report is certainly worth a full reading.
I was shown this case by Dr. Bob DeYoung of
If that were me, the police investigator, I would seize the HD because it is original evidence. I would then request a statement from you documenting your procedures up to the time that the HD was turned over to me. I would then seek a search warrant for the drive and its contents, CP. Because of the fact that you were assisting us, I would get reimbursement to you for hardware expenses that you may have incurred, most likely a HD.
I could be unclear on this, but…
In the great state of California the crime is posession or control. Those two elements, either or, only. NOT knowledge.
So if an person who is angry at you places a thumbdrive under the front bumper of your car, and on this thumbdrive is ONE CP image, (s)he can
Call the police, leave an anonymous tip, and YOU will be
(1) A sex felon
(2) A registered sex offender for life– presuming you survive prison– who is subject to Megan's Law (online notification, community banners), Jessica's Law (starve under a bridge, the heck with your family), the Adam Walsh Act (more of the same, but worse)
(3) Dual-prosecuted in federal court. Where the mandatory minimums start at five years.
It is only this easy on you since you have no priors. You say you did not know about this item? You might as well say, "My socks are green!" The People's response That has nothing to do with anything. Perve.
The next time some smarmy politician dreams up a Tough On Crime initiative, especially one that "punishes sex offenders," read the fine print. Because once it is law it is too late.
Assuming it is actually CP, the right thing to do is to stop working on the image and report it to the police. Anything else is just plain wrong and, depending on where you are, probably illegal. Of course you have an obligation to your employer and should keep them involved and informed, but ultimately they won't do your time for you if you allow commercial considerations get you into legal difficulties.
Here is the relevant legislation in Ireland for anyone who may have an interest. As you can see, possession is allowed for investigation and research purposes.
5.—(1) Subject to sections 6(2) and 6(3), any person who—
(a) knowingly produces, distributes, prints or publishes any child pornography,
(b) knowingly imports, exports, sells or shows any child pornography,
© knowingly publishes or distributes any advertisement likely to be understood as conveying that the advertiser or any other person produces, distributes, prints, publishes, imports, exports, sells or shows any child pornography,
(d) encourages or knowingly causes or facilitates any activity mentioned in paragraph (a), (b) or ©, or
(e) knowingly possesses any child pornography for the purpose of distributing, publishing, exporting, selling or showing it,
shall be guilty of an offence and shall be liable—
(i) on summary conviction to a fine not exceeding £1,500 or to imprisonment for a term not exceeding 12 months or both, or
(ii) on conviction on indictment to a fine or to imprisonment for a term not exceeding 14 years or both.
(2) In this section "distributes", in relation to child pornography, includes parting with possession of it to, or exposing or offering it for acquisition by, another person, and the reference to "distributing" in that context shall be construed accordingly.
6.—(1) Without prejudice to section 5(1)(e) and subject to subsections (2) and (3), any person who knowingly possesses any child pornography shall be guilty of an offence and shall be liable—
(a) on summary conviction to a fine not exceeding £1,500 or to imprisonment for a term not exceeding 12 months or both, or
(b) on conviction on indictment to a fine not exceeding £5,000 or to imprisonment for a term not exceeding 5 years or both.
(2) Section 5(1) and subsection (1) shall not apply to a person who possesses child pornography—
(a) in the exercise of functions under the Censorship of Films Acts, 1923 to 1992, the Censorship of Publications Acts, 1929 to 1967, or the Video Recordings Acts, 1989 and 1992, or
(b) for the purpose of the prevention, investigation or prosecution of offences under this Act.
(3) Without prejudice to subsection (2), it shall be a defence in a prosecution for an offence under section 5(1) or subsection (1) for the accused to prove that he or she possessed the child pornography concerned for the purposes of bona fide research.
The way i suggest to go about it, If you run into CP then discretely inform your client who have 3 options
1 Report it to the police
2 Have you erase the HDD with a tool like dban
3 Do nothing
Wiping a hard drive that contains CP would be destroying evidence.
Giving the HDD containing CP back to your client will constitute distributing CP…
Doing nothing indicates that you will be keeping (illegally possessing) CP, not only on your image, but probably all over your forensic machine too.
And creating a copy of an image, or creating copies of individual CP images would be a violation as well, if you knew you were duplicating CP.
Best advice Stop, Drop, and Roll (have the police pick it up from you, get written permission to clean your forensic machine, and make sure all of the CP is out of your hands). Have a clause in your contract to this effect if you are doing civil work.
I work quite a few cases involving CP as a defense expert. In most cases, the DA is quite reasonable to allow me to bring my equipment to the LE and do my work there under their supervision.
If they are not, then I have standard language I give to the defense attorney to compel it via the court.
I have never had an issue doing this and have made some great friends in law enforcement in the process.
I have not found CP on any drive that I have examined in civil or domestic cases. However, if I did, I would stop my examination, call the local special victims detective, have them come look at it and decide if they want to take over the investigation.
At that point, I would give them whatever they ask for to support getting the CP out of my possesion and into theirs.
Some of you guys are getting to the point of talking like witnessing someone commit a murder makes you an accessory.
Considering that people find CP on computers all the time and report it to police and they do not get charged should give you some indication of where LE stands on the subject.
Many of the CP cases I work originate with a family member finding CP on their home computer and calling police. Under some of the scenarios posted here, they should get arrested and prosecuted.
It is not illegal to report a crime and to provide the evidence of that crime to police.
It is however, illegal to try to hide the evidence, transmit the evidence to anyone other than LE or to destroy the evidence.
Wiping a hard drive that contains CP would be destroying evidence.
Only if evidence could be provided that CP actually was on the HDD in the first place.
What about the examiners that dogo to the police with what they find and find themselves being arrested because i know that this happens far too often.
What about the examiners that dogo to the police with what they find and find themselves being arrested because i know that this happens far too often.
Really? It does? Can you please cite some instances because I've never actually heard of anyone getting arrested for reporting it when they have it for legitimate reasons.
I have just completed 30 years in the police with the last 5 in a High tech crime unit and now work for myself as a forensic consultant. If I should come across IIC (Indecent Images of Children) whilst analysing an image for a client then as keydet89 mentions - its stop drop and roll. However I would not hand all the data back to the client. Once you are aware of/or suspect the presence of IIC you must report it to the police and have them take possession of it.
I appreciate you may not be 100% certain of the nature of the material but if you suspect then you must report. When lecturing to uniformed police officers who are the most likely to attend an incident I instructed them to view the material and if they suspect its IIC then they must seize it - including the initial exhibit.
Of course this creates a problem for independents who have imaged a drive to thier forensic machine as it is an offence to possess IIC unless you are involved in the investigation. I personally image new cases to external drives so if necessary I can hand this over as well. As an IT professional you can make a statement to the officer that you have no further copies of the material including which wiping techniques you may have employed. Of course the detective assigned to the investigation may not be happy with this and take your machines as well pending examination by the local HTCU to clear it but you would be unlucky if this happened.
You cannot give the data back to the client as they may be the perpertrator or if they are a third party you are now distributing IIC. The issue being that you are aware of the presence of/or possibility of illegal material.
I would also advise against working around the suspect material as once again the issue is that once you are aware of it and are capable of accessing it you are in possession of illegal material per se.
I apologise if this sounds like a lecture it was not my intention I also appreciate that I have only just started in the private sector and have little experience of privacy clauses and paying clients but I would act in the manner I have described . All of this is based around UK legislation