Join Us!

What if private for...
 
Notifications
Clear all

What if private forensic examiner encounters CP?  

Page 2 / 4
  RSS
Jimmer
(@jimmer)
Junior Member

Bigleas, I wonder why the US doesn't incorporate something to that effect. I see by your tag that your in Korea. How does Korean law address this issue?

ReplyQuote
Posted : 01/01/2006 6:55 pm
bjgleas
(@bjgleas)
Active Member

Bigleas, I wonder why the US doesn't incorporate something to that effect. I see by your tag that your in Korea. How does Korean law address this issue?

Jimmer

I'm sure most countries have laws similar to this - the trick is finding them.

I'm not sure how the Korean's handle it, I work with the US Military. The MPs take CP very seriously, and a number of careers have been ended over it. In one recent case, the CP found on one soldier's system was planted by another soldier. It forensic team determined that the files were transfered via a pocket PC, which the suspect didn't own, and based on a timeline analysis, they were able to find the culprit.

bj

ReplyQuote
Posted : 01/01/2006 7:14 pm
Jimmer
(@jimmer)
Junior Member

Now that must be interesting, trying to apply our laws while working in a different country. I assume that you work on a US base which of course is US soil. How do they handle the issue if a Korean National does something on the base. Are they subject to US law or do we turn them and the evidence over to the Korean Govt. for prosecution. If the latter, whose rules of evidence and accepted method of collection do you use?

ReplyQuote
Posted : 01/01/2006 7:35 pm
psu89
(@psu89)
Active Member

I can not point to a specific law but I do know we are being taught in school to immediately stop an investigation and report any CP to the FBI. I will look again in my texts to see if i can find any more details.

ReplyQuote
Posted : 01/01/2006 7:57 pm
bjgleas
(@bjgleas)
Active Member

How do they handle the issue if a Korean National does something on the base. Are they subject to US law or do we turn them and the evidence over to the Korean Govt. for prosecution. If the latter, whose rules of evidence and accepted method of collection do you use?

Jimmer

As you have guessed, it is a very complex process. We have a complex agreement called the SOFA (Status of Forces Agreement) that determined jurisdiction based on the nationality (US, Korea, other), location (onbase / offbase), status (Active duty, DOD, contractor, dependent), the type of offense, and the national security implications. It gets very messy, very quickly, and the resulting decisions are typically very polarized.

For a slight taste of the problems, see http//news.bbc.co.uk/1/hi/world/asia-pacific/2510477.stm

bj

ReplyQuote
Posted : 01/01/2006 8:24 pm
Jimmer
(@jimmer)
Junior Member

Hah, and people say that police work in this country is tough. Jurisdictional lines seem to be our biggest problem!

PSU89 where are you going to school?

ReplyQuote
Posted : 01/01/2006 9:36 pm
armresl
(@armresl)
Community Legend

PSU89,

I am interested to know if they teach you about anything that can arise from you doing so, either criminal or civil? How do they teach you to deal with your clients and the possible backlash it can cause?

There are lots of people who say report it now but no one can show a law that says it has to be reported, at least on the Federal level. Keep in mind that if you are independent or working for some corporation and decide to follow what Professor Xyz told you if may very well cost you a large majority of your clients through viral marketing against you. Professor Xyz has no liability on this issue and I would not go along with what someone from a school says regardless of their outside job, unless they had a stake in what could happen if something goes wrong.

You also run into issues on how YOU know it is cp and you are not just thinking from the Justice Stewart " I know it when I see it" attitude. If it matches a hashset you have you have more credibility than I think this is cp. You open a whole box that I am not sure you wanted to open. In this day and age of romoshopping I wouldn't want to be on the wrong end of an accusation, report, and the associated items when you just aren't sure.

ReplyQuote
Posted : 01/01/2006 11:30 pm
Jimmer
(@jimmer)
Junior Member

Armresi, let me try this again. Lets keep the discussion strictly to CP. There are no laws federal state or otherwise that require you to tell anyone that you are aware of or find CP on any computer that you may be working on. If you open a picture and see what you believe to be cp you can simply get up and walk away. No harm no foul. However, if you continue to collect it etc. and you are caught with it prior to turning it over to LE, You MAY be subject to prosecution. Notice I say MAY, there is still some discretion with the prosecution as to your intent etc. however, if a zealous DA wants to he could indict and prosecute, leaving it up to you to explain the how comes and whys. Possession by non LE, without the permission of a competent authority, such as the courts, is illegal.

As far as your responsiblity to the client. Your job as a forensic investigator should be to simply collect, and to report to the client what you find. Not to pass judgement or make legal decisions for them. If you find pictures of nude children you ethically are responsible to report it to them. It is up to the client at that time to make decide how to handle it. Ethically, you should also make the client aware that possession etc of the suspected pics may very well open them to criminal charges. Quite frankly any company that would protect or hide anyone dealing in cp is not someone I would want for a client anyhow.

You don't say if you work for a company or work for yourself. If you work for a company then that company should have a policy that should deal with the issue of how to handle the inadvertant finding of such material. If you work for yourself then you owe it to yourself and your clients to contact the local LE to determine how they want you to handle the turning in or reporting of this material. Why is this important. Let's say you work for a company and in the course of your work you obtain an image of a harddrive from a client. While reviewing the drive you find pictures that are obviously CP. You transfer the images to your working drive to prepare your report. You know as well as I that short of sterilizing the drive those pics will remain. Several months go by and for what ever reason your working drive is examined by someone and they find the pics. How do you explain them? Now if your company has a policy that deals with this issue then you have some guidlines to follow and a paper trail can be started to answer questions down the road.

By the way, how come this forum doesn't have spell check, I am dying here trying to remember the simple words!

ReplyQuote
Posted : 02/01/2006 5:29 am
armresl
(@armresl)
Community Legend

Hi Jimmer,

I have my own company, but have worked for other companies.

In the consultation phase the ground rules can be laid out for if A or B is found then here is what is to be done. If it is mutually agreed upon that the data is turned over then that is fine.

I agree with several of your points.

ReplyQuote
Posted : 02/01/2006 6:17 am
Jimmer
(@jimmer)
Junior Member

Armresi, I hope I helped clear up any issues you had. LE work has taught me many things among them is the ultimately you are responsible for your actions. When faced with something of question always choose the option that is legal and ethical. You will be surprised to see how often that they are one in the same. Jim

ReplyQuote
Posted : 02/01/2006 9:27 am
arashiryu
(@arashiryu)
Active Member

Just wrapped up a local case involving corruption of minors/students using AOL IM and AOL e-mail and ended up as a CP case. I was called in to validate the findings as disclosed by the police dept. After a well documented chain of custody, I was allowed to take copies of the forensic images of 3 machines to my lab. After a week, I had to return the images. Was cautioned not to keep any copies if I archived images of the cases.

I am going to follow up with the detective I worked with to see what his opinion is for this topic.

ReplyQuote
Posted : 03/01/2006 8:48 am
Jimmer
(@jimmer)
Junior Member

I for one would also be interested in his opinion. Was the authorization done by a court offical, or just a LE officer? Also how did you document the cp you did find? Were they just described or printed directly from your image? Thanks…..

ReplyQuote
Posted : 03/01/2006 8:58 am
arashiryu
(@arashiryu)
Active Member

When the evidence was given to me, the attorney of the defendent, the detective and one other witness from the police dept. were present. No court or judge involved. Please note that I was hired as a 3rd party just to validate the evidence. I recieved the EnCase report with the evidence from the police. The subject plead guilty the next day after I validated the police dept. findings so this did not end up in court.

I used WinHex and FTK to validate and support the police dept. findings.

I'll post if or as soon as the detective returns my call.

ReplyQuote
Posted : 03/01/2006 11:32 am
Jimmer
(@jimmer)
Junior Member

That scenario would scare the hell out of me. I wouldn't trust a defense attorney if he were my best friend! More than once I have been told by defense attorneys that I didn't need to prepare for court, show up you name etc, because the defendant was going to plead quilty. Thank god I learned at an early age. In the future you may want to get one of the prosecuters to be involved. They and only they represent the court. The police in this instance, especially, would be considered bias, as they are witnesees, and really, at least in my opinion, did not have the authority to supercede the law and allow you possession of the drives.

Does anyone else feel the way I do?

ReplyQuote
Posted : 03/01/2006 10:17 pm
psu89
(@psu89)
Active Member

Jimmer, armresl

I am at Hagerstown Business College in Maryland.

We were not told any specific law requiring us to do so, just that it must be turned over to the FBI. I got the impression it was more of a moral/ethical preaching being done by the instructor. It was presented in a discussion of "silver platter doctrine" and that we should make sure not to become an agent of LE (if we are private or corporate employees).

ReplyQuote
Posted : 03/01/2006 10:41 pm
Page 2 / 4
Share: