Join Us!

What if private for...
 
Notifications
Clear all

What if private forensic examiner encounters CP?  

Page 1 / 4
  RSS
arashiryu
(@arashiryu)
Active Member

What if a forensic examiner encounters CP while he/she is conducting an examination for adult porn at a private company? If the owner gives the permission to proceed regardless, should the examiner proceed or contact law enforcement?

I think the forensic examiner should contact law enforcement and let them know, of the findings. Then ask law enforcement's permission to continue the examination to complete it. Also offer to drop off evidence (image etc) at the station as well. Then complete the examination.

Your thoughts?

Quote
Posted : 02/08/2005 9:33 am
schlecht
(@schlecht)
Junior Member

In the US, it is required that when you find CP, you immediately report it to the authorities. This is where your rolodex should be stacked with contacts. Normally, if you can promise the evidence be presented within a reasonable time, they will allow you to proceed to get the evidence to them. Therefore, you can finish your case.

ReplyQuote
Posted : 02/08/2005 9:43 am
schlecht
(@schlecht)
Junior Member

Current laws put the fate of those that innocently handle child porn at the mercy of prosecutorial discretion. It is illegal to posess child porn. Possession on behalf of a client for an investigation is no different. If, upon finding child porn you make contact with authorities and are cleared to continue - you have at least given yourself some level confidence if prosecuted in a "innocent handling defense".

ReplyQuote
Posted : 02/08/2005 10:35 pm
arashiryu
(@arashiryu)
Active Member

Schlecht,
Thank you for your input. Much appreciated.

ReplyQuote
Posted : 02/08/2005 11:53 pm
Jimmer
(@jimmer)
Junior Member

Speaking strictly from a law enforcement point of view. If you find CP while conducting a private examine, you should immediately stop and contact the local law enforcement, showing them what you found. At that time the Law enforcement will most likely seize the machine from you, obtain a search warrant and view and collect the contents of the drive themselves. If they simply acknowledge that they are aware of the CP and allow you to continue the examine, the defendant may try to argue that the search was warrantless and you were acting as an agent of law enforcement. True the owner of the drive has given you and may in fact give the law enforcement the same permission to examine the drive. However, ANY question of the legality of searching the drive can be answered and addressed with the obtaining of a warrant. One other thing to keep in mind. While the company you are dealing with may very well allow you to look for porn, they may become concerned if your search starts to look into other areas such as financial etc. A search warrant is going to allow the law enforcement to view, albeit very briefly, every file on the drive to determine if CP is present or not. Some companies may balk at having their private business run through in such a manner.

ReplyQuote
Posted : 31/12/2005 7:35 pm
armresl
(@armresl)
Community Legend

Would the people who say that you have to stop and report the images to the authorities please post a link to the law you are referring to.

ReplyQuote
Posted : 31/12/2005 10:39 pm
Jimmer
(@jimmer)
Junior Member

I am not aware of any particular law, at least in the area I work in, that states that you have to report any particular crime. The reporting of any crime or evidence of a crime is simply a civic duty. The problem with child porn is just possessing it is a crime in itself. By notifing the law enforcement of what you have found, you are distancing yourself from it and removing the possibility of prosecution. Should you be caught with them how would you explain them? How can someone in law enforcement determine who is possessing them for "legal" reasons and who is possessing them for personal use? Lets say for example, you find child porn on a hard drive. In your effort to be efficent you print copies of the images for your records and reports to show your client. However on the way home your involved in an accident and an alert police officer finds them in your car. How would you explain it? Possession of child porn is such an issue that law enforcement, local, state and federal agency have certain reporting guidelines that require officers working child porn cases to notify their supervisors, so that their personal possession and that in the line of duty is clearly defined. Reporting it is simply a matter of protecting you as well as the interests of your client.

ReplyQuote
Posted : 01/01/2006 3:56 am
armresl
(@armresl)
Community Legend

n/t

ReplyQuote
Posted : 01/01/2006 5:55 am
bjgleas
(@bjgleas)
Active Member

Would the people who say that you have to stop and report the images to the authorities please post a link to the law you are referring to.

From Casey, Eoghan (2004) Digital Evidence and Computer Crime Forensic Science, Computers, and the Internet 2nd ed. (BTW I consider this to be one of the best books on digital evidence. If you don't have it, it is strongly recommened that you pick it up.)

3A.2.1 Child Pornography
Like obscenity, child pornography is not expression protected by the First Amendment. Like obscenity, its distribution is illegal. However, unlike obscenity, its mere possession is criminal.

Historically, courts have given the states and the federal government more leeway in regulating child pornography. Attempts at the federal level to deal with the problem of child pornography have an extensive history. The original federal legislation on this topic was the Protection of Children Against Sexual Exploitation Act of 1977. In the following 14 years, four other Acts of Congress were targeted at the problem of child pornography. These included the Child Protection Act, the Child Sexual Abuse and Pornography Act, the Child Protection and Obscenity Enforcement Act, and the Child Protection Restoration and Penalties Enforcement Act.

The "compelling interest" that made all of these statutes constitutional was preventing the exploitation and abuse of the children used in making the pornography. Congress has always defined the problem of child pornography in terms of real children. In the case of New York v. Ferber, in 1982, the Supreme Court limited criminalization of child pornography to works that "visually depict explicit sexual conduct by children below a specified age." The Ferber court specifically stated that depictions of sexual conduct "which do not involve live performance or photographic or other visual reproduction of live performances, retain First Amendment protection." Sketches from the imagination or literary descriptions of children engaged in sexual activities remained protected. Even the use of persons who looked younger than their actual age would be permissible.

However, digital technology now makes it possible to create "virtual" child pornography that is essentially indistinguishable from photographs of actual children engaged in sexual activities. Congress sought to prohibit the distribution of digitally created child pornography by passing the Child Pornography Prevention Act (CPPA) in 1996. The focus of the regulation shifted at this point radically from harm to real children to a determination that child pornography was evil in itself. The basis of the new law was the asserted impact of such images on children who view them and the notion that child pornography, real or virtual, increases the activities of pedophiles and child molesters. The law criminalized depictions that "appear to be" of a minor, or that "convey the impression that the material is or contains a visual depiction of a minor" engaged in sexual activities.

Decisions by various federal appellate courts regarding the constitutionality of the CPPA differed. The Court of Appeals for the First Circuit decided in 1999 in United States v. Hilton that the statute was not unconstitutionally vague. In the same year, the Ninth Circuit Court of Appeals, in Free Speech Coalition v. Ashcroft, held that "the First Amendment prohibits Congress from enacting a statute that makes criminal the generation of images of fictitious children engaged in imaginary but explicit conduct."

And a classic case reference from the same text

CASE EXAMPLE (UNITED STATES v. CAREY 1998)

Although investigators may seize additional material under the "plain view" exception to search warrant requirements, it is not always clear what "plain view" means when dealing with computers. This is demonstrated in the precedent setting case of United States v. Carey that has made digital investigators more cautious in their search methods.

Mr Carey had been under investigation for some time for possible sale and possession of cocaine. Controlled buys had been made from him at his residence, and six weeks after the last purchase, police obtained a warrant to arrest him. During the course of the arrest, officers observed in plain view a "bong," a device for smoking marijuana, and what appeared to be marijuana in defendant's apartment.

Alerted by these items, a police officer asked Mr Carey to consent to a search of his apartment. The officer said he would get a search warrant if Mr Carey refused permission. After considerable discussion with the officer, Mr Carey verbally consented to the search and later signed a formal written consent at the police station …

Armed with this consent, the officers returned to the apartment that night and discovered quantities of cocaine, marijuana, and hallucinogenic mushrooms. They also discovered and took two computers, which they believed would either be subject to forfeiture or evidence of drug dealing. (United States v. Carey 1998)

Investigators obtained a warrant that authorized them to search the files on the computers for "names, telephone numbers, ledger receipts, addresses, and other documentary evidence pertaining to the sale and distribution of controlled substances." However, during the examination of the computer investigators found files with sexually suggestive titles and the label ".jpg" that contained child pornography. At this stage, the detective temporarily abandoned his search for evidence pertaining to the sale and distribution of controlled substances to look for more child pornography, and only "went back" to searching for drug-related documents after conducting a five-hour search of the child pornography files. Mr Carey was eventually charged with one count of child pornography.

In appeal, Carey challenged that the child pornography was inadmissible because it was taken as the result of a general, warrantless search. The government argued the warrant authorized the detective to search any file on the computer because any file might have contained information relating to drug crimes and claimed that the child pornography came into plain view during this search. The court concluded that the investigators exceeded the scope of the warrant and reversed Carey's conviction, noting that the Supreme Court has instructed, "the plain view doctrine may not be used to extend a general exploratory search from one object to another until something incriminating at last emerges."

The main issue in this case was that the investigator acknowledged abandoning his authorized search and did not obtain a new warrant before conducting a new search for additional child pornography.

So it boils down to this the mere possesion of CP is against the law, and as mentioned in other posts, LE have to get special permission to work with it. CP is the preverbial "hot potato" in digital evidence. If you find it, even one image, stop and contact LE.

Something to remember 99.9% of Traci Lords pornography is considered child porn. AFAIK she made 107 movies, but only one when she was 18, "Traci, I Love You." Unless the images are from that film, they are child porn. In 1984, Traci posed for a Penthouse centerfold, in the same issue that ultimately exposed Vanessa Williams, but the issue is also considered illegal. I've seen people get into a lot of trouble trouble over her.

Hope this helps,

bj

ReplyQuote
Posted : 01/01/2006 7:00 am
Jimmer
(@jimmer)
Junior Member

BJ thanks for confirming my thoughts. However, I believe US v Carey is a little different from what Armresi was inquiring. In Carey the problem was not that he found CP or failed to inform anyone, but the fact that he abandoned his orginal search and went off in search of more CP only returning to the drugs after he had finished the cp search. Had he obtained a second warrant for CP based on the orginal pic (see case of Cf. United States v.Walser, 275 F.3d 981, 986-87 (10th Cir. 2001) (finding no Fourth Amendment violation when officer with warrant to search for electronic records of drug transactions opened single computer file containing child pornography, suspended search, and then returned to magistrate for second warrant to search for child pornography) or had he continued his search for drug info and continued to inadvertently find CP such as in the case of United States v. Gray, 78 F. Supp. 2d 524, 530 (E.D. Va. 1999) (noting that agents executing a search for computer files "are not required to accept as accurate any file name or suffix and [to] limit [their] search accordingly," because criminals may "intentionally mislabel files, or attempt to bury incriminating files within innocuously named directories." there would never have been any question of legality.

Armresi, as you can see I am new to this board. By N/T your meant??? I am not sure I understand what you were saying. My wife says it means Not True!

ReplyQuote
Posted : 01/01/2006 8:05 am
armresl
(@armresl)
Community Legend

No sorry, it means No text. I started something and then deleted it because of time constraints.

ReplyQuote
Posted : 01/01/2006 9:00 am
armresl
(@armresl)
Community Legend

If you want to be technical about the topic there is no difference between LE and you or I

I had a case in the 8th District where the Judge agreed and forced the government to give me an image of the drive over their objections that me possessing the CP would be illegal. It was pretty interesting to say the least.

ReplyQuote
Posted : 01/01/2006 9:03 am
Jimmer
(@jimmer)
Junior Member

In 20 years of police work the one thing I have learned is nothing is for certain. Not even the rulings of the court. Of course I would have expected that type of ruling from the 9th Dist. not from the heartlands! In fact that would be a good question for this forum. What or how do the different courts handle the problem of discovery when it comes to turning over cp to the defendants. By the way, would you have the cite for the case, I would be interested in seeing how the judge addressed the issue.

ReplyQuote
Posted : 01/01/2006 10:28 am
bjgleas
(@bjgleas)
Active Member

BJ thanks for confirming my thoughts. However, I believe US v Carey is a little different from what Armresi was inquiring.

Jimmer

While that is true, the point of referencing that case was that if in the course of an investigation, you discover something outside the scope of the warrent, stop and get another warrent, which, in effect, would be going back of the chain of command and informing them of what was found, and determining the proper response.

bj

ReplyQuote
Posted : 01/01/2006 11:16 am
bjgleas
(@bjgleas)
Active Member

Here is something that may be right on the money. From Guidelines for Handling Illegal Material, http//www.ja.net/development/legislation/documents/soaguidelines.html

"Occasionally, organisations may have to deal with allegations of serious misuse of computers, where indecent images of children (as defined by the Protection of Children Act 1978) may be present on the organisation's computers. The posession of such images is a serious criminal offence and must be reported to the Police as soon as possible. Until the material can be handed to the Police, organisations need to act very carefully to avoid harm to their users or potential criminal liability for the organisation or its staff. UKERNA has developed the following Guidelines, with assistance from JANET sites and the Home Office, to assist sites in this situation."

"Viewing or handling indecent images of children will normally be a serious criminal offence. However, section 46 of the Sexual Offences Act 2003 provides a limited defence for those who can prove that they needed to do so for the purposes of the prevention, detection or investigation of crime. The CPS (Crown Prosecution Service) and ACPO (the Association of Chief Police Officers) have agreed an MoU (Memorandum of Understanding) setting out the factors they will consider when deciding whether this defence may be available in any specific case."

The MoU is available at http//www.cps.gov.uk/publications/docs/mousexoffences.pdf

The major factors considered in the MoU are how the materials were discovered; how quickly the incident was reported and to whom; how the material was handled and secured; how many copies were made; and if the peson acted reasonably.

bj

ReplyQuote
Posted : 01/01/2006 11:45 am
Page 1 / 4
Share: