You find illegal material while on a non-LE job
What would you do? There is quite a 'heated' debate on another forensic board on the correct procedure to follow if you, as a civilian investigator working for a corporate client, were to find illegal material on a computer such picture depicting the sexual abuse of children.
Am I right in thinking that in the USA if this happened you would have no legal obligation in telling the police and your first obligation lays with your client?
IANAL. The client is a corporation? The absolute obligation would be to turn the evidence over to the police. The only time that there could be argued that the client is "protected" is if one is hired by an attorney to help prepare a defense. The examiner must report the contraband to the attorney. Then the attorney has what ever obligation there might be to report the posession.
There are problems for examiners in that they often have to craft their contract with potential clients so that they are indemnified in the event they do discover and report contraband.
I am not so naive as to believe that everyone reports misconduct when they should.
Heres a link to the UK Protection of Children Act 1978.
- to distribute or show such indecent photographs OR
- to have in his possession such indecent photographs, with a view to their being distributed or shown by himself or others.
It then states
- For purposes of this Act, a person is to be regarded as distributing an indecent photograph if he parts with possession of it to, or exposes or offers it for acquisition by, another person.
In the UK if you found CP and handed the PC back to the client you can be charged with distributing CP. In all cases, and any discussions/best practices I've been privy to, you MUST ALWAYS put the interests of the children first and report it to LE.
I believe this act has been updated in 2003/2004 to help LE catch perpetrators of CP but the same possession/distribution laws come from the 1978 Act.
Theres an overview page here about US/UK law that might be useful
Hi Ronan, thanks for that and the interesting link too.
My OP was hypothetical and based on a situation currently being discussed on another forensic board. As Forensic Focus has a very international flavour I was wondering if the situation differed elsewhere and if so what was the reasoning behind it.
In the UK it is worth pointing out that the Sex Offences Act 2003 Memorandum of Understanding clarifies the position "of those professionally involved in the management, operation or use of electronic communications networks and serviceswho may face jeopardy for criminal offences so that they will be re-assured of protection where they are acting to combat the creation and distribution of images of child abuse. This memorandum has been created within the context of child protection, which will always take primacy."
Our Terms of Engagement contains the following
8. Client understands that if any child pornography is encountered during X’s investigations, all work will stop, all materials will be secured, Client’s legal counsel and X’s legal counsel will be contacted, and the appropriate law enforcement agency will be notified.
We take this very seriously.
The references above to UK legistation, all relate to possession with an intent to distribute so, apart from the question of returning the offending images to their owner, there is a full defence available to an investigator. Perhaps more relevant is Section 160 of the Criminal Justice Act 1988 which makes the mere possession of such images an offence. There is also a defence in this section available to investigators. There appears to be no obligation in these Acts to report anything to the authorities providing that, upon discovery, no further copies are made. Indeed in the CJA one of the questions to be considered is the length of time that the images were kept. This appears to be an implied permission to destroy the images as soon as possible.
what if a report were to be created including all graphics from a drive, but never viewed or analyzed by the examiner? Simply a report created and given to the client/attorney. It could then be argued there were no illegal materials found during the limited examination. I currently have a client requesting this and have made the decision not to do this, but would be interested in any thoughts on this.
It passed through your system and, since you maintain a copy of the image and work product until the case is completed, copies of the material will remain on your system or in your backup environment.
I don't think the court will buy "But I didn't know the CP was there." "Didn't you wonder why the client asked you not to look at the images?" "Well, yes, but …."
Or, buy that you didn't look at the images, though I suppose you could hire a forensic examiner to examine your system to see if …. Wait, you used a write blocker and you always wipe and rebuild your systems so there'd not be any traces of you viewing the images if you wanted to hide the fact that you'd done so.
Then there are ethical and moral questions, but that's a different problem.
We are all addressing the issue of CP where there are, it seems, protections and obligations under law.
Could we move off that onto other crime ? Fraud ? Drugs ? Adult prostitution ? Copyright infringement 😉 ?
Is there any obligation to disclose these ? Could we be considered to be "aiding and abetting" by having knowledge of crimes either actual or planned, but allowing the criminal to continue to perpetrate the crime ?
Ethically at least, some of us here have signed up to an agreed code of conduct with our CISSP qualifications - this states
Code of Ethics Preamble
* Safety of the commonwealth, duty to our principals, and to each other requires that we adhere, and be seen to adhere, to the highest ethical standards of behaviour.
* Therefore, strict adherence to this Code is a condition of certification.
Code of Ethics Canons
* Protect society, the commonwealth, and the infrastructure.
* Act honourably, honestly, justly, responsibly, and legally.
* Provide diligent and competent service to principals.
* Advance and protect the profession.
I'd suggest that "Protecting Society" means that all crime, as it is of detriment to society, should be reported …
My 2p 😉