Re: what to do it illegal activity found during pen-test

["Eliah Kagan" <degeneracypressure () gmail com>]

On 7/11/06, Ebeling, Jr., Herman Frederick wrote:
> Unless they've been changed (and I'll admit that they could have)
> that the child pornography laws have been written to include pictures
> of adults who have been "dressed down" or "made down" to look as if
> they are children.

If true, this would criminalize a significant fraction of all existing
adult porn, porn which is readily, easily, and even accidentally
available and does not appear to face any opposition whatsoever from
legal authorities, at least in the United States. The purpose of child
pornography laws is to criminalize a practice and an industry that is
based fundamentally on real rape and sexual exploitation of
children--material that is, for instance, merely sickening, is not
criminalized. I understand that you are not making a firm statement
about the state of the law, and I do not wish to put you on the spot,
but could you cite evidence that the law is or was ever as you say?

This is relevant to the present thread because a lot of infantilized
adult porn is such that the subjects are still clearly not
children--if this material is illegal, pen-testers (and computer
professionals in general) should know that it is illegal.

Though I lack the time to formally cite *my* statements, the
introductory chapters of the book **Beyond Tolerance: Child
Pornography on the Internet** by Philip Jenkins substantiates them and
contains citations.

-Eliah

------------------------------------------------------------------------------
This List Sponsored by: Cenzic

Concerned about Web Application Security? 
Why not go with the #1 solution - Cenzic, the only one to win the Analyst's 
Choice Award from eWeek. As attacks through web applications continue to rise, 
you need to proactively protect your applications from hackers. Cenzic has the 
most comprehensive solutions to meet your application security penetration 
testing and vulnerability management needs. You have an option to go with a 
managed service (Cenzic ClickToSecure) or an enterprise software 
(Cenzic Hailstorm). Download FREE whitepaper on how a managed service can 
help you: http://www.cenzic.com/news_events/wpappsec.php 
And, now for a limited time we can do a FREE audit for you to confirm your 
results from other product. Contact us at request () cenzic com for details.
------------------------------------------------------------------------------