1.
Digital Forensics and
Child Pornography
Frederick S. Lane
DE Assoc. of Criminal Defense Lawyers
Wilmington, DE
6 December 2013
www.FrederickLane.com
www.ComputerForensicsDigest.com
1

2.
Seminar Overview
• Introduction and
Overview
• Digital Technology and
CP
• Digital Investigations
• Defending Child
Pornography Cases
www.FrederickLane.com
www.ComputerForensicsDigest.com
2

3.
Introduction and Overview
• Background and
Expertise
• What Is Child
Pornography?
• Digital Technology and
the Spread of Child
Pornography
www.FrederickLane.com
www.ComputerForensicsDigest.com
3

4.
Background and Expertise
• Attorney and Author of 7
Books
• Computer Forensics
Expert -- 15 years
• Over 100 criminal cases
• Lecturer on ComputerRelated Topics – 20+
years
• Computer user
(midframes, desktops,
laptops) – 35+ years
www.FrederickLane.com
www.ComputerForensicsDigest.com
4

5.
What Is Child Pornography?
•
•
•
•
Federal Laws
State Laws
International Law
Determining Age of
Person Depicted
www.FrederickLane.com
www.ComputerForensicsDigest.com
5

6.
Federal CP Laws
• 18 U.S.C. c. 110 – Sexual
Exploitation and Other Abuse
of Children
• 18 U.S.C. § 2251 – Production
• 18 U.S.C. § 2252 – Possession,
Distribution, and Receipt
• 18 U.S.C. § 2256 -- Definitions
www.FrederickLane.com
www.ComputerForensicsDigest.com
6

7.
“Child Pornography”
18 U.S.C. § 2256(8): “any visual depiction, including
any photograph, film, video, picture, or computer or
computer-generated image or picture, whether made
or produced by electronic, mechanical, or other
means, of sexually explicit conduct, where—
(A) the production of such visual depiction
involves the use of a minor engaging in sexually
explicit conduct; [or]
(B) such visual depiction is a digital image,
computer image, or computer-generated image that is,
or is indistinguishable from, that of a minor engaging in
sexually explicit conduct; or
(C) such visual depiction has been created,
adapted, or modified to appear that an identifiable
minor is engaging in sexually explicit conduct.”
www.FrederickLane.com
www.ComputerForensicsDigest.com
7

8.
Other Relevant Definitions
• “Minor” [18 U.S.C. § 2256(1)]: <18
• 18 U.S.C. § 2257: Record-keeping requirements
• “Sexually Explicit Conduct” [18 U.S.C. §
2256(2)(A)]:
• (i) sexual intercourse, including genital-genital, oral-genital,
anal-genital, or oral-anal, whether between persons of the
same or opposite sex;
• (ii) bestiality;
• (iii) masturbation;
• (iv) sadistic or masochistic abuse; or
• (v) lascivious exhibition of the genitals or pubic area of any
person.
• Slightly Different Definitions for Computer
Images [18 U.S.C. § 2256(2)(B)]
www.FrederickLane.com
www.ComputerForensicsDigest.com
8

9.
NCMEC
• “National Center for Missing
and Exploited Children”
• Created by Congress in 1984
• Child Recognition and
Identification System –
database of hash values of CP
images
• Child Victim Identification
Program
www.FrederickLane.com
www.ComputerForensicsDigest.com
9

10.
State CP Laws
• All 50 states have their own CP
laws
• Age of minority varies: 16 (30
states); 17 (9 states); and 18
(12 states)
• Prosecution can be federal or
state, or both.
• Can include “harmful to
minors” standard (states only)
www.FrederickLane.com
www.ComputerForensicsDigest.com
10

11.
Delaware CP Laws
• DEL CODE § 1103 – Definitions
Relating to Children
• DEL CODE § 1108 – Sexual
Exploitation of a Child
• DEL CODE § 1109 – Dealing in Child
Pornography
• DEL CODE § 1110 – Subsequent
Convictions …
• DEL CODE § 1111 – Possession of
Child Pornography
www.FrederickLane.com
www.ComputerForensicsDigest.com
11

12.
DEL CODE
1103
•
“Child”: Anyone under age of 18 or any individual intended to appear
<14.
•
“Prohibited Sexual Acts”:
• (1) Sexual intercourse;
• (2) Anal intercourse;
• (3) Masturbation;
• (4) Bestiality;
• (5) Sadism;
• (6) Masochism;
• (7) Fellatio;
• (8) Cunnilingus;
• (9) Nudity, if such nudity is to be depicted for the purpose of the sexual stimulation or
the sexual gratification of any individual who may view such depiction;
• (10) Sexual contact;
• (11) Lascivious exhibition of the genitals or pubic area of any child;
• (12) Any other act which is intended to be a depiction or simulation of any act described
in this subsection.
www.FrederickLane.com
www.ComputerForensicsDigest.com
12

13.
International CP Laws
• Over last 7 years, 100 countries
have adopted new CP laws
• 53 countries still have no CP law
at all
• International Center for Missing
and Exploited Children
• 2012 Child Pornography Model
Laws: http://bit.ly/19eWJPz
www.FrederickLane.com
www.ComputerForensicsDigest.com
13

14.
Determining Age
Is expert testimony need?
Tanner Stage: Outmoded?
Role of environmental factors
Bait and switch
Defendant’s subjective belief
is irrelevant
• Prosecutors prefer clear cases
•
•
•
•
•
www.FrederickLane.com
www.ComputerForensicsDigest.com
14

15.
Digital Technology and CP
A Brief Background
Digital Production of CP
Digital Distribution of CP
Digital Consumption
(Receipt and Possession)
• Societal Changes
•
•
•
•
www.FrederickLane.com
www.ComputerForensicsDigest.com
15

16.
A Brief Background
•
1978: Protection of Children Against Sexual
Exploitation Act
•
1982: New York v. Ferber – Upholding state
law banning child pornography
•
1984: Child Protection Act (prohibiting noncommercial distribution)
•
1992: Jacobson v. United States – Postal
Service entrapment
•
2000: Poehlman v. United States – FBI
entrapped defendant after lengthy email
correspondence
www.FrederickLane.com
www.ComputerForensicsDigest.com
16

17.
Digital Production of CP
• Scanners
• Digital Cameras (still and
video)
• Cameraphones (dumb and
smart)
• Web cams
www.FrederickLane.com
www.ComputerForensicsDigest.com
17

18.
Digital Distribution of CP
• One-to-One
• Sneakernet
• E-mail / Personal File-Sharing
• Instant Messaging / Chat Rooms
• One-to-Many
•
•
•
•
Newsgroups and Forums
Peer-to-Peer Networks
Torrent Networks / File-Hosting
Underground Web Sites
www.FrederickLane.com
www.ComputerForensicsDigest.com
18

19.
Digital Consumption of CP
• Producer of CP may be in
possession without having
“received” it
• Defendant may be in “receipt” of
CP without “knowingly”
possessing it
• The challenges of determining
“intentionally” and “knowingly” in
the context of Internet activity
www.FrederickLane.com
www.ComputerForensicsDigest.com
19

20.
Societal Changes
• Computers and the
Internet
• The Democratization of
Porn Production
• “Porn Chic”
• The “Selfie”
www.FrederickLane.com
www.ComputerForensicsDigest.com
20

21.
Digital Investigations
• Discovery of Possible Child
Pornography
• The Role of IP Addresses
• Intro to Computer
Forensics
www.FrederickLane.com
www.ComputerForensicsDigest.com
21

22.
Discovery of Possible CP
•
•
•
•
•
Angry Spouse or Girlfriend
Geek Squads
Chat Rooms
Hash Flags
P2P and Torrent
Investigations
• Server or Payment Logs
www.FrederickLane.com
www.ComputerForensicsDigest.com
22

23.
Overview of IP Addresses
• Assigned to Every InternetConnected Device
• Two Flavors:
• IPv4: 196.172.0.1
• IPv6:
2001:0db8:85a3:0042:1000:8a2
e:0370:7334
• Leading to “Internet of Things”
www.FrederickLane.com
www.ComputerForensicsDigest.com
23

24.
IP → Physical Address
• Ranges of IP Addresses
Assigned to ISPs by Internet
Assigned Numbers Authority
• Online Tools to Look Up ISP
• Dynamic vs. Static
• Subscriber Records Show
Date, Time, IP Address,
Limited Activity
www.FrederickLane.com
www.ComputerForensicsDigest.com
24

25.
Limitations of IP Addresses
• Links Online Activity to
Device, Not Necessarily a
Specific User
• Data May Not Be Available
from ISP
• Possibility of War-Dialing
www.FrederickLane.com
www.ComputerForensicsDigest.com
25

26.
Intro to Computer Forensics
•
•
•
•
Increasingly Specialized
Forensics Procedures
Forensics Software
A Typical Forensics
Report
www.FrederickLane.com
www.ComputerForensicsDigest.com
26

27.
Increasingly Specialized
• Computer Forensics
• Windows
• Mac OS
• Linux
• Network Forensics
• Mobile Forensics
• Dozens of Mobile OSs
• Hundreds of Models
• Cloud Forensics
• Many Questions, No Clear Answers
www.FrederickLane.com
www.ComputerForensicsDigest.com
27

28.
Forensics Procedures
•
•
•
•
•
•
Field Previews
Mirror Images
Hash Values
Staggering Amounts of Data
Chains of Custody
2006: The Adam Walsh Act
www.FrederickLane.com
www.ComputerForensicsDigest.com
28

29.
A Typical Forensics Report
• There should be at least two
reports:
•
•
•
•
•
• Acquisition
• Evaluation of Evidence
Bowdlerized
Detailed procedures
Hash value checks
Bookmarks of possible contraband
Evidence of user ID
www.FrederickLane.com
www.ComputerForensicsDigest.com
29

30.
Defending CP Cases
• Pre-Trial Issues
• Trial Issues
• Typical Defenses in CP
Cases [Some More Viable
than Others]
www.FrederickLane.com
www.ComputerForensicsDigest.com
30

31.
Pre-Trial Issues
• Retaining a Defense Expert
• Deposition of Government
Experts
• Motion(s) to Produce
• Motion(s) to Suppress or
in limine
www.FrederickLane.com
www.ComputerForensicsDigest.com
31

32.
Trial Issues
• Should There Be a
Trial?
• Motion(s) in limine
• Cross-Examination of
Government Expert
www.FrederickLane.com
www.ComputerForensicsDigest.com
32

33.
Typical Defenses (1)
• Lack of Possession or Receipt
• Mere Browsing
• The Phantom Hash
• Accident or Lack of Intent
• Ignorance or Mistake as to Age
• Not a Real Child / Morphed /
Computer-Generated
www.FrederickLane.com
www.ComputerForensicsDigest.com
33

34.
Typical Defenses (2)
• Multiple Persons with Access
to Device
• Used Equipment with PreExisting CP
• Viral Infection
• Planting of Evidence by Spouse
or Police
• Entrapment
www.FrederickLane.com
www.ComputerForensicsDigest.com
34

35.
Slides and Contact Info
• Download a PDF of slides
from:
SlideShare.net/FSL3
• E-mail or Call Me:
FSLane3@gmail.com
802-318-4604
www.FrederickLane.com
www.ComputerForensicsDigest.com
35

36.
Digital Forensics and
Child Pornography
Frederick S. Lane
DE Assoc. of Criminal Defense Lawyers
Wilmington, DE
6 December 2013
www.FrederickLane.com
www.ComputerForensicsDigest.com
36