2013-12-06 Digital Forensics and Child Pornography
•Transferir como PPTX, PDF•
3 gostaram•4,335 visualizações
This is a presentation I gave to the DE Association of Criminal Defense Lawyers on December 6, 2013. Main themes include: Digital Technology and Child Pornography, Digital Investigations, Introduction to Computer Forensics, and Defending Child Pornography Cases.
Recomendados
Mais conteúdo relacionado
Destaque
Destaque (13)
Semelhante a 2013-12-06 Digital Forensics and Child Pornography
Semelhante a 2013-12-06 Digital Forensics and Child Pornography (20)
Mais de Frederick Lane
Mais de Frederick Lane (20)
Último
Último (20)
2013-12-06 Digital Forensics and Child Pornography
- 1. Digital Forensics and Child Pornography Frederick S. Lane DE Assoc. of Criminal Defense Lawyers Wilmington, DE 6 December 2013 www.FrederickLane.com www.ComputerForensicsDigest.com 1
- 2. Seminar Overview • Introduction and Overview • Digital Technology and CP • Digital Investigations • Defending Child Pornography Cases www.FrederickLane.com www.ComputerForensicsDigest.com 2
- 3. Introduction and Overview • Background and Expertise • What Is Child Pornography? • Digital Technology and the Spread of Child Pornography www.FrederickLane.com www.ComputerForensicsDigest.com 3
- 4. Background and Expertise • Attorney and Author of 7 Books • Computer Forensics Expert -- 15 years • Over 100 criminal cases • Lecturer on ComputerRelated Topics – 20+ years • Computer user (midframes, desktops, laptops) – 35+ years www.FrederickLane.com www.ComputerForensicsDigest.com 4
- 5. What Is Child Pornography? • • • • Federal Laws State Laws International Law Determining Age of Person Depicted www.FrederickLane.com www.ComputerForensicsDigest.com 5
- 6. Federal CP Laws • 18 U.S.C. c. 110 – Sexual Exploitation and Other Abuse of Children • 18 U.S.C. § 2251 – Production • 18 U.S.C. § 2252 – Possession, Distribution, and Receipt • 18 U.S.C. § 2256 -- Definitions www.FrederickLane.com www.ComputerForensicsDigest.com 6
- 7. “Child Pornography” 18 U.S.C. § 2256(8): “any visual depiction, including any photograph, film, video, picture, or computer or computer-generated image or picture, whether made or produced by electronic, mechanical, or other means, of sexually explicit conduct, where— (A) the production of such visual depiction involves the use of a minor engaging in sexually explicit conduct; [or] (B) such visual depiction is a digital image, computer image, or computer-generated image that is, or is indistinguishable from, that of a minor engaging in sexually explicit conduct; or (C) such visual depiction has been created, adapted, or modified to appear that an identifiable minor is engaging in sexually explicit conduct.” www.FrederickLane.com www.ComputerForensicsDigest.com 7
- 8. Other Relevant Definitions • “Minor” [18 U.S.C. § 2256(1)]: <18 • 18 U.S.C. § 2257: Record-keeping requirements • “Sexually Explicit Conduct” [18 U.S.C. § 2256(2)(A)]: • (i) sexual intercourse, including genital-genital, oral-genital, anal-genital, or oral-anal, whether between persons of the same or opposite sex; • (ii) bestiality; • (iii) masturbation; • (iv) sadistic or masochistic abuse; or • (v) lascivious exhibition of the genitals or pubic area of any person. • Slightly Different Definitions for Computer Images [18 U.S.C. § 2256(2)(B)] www.FrederickLane.com www.ComputerForensicsDigest.com 8
- 9. NCMEC • “National Center for Missing and Exploited Children” • Created by Congress in 1984 • Child Recognition and Identification System – database of hash values of CP images • Child Victim Identification Program www.FrederickLane.com www.ComputerForensicsDigest.com 9
- 10. State CP Laws • All 50 states have their own CP laws • Age of minority varies: 16 (30 states); 17 (9 states); and 18 (12 states) • Prosecution can be federal or state, or both. • Can include “harmful to minors” standard (states only) www.FrederickLane.com www.ComputerForensicsDigest.com 10
- 11. Delaware CP Laws • DEL CODE § 1103 – Definitions Relating to Children • DEL CODE § 1108 – Sexual Exploitation of a Child • DEL CODE § 1109 – Dealing in Child Pornography • DEL CODE § 1110 – Subsequent Convictions … • DEL CODE § 1111 – Possession of Child Pornography www.FrederickLane.com www.ComputerForensicsDigest.com 11
- 12. DEL CODE 1103 • “Child”: Anyone under age of 18 or any individual intended to appear <14. • “Prohibited Sexual Acts”: • (1) Sexual intercourse; • (2) Anal intercourse; • (3) Masturbation; • (4) Bestiality; • (5) Sadism; • (6) Masochism; • (7) Fellatio; • (8) Cunnilingus; • (9) Nudity, if such nudity is to be depicted for the purpose of the sexual stimulation or the sexual gratification of any individual who may view such depiction; • (10) Sexual contact; • (11) Lascivious exhibition of the genitals or pubic area of any child; • (12) Any other act which is intended to be a depiction or simulation of any act described in this subsection. www.FrederickLane.com www.ComputerForensicsDigest.com 12
- 13. International CP Laws • Over last 7 years, 100 countries have adopted new CP laws • 53 countries still have no CP law at all • International Center for Missing and Exploited Children • 2012 Child Pornography Model Laws: http://bit.ly/19eWJPz www.FrederickLane.com www.ComputerForensicsDigest.com 13
- 14. Determining Age Is expert testimony need? Tanner Stage: Outmoded? Role of environmental factors Bait and switch Defendant’s subjective belief is irrelevant • Prosecutors prefer clear cases • • • • • www.FrederickLane.com www.ComputerForensicsDigest.com 14
- 15. Digital Technology and CP A Brief Background Digital Production of CP Digital Distribution of CP Digital Consumption (Receipt and Possession) • Societal Changes • • • • www.FrederickLane.com www.ComputerForensicsDigest.com 15
- 16. A Brief Background • 1978: Protection of Children Against Sexual Exploitation Act • 1982: New York v. Ferber – Upholding state law banning child pornography • 1984: Child Protection Act (prohibiting noncommercial distribution) • 1992: Jacobson v. United States – Postal Service entrapment • 2000: Poehlman v. United States – FBI entrapped defendant after lengthy email correspondence www.FrederickLane.com www.ComputerForensicsDigest.com 16
- 17. Digital Production of CP • Scanners • Digital Cameras (still and video) • Cameraphones (dumb and smart) • Web cams www.FrederickLane.com www.ComputerForensicsDigest.com 17
- 18. Digital Distribution of CP • One-to-One • Sneakernet • E-mail / Personal File-Sharing • Instant Messaging / Chat Rooms • One-to-Many • • • • Newsgroups and Forums Peer-to-Peer Networks Torrent Networks / File-Hosting Underground Web Sites www.FrederickLane.com www.ComputerForensicsDigest.com 18
- 19. Digital Consumption of CP • Producer of CP may be in possession without having “received” it • Defendant may be in “receipt” of CP without “knowingly” possessing it • The challenges of determining “intentionally” and “knowingly” in the context of Internet activity www.FrederickLane.com www.ComputerForensicsDigest.com 19
- 20. Societal Changes • Computers and the Internet • The Democratization of Porn Production • “Porn Chic” • The “Selfie” www.FrederickLane.com www.ComputerForensicsDigest.com 20
- 21. Digital Investigations • Discovery of Possible Child Pornography • The Role of IP Addresses • Intro to Computer Forensics www.FrederickLane.com www.ComputerForensicsDigest.com 21
- 22. Discovery of Possible CP • • • • • Angry Spouse or Girlfriend Geek Squads Chat Rooms Hash Flags P2P and Torrent Investigations • Server or Payment Logs www.FrederickLane.com www.ComputerForensicsDigest.com 22
- 23. Overview of IP Addresses • Assigned to Every InternetConnected Device • Two Flavors: • IPv4: 196.172.0.1 • IPv6: 2001:0db8:85a3:0042:1000:8a2 e:0370:7334 • Leading to “Internet of Things” www.FrederickLane.com www.ComputerForensicsDigest.com 23
- 24. IP → Physical Address • Ranges of IP Addresses Assigned to ISPs by Internet Assigned Numbers Authority • Online Tools to Look Up ISP • Dynamic vs. Static • Subscriber Records Show Date, Time, IP Address, Limited Activity www.FrederickLane.com www.ComputerForensicsDigest.com 24
- 25. Limitations of IP Addresses • Links Online Activity to Device, Not Necessarily a Specific User • Data May Not Be Available from ISP • Possibility of War-Dialing www.FrederickLane.com www.ComputerForensicsDigest.com 25
- 26. Intro to Computer Forensics • • • • Increasingly Specialized Forensics Procedures Forensics Software A Typical Forensics Report www.FrederickLane.com www.ComputerForensicsDigest.com 26
- 27. Increasingly Specialized • Computer Forensics • Windows • Mac OS • Linux • Network Forensics • Mobile Forensics • Dozens of Mobile OSs • Hundreds of Models • Cloud Forensics • Many Questions, No Clear Answers www.FrederickLane.com www.ComputerForensicsDigest.com 27
- 28. Forensics Procedures • • • • • • Field Previews Mirror Images Hash Values Staggering Amounts of Data Chains of Custody 2006: The Adam Walsh Act www.FrederickLane.com www.ComputerForensicsDigest.com 28
- 29. A Typical Forensics Report • There should be at least two reports: • • • • • • Acquisition • Evaluation of Evidence Bowdlerized Detailed procedures Hash value checks Bookmarks of possible contraband Evidence of user ID www.FrederickLane.com www.ComputerForensicsDigest.com 29
- 30. Defending CP Cases • Pre-Trial Issues • Trial Issues • Typical Defenses in CP Cases [Some More Viable than Others] www.FrederickLane.com www.ComputerForensicsDigest.com 30
- 31. Pre-Trial Issues • Retaining a Defense Expert • Deposition of Government Experts • Motion(s) to Produce • Motion(s) to Suppress or in limine www.FrederickLane.com www.ComputerForensicsDigest.com 31
- 32. Trial Issues • Should There Be a Trial? • Motion(s) in limine • Cross-Examination of Government Expert www.FrederickLane.com www.ComputerForensicsDigest.com 32
- 33. Typical Defenses (1) • Lack of Possession or Receipt • Mere Browsing • The Phantom Hash • Accident or Lack of Intent • Ignorance or Mistake as to Age • Not a Real Child / Morphed / Computer-Generated www.FrederickLane.com www.ComputerForensicsDigest.com 33
- 34. Typical Defenses (2) • Multiple Persons with Access to Device • Used Equipment with PreExisting CP • Viral Infection • Planting of Evidence by Spouse or Police • Entrapment www.FrederickLane.com www.ComputerForensicsDigest.com 34
- 35. Slides and Contact Info • Download a PDF of slides from: SlideShare.net/FSL3 • E-mail or Call Me: FSLane3@gmail.com 802-318-4604 www.FrederickLane.com www.ComputerForensicsDigest.com 35
- 36. Digital Forensics and Child Pornography Frederick S. Lane DE Assoc. of Criminal Defense Lawyers Wilmington, DE 6 December 2013 www.FrederickLane.com www.ComputerForensicsDigest.com 36