Crossing the line???
Recently a private detective associate of mine decided he was going to verify the prosecutions allegation that using certain search terms in Lime Wire would produce the results alleged in their complaint. He downloaded Lime Wire and used "questionable" search terms to see if he got the same results as alleged in the complaint. He then proceeded to write a report to the defense council explaining step by step what he had done and what those results were. Since then the prosecuting attorney has asked for a defense witness list and what they will be testifying to. The defense attorney gives them this investigators name and what he will be testifying to including his Lime Wire search investigation.
Got a letter that the prosecuting attorney may be looking at charges against the investigator for actively searching and viewing CP.
Did he cross the line doing research/investigation to verify the prosecutions allegations?
Is it illegal to search for child porn? I have not heard of a statute that says that, though I am by no means a lawyer.
Did he actual view any files?
It really was quite dumb of him anyways. CP terms are quite well known to anyone working in ICAC, and him going and searching will have no bearing on what the original offender saw. Each search is unique depending on who is on the network at the time, he in no way would have gotten 'the same results', similiar, maybe.
Cross the line, depending on the answers to the first two questions, maybe. Stupid and fruitless for an investigation, yes.
I have been asked in the past to do similar type investigation work in the private sector. Looking at it practically, no matter how much experimentation you do you cannot recreate the search terms that person would have gotten at that moment in time unless you know the every computer that was connected to that network and the files they had shared at the time.
I do not believe he should have searched for the terms personally, hopefully no harm will come if his intentions were genuine. (Because of the above) Even if he does prove that results in the creation of such a file another expert will just say "Can you guarantee these are the exact same results Mr/MRS X would have also seen." and of course the answer will have to be know. This will not give burden of proof. cry
If he has downloaded files then, unfortunately… he may fall foul of the letter of the law. You cannot break the law to prove someone else was also breaking it, unless you have direct permission from the law makers themselves who will explain the grey fuzzy edge which you should always walk very carefully.
If he actually downloaded cp files, then he should be prosecuted at the most and at the least have his box seized and wiped.
Furthermore, was it really necessary for him to even do that "research" in the first place? You didn't state whether he was experienced in digital forensics or in conducting online investigations but this type of research has been done before. Of course, the more "work" one does, the more hours one can invoice.
Thanks for the reply's He is not a computer examiner and I would put him in the category of average user. His intent was to see if the allegation was true. Why I don't know. I was retained by the attorney to examine the evidence because they wouldn't allow this PI to do it. He didn't have the proper equipment i.e. write blocker, software or knowledge to view an imaged drive and he and the attorney tried to get the imaged drives sent to their office as a part of discovery.
Here is a blog I recently found about this very situation.
Hopefully more will read this. Let this be a warning to any PI's or attorney's read this. Get a qualified computer examiner if your going to work these types of cases.