Procedure for CP ev...
 
Notifications
Clear all

Procedure for CP evidence?

81 Posts
52 Users
0 Likes
6,213 Views
(@olddawg)
Posts: 108
Estimable Member
Topic starter
 

I think I have some CP images in a case I'm working on. I've been in touch with the po-po and will be providing them with a CD of the images in a face-to-face meeting. So how does this work?

Let's say they determine that the images are indeed CP. Do they then take my DD image disk as well as seize the original computer? How do I then provide evidence for the original case which has nothing to do with CP?

Maybe I should get a honkin big external drive and export everything EXCEPT the suspect images to it?

Inquiring minds want to know…

 
Posted : 09/02/2007 11:20 pm
keydet89
(@keydet89)
Posts: 3568
Famed Member
 

I'm in a corporate consulting position and I find CP, it's stop, drop, and roll. Stop the examination, drop everything, and roll all data back to the client, with a strong suggestion that they contact local law enforcement.

 
Posted : 10/02/2007 1:21 am
az_gcfa
(@az_gcfa)
Posts: 116
Estimable Member
 

How the incident or case proceeds will really depend upon the local LE and the amount/quanity of content, likelyhood of distribution and if any Federal agency become's involved.

I have not been involved with any activity of this nature as a consultant in the private sector.

However, several of my college instructors in Forensics are active members of "Child Exploitation Task Forces". From our discussions they will take whatever you offer them and if they need more, they will ask or get a search warrant! They can ask you without alerting anyone, since you have an image of the hard drive. I would guess that after they have verified the CP, they will issue a search warrant for the original drive.

I would contact my lawyer as a CYA! Just to insure that you know exactly what your legal obligation are concerning local or state regulations and to insure that you are not violating any NDA or other contractual restrictions.

NJ court held that corporations/business are responsible for investigating and reporting CP incidents (victims parents used the corporation that employed the person with CP). A lot of schools and universities are required by state law to report things of this nature.

As a hired consultant for a company or entity, does your state consider your consulting services independent of the company activities, or are you considered a restricted agent of the company?

These are some of the questions I'm going to revisit with my lawyer – real soon!

Thanks for posting! Things that I thought were cut and dry became awful fuzzy when I stated running this to ground!

 
Posted : 10/02/2007 8:58 am
Jamie
(@jamie)
Posts: 1288
Moderator
 

az_gcfa's advice to take legal advice is undoubtedly sound, there are a number of issues which need to be considered as soon as you suspect that CP has been detected and from a legal perspective there may be things that you are obliged to do and things you are strictly forbidden from doing. As important are your own views about your moral obligations in this kind of situation (it is sometimes forgotten that CP is evidence of a serious crime, regardless of how it came to be on the device in question). Finally, private sector workers need to consider the commercial implications of their actions or inactions (note I am certainly NOT suggesting that commercial interests take any kind of precedence over legal or moral obligations - far from it - simply that is wise to be aware of any likely impact).

OldDawg, I note you talk about creating a CD with the images. I'm not familiar with the relevant legislation in your location but I would strongly advise you to take legal advice before creating any further copies of the material in question.

Jamie

 
Posted : 10/02/2007 12:39 pm
keydet89
(@keydet89)
Posts: 3568
Famed Member
 

Just an FYI…my response was based on already having contacted corporate counsel and received my manager's advice.

If I have to analyze a drive that is suspected to have CP on it, I will perform as much analysis as I can without looking at images…identifying the locations of image or movie files, etc…all without looking at the image in Gallery mode.

Speaking of impact…if I were to take an image and go straight to the police with it, there would be significant impact…my employer could be sued, I may be sued, and I most definitely will be fired.

Harlan

 
Posted : 10/02/2007 6:10 pm
psu89
(@psu89)
Posts: 118
Estimable Member
 

In my one and only experience with CP, we called the corporate atty, who called the FBI. They came and seized the suspect laptop, the external drive that contained the image of the laptop and the CD I burned my report to (which contained CP images).

I was able to keep my forensic workstation only by running an eraser program (DOD 7 pass) on the report files and free space. This was done under the supervision of the FBI agent.

 
Posted : 10/02/2007 9:04 pm
deckard
(@deckard)
Posts: 77
Trusted Member
 

FWIW;
In my contract with my clients, in my Confifentiality clause, it states that in the event of CP appearing during my exam, the confidentiality claused is waived without notification to the client and LE will be contacted and ALL client materials turned over to them.

This is because I had this happen once. The Feds I dealt with made it clear that if II had returned items to the client, I would have been charged with coveyance of CP. So wise thing for me is to have it in the contract upfront.

Bill

 
Posted : 10/02/2007 9:08 pm
 dcso
(@dcso)
Posts: 31
Eminent Member
 

Speaking of impact…if I were to take an image and go straight to the police with it, there would be significant impact…my employer could be sued, I may be sued, and I most definitely will be fired.

Is there any law that requires you to report this to police? I believe some states have enacted legislation to address repair shops, service techs, and I assume CF.

It seems odd that reporting a crime would get you sued. I can somewhat understand why, but still seems odd. )

 
Posted : 10/02/2007 9:20 pm
(@armresl)
Posts: 1011
Noble Member
 

You are surely led to believe that if you know of "any" crime that has been committed the FBI would like you to report it to them.

If you are in the private sector the ramifications of doing this and possibly being wrong are monumental. You can 100% forget doing any more work in this field. I have been around hearings where a person such as a worker in a large retail type outlet called the FBI on what he though was CP. Turned out it wasn't and the guy got reamed bad. While you think you may be getting a new friend in a G-Man, you may also open yourself up to a civil lawsuit in which you did nothing wrong but find you need to defend yourself and pay large attorney costs.

First one would ask what would make you able to be an expert in the area of CP to be able to tell that the images were in fact illegal? Then one would wonder if there were any agreements or contracts signed between you and the client where there are privacy issues or issues of privilege.

You can also look at the charge on it's face and say that CP possession is CP possession regardless of where you got it from. Don't think that people who examine hard drives and stumble upon contraband haven't been charged and subjected to the stigma that goes with that type of a charge.
I in fact worked on a case where a person dropped off media to a computer shop operator and the worker discovered it contained problem material, he called the FBI and they arrested him, charged him, and convicted him (with mandatory minimums he did some time in Fed system) on possession charges.

OF course this is all IMHO and your counsel, my counsel, an AUSA, Judge, or other counsel might all have different opinions on what should be or should have been done.

 
Posted : 10/02/2007 10:48 pm
(@wilber999)
Posts: 30
Eminent Member
 

I am a bit confused (or I misunderstood some posts).

I have read here to call your lawyer, examine around the CP, go straight to the FBI, and don't go straight to the FBI to avoid a civil suit if you are wrong.

The post by armresl concerns me the most about a repair guy getting convicted and doing time after calling the FBI. Is there more to the story than they found CP while servicing a computer and called the FBI?

It is starting to sound like my chosen career is like playing Russian Roulette with these hard drives.

Can someone clarify what to do if we run across it?
My contract states that I "will immediately cease its examination and advise CLIENT and appropriate law enforcement authorities of the nature of the materials found". Is this wrong?

 
Posted : 11/02/2007 1:29 am
Page 1 / 9
Share: