What if child porn is encountered during research?

[rd at rd1.net (Ralph Durkee)]

Just to be clear on this, notifying LE on this is not only the right 
thing to do, NOT doing so can be tried in court as criminal.  It's along 
the same lines as seeing someone beaten or murdered and not reporting 
it.   The Law Enforcement I deal with make child porn a priority, 
although it's true they are also very busy.

-- Ralph Durkee, CISSP, GSEC, GCIH, GSNA, GPEN


Adrian Crenshaw wrote:
> My fear is that I'd get a hold of someone in law enforcement that has 
> no ability to understand the research I plan to do, and I'd just end 
> up on their radar as someone to watch. Having to contact LE everytime 
> a small peice of contraband is encountered would make the research 
> impossible, but that may be the only way to do it legally.
>
> Adrian
>
> On Thu, Sep 10, 2009 at 7:59 AM, Michael Douglas <mick at pauldotcom.com 
> <mailto:mick at pauldotcom.com>> wrote:
>
>     Actually upon reflection, I'm changing my story somewhat.  You *need*
>     to turn it in & you need to see a lawyer too. (NOT IN THAT ORDER!)
>
>     This is the best I can remember the quote from Special Agent Rob White
>     (damn skilled white hat & an all around nice guy)
>     "This data is contraband. You cannot just destroy it and walk away.
>     Imagine finding a kilo of coke at work. Very few would simply flush it
>     down the toilet and pretend nothing ever happened. Same with this data
>     (we were talking about kiddie porn and other data which is simply
>     illegal) you have to handle it correctly, you have to report it"
>
>     I'd still talk with a lawyer first if for nothing else, it will help
>     you understand what rights *you* have and what the law enforcement
>     group you turn the data (again I really think you should) is and is
>     not permitted to do.
>
>     Also, you need to be aware that things have shifted with regard to how
>     child porn is handled by law enforcement.  It has been my unfortunate
>     experience that I've had to deal with this multiple times in my
>     career.  What's sad, is that it seems all police forces have now dealt
>     with this issue enough that they have good policies and procedures and
>     are now able to handle things in a highly professional manner.  so the
>     chances of them saying things like "oh lookie here! and how come you
>     have this sonny?" are almost nil.
>
>     Best of luck!
>     - Mick
>
>
>
>
>     On Thu, Sep 10, 2009 at 6:54 AM, Jack Daniel<jackadaniel at gmail.com
>     <mailto:jackadaniel at gmail.com>> wrote:
>     > Echoing Mick's answers- talk to a lawyer, and your local
>     Infragard is
>     > probably a good resource.  Do not make assumptions as to what
>     would or
>     > would not be of value to law enforcement, allow the investigators to
>     > make those decisions.
>     >
>     > I am not a lawyer...but I would stop and document what I had
>     done and
>     > what I thought I had found as soon as I discovered something
>     > potentially ugly and stop my investigation- then make contact with
>     > legal and/or law enforcement before proceeding.
>     >
>     > Jack
>     >
>     >
>     >
>     > On Thu, Sep 10, 2009 at 12:00 AM, Michael Douglas
>     <mick at pauldotcom.com <mailto:mick at pauldotcom.com>> wrote:
>     >> You *need* to consult a lawyer.
>     >>
>     >> Also it helps if you can reach out to your local law enforcement
>     >> community *before* you get in such a situation.  The local
>     InfraGard
>     >> chapter is pretty good where I'm at so I was able to get to
>     know the
>     >> agents who covered these cases.
>     >>
>     >> Excellent question, but I don't think there's a stock answer...
>     >>
>     >> - Mick
>     >>
>     >> On Wed, Sep 9, 2009 at 9:49 PM, Adrian
>     Crenshaw<irongeek at irongeek.com <mailto:irongeek at irongeek.com>> wrote:
>     >>>
>     >>> While doing research on anonymizing networks, what is the best
>     policy to
>     >>> follow concerning inadvertently captured contraband (child
>     porn, copyright
>     >>> infringing files, etc.)? In the case of child porn, the
>     authorities should
>     >>> be notified under normal circumstances, but with anonymizing
>     networks the
>     >>> origin of the files is hard if not impossible to determine.
>     Would it be
>     >>> correct to just wipe the data after research on the network is
>     done?  As I
>     >>> understand it, even having it on your hard drive because of
>     peripherally
>     >>> relevant research would be a crime.
>     >>>
>     >>> Adrian
>     >>>
>     >>> _______________________________________________
>     > _______________________________________________
>     > Pauldotcom mailing list
>     > Pauldotcom at mail.pauldotcom.com
>     <mailto:Pauldotcom at mail.pauldotcom.com>
>     > http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom
>     > Main Web Site: http://pauldotcom.com
>     >
>     _______________________________________________
>     Pauldotcom mailing list
>     Pauldotcom at mail.pauldotcom.com <mailto:Pauldotcom at mail.pauldotcom.com>
>     http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom
>     Main Web Site: http://pauldotcom.com
>
>
> ------------------------------------------------------------------------
>
> _______________________________________________
> Pauldotcom mailing list
> Pauldotcom at mail.pauldotcom.com
> http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom
> Main Web Site: http://pauldotcom.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mail.pauldotcom.com/pipermail/pauldotcom/attachments/20090910/ddc0a259/attachment.htm