2013-12-06 Digital Forensics and Child Pornography
Upcoming SlideShare
Loading in...5
×
 

2013-12-06 Digital Forensics and Child Pornography

on

  • 765 views

This is a presentation I gave to the DE Association of Criminal Defense Lawyers on December 6, 2013. Main themes include: Digital Technology and Child Pornography, Digital Investigations, Introduction ...

This is a presentation I gave to the DE Association of Criminal Defense Lawyers on December 6, 2013. Main themes include: Digital Technology and Child Pornography, Digital Investigations, Introduction to Computer Forensics, and Defending Child Pornography Cases.

Statistics

Views

Total Views
765
Views on SlideShare
593
Embed Views
172

Actions

Likes
1
Downloads
12
Comments
0

3 Embeds 172

http://cpcasedigest.com 166
http://cpcasedigest.wordpress.com 5
http://www.linkedin.com 1

Accessibility

Upload Details

Uploaded via as Microsoft PowerPoint

Usage Rights

© All Rights Reserved

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Processing…
Post Comment
Edit your comment

2013-12-06 Digital Forensics and Child Pornography 2013-12-06 Digital Forensics and Child Pornography Presentation Transcript

  • Digital Forensics and Child Pornography Frederick S. Lane DE Assoc. of Criminal Defense Lawyers Wilmington, DE 6 December 2013 www.FrederickLane.com www.ComputerForensicsDigest.com 1
  • Seminar Overview • Introduction and Overview • Digital Technology and CP • Digital Investigations • Defending Child Pornography Cases www.FrederickLane.com www.ComputerForensicsDigest.com 2
  • Introduction and Overview • Background and Expertise • What Is Child Pornography? • Digital Technology and the Spread of Child Pornography www.FrederickLane.com www.ComputerForensicsDigest.com 3
  • Background and Expertise • Attorney and Author of 7 Books • Computer Forensics Expert -- 15 years • Over 100 criminal cases • Lecturer on ComputerRelated Topics – 20+ years • Computer user (midframes, desktops, laptops) – 35+ years www.FrederickLane.com www.ComputerForensicsDigest.com 4
  • What Is Child Pornography? • • • • Federal Laws State Laws International Law Determining Age of Person Depicted www.FrederickLane.com www.ComputerForensicsDigest.com 5
  • Federal CP Laws • 18 U.S.C. c. 110 – Sexual Exploitation and Other Abuse of Children • 18 U.S.C. § 2251 – Production • 18 U.S.C. § 2252 – Possession, Distribution, and Receipt • 18 U.S.C. § 2256 -- Definitions www.FrederickLane.com www.ComputerForensicsDigest.com 6
  • “Child Pornography” 18 U.S.C. § 2256(8): “any visual depiction, including any photograph, film, video, picture, or computer or computer-generated image or picture, whether made or produced by electronic, mechanical, or other means, of sexually explicit conduct, where— (A) the production of such visual depiction involves the use of a minor engaging in sexually explicit conduct; [or] (B) such visual depiction is a digital image, computer image, or computer-generated image that is, or is indistinguishable from, that of a minor engaging in sexually explicit conduct; or (C) such visual depiction has been created, adapted, or modified to appear that an identifiable minor is engaging in sexually explicit conduct.” www.FrederickLane.com www.ComputerForensicsDigest.com 7
  • Other Relevant Definitions • “Minor” [18 U.S.C. § 2256(1)]: <18 • 18 U.S.C. § 2257: Record-keeping requirements • “Sexually Explicit Conduct” [18 U.S.C. § 2256(2)(A)]: • (i) sexual intercourse, including genital-genital, oral-genital, anal-genital, or oral-anal, whether between persons of the same or opposite sex; • (ii) bestiality; • (iii) masturbation; • (iv) sadistic or masochistic abuse; or • (v) lascivious exhibition of the genitals or pubic area of any person. • Slightly Different Definitions for Computer Images [18 U.S.C. § 2256(2)(B)] www.FrederickLane.com www.ComputerForensicsDigest.com 8
  • NCMEC • “National Center for Missing and Exploited Children” • Created by Congress in 1984 • Child Recognition and Identification System – database of hash values of CP images • Child Victim Identification Program www.FrederickLane.com www.ComputerForensicsDigest.com 9
  • State CP Laws • All 50 states have their own CP laws • Age of minority varies: 16 (30 states); 17 (9 states); and 18 (12 states) • Prosecution can be federal or state, or both. • Can include “harmful to minors” standard (states only) www.FrederickLane.com www.ComputerForensicsDigest.com 10
  • Delaware CP Laws • DEL CODE § 1103 – Definitions Relating to Children • DEL CODE § 1108 – Sexual Exploitation of a Child • DEL CODE § 1109 – Dealing in Child Pornography • DEL CODE § 1110 – Subsequent Convictions … • DEL CODE § 1111 – Possession of Child Pornography www.FrederickLane.com www.ComputerForensicsDigest.com 11
  • DEL CODE 1103 • “Child”: Anyone under age of 18 or any individual intended to appear <14. • “Prohibited Sexual Acts”: • (1) Sexual intercourse; • (2) Anal intercourse; • (3) Masturbation; • (4) Bestiality; • (5) Sadism; • (6) Masochism; • (7) Fellatio; • (8) Cunnilingus; • (9) Nudity, if such nudity is to be depicted for the purpose of the sexual stimulation or the sexual gratification of any individual who may view such depiction; • (10) Sexual contact; • (11) Lascivious exhibition of the genitals or pubic area of any child; • (12) Any other act which is intended to be a depiction or simulation of any act described in this subsection. www.FrederickLane.com www.ComputerForensicsDigest.com 12
  • International CP Laws • Over last 7 years, 100 countries have adopted new CP laws • 53 countries still have no CP law at all • International Center for Missing and Exploited Children • 2012 Child Pornography Model Laws: http://bit.ly/19eWJPz www.FrederickLane.com www.ComputerForensicsDigest.com 13
  • Determining Age Is expert testimony need? Tanner Stage: Outmoded? Role of environmental factors Bait and switch Defendant’s subjective belief is irrelevant • Prosecutors prefer clear cases • • • • • www.FrederickLane.com www.ComputerForensicsDigest.com 14
  • Digital Technology and CP A Brief Background Digital Production of CP Digital Distribution of CP Digital Consumption (Receipt and Possession) • Societal Changes • • • • www.FrederickLane.com www.ComputerForensicsDigest.com 15
  • A Brief Background • 1978: Protection of Children Against Sexual Exploitation Act • 1982: New York v. Ferber – Upholding state law banning child pornography • 1984: Child Protection Act (prohibiting noncommercial distribution) • 1992: Jacobson v. United States – Postal Service entrapment • 2000: Poehlman v. United States – FBI entrapped defendant after lengthy email correspondence www.FrederickLane.com www.ComputerForensicsDigest.com 16
  • Digital Production of CP • Scanners • Digital Cameras (still and video) • Cameraphones (dumb and smart) • Web cams www.FrederickLane.com www.ComputerForensicsDigest.com 17
  • Digital Distribution of CP • One-to-One • Sneakernet • E-mail / Personal File-Sharing • Instant Messaging / Chat Rooms • One-to-Many • • • • Newsgroups and Forums Peer-to-Peer Networks Torrent Networks / File-Hosting Underground Web Sites www.FrederickLane.com www.ComputerForensicsDigest.com 18
  • Digital Consumption of CP • Producer of CP may be in possession without having “received” it • Defendant may be in “receipt” of CP without “knowingly” possessing it • The challenges of determining “intentionally” and “knowingly” in the context of Internet activity www.FrederickLane.com www.ComputerForensicsDigest.com 19
  • Societal Changes • Computers and the Internet • The Democratization of Porn Production • “Porn Chic” • The “Selfie” www.FrederickLane.com www.ComputerForensicsDigest.com 20
  • Digital Investigations • Discovery of Possible Child Pornography • The Role of IP Addresses • Intro to Computer Forensics www.FrederickLane.com www.ComputerForensicsDigest.com 21
  • Discovery of Possible CP • • • • • Angry Spouse or Girlfriend Geek Squads Chat Rooms Hash Flags P2P and Torrent Investigations • Server or Payment Logs www.FrederickLane.com www.ComputerForensicsDigest.com 22
  • Overview of IP Addresses • Assigned to Every InternetConnected Device • Two Flavors: • IPv4: 196.172.0.1 • IPv6: 2001:0db8:85a3:0042:1000:8a2 e:0370:7334 • Leading to “Internet of Things” www.FrederickLane.com www.ComputerForensicsDigest.com 23
  • IP → Physical Address • Ranges of IP Addresses Assigned to ISPs by Internet Assigned Numbers Authority • Online Tools to Look Up ISP • Dynamic vs. Static • Subscriber Records Show Date, Time, IP Address, Limited Activity www.FrederickLane.com www.ComputerForensicsDigest.com 24
  • Limitations of IP Addresses • Links Online Activity to Device, Not Necessarily a Specific User • Data May Not Be Available from ISP • Possibility of War-Dialing www.FrederickLane.com www.ComputerForensicsDigest.com 25
  • Intro to Computer Forensics • • • • Increasingly Specialized Forensics Procedures Forensics Software A Typical Forensics Report www.FrederickLane.com www.ComputerForensicsDigest.com 26
  • Increasingly Specialized • Computer Forensics • Windows • Mac OS • Linux • Network Forensics • Mobile Forensics • Dozens of Mobile OSs • Hundreds of Models • Cloud Forensics • Many Questions, No Clear Answers www.FrederickLane.com www.ComputerForensicsDigest.com 27
  • Forensics Procedures • • • • • • Field Previews Mirror Images Hash Values Staggering Amounts of Data Chains of Custody 2006: The Adam Walsh Act www.FrederickLane.com www.ComputerForensicsDigest.com 28
  • A Typical Forensics Report • There should be at least two reports: • • • • • • Acquisition • Evaluation of Evidence Bowdlerized Detailed procedures Hash value checks Bookmarks of possible contraband Evidence of user ID www.FrederickLane.com www.ComputerForensicsDigest.com 29
  • Defending CP Cases • Pre-Trial Issues • Trial Issues • Typical Defenses in CP Cases [Some More Viable than Others] www.FrederickLane.com www.ComputerForensicsDigest.com 30
  • Pre-Trial Issues • Retaining a Defense Expert • Deposition of Government Experts • Motion(s) to Produce • Motion(s) to Suppress or in limine www.FrederickLane.com www.ComputerForensicsDigest.com 31
  • Trial Issues • Should There Be a Trial? • Motion(s) in limine • Cross-Examination of Government Expert www.FrederickLane.com www.ComputerForensicsDigest.com 32
  • Typical Defenses (1) • Lack of Possession or Receipt • Mere Browsing • The Phantom Hash • Accident or Lack of Intent • Ignorance or Mistake as to Age • Not a Real Child / Morphed / Computer-Generated www.FrederickLane.com www.ComputerForensicsDigest.com 33
  • Typical Defenses (2) • Multiple Persons with Access to Device • Used Equipment with PreExisting CP • Viral Infection • Planting of Evidence by Spouse or Police • Entrapment www.FrederickLane.com www.ComputerForensicsDigest.com 34
  • Slides and Contact Info • Download a PDF of slides from: SlideShare.net/FSL3 • E-mail or Call Me: FSLane3@gmail.com 802-318-4604 www.FrederickLane.com www.ComputerForensicsDigest.com 35
  • Digital Forensics and Child Pornography Frederick S. Lane DE Assoc. of Criminal Defense Lawyers Wilmington, DE 6 December 2013 www.FrederickLane.com www.ComputerForensicsDigest.com 36