Hello all,
I have a quick question, when working a case if CP is found I've always been told you would stop everything and report the findings to federal officers. My question is would that override Attorney Client Privilege contract, for example would I first report the findings to our client or go straight to the federal officers? Also is there a law I could quote in our statement of work that would express this law so it is unquestioned when the situation arises?
First question, short answer, yes. Second question, short answer federal and/or state criminal statutes. )
thank you kind sir for that information, I just wanted to make 100% sure before I proceed.
I will reference Title 18 United States Code, section 2252 and 2252a.
This is the kind of thing you want to explicitly spell out in your rules of engagement or contract with the client; what do you do if you encounter child porn during the course of your investigation.
For consulting work, if you go direct to LE and you don't have this spelled out in your contract, you risk not being hired again or possibly being sued (sounds ridiculous but we live in a litigious era).
For corporate work, if you're working as an employee, you should ask your general counsel how they want such situations handled. In my experience, they will want you to stop your investigation and contact them before contacting law enforcement. Most companies have policies (written or otherwise) regarding who contacts law enforcement for criminal activities discovered internally.
What do you do when you report it to GC and they don't call law enforcement? I recommend calling your own attorney and having a discussion.
Law enforcement trumps general counsel and everyone else. Notify your boss who will report it to LE and notify general counsel. The company lawyer will have little to do with a criminal case against an employee other than to be aware of it. Your employer should already have a reporting procedure in place and if they don't they need to make one. Normally your CISO will make the phone call to the State LE. Here in NC they are called the SBI and my boss has had to call them twice.
At least seven states–Arkansas, Illinois, Missouri, North Carolina, Oklahoma, South Carolina, and South Dakota–have enacted laws requiring computer technicians or Internet service providers to report child pornography if they encounter it in the scope of their work.
U.S. Code Title 42, Section 13032 requires those providing electronic communication services to make a report to the Cyber Tip Line at the National Center for Missing and Exploited Children.
The laws don't require technicians or service providers to search for the illegal material, only to report it if they find it. Similar laws apply to film developers who encounter child pornography on the job. Michigan law provides confidentiality and immunity from civil liability for computer technicians who report child pornography encountered in the scope of their work.
Critics charge that this type of law unfairly transfers law enforcement duties to individuals who may not be qualified to handle evidence or determine what constitutes child pornography. Supporters say reporting mandates for photo labs have proven effective, and that similar laws for IT workers will help combat child pornography on the Internet.
People are quick to talk about reporting, there can be consequences if you (Joe's Computer repair) think you view CP and report it, and it's not. Your honesty and integrity is shot. Even this example, Joe's Computer repair thinks there is CP on a drive and calls the police, the police show up and are not sure, but seize the computer and based on that, ask a Judge for a search warrant for the house and defendants work. Now they go in to the work places and disrupt things as well as letting everyone know what kind of charge it is.
Later it's found the items were erotica, legal girls who are adult stars and just look younger, etc. How can you go back to those places of work, that neighborhood, and get those people their life back?
One more thing for you to think about at Joe's computers. You are working on that machine and the machine is being used as a zombie, or it's an owned box. You turn on the box to try to figure out things and update the drivers for malware or norton, etc. you could open not only yourself, but your company with distributing. Weirder things have happened.
Whilst all of that might be a concern armresl, isn't it your legal obligation to do so regardless? (I don't know the relevant law over on your side of the pond but I would assume that's the case.)
I feel that if you are not sure you go ahead and report it and let the police sort it out. They do not proceed unless it is a clear cut case of CP. Their workload is too heavy to take on cases that are not sure about.
We have had three investigations that led to CP and the subsequent calling in of state LE (The NC State Bureau of Investigation or SBI). The first CP case we had was an elderly lady who retired. After she was gone the new user found CP on her computer. The SBI was called and the computer was seized. Analysis determined that it was infected and it was a zombie in a botnet being used to transmit CP. She was exonerated and there were no repercussions to her social standing. Nobody outside a a couple of people in MIS and her old office knew about it.
In the second one there was three photos that appeared to be CP but after preliminary examination the SBI decided it was real but there were not enough photos to proceed. Turns out they require more than three photos. The employee resigned saving us the trouble of further action.
The third one was interesting because the guy I was investigating was looking at teens. As I am going through all the graphic thumbnails I am seeing teen porn that is getting progressively younger. When I get to one that appears to be ten years old I am getting creeped out. I tell my boss and he calls in the SBI. They look and agree it is CP but they need at least three to proceed. So we wind up treating it like a standard porn case.
I was quick to promote reporting because I was presuming that the person who posted was referring to real CP and not teen porn. If you see some real genuine CP you will know it instantly and you will be grossed out. I just wanted him to understand that the safe thing to do is report it even if he is not sure.
It would seem that armresl is saying to not report if not sure or at least to second guess oneself in order to be real sure. I disagree.
"if you (Joe's Computer repair) think you view CP and report it, and it's not. Your honesty and integrity is shot."
Why? More like if you fail to report it.
"Even this example, Joe's Computer repair thinks there is CP on a drive and calls the police, the police show up and are not sure, but seize the computer"
Probably not. If it is not a solid case they will leave it alone. They don't have time to mess around.
" based on that, ask a Judge for a search warrant for the house and defendants work. Now they go in to the work places and disrupt things as well as letting everyone know what kind of charge it is."
Unlikely unless it is a real solid case with definite CP.
"Later it's found the items were erotica, legal girls who are adult stars and just look younger, etc."
They are going to scan the computer using FieldSearch or PreSearch before they make any arrest or seizure. They can tell what they are looking at very quickly based on years of experience.
Let's give the police credit for being experienced at what they do. They look at CP all day long and know it when they see it. Asking them for confirmation is the safe thing to do and if they see teen porn they will know the difference.
I am sorry, but how could you not report it!
As someone who has been on both sides of the fence; having worked in law enforcement and the commercial world there can be no question of not reporting which ever way you look at it.
Firstly, in the UK there is an offence of making an indecent image. Making that image is also making it on a screen, knowingly. If you are doing a routine exam and you see an indecent image of a child you have technically commited an offence. You have a defence at that point that it was not knowingly commited, but if you carry on, knowing or expecting to see the same sort of images, you are committing an offence.
Secondly, if you dont report it and for some reason law enforcement come a calling as a result of doing a warrant at the suspects home address and find you hadnt reported knowing about that material, where does that leave the organisation? Knowingly possessing indecent images!
Thirdly, If someone does this at work, they have a problem! It has been shown that paedophiles have a cycle of offending, starting with images, and then progress. Some would argue not all do progress, but I have a screen saver of a picture of an Aston Martin, and if the opportunity arose to have one came up, of course I would! I dont have a screen saver of an Aston Martin, but I hope you get the analogy! So what would happen if the suspect then goes on to real life abuse - you had an early warning and you did nothing about it! How would you feel?
Lastly, maybe I am in a position to judge better than most what would be classed as an indecent image of a child, as I have seen my fill of these type of images, but at the end of the day it is no longer my decision to make if it is indecent, or a child. That decision sits firmly with the law enforcement officer.
I can't even I believe that I read this line from an investigator.
"I feel that if you are not sure you go ahead and report it and let the police sort it out."
I honestly hope that you don't approach other forensic issues with that attitude.
If you are 100% sure by hash that it's CP, then by all means report it, if you have a doubt, consider the repercussions against the person you are reporting as that information finds it's way through the community (and it does) that their computer was seized to see if there was CP on the machine.
I've seen firsthand lives destroyed by allegations which proved to be false and the guy who is highly educated couldn't get his life back.
The government backed off the report everything issue with terrorism because everybody was reporting the first person who seemed just a little out of place and there were thousands of thousands of reports which were mostly false, what you create by a blanket statement like that is an audience of people who go out to play supercop and if you're in doubt, report everyone, let the police sort it out.
BTW as I said previously, after you do a few of those reporting things and nothing comes back, GL on continuing to work in this field.