Icac peer to peer presentation

960 views

Published on

Published in: Technology, News & Politics
0 Comments
1 Like
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total views
960
On SlideShare
0
From Embeds
0
Number of Embeds
6
Actions
Shares
0
Downloads
9
Comments
0
Likes
1
Embeds 0
No embeds

No notes for slide

Icac peer to peer presentation

  1. 1. Legal IssuesLegal Issues inin Peer to PeerPeer to Peer CasesCases Joseph LesniakJoseph Lesniak Law Offices of Joseph Lesniak, LLCLaw Offices of Joseph Lesniak, LLC Delaware County, PennsylvaniaDelaware County, Pennsylvania
  2. 2. 2 Butner Study (2009)Butner Study (2009)  155 child pornography offenders in an 18155 child pornography offenders in an 18 month voluntary treatment program.month voluntary treatment program.  At time of sentencing 115 (74%) had noAt time of sentencing 115 (74%) had no documented contact offenses.documented contact offenses.  40 (26%) had known histories of contact40 (26%) had known histories of contact offenses.offenses.
  3. 3. 3 Butner Study (2009)Butner Study (2009)  The total number of victims, at sentencingThe total number of victims, at sentencing was 75, or 1.88 victims per offender.was 75, or 1.88 victims per offender.
  4. 4. 4 Butner Study (2009)Butner Study (2009)  By the end of treatment 24 (15%) deniedBy the end of treatment 24 (15%) denied contact offences and 131 subjects (85%)contact offences and 131 subjects (85%) admitted to at least 1 hands-on offense.admitted to at least 1 hands-on offense. An increase of 59%.An increase of 59%.  The number of reported victims, at the endThe number of reported victims, at the end of treatment, wasof treatment, was 1,7771,777 for an average offor an average of 13.56 victims per offender.13.56 victims per offender.
  5. 5. 5 Butner Study (2009)Butner Study (2009) High % of crossover:High % of crossover:  70% had both child and adolescent victims70% had both child and adolescent victims  Approximately 40% had both male andApproximately 40% had both male and female victimsfemale victims  68.7% had no prior conviction for a sex68.7% had no prior conviction for a sex offense.offense.  30.1% had participated in acts of30.1% had participated in acts of bestiality.bestiality.
  6. 6. TOPICS WE WILL COVERTOPICS WE WILL COVER  44thth Amendment IssuesAmendment Issues  Probable Cause (drafting the search warrant)Probable Cause (drafting the search warrant)  Plain ViewPlain View  Charging considerationsCharging considerations  Trying a Peer to Peer CaseTrying a Peer to Peer Case
  7. 7. Fourth Amendment Issues inFourth Amendment Issues in Peer to Peer CasesPeer to Peer Cases
  8. 8. ECPAECPA (Electronic Communication Provider Act)(Electronic Communication Provider Act) Title 18, Section §2701,Title 18, Section §2701, et.seq.et.seq.  Applies to Public ISPs.Applies to Public ISPs.  A Four-Tiered Approach to Privacy Issues.A Four-Tiered Approach to Privacy Issues.  The More Private the Info Sought - TheThe More Private the Info Sought - The More Process Required.More Process Required.
  9. 9. The Four TiersThe Four Tiers  Customer Information - SubpoenaCustomer Information - Subpoena  Transactional Information - § 2703(d)Transactional Information - § 2703(d) OrderOrder  Content - Search WarrantContent - Search Warrant  Real-Time Interception - Title III WiretapReal-Time Interception - Title III Wiretap
  10. 10. Use of Subpoena/ Court OrderUse of Subpoena/ Court Order in a P2P Investigationin a P2P Investigation  Once you obtain IP Address of targetOnce you obtain IP Address of target computer what then?computer what then?  Determine which ISP was assigned the IPDetermine which ISP was assigned the IP address .address .  Subpoena/ Court Order to the ISP forSubpoena/ Court Order to the ISP for information relating to the account assignedinformation relating to the account assigned IP address on specific date at specific time.IP address on specific date at specific time.  Make sure that customer will not be notified ofMake sure that customer will not be notified of your subpoena by requestingyour subpoena by requesting 90 day non-90 day non- disclosure - - Supervisor statementdisclosure - - Supervisor statement
  11. 11. ECPAECPA “Customer Information”“Customer Information” (Subpoena/ Court Order)(Subpoena/ Court Order) 1) name;1) name; 2) address;2) address; 3) records of session times and3) records of session times and durations;durations; 4) Other IP addresses assigned; and4) Other IP addresses assigned; and 5) length of service (including start5) length of service (including start date) and types of service utilized.date) and types of service utilized.
  12. 12. Expectation of Privacy inExpectation of Privacy in P2P CasesP2P Cases U.S. v. BorowyU.S. v. Borowy, 595 F.3d 1045 (9, 595 F.3d 1045 (9thth Cir. 2010)Cir. 2010) Defendant claimed he attempted to turn off theDefendant claimed he attempted to turn off the share function of Limewire, thus he argued he hadshare function of Limewire, thus he argued he had expectation of privacy in contents of share folder.expectation of privacy in contents of share folder.
  13. 13. Expectation of Privacy inExpectation of Privacy in P2P CasesP2P Cases U.S. v. BorowyU.S. v. Borowy, 595 F.3d 1045 (9, 595 F.3d 1045 (9thth Cir. 2010)Cir. 2010) ““Borowy’s subjective intention not to share his filesBorowy’s subjective intention not to share his files did not create an objectively reasonabledid not create an objectively reasonable expectation of privacy [in the contents of sharedexpectation of privacy [in the contents of shared folder].”folder].”  Downloading from share folder on target computerDownloading from share folder on target computer files with names suggestive of child pornographyfiles with names suggestive of child pornography does not violate 4does not violate 4thth Amendment.Amendment.
  14. 14. Expectation of Privacy inExpectation of Privacy in P2P CasesP2P Cases U.S. v. BorowyU.S. v. Borowy, 595 F.3d 1045 (9, 595 F.3d 1045 (9thth Cir. 2010)Cir. 2010) Downloading from share folder on target computerDownloading from share folder on target computer files with names suggestive of child pornographyfiles with names suggestive of child pornography does not violate 4does not violate 4thth Amendment.Amendment.
  15. 15. Search Warrants in P2P CasesSearch Warrants in P2P Cases  Computer search warrants present uniqueComputer search warrants present unique problems.problems.  Amount of material that may be stored onAmount of material that may be stored on computer is enormous.computer is enormous.  Highly technical information needs to beHighly technical information needs to be drafted into the warrant in andrafted into the warrant in an understandable fashion.understandable fashion.  Problems such as scope of warrant,Problems such as scope of warrant, staleness, and how the data will bestaleness, and how the data will be analyzed need to be considered.analyzed need to be considered.
  16. 16. Drafting the Search WarrantDrafting the Search Warrant  Things to consider:Things to consider:  Is sufficientIs sufficient backgroundbackground information in theinformation in the affidavit in support of search warrant?affidavit in support of search warrant?  Does affidavit contain facts constitutingDoes affidavit contain facts constituting probable causeprobable cause??  Does the affidavit discussDoes the affidavit discuss searchsearch methodology?methodology?  Is the warrantIs the warrant particular enoughparticular enough in describingin describing items to be seized yet broad enough to coveritems to be seized yet broad enough to cover important evidentiary items you will want toimportant evidentiary items you will want to seize?seize?
  17. 17. BackgroundBackground  Affiant’s training and experience.Affiant’s training and experience.  Statutory violations that may have beenStatutory violations that may have been violated.violated.  Remember the target at this point isRemember the target at this point is computer and storage media – not acomputer and storage media – not a person.person.  Background information to educate theBackground information to educate the judge:judge:  Definitions if necessary.Definitions if necessary.  Description of how peer to peer file sharing works.Description of how peer to peer file sharing works.  Overview of investigative techniques used in P2POverview of investigative techniques used in P2P cases.cases.
  18. 18. Probable CauseProbable Cause  P/C to believe that evidence, fruits, orP/C to believe that evidence, fruits, or contraband can be found on each computercontraband can be found on each computer and/or storage media at location.and/or storage media at location.  In P2P case describe file list obtained in browse.In P2P case describe file list obtained in browse.  Describe with specificity images of childDescribe with specificity images of child pornography that may be on computer –pornography that may be on computer –  Describe diminutive stature, lack of breast/pubic hairDescribe diminutive stature, lack of breast/pubic hair development, say if prepubescent.development, say if prepubescent.  Affiant may approximate age; okay to say childAffiant may approximate age; okay to say child “appeared” to affiant to be under 18 or 10 or 5 yoa.“appeared” to affiant to be under 18 or 10 or 5 yoa.  How are actors clothed? Or lack thereof.How are actors clothed? Or lack thereof.  Describe sexual activityDescribe sexual activity
  19. 19. Probable CauseProbable Cause  Search warrant drafting 101:Search warrant drafting 101:  Who, what, when, where, why, and how.Who, what, when, where, why, and how.  Make sure that you understand theMake sure that you understand the background portion of the warrant and thatbackground portion of the warrant and that you reference it as necessary in P/C portionyou reference it as necessary in P/C portion of S/W.of S/W.  Don’t overlook details like signatures,Don’t overlook details like signatures, accurate description of place to be searchedaccurate description of place to be searched etc.etc.
  20. 20. Probable CauseProbable Cause State v. NussState v. Nuss, 2010 WL 1405245 (Neb., 2010 WL 1405245 (Neb. 2010)2010) P2P case.P2P case. Affidavit related that 20 files downloaded fromAffidavit related that 20 files downloaded from target computer “appeared to be childtarget computer “appeared to be child pornography.”pornography.”
  21. 21. Probable CauseProbable Cause State v. NussState v. Nuss, 2010 WL 1405245 (Neb., 2010 WL 1405245 (Neb. 2010).2010). Nebraska Supreme Court ruled that warrantNebraska Supreme Court ruled that warrant did not use or even refer to the statutorydid not use or even refer to the statutory definitions of sexually explicit conduct indefinitions of sexually explicit conduct in describing the images.describing the images. Used terms: “appear to be child pornography”Used terms: “appear to be child pornography” “…“…consistent with child pornography”consistent with child pornography”
  22. 22. Probable CauseProbable Cause U.S. v. Henderson,U.S. v. Henderson, 595 F.3d 1198 (10595 F.3d 1198 (10thth Cir. 2010).Cir. 2010). P2P search warrant.P2P search warrant. Be sure to include every critical investigativeBe sure to include every critical investigative step.step. who, what, where, when, why and how.who, what, where, when, why and how.
  23. 23. Probable CauseProbable Cause U.S. v. Henderson,U.S. v. Henderson, 595 F.3d 1198 (10595 F.3d 1198 (10thth Cir. 2010).Cir. 2010). Affidavit “failed to identify how [agent whoAffidavit “failed to identify how [agent who applied for search warrant]’s source [agentapplied for search warrant]’s source [agent who sent P2P lead] determined that computerwho sent P2P lead] determined that computer with relevant IP address – rather than somewith relevant IP address – rather than some other computer – shared child pornographyother computer – shared child pornography videos.”videos.”
  24. 24. Probable Cause – Do We NeedProbable Cause – Do We Need a Download?a Download?  U.S. v. Miknevich, 638 F.3d 178, (3U.S. v. Miknevich, 638 F.3d 178, (3rdrd Cir.Cir. 2011)2011)  State warrant. No download and vagueState warrant. No download and vague description of files that were viewed as adescription of files that were viewed as a result of browse. However, based uponresult of browse. However, based upon statement of affiant that he knew the filestatement of affiant that he knew the file contained child porn based the SHA1 value ofcontained child porn based the SHA1 value of the file and the file name itself the court foundthe file and the file name itself the court found sufficient P/C to uphold the warrant.sufficient P/C to uphold the warrant.
  25. 25. Probable Cause – OvercomingProbable Cause – Overcoming StalenessStaleness  Characteristics of Persons SexuallyCharacteristics of Persons Sexually Interested in ChildrenInterested in Children  U.S. v. GourdeU.S. v. Gourde, 430 F.3d 1065 (9, 430 F.3d 1065 (9thth Cir. 2006)Cir. 2006) (affidavit said collectors store pics on computer).(affidavit said collectors store pics on computer).  U.S. v. AbrahamU.S. v. Abraham, 2006 WL 1344303 (W.D. Pa.), 2006 WL 1344303 (W.D. Pa.) (affidavit said collectors keep pics for long time).(affidavit said collectors keep pics for long time). E.g., “I am aware that persons who collect childE.g., “I am aware that persons who collect child pornography cherish their collections and tend topornography cherish their collections and tend to retain their collections for very long periods of time,retain their collections for very long periods of time, often for years.”often for years.” BUTBUT, especially in the 9, especially in the 9thth Circuit,Circuit, make sure you say why your target is a collector.make sure you say why your target is a collector. SeeSee U.S. v. WeberU.S. v. Weber, 923 F.2d 1338, 923 F.2d 1338 (9(9thth Cir. 1990).Cir. 1990).
  26. 26. Probable Cause – Role ofProbable Cause – Role of Officer ExpertiseOfficer Expertise  Listing of an officer’s training andListing of an officer’s training and experience helps to enhance probableexperience helps to enhance probable cause.cause.  PitfallsPitfalls  Failing to place the suspect within the class ofFailing to place the suspect within the class of persons being describedpersons being described  Broad conclusions without expertiseBroad conclusions without expertise
  27. 27. Probable Cause – Role ofProbable Cause – Role of Officer ExpertiseOfficer Expertise U.S. v. Weber,U.S. v. Weber, 923 F.2d 1338 (9923 F.2d 1338 (9thth Cir. 1990)Cir. 1990) Expert information consisted of ramblingExpert information consisted of rambling boilerplate recitations that did not connect at allboilerplate recitations that did not connect at all to the facts of the specific case or defendant.to the facts of the specific case or defendant. Expert reported he knew the habits of “childExpert reported he knew the habits of “child molesters”, “pedophiles” and “child pornographymolesters”, “pedophiles” and “child pornography collectors”collectors”
  28. 28. Probable Cause – Role ofProbable Cause – Role of Officer ExpertiseOfficer Expertise U.S. v. Weber,U.S. v. Weber, 923 F.2d 1338 (9923 F.2d 1338 (9thth Cir. 1990)Cir. 1990) ““If the government presents expert opinionIf the government presents expert opinion about the behavior of a particular class ofabout the behavior of a particular class of persons, for the opinion to have any relevance, itpersons, for the opinion to have any relevance, it must lay a foundation which shows that themust lay a foundation which shows that the person subject to the search is a member of theperson subject to the search is a member of the class.”class.”
  29. 29. Probable Cause – Role ofProbable Cause – Role of Officer ExpertiseOfficer Expertise Burnett v. State,Burnett v. State, Fla.2d DCA 2003Fla.2d DCA 2003 Defendant videotaped two boys engaged inDefendant videotaped two boys engaged in lewd conduct found during a consent search oflewd conduct found during a consent search of his home.his home. As a result detective sought a search warrantAs a result detective sought a search warrant for the computer. In the affidavit it is alleged thatfor the computer. In the affidavit it is alleged that based on her expertise, child pornography wouldbased on her expertise, child pornography would be found on the computer.be found on the computer.
  30. 30. Probable Cause – Role ofProbable Cause – Role of Officer ExpertiseOfficer Expertise Burnett v. State,Burnett v. State, Fla.2d DCA 2003Fla.2d DCA 2003 The court ruled that the affidavit failed toThe court ruled that the affidavit failed to describe a factual link between the video cameradescribe a factual link between the video camera and the computer. The expertise was notand the computer. The expertise was not enough.enough.
  31. 31. Probable Cause – Role ofProbable Cause – Role of Officer ExpertiseOfficer Expertise Burnett v. State,Burnett v. State, Fla.2d DCA 2003Fla.2d DCA 2003 In the opinion the court discussed two flawsIn the opinion the court discussed two flaws in the detective’s affidavit:in the detective’s affidavit: 1) She never expounded on her expertise in1) She never expounded on her expertise in the habits of child pornographers.the habits of child pornographers. 2) She never stated if the computer had2) She never stated if the computer had internet capabilities or was able to be connectedinternet capabilities or was able to be connected to the video camera where the childto the video camera where the child pornography was located.pornography was located.
  32. 32. Probable Cause – OvercomingProbable Cause – Overcoming StalenessStaleness  The term “collector” can be problematic.The term “collector” can be problematic.  Persons “with a sexual interest in children”Persons “with a sexual interest in children” has worked in some districts.has worked in some districts.  Be sure to give the court some basis toBe sure to give the court some basis to conclude that the subject is a “collector.”conclude that the subject is a “collector.”
  33. 33. Probable Cause – OvercomingProbable Cause – Overcoming StalenessStaleness  Defeating staleness through language re:Defeating staleness through language re: deleted images still indeleted images still in unallocated space.unallocated space.  E.g., “Based on my training andE.g., “Based on my training and experience, I know that just because anexperience, I know that just because an image is deleted does not mean it isimage is deleted does not mean it is erased from the computer. It can beerased from the computer. It can be retained indefinitely in an area of theretained indefinitely in an area of the computer known as unallocated spacecomputer known as unallocated space until overwritten.”until overwritten.”  See, e.g.,See, e.g., U.S. v. GourdeU.S. v. Gourde, 440 F.3d 1065 (9, 440 F.3d 1065 (9thth Cir. 2006)Cir. 2006)
  34. 34. Probable Cause - StalenessProbable Cause - Staleness  What is too stale? Depends upon theWhat is too stale? Depends upon the judge and the district...judge and the district...  U.S. v. IsgutU.S. v. Isgut, 1996 WL 775064 (SDFL 1996):, 1996 WL 775064 (SDFL 1996): 11 mo. old information too stale where profile11 mo. old information too stale where profile language failed to spell out affiant’slanguage failed to spell out affiant’s experience and lacked opinion that target wasexperience and lacked opinion that target was a collector.a collector.  U.S. v. ZimmermanU.S. v. Zimmerman, 277 F.3d 426 (3, 277 F.3d 426 (3rdrd Cir.Cir. 2002): Affidavit stale where it only mentioned2002): Affidavit stale where it only mentioned one clip of obscenity seen 6 to 10 monthsone clip of obscenity seen 6 to 10 months earlier.earlier.
  35. 35. Probable Cause - StalenessProbable Cause - Staleness  What is fresh enough?What is fresh enough?  U.S. v. LacyU.S. v. Lacy, 119 F.3d 742 (9, 119 F.3d 742 (9thth Cir. 1997):Cir. 1997): Ten months ok since D was a “collector ofTen months ok since D was a “collector of child porn.”child porn.”  U.S. v. DiazU.S. v. Diaz, 2004 WL 212787 (D.Conn, 2004 WL 212787 (D.Conn 2/13/04): Given crime was production, 162/13/04): Given crime was production, 16 months not stale after cessation of two yearmonths not stale after cessation of two year on-going abuse.on-going abuse.  U.S. v. HornU.S. v. Horn, 187 F.3d 781 (8, 187 F.3d 781 (8thth Cir. 1999):Cir. 1999): Three months not stale.Three months not stale.
  36. 36. Staleness – Pony JacksonStaleness – Pony Jackson  Age 33Age 33  Food service workerFood service worker  AutomobileAutomobile repossessedrepossessed  Personal belongingsPersonal belongings within car seized bywithin car seized by tow truck operatortow truck operator  Briefcase in vehicleBriefcase in vehicle
  37. 37. ParticularityParticularity  Affidavit must establish with particularityAffidavit must establish with particularity what evidence will be seized.what evidence will be seized.  Offenses being investigated will helpOffenses being investigated will help define what can be seized.define what can be seized.  C/P images and all storage media thatC/P images and all storage media that might contain such images.might contain such images.  Cameras, cell phones, CDs, thumb drives, etc.Cameras, cell phones, CDs, thumb drives, etc.  Child erotica/incest literature.Child erotica/incest literature.  Pictures of children that don’t meet the definition ofPictures of children that don’t meet the definition of child pornography.child pornography.  Items pertaining to a sexual interest in children likeItems pertaining to a sexual interest in children like little girls’ panties or kids’ clothing catalogues – at thelittle girls’ panties or kids’ clothing catalogues – at the very least photograph these types of materials.very least photograph these types of materials.
  38. 38. ParticularityParticularity  Your need to determine who isYour need to determine who is responsible for placing the C/P onresponsible for placing the C/P on computer can also broaden the scope ofcomputer can also broaden the scope of search.search.  Correspondence re: child exploitation.Correspondence re: child exploitation.  Billing records/proof of payment.Billing records/proof of payment.  Records regarding computer ownership.Records regarding computer ownership.  Software applications.Software applications.  Need to rule out possible intruder activityNeed to rule out possible intruder activity at the computer that might be attributed toat the computer that might be attributed to the owner of the computer.the owner of the computer.
  39. 39. Possession & Distribution Issues Com Vs. Diodoro (932 A2d 172, Pa.Super. 2007) Defendant was convicted of “possessing” images of child pornography. These images were not downloaded, saved or printed by the Defendant. Defense claims that merely opening the files is not possession.
  40. 40. “Defendant intentionally sought out and viewed pornography, actions of operating computer mouse, locating websites, opening sites, displaying images on computer screen, and closing sites, were affirmative steps corroborating intent to control child pornography.” “Officer stated that fact that multiple images were stored in cache files indicated that someone, after accessing websites, had to click “next” button to view successive images.” “While defendant was viewing images, he could download, print, copy, or email them to others.” Possession & Distribution Issues
  41. 41. U.S. v. Shaffer ( 2007 WL 10770 (C.A. 10(Kan.) Defendant shared files of child pornography using Kazaa a peer-to-peer file sharing program Defense claims there was insufficient evidence to prove “distribution” Possession & Distribution Issues
  42. 42. Court concluded that the term “distribute” means: “…to deliver, transfer, dispense…” In this case the Defendant allowed access to his stash. Just like a self-service gas station the Defendant was in the business of distributing child pornography. Further, the Defendant could have activated a feature on Kazaa to preclude the taking of files. Possession & Distribution Issues
  43. 43. U.S. v. Abraham (2006 WL 3052702 (W.D.Pa.) Again a Defendant was sharing files on a peer- to-peer network Several of these files were downloaded by a PA State Trooper and verified they were known depictions of child pornography Possession & Distribution Issues
  44. 44. The court held that distribution occurred when as a result of the Defendant’s installation of a peer-to-peer file sharing program a trooper was able to download the child pornography to his computer. Possession & Distribution Issues
  45. 45. U.S. v. SlaninaU.S. v. Slanina  U.S. v. Slanina, 359 F.3d 356 (5U.S. v. Slanina, 359 F.3d 356 (5thth Cir.Cir. 2004)2004)  Expert testimony not necessary to proveExpert testimony not necessary to prove child pornography images depict a realchild pornography images depict a real childchild
  46. 46. Proving Image is Child –Proving Image is Child – Jury QuestionJury Question  ““Free Speech CoalitionFree Speech Coalition did not establish a broaddid not establish a broad requirement that the Government must present expertrequirement that the Government must present expert testimony to establish that the unlawful image depicts atestimony to establish that the unlawful image depicts a real child. Three circuits that have considered this issuereal child. Three circuits that have considered this issue take the same position.take the same position. See United States v. KimlerSee United States v. Kimler, 335, 335 F.3d 1132, 1142 (10F.3d 1132, 1142 (10thth Cir. 2003)Cir. 2003);; United States v.United States v. DeatonDeaton, 328 F.3d 454, 455 (8, 328 F.3d 454, 455 (8thth Cir. 2003) (citingCir. 2003) (citing UnitedUnited States v. VigStates v. Vig 167 F.3d 443. 449-50 (8167 F.3d 443. 449-50 (8thth Cir. 1999);Cir. 1999); UnitedUnited States v. HallStates v. Hall, 312 F.3d 1250, 1260 (11, 312 F.3d 1250, 1260 (11thth Cir. 2002).”Cir. 2002).”  ““Juries are still capable of distinguishing between realJuries are still capable of distinguishing between real and virtual images; and admissibility remains within theand virtual images; and admissibility remains within the province of the sound discretion of the trial judgeprovince of the sound discretion of the trial judge.”.” KimlerKimler, 335 F.3d at 1142, 335 F.3d at 1142
  47. 47. GOING TO TRIAL IN THEGOING TO TRIAL IN THE PEER TO PEER CASEPEER TO PEER CASE
  48. 48. DEFENSES TO UC OPSDEFENSES TO UC OPS  Particular to Peer to Peer Prosecutions:Particular to Peer to Peer Prosecutions:  Lack of Knowledge.Lack of Knowledge.  Accident or Mistake.Accident or Mistake.  SODDI.SODDI.  Good Samaritan.Good Samaritan.
  49. 49. KnowledgeKnowledge  Did defendantDid defendant KNOWINGLYKNOWINGLY produce,produce, distribute, receive and/or possess childdistribute, receive and/or possess child pornography?pornography?  U.S. v. X-Citement VideoU.S. v. X-Citement Video, 513 U.S. 64, 513 U.S. 64 (1994)(1994)  ““knowingly” extends both to the sexuallyknowingly” extends both to the sexually explicit nature of the material and to theexplicit nature of the material and to the minority of the performers.minority of the performers.
  50. 50. Knowledge - ProofKnowledge - Proof  Volume of evidence on computer.Volume of evidence on computer.  Look for patterns of use through forensic exam.Look for patterns of use through forensic exam.  When was C/P downloaded.When was C/P downloaded.  What other use going on during that timeWhat other use going on during that time frame.frame.  ““Index.dat” file.Index.dat” file.  How is C/P organized on computer.How is C/P organized on computer.  Has C/P been transferred to other storageHas C/P been transferred to other storage media.media.  Past relevant conduct.Past relevant conduct.  ““OTHER EVIDENCE” – writings, non-OTHER EVIDENCE” – writings, non- pornographic images of kids etc.pornographic images of kids etc.
  51. 51. Accident or MistakeAccident or Mistake  ““I was looking for adult pornography andI was looking for adult pornography and this stuff got on my computer by mistake.”this stuff got on my computer by mistake.”  Ratio of C/P to adult pornRatio of C/P to adult porn  Look at file creation, last modified and lastLook at file creation, last modified and last accessed dates and times.accessed dates and times.  Has the material been moved out of sharedHas the material been moved out of shared folder? Organized?folder? Organized?  Has material been transferred to otherHas material been transferred to other storage media?storage media?
  52. 52. Technologically IneptTechnologically Inept  This is the “I have been run over by theThis is the “I have been run over by the technology” defense.technology” defense.  Refute with: interview of defendant; wayRefute with: interview of defendant; way computer files organized; programs andcomputer files organized; programs and peripherals.peripherals.
  53. 53. Identity (SODDI)Identity (SODDI)  Someone else in the household had access.Someone else in the household had access.  Friend(s) knew the password to the account andFriend(s) knew the password to the account and must have done it.must have done it.  An unknown perpetrator must have done it.An unknown perpetrator must have done it.  Remote access.Remote access.  Refute defense with:Refute defense with:  What time images downloaded.What time images downloaded.  Who had access to computer during that specificWho had access to computer during that specific time.time.  Other activity surrounding time when c/p downloaded.Other activity surrounding time when c/p downloaded.  Lack of evidence relating to remote access.Lack of evidence relating to remote access.
  54. 54. Good SamaritanGood Samaritan  Meet defense by: volume of evidence seized;Meet defense by: volume of evidence seized; how collected (i.e., no notes/records of activity).how collected (i.e., no notes/records of activity).  Best evidence: if made no effort to contact lawBest evidence: if made no effort to contact law enforcement; if target distributed any of the childenforcement; if target distributed any of the child pornography [undermines the credibility of thepornography [undermines the credibility of the claim].claim].
  55. 55. Good SamaritanGood Samaritan  Variations of this defense:Variations of this defense:  Collecting evidence for the police, just haven’tCollecting evidence for the police, just haven’t had time to turn it over.had time to turn it over.  Helping out -- e.g., know how busy the policeHelping out -- e.g., know how busy the police are, or police dept. said don’t have a specializedare, or police dept. said don’t have a specialized unit, etc.unit, etc.  OR - - Target is a police officer doing UC work.OR - - Target is a police officer doing UC work.  Affirmative defense, 18 USC § 2252(c), 18 USC § 2252A(d).
  56. 56. Good SamaritanGood Samaritan  Meet defense: target never advised co-Meet defense: target never advised co- workers or police or superior of activity;workers or police or superior of activity; maintaining the pictures but little or nomaintaining the pictures but little or no information as to subjects engaged in theinformation as to subjects engaged in the conduct; extent of activity (i.e., very time-conduct; extent of activity (i.e., very time- consuming and to the exclusion of otherconsuming and to the exclusion of other activity).activity).

×