2013-12-06 digital forensics and child pornography
DESCRIPTION
This is a presentation I gave to the DE Association of Criminal Defense Lawyers on December 6, 2013. Main themes include: Digital Technology and Child Pornography, Digital Investigations, Introduction to Computer Forensics, and Defending Child Pornography Cases.TRANSCRIPT
Digital Forensics andChild Pornography
DE Assoc. of Criminal Defense Lawyers
Wilmington, DE6 December 2013
Frederick S. Lane
www.FrederickLane.com
www.ComputerForensicsDigest.com 1
2
Seminar Overview
• Introduction and Overview
• Digital Technology and CP
• Digital Investigations• Defending Child
Pornography Caseswww.FrederickLane.co
mwww.ComputerForensicsDi
gest.com
3
Introduction and Overview
• Background and Expertise
• What Is Child Pornography?
• Digital Technology and the Spread of Child Pornography
www.FrederickLane.com
www.ComputerForensicsDigest.com
4
Background and Expertise
• Attorney and Author of 7 Books
• Computer Forensics Expert -- 15 years
• Over 100 criminal cases
• Lecturer on Computer-Related Topics – 20+ years
• Computer user (midframes, desktops, laptops) – 35+ yearswww.FrederickLane.co
mwww.ComputerForensicsDi
gest.com
5
What Is Child Pornography?
• Federal Laws• State Laws• International Law• Determining Age of
Person Depictedwww.FrederickLane.co
mwww.ComputerForensicsDi
gest.com
6
Federal CP Laws• 18 U.S.C. c. 110 – Sexual
Exploitation and Other Abuse of Children
• 18 U.S.C. § 2251 – Production
• 18 U.S.C. § 2252 – Possession, Distribution, and Receipt
• 18 U.S.C. § 2256 -- Definitions
www.FrederickLane.com
www.ComputerForensicsDigest.com
7
“Child Pornography”
18 U.S.C. § 2256(8): “any visual depiction, including any photograph, film, video, picture, or computer or computer-generated image or picture, whether made or produced by electronic, mechanical, or other means, of sexually explicit conduct, where—
(A) the production of such visual depiction involves the use of a minor engaging in sexually explicit conduct; [or]
(B) such visual depiction is a digital image, computer image, or computer-generated image that is, or is indistinguishable from, that of a minor engaging in sexually explicit conduct; or
(C) such visual depiction has been created, adapted, or modified to appear that an identifiable minor is engaging in sexually explicit conduct.”www.FrederickLane.co
mwww.ComputerForensicsDi
gest.com
8
Other Relevant Definitions
• “Minor” [18 U.S.C. § 2256(1)]: <18• 18 U.S.C. § 2257: Record-keeping requirements
• “Sexually Explicit Conduct” [18 U.S.C. § 2256(2)(A)]:• (i) sexual intercourse, including genital-genital, oral-genital, anal-
genital, or oral-anal, whether between persons of the same or opposite sex;
• (ii) bestiality;• (iii) masturbation;• (iv) sadistic or masochistic abuse; or• (v) lascivious exhibition of the genitals or pubic area of any person.
• Slightly Different Definitions for Computer Images [18 U.S.C. § 2256(2)(B)]
www.FrederickLane.com
www.ComputerForensicsDigest.com
9
NCMEC• “National Center for Missing
and Exploited Children”
• Created by Congress in 1984
• Child Recognition and Identification System – database of hash values of CP images
• Child Victim Identification Program
www.FrederickLane.com
www.ComputerForensicsDigest.com
10
State CP Laws• All 50 states have their own CP
laws
• Age of minority varies: 16 (30 states); 17 (9 states); and 18 (12 states)
• Prosecution can be federal or state, or both.
• Can include “harmful to minors” standard (states only)
www.FrederickLane.com
www.ComputerForensicsDigest.com
11
Delaware CP Laws
• DEL CODE § 1103 – Definitions Relating to Children
• DEL CODE § 1108 – Sexual Exploitation of a Child
• DEL CODE § 1109 – Dealing in Child Pornography
• DEL CODE § 1110 – Subsequent Convictions …
• DEL CODE § 1111 – Possession of Child Pornography
www.FrederickLane.com
www.ComputerForensicsDigest.com
12
DEL CODE § 1103• “Child”: Anyone under age of 18 or any individual intended
to appear <14.• “Prohibited Sexual Acts”:
• (1) Sexual intercourse;• (2) Anal intercourse;• (3) Masturbation;• (4) Bestiality;• (5) Sadism;• (6) Masochism;• (7) Fellatio;• (8) Cunnilingus;• (9) Nudity, if such nudity is to be depicted for the purpose of the sexual
stimulation or the sexual gratification of any individual who may view such depiction;
• (10) Sexual contact;• (11) Lascivious exhibition of the genitals or pubic area of any child;• (12) Any other act which is intended to be a depiction or simulation of any act
described in this subsection.www.FrederickLane.co
mwww.ComputerForensicsDi
gest.com
13
International CP Laws
• Over last 7 years, 100 countries have adopted new CP laws
• 53 countries still have no CP law at all
• International Center for Missing and Exploited Children
• 2012 Child Pornography Model Laws: http://bit.ly/19eWJPz
www.FrederickLane.com
www.ComputerForensicsDigest.com
14
Determining Age• Is expert testimony need?
• Tanner Stage: Outmoded?
• Role of environmental factors
• Bait and switch
• Defendant’s subjective belief is irrelevant
• Prosecutors prefer clear caseswww.FrederickLane.co
mwww.ComputerForensicsDi
gest.com
15
Digital Technology and CP
• A Brief Background• Digital Production of CP• Digital Distribution of CP• Digital Consumption
(Receipt and Possession)• Societal Changeswww.FrederickLane.co
mwww.ComputerForensicsDi
gest.com
16
A Brief Background
• 1978: Protection of Children Against Sexual Exploitation Act
• 1982: New York v. Ferber – Upholding state law banning child pornography
• 1984: Child Protection Act (prohibiting non-commercial distribution)
• 1992: Jacobson v. United States – Postal Service entrapment
• 2000: Poehlman v. United States – FBI entrapped defendant after lengthy email correspondence
www.FrederickLane.com
www.ComputerForensicsDigest.com
17
Digital Production of CP
• Scanners• Digital Cameras (still and
video)• Cameraphones (dumb and
smart)• Web camswww.FrederickLane.co
mwww.ComputerForensicsDi
gest.com
18
Digital Distribution of CP
• One-to-One• Sneakernet• E-mail / Personal File-Sharing• Instant Messaging / Chat Rooms
• One-to-Many• Newsgroups and Forums• Peer-to-Peer Networks• Torrent Networks / File-Hosting• Underground Web Sites
www.FrederickLane.com
www.ComputerForensicsDigest.com
19
Digital Consumption of CP
• Producer of CP may be in possession without having “received” it
• Defendant may be in “receipt” of CP without “knowingly” possessing it
• The challenges of determining “intentionally” and “knowingly” in the context of Internet activity
www.FrederickLane.com
www.ComputerForensicsDigest.com
20
Societal Changes• Computers and the
Internet• The Democratization of
Porn Production• “Porn Chic”• The “Selfie”www.FrederickLane.co
mwww.ComputerForensicsDi
gest.com
21
Digital Investigations
• Discovery of Possible Child Pornography
• The Role of IP Addresses• Intro to Computer
Forensics
www.FrederickLane.com
www.ComputerForensicsDigest.com
22
Discovery of Possible CP
• Angry Spouse or Girlfriend• Geek Squads• Chat Rooms• Hash Flags• P2P and Torrent Investigations• Server or Payment Logswww.FrederickLane.co
mwww.ComputerForensicsDi
gest.com
23
Overview of IP Addresses
• Assigned to Every Internet-Connected Device
• Two Flavors:• IPv4: 196.172.0.1• IPv6:
2001:0db8:85a3:0042:1000:8a2e:0370:7334
• Leading to “Internet of Things”www.FrederickLane.co
mwww.ComputerForensicsDi
gest.com
24
IP → Physical Address
• Ranges of IP Addresses Assigned to ISPs by Internet Assigned Numbers Authority
• Online Tools to Look Up ISP• Dynamic vs. Static• Subscriber Records Show Date,
Time, IP Address, Limited Activitywww.FrederickLane.co
mwww.ComputerForensicsDi
gest.com
25
Limitations of IP Addresses
• Links Online Activity to Device, Not Necessarily a Specific User
• Data May Not Be Available from ISP
• Possibility of War-Dialingwww.FrederickLane.co
mwww.ComputerForensicsDi
gest.com
26
Intro to Computer Forensics
• Increasingly Specialized• Forensics Procedures• Forensics Software• A Typical Forensics
Reportwww.FrederickLane.co
mwww.ComputerForensicsDi
gest.com
27
Increasingly Specialized
• Computer Forensics• Windows• Mac OS• Linux
• Network Forensics• Mobile Forensics• Dozens of Mobile OSs• Hundreds of Models
• Cloud Forensics• Many Questions, No Clear Answers
www.FrederickLane.com
www.ComputerForensicsDigest.com
28
Forensics Procedures
• Field Previews• Mirror Images • Hash Values• Staggering Amounts of Data• Chains of Custody• 2006: The Adam Walsh Actwww.FrederickLane.co
mwww.ComputerForensicsDi
gest.com
29
A Typical Forensics Report
• There should be at least two reports:• Acquisition• Evaluation of Evidence
• Bowdlerized• Detailed procedures• Hash value checks• Bookmarks of possible contraband• Evidence of user IDwww.FrederickLane.co
mwww.ComputerForensicsDi
gest.com
30
Defending CP Cases
• Pre-Trial Issues• Trial Issues• Typical Defenses in CP
Cases [Some More Viable than Others]
www.FrederickLane.com
www.ComputerForensicsDigest.com
31
Pre-Trial Issues• Retaining a Defense Expert• Deposition of Government
Experts• Motion(s) to Produce• Motion(s) to Suppress or
in liminewww.FrederickLane.co
mwww.ComputerForensicsDi
gest.com
32
Trial Issues
• Should There Be a Trial?• Motion(s) in limine• Cross-Examination of
Government Expert
www.FrederickLane.com
www.ComputerForensicsDigest.com
33
Typical Defenses (1)
• Lack of Possession or Receipt• Mere Browsing• The Phantom Hash
• Accident or Lack of Intent• Ignorance or Mistake as to Age• Not a Real Child / Morphed /
Computer-Generatedwww.FrederickLane.co
mwww.ComputerForensicsDi
gest.com
34
Typical Defenses (2)
• Multiple Persons with Access to Device
• Used Equipment with Pre-Existing CP
• Viral Infection• Planting of Evidence by Spouse or
Police• Entrapmentwww.FrederickLane.co
mwww.ComputerForensicsDi
gest.com
35
Slides and Contact Info
• Download a PDF of slides from:
SlideShare.net/FSL3• E-mail or Call Me:
[email protected] 802-318-4604
www.FrederickLane.com
www.ComputerForensicsDigest.com
36
Digital Forensics andChild Pornography
DE Assoc. of Criminal Defense Lawyers
Wilmington, DE6 December 2013
Frederick S. Lane
www.FrederickLane.com
www.ComputerForensicsDigest.com