Icac peer to peer presentation

Legal IssuesLegal Issues
inin
Peer to PeerPeer to Peer
CasesCases
Joseph LesniakJoseph Lesniak
Law Offices of Joseph Lesniak, LLCLaw Offices of Joseph Lesniak, LLC
Delaware County, PennsylvaniaDelaware County, Pennsylvania

2
Butner Study (2009)Butner Study (2009)
 155 child pornography offenders in an 18155 child pornography offenders in an 18
month voluntary treatment program.month voluntary treatment program.
 At time of sentencing 115 (74%) had noAt time of sentencing 115 (74%) had no
documented contact offenses.documented contact offenses.
 40 (26%) had known histories of contact40 (26%) had known histories of contact
offenses.offenses.

3
 The total number of victims, at sentencingThe total number of victims, at sentencing
was 75, or 1.88 victims per offender.was 75, or 1.88 victims per offender.

4
 By the end of treatment 24 (15%) deniedBy the end of treatment 24 (15%) denied
contact offences and 131 subjects (85%)contact offences and 131 subjects (85%)
admitted to at least 1 hands-on offense.admitted to at least 1 hands-on offense.
An increase of 59%.An increase of 59%.
 The number of reported victims, at the endThe number of reported victims, at the end
of treatment, wasof treatment, was 1,7771,777 for an average offor an average of
13.56 victims per offender.13.56 victims per offender.

5
High % of crossover:High % of crossover:
 70% had both child and adolescent victims70% had both child and adolescent victims
 Approximately 40% had both male andApproximately 40% had both male and
female victimsfemale victims
 68.7% had no prior conviction for a sex68.7% had no prior conviction for a sex
offense.offense.
 30.1% had participated in acts of30.1% had participated in acts of
bestiality.bestiality.

TOPICS WE WILL COVERTOPICS WE WILL COVER
 44thth
Amendment IssuesAmendment Issues
 Probable Cause (drafting the search warrant)Probable Cause (drafting the search warrant)
 Plain ViewPlain View
 Charging considerationsCharging considerations
 Trying a Peer to Peer CaseTrying a Peer to Peer Case

Fourth Amendment Issues inFourth Amendment Issues in
Peer to Peer CasesPeer to Peer Cases

ECPAECPA
(Electronic Communication Provider Act)(Electronic Communication Provider Act)
Title 18, Section §2701,Title 18, Section §2701, et.seq.et.seq.
 Applies to Public ISPs.Applies to Public ISPs.
 A Four-Tiered Approach to Privacy Issues.A Four-Tiered Approach to Privacy Issues.
 The More Private the Info Sought - TheThe More Private the Info Sought - The
More Process Required.More Process Required.

The Four TiersThe Four Tiers
 Customer Information - SubpoenaCustomer Information - Subpoena
 Transactional Information - § 2703(d)Transactional Information - § 2703(d)
OrderOrder
 Content - Search WarrantContent - Search Warrant
 Real-Time Interception - Title III WiretapReal-Time Interception - Title III Wiretap

Use of Subpoena/ Court OrderUse of Subpoena/ Court Order
in a P2P Investigationin a P2P Investigation
 Once you obtain IP Address of targetOnce you obtain IP Address of target
computer what then?computer what then?
 Determine which ISP was assigned the IPDetermine which ISP was assigned the IP
address .address .
 Subpoena/ Court Order to the ISP forSubpoena/ Court Order to the ISP for
information relating to the account assignedinformation relating to the account assigned
IP address on specific date at specific time.IP address on specific date at specific time.
 Make sure that customer will not be notified ofMake sure that customer will not be notified of
your subpoena by requestingyour subpoena by requesting 90 day non-90 day non-
disclosure - - Supervisor statementdisclosure - - Supervisor statement

ECPAECPA
“Customer Information”“Customer Information”
(Subpoena/ Court Order)(Subpoena/ Court Order)
1) name;1) name;
2) address;2) address;
3) records of session times and3) records of session times and
durations;durations;
4) Other IP addresses assigned; and4) Other IP addresses assigned; and
5) length of service (including start5) length of service (including start
date) and types of service utilized.date) and types of service utilized.

Expectation of Privacy inExpectation of Privacy in
P2P CasesP2P Cases
U.S. v. BorowyU.S. v. Borowy, 595 F.3d 1045 (9, 595 F.3d 1045 (9thth
Cir. 2010)Cir. 2010)
Defendant claimed he attempted to turn off theDefendant claimed he attempted to turn off the
share function of Limewire, thus he argued he hadshare function of Limewire, thus he argued he had
expectation of privacy in contents of share folder.expectation of privacy in contents of share folder.

P2P CasesP2P Cases
Cir. 2010)Cir. 2010)
““Borowy’s subjective intention not to share his filesBorowy’s subjective intention not to share his files
did not create an objectively reasonabledid not create an objectively reasonable
expectation of privacy [in the contents of sharedexpectation of privacy [in the contents of shared
folder].”folder].”
 Downloading from share folder on target computerDownloading from share folder on target computer
files with names suggestive of child pornographyfiles with names suggestive of child pornography
does not violate 4does not violate 4thth
Amendment.Amendment.

P2P CasesP2P Cases
Cir. 2010)Cir. 2010)
Downloading from share folder on target computerDownloading from share folder on target computer
files with names suggestive of child pornographyfiles with names suggestive of child pornography
does not violate 4does not violate 4thth
Amendment.Amendment.

Search Warrants in P2P CasesSearch Warrants in P2P Cases
 Computer search warrants present uniqueComputer search warrants present unique
problems.problems.
 Amount of material that may be stored onAmount of material that may be stored on
computer is enormous.computer is enormous.
 Highly technical information needs to beHighly technical information needs to be
drafted into the warrant in andrafted into the warrant in an
understandable fashion.understandable fashion.
 Problems such as scope of warrant,Problems such as scope of warrant,
staleness, and how the data will bestaleness, and how the data will be
analyzed need to be considered.analyzed need to be considered.

Drafting the Search WarrantDrafting the Search Warrant
 Things to consider:Things to consider:
 Is sufficientIs sufficient backgroundbackground information in theinformation in the
affidavit in support of search warrant?affidavit in support of search warrant?
 Does affidavit contain facts constitutingDoes affidavit contain facts constituting
probable causeprobable cause??
 Does the affidavit discussDoes the affidavit discuss searchsearch
methodology?methodology?
 Is the warrantIs the warrant particular enoughparticular enough in describingin describing
items to be seized yet broad enough to coveritems to be seized yet broad enough to cover
important evidentiary items you will want toimportant evidentiary items you will want to
seize?seize?

BackgroundBackground
 Affiant’s training and experience.Affiant’s training and experience.
 Statutory violations that may have beenStatutory violations that may have been
violated.violated.
 Remember the target at this point isRemember the target at this point is
computer and storage media – not acomputer and storage media – not a
person.person.
 Background information to educate theBackground information to educate the
judge:judge:
 Definitions if necessary.Definitions if necessary.
 Description of how peer to peer file sharing works.Description of how peer to peer file sharing works.
 Overview of investigative techniques used in P2POverview of investigative techniques used in P2P
cases.cases.

Probable CauseProbable Cause
 P/C to believe that evidence, fruits, orP/C to believe that evidence, fruits, or
contraband can be found on each computercontraband can be found on each computer
and/or storage media at location.and/or storage media at location.
 In P2P case describe file list obtained in browse.In P2P case describe file list obtained in browse.
 Describe with specificity images of childDescribe with specificity images of child
pornography that may be on computer –pornography that may be on computer –
 Describe diminutive stature, lack of breast/pubic hairDescribe diminutive stature, lack of breast/pubic hair
development, say if prepubescent.development, say if prepubescent.
 Affiant may approximate age; okay to say childAffiant may approximate age; okay to say child
“appeared” to affiant to be under 18 or 10 or 5 yoa.“appeared” to affiant to be under 18 or 10 or 5 yoa.
 How are actors clothed? Or lack thereof.How are actors clothed? Or lack thereof.
 Describe sexual activityDescribe sexual activity

 Search warrant drafting 101:Search warrant drafting 101:
 Who, what, when, where, why, and how.Who, what, when, where, why, and how.
 Make sure that you understand theMake sure that you understand the
background portion of the warrant and thatbackground portion of the warrant and that
you reference it as necessary in P/C portionyou reference it as necessary in P/C portion
of S/W.of S/W.
 Don’t overlook details like signatures,Don’t overlook details like signatures,
accurate description of place to be searchedaccurate description of place to be searched
etc.etc.

State v. NussState v. Nuss, 2010 WL 1405245 (Neb., 2010 WL 1405245 (Neb.
2010)2010)
P2P case.P2P case.
Affidavit related that 20 files downloaded fromAffidavit related that 20 files downloaded from
target computer “appeared to be childtarget computer “appeared to be child
pornography.”pornography.”

State v. NussState v. Nuss, 2010 WL 1405245 (Neb., 2010 WL 1405245 (Neb.
2010).2010).
Nebraska Supreme Court ruled that warrantNebraska Supreme Court ruled that warrant
did not use or even refer to the statutorydid not use or even refer to the statutory
definitions of sexually explicit conduct indefinitions of sexually explicit conduct in
describing the images.describing the images.
Used terms: “appear to be child pornography”Used terms: “appear to be child pornography”
“…“…consistent with child pornography”consistent with child pornography”

U.S. v. Henderson,U.S. v. Henderson, 595 F.3d 1198 (10595 F.3d 1198 (10thth
Cir. 2010).Cir. 2010).
P2P search warrant.P2P search warrant.
Be sure to include every critical investigativeBe sure to include every critical investigative
step.step.
who, what, where, when, why and how.who, what, where, when, why and how.

U.S. v. Henderson,U.S. v. Henderson, 595 F.3d 1198 (10595 F.3d 1198 (10thth
Cir. 2010).Cir. 2010).
Affidavit “failed to identify how [agent whoAffidavit “failed to identify how [agent who
applied for search warrant]’s source [agentapplied for search warrant]’s source [agent
who sent P2P lead] determined that computerwho sent P2P lead] determined that computer
with relevant IP address – rather than somewith relevant IP address – rather than some
other computer – shared child pornographyother computer – shared child pornography
videos.”videos.”

Probable Cause – Do We NeedProbable Cause – Do We Need
a Download?a Download?
 U.S. v. Miknevich, 638 F.3d 178, (3U.S. v. Miknevich, 638 F.3d 178, (3rdrd
Cir.Cir.
2011)2011)
 State warrant. No download and vagueState warrant. No download and vague
description of files that were viewed as adescription of files that were viewed as a
result of browse. However, based uponresult of browse. However, based upon
statement of affiant that he knew the filestatement of affiant that he knew the file
contained child porn based the SHA1 value ofcontained child porn based the SHA1 value of
the file and the file name itself the court foundthe file and the file name itself the court found
sufficient P/C to uphold the warrant.sufficient P/C to uphold the warrant.

Probable Cause – OvercomingProbable Cause – Overcoming
StalenessStaleness
 Characteristics of Persons SexuallyCharacteristics of Persons Sexually
Interested in ChildrenInterested in Children
 U.S. v. GourdeU.S. v. Gourde, 430 F.3d 1065 (9, 430 F.3d 1065 (9thth
Cir. 2006)Cir. 2006)
(affidavit said collectors store pics on computer).(affidavit said collectors store pics on computer).
 U.S. v. AbrahamU.S. v. Abraham, 2006 WL 1344303 (W.D. Pa.), 2006 WL 1344303 (W.D. Pa.)
(affidavit said collectors keep pics for long time).(affidavit said collectors keep pics for long time).
E.g., “I am aware that persons who collect childE.g., “I am aware that persons who collect child
pornography cherish their collections and tend topornography cherish their collections and tend to
retain their collections for very long periods of time,retain their collections for very long periods of time,
often for years.”often for years.” BUTBUT, especially in the 9, especially in the 9thth
Circuit,Circuit,
make sure you say why your target is a collector.make sure you say why your target is a collector. SeeSee
U.S. v. WeberU.S. v. Weber, 923 F.2d 1338, 923 F.2d 1338 (9(9thth
Cir. 1990).Cir. 1990).

Probable Cause – Role ofProbable Cause – Role of
Officer ExpertiseOfficer Expertise
 Listing of an officer’s training andListing of an officer’s training and
experience helps to enhance probableexperience helps to enhance probable
cause.cause.
 PitfallsPitfalls
 Failing to place the suspect within the class ofFailing to place the suspect within the class of
persons being describedpersons being described
 Broad conclusions without expertiseBroad conclusions without expertise

U.S. v. Weber,U.S. v. Weber, 923 F.2d 1338 (9923 F.2d 1338 (9thth
Cir. 1990)Cir. 1990)
Expert information consisted of ramblingExpert information consisted of rambling
boilerplate recitations that did not connect at allboilerplate recitations that did not connect at all
to the facts of the specific case or defendant.to the facts of the specific case or defendant.
Expert reported he knew the habits of “childExpert reported he knew the habits of “child
molesters”, “pedophiles” and “child pornographymolesters”, “pedophiles” and “child pornography
collectors”collectors”

U.S. v. Weber,U.S. v. Weber, 923 F.2d 1338 (9923 F.2d 1338 (9thth
Cir. 1990)Cir. 1990)
““If the government presents expert opinionIf the government presents expert opinion
about the behavior of a particular class ofabout the behavior of a particular class of
persons, for the opinion to have any relevance, itpersons, for the opinion to have any relevance, it
must lay a foundation which shows that themust lay a foundation which shows that the
person subject to the search is a member of theperson subject to the search is a member of the
class.”class.”

Burnett v. State,Burnett v. State, Fla.2d DCA 2003Fla.2d DCA 2003
Defendant videotaped two boys engaged inDefendant videotaped two boys engaged in
lewd conduct found during a consent search oflewd conduct found during a consent search of
his home.his home.
As a result detective sought a search warrantAs a result detective sought a search warrant
for the computer. In the affidavit it is alleged thatfor the computer. In the affidavit it is alleged that
based on her expertise, child pornography wouldbased on her expertise, child pornography would
be found on the computer.be found on the computer.

The court ruled that the affidavit failed toThe court ruled that the affidavit failed to
describe a factual link between the video cameradescribe a factual link between the video camera
and the computer. The expertise was notand the computer. The expertise was not
enough.enough.

In the opinion the court discussed two flawsIn the opinion the court discussed two flaws
in the detective’s affidavit:in the detective’s affidavit:
1) She never expounded on her expertise in1) She never expounded on her expertise in
the habits of child pornographers.the habits of child pornographers.
2) She never stated if the computer had2) She never stated if the computer had
internet capabilities or was able to be connectedinternet capabilities or was able to be connected
to the video camera where the childto the video camera where the child
pornography was located.pornography was located.

StalenessStaleness
 The term “collector” can be problematic.The term “collector” can be problematic.
 Persons “with a sexual interest in children”Persons “with a sexual interest in children”
has worked in some districts.has worked in some districts.
 Be sure to give the court some basis toBe sure to give the court some basis to
conclude that the subject is a “collector.”conclude that the subject is a “collector.”

StalenessStaleness
 Defeating staleness through language re:Defeating staleness through language re:
deleted images still indeleted images still in unallocated space.unallocated space.
 E.g., “Based on my training andE.g., “Based on my training and
experience, I know that just because anexperience, I know that just because an
image is deleted does not mean it isimage is deleted does not mean it is
erased from the computer. It can beerased from the computer. It can be
retained indefinitely in an area of theretained indefinitely in an area of the
computer known as unallocated spacecomputer known as unallocated space
until overwritten.”until overwritten.”
 See, e.g.,See, e.g., U.S. v. GourdeU.S. v. Gourde, 440 F.3d 1065 (9, 440 F.3d 1065 (9thth
Cir. 2006)Cir. 2006)

Probable Cause - StalenessProbable Cause - Staleness
 What is too stale? Depends upon theWhat is too stale? Depends upon the
judge and the district...judge and the district...
 U.S. v. IsgutU.S. v. Isgut, 1996 WL 775064 (SDFL 1996):, 1996 WL 775064 (SDFL 1996):
11 mo. old information too stale where profile11 mo. old information too stale where profile
language failed to spell out affiant’slanguage failed to spell out affiant’s
experience and lacked opinion that target wasexperience and lacked opinion that target was
a collector.a collector.
 U.S. v. ZimmermanU.S. v. Zimmerman, 277 F.3d 426 (3, 277 F.3d 426 (3rdrd
Cir.Cir.
2002): Affidavit stale where it only mentioned2002): Affidavit stale where it only mentioned
one clip of obscenity seen 6 to 10 monthsone clip of obscenity seen 6 to 10 months
earlier.earlier.

Probable Cause - StalenessProbable Cause - Staleness
 What is fresh enough?What is fresh enough?
 U.S. v. LacyU.S. v. Lacy, 119 F.3d 742 (9, 119 F.3d 742 (9thth
Cir. 1997):Cir. 1997):
Ten months ok since D was a “collector ofTen months ok since D was a “collector of
child porn.”child porn.”
 U.S. v. DiazU.S. v. Diaz, 2004 WL 212787 (D.Conn, 2004 WL 212787 (D.Conn
2/13/04): Given crime was production, 162/13/04): Given crime was production, 16
months not stale after cessation of two yearmonths not stale after cessation of two year
on-going abuse.on-going abuse.
 U.S. v. HornU.S. v. Horn, 187 F.3d 781 (8, 187 F.3d 781 (8thth
Cir. 1999):Cir. 1999):
Three months not stale.Three months not stale.

Staleness – Pony JacksonStaleness – Pony Jackson
 Age 33Age 33
 Food service workerFood service worker
 AutomobileAutomobile
repossessedrepossessed
 Personal belongingsPersonal belongings
within car seized bywithin car seized by
tow truck operatortow truck operator
 Briefcase in vehicleBriefcase in vehicle

ParticularityParticularity
 Affidavit must establish with particularityAffidavit must establish with particularity
what evidence will be seized.what evidence will be seized.
 Offenses being investigated will helpOffenses being investigated will help
define what can be seized.define what can be seized.
 C/P images and all storage media thatC/P images and all storage media that
might contain such images.might contain such images.
 Cameras, cell phones, CDs, thumb drives, etc.Cameras, cell phones, CDs, thumb drives, etc.
 Child erotica/incest literature.Child erotica/incest literature.
 Pictures of children that don’t meet the definition ofPictures of children that don’t meet the definition of
child pornography.child pornography.
 Items pertaining to a sexual interest in children likeItems pertaining to a sexual interest in children like
little girls’ panties or kids’ clothing catalogues – at thelittle girls’ panties or kids’ clothing catalogues – at the
very least photograph these types of materials.very least photograph these types of materials.

ParticularityParticularity
 Your need to determine who isYour need to determine who is
responsible for placing the C/P onresponsible for placing the C/P on
computer can also broaden the scope ofcomputer can also broaden the scope of
search.search.
 Correspondence re: child exploitation.Correspondence re: child exploitation.
 Billing records/proof of payment.Billing records/proof of payment.
 Records regarding computer ownership.Records regarding computer ownership.
 Software applications.Software applications.
 Need to rule out possible intruder activityNeed to rule out possible intruder activity
at the computer that might be attributed toat the computer that might be attributed to
the owner of the computer.the owner of the computer.

Possession & Distribution
Issues
Com Vs. Diodoro (932 A2d 172, Pa.Super. 2007)
Defendant was convicted of “possessing”
images of child pornography. These
images were not downloaded, saved or
printed by the Defendant.
Defense claims that merely opening the
files is not possession.

“Defendant intentionally sought out and viewed
pornography, actions of operating computer mouse,
locating websites, opening sites, displaying images on
computer screen, and closing sites, were affirmative
steps corroborating intent to control child pornography.”
“Officer stated that fact that multiple images were stored
in cache files indicated that someone, after accessing
websites, had to click “next” button to view successive
images.”
“While defendant was viewing images, he could
download, print, copy, or email them to others.”
Issues

U.S. v. Shaffer ( 2007 WL 10770 (C.A. 10(Kan.)
Defendant shared files of child
pornography using Kazaa a peer-to-peer
file sharing program
Defense claims there was insufficient
evidence to prove “distribution”
Issues

Court concluded that the term “distribute”
means: “…to deliver, transfer, dispense…”
In this case the Defendant allowed access
to his stash. Just like a self-service gas
station the Defendant was in the business
of distributing child pornography.
Further, the Defendant could have
activated a feature on Kazaa to preclude
the taking of files.
Issues

U.S. v. Abraham (2006 WL 3052702 (W.D.Pa.)
Again a Defendant was sharing files on a peer-
to-peer network
Several of these files were downloaded by a PA
State Trooper and verified they were known
depictions of child pornography
Issues

The court held that distribution occurred
when as a result of the Defendant’s
installation of a peer-to-peer file sharing
program a trooper was able to download
the child pornography to his computer.
Issues

U.S. v. SlaninaU.S. v. Slanina
 U.S. v. Slanina, 359 F.3d 356 (5U.S. v. Slanina, 359 F.3d 356 (5thth
Cir.Cir.
2004)2004)
 Expert testimony not necessary to proveExpert testimony not necessary to prove
child pornography images depict a realchild pornography images depict a real
childchild

Proving Image is Child –Proving Image is Child –
Jury QuestionJury Question
 ““Free Speech CoalitionFree Speech Coalition did not establish a broaddid not establish a broad
requirement that the Government must present expertrequirement that the Government must present expert
testimony to establish that the unlawful image depicts atestimony to establish that the unlawful image depicts a
real child. Three circuits that have considered this issuereal child. Three circuits that have considered this issue
take the same position.take the same position. See United States v. KimlerSee United States v. Kimler, 335, 335
F.3d 1132, 1142 (10F.3d 1132, 1142 (10thth
Cir. 2003)Cir. 2003);; United States v.United States v.
DeatonDeaton, 328 F.3d 454, 455 (8, 328 F.3d 454, 455 (8thth
Cir. 2003) (citingCir. 2003) (citing UnitedUnited
States v. VigStates v. Vig 167 F.3d 443. 449-50 (8167 F.3d 443. 449-50 (8thth
Cir. 1999);Cir. 1999); UnitedUnited
States v. HallStates v. Hall, 312 F.3d 1250, 1260 (11, 312 F.3d 1250, 1260 (11thth
Cir. 2002).”Cir. 2002).”
 ““Juries are still capable of distinguishing between realJuries are still capable of distinguishing between real
and virtual images; and admissibility remains within theand virtual images; and admissibility remains within the
province of the sound discretion of the trial judgeprovince of the sound discretion of the trial judge.”.”
KimlerKimler, 335 F.3d at 1142, 335 F.3d at 1142

GOING TO TRIAL IN THEGOING TO TRIAL IN THE
PEER TO PEER CASEPEER TO PEER CASE

DEFENSES TO UC OPSDEFENSES TO UC OPS
 Particular to Peer to Peer Prosecutions:Particular to Peer to Peer Prosecutions:
 Lack of Knowledge.Lack of Knowledge.
 Accident or Mistake.Accident or Mistake.
 SODDI.SODDI.
 Good Samaritan.Good Samaritan.

KnowledgeKnowledge
 Did defendantDid defendant KNOWINGLYKNOWINGLY produce,produce,
distribute, receive and/or possess childdistribute, receive and/or possess child
pornography?pornography?
 U.S. v. X-Citement VideoU.S. v. X-Citement Video, 513 U.S. 64, 513 U.S. 64
(1994)(1994)
 ““knowingly” extends both to the sexuallyknowingly” extends both to the sexually
explicit nature of the material and to theexplicit nature of the material and to the
minority of the performers.minority of the performers.

Knowledge - ProofKnowledge - Proof
 Volume of evidence on computer.Volume of evidence on computer.
 Look for patterns of use through forensic exam.Look for patterns of use through forensic exam.
 When was C/P downloaded.When was C/P downloaded.
 What other use going on during that timeWhat other use going on during that time
frame.frame.
 ““Index.dat” file.Index.dat” file.
 How is C/P organized on computer.How is C/P organized on computer.
 Has C/P been transferred to other storageHas C/P been transferred to other storage
media.media.
 Past relevant conduct.Past relevant conduct.
 ““OTHER EVIDENCE” – writings, non-OTHER EVIDENCE” – writings, non-
pornographic images of kids etc.pornographic images of kids etc.

Accident or MistakeAccident or Mistake
 ““I was looking for adult pornography andI was looking for adult pornography and
this stuff got on my computer by mistake.”this stuff got on my computer by mistake.”
 Ratio of C/P to adult pornRatio of C/P to adult porn
 Look at file creation, last modified and lastLook at file creation, last modified and last
accessed dates and times.accessed dates and times.
 Has the material been moved out of sharedHas the material been moved out of shared
folder? Organized?folder? Organized?
 Has material been transferred to otherHas material been transferred to other
storage media?storage media?

Technologically IneptTechnologically Inept
 This is the “I have been run over by theThis is the “I have been run over by the
technology” defense.technology” defense.
 Refute with: interview of defendant; wayRefute with: interview of defendant; way
computer files organized; programs andcomputer files organized; programs and
peripherals.peripherals.

Identity (SODDI)Identity (SODDI)
 Someone else in the household had access.Someone else in the household had access.
 Friend(s) knew the password to the account andFriend(s) knew the password to the account and
must have done it.must have done it.
 An unknown perpetrator must have done it.An unknown perpetrator must have done it.
 Remote access.Remote access.
 Refute defense with:Refute defense with:
 What time images downloaded.What time images downloaded.
 Who had access to computer during that specificWho had access to computer during that specific
time.time.
 Other activity surrounding time when c/p downloaded.Other activity surrounding time when c/p downloaded.
 Lack of evidence relating to remote access.Lack of evidence relating to remote access.

Good SamaritanGood Samaritan
 Meet defense by: volume of evidence seized;Meet defense by: volume of evidence seized;
how collected (i.e., no notes/records of activity).how collected (i.e., no notes/records of activity).
 Best evidence: if made no effort to contact lawBest evidence: if made no effort to contact law
enforcement; if target distributed any of the childenforcement; if target distributed any of the child
pornography [undermines the credibility of thepornography [undermines the credibility of the
claim].claim].

 Variations of this defense:Variations of this defense:
 Collecting evidence for the police, just haven’tCollecting evidence for the police, just haven’t
had time to turn it over.had time to turn it over.
 Helping out -- e.g., know how busy the policeHelping out -- e.g., know how busy the police
are, or police dept. said don’t have a specializedare, or police dept. said don’t have a specialized
unit, etc.unit, etc.
 OR - - Target is a police officer doing UC work.OR - - Target is a police officer doing UC work.
 Affirmative defense, 18 USC § 2252(c),
18 USC § 2252A(d).

 Meet defense: target never advised co-Meet defense: target never advised co-
workers or police or superior of activity;workers or police or superior of activity;
maintaining the pictures but little or nomaintaining the pictures but little or no
information as to subjects engaged in theinformation as to subjects engaged in the
conduct; extent of activity (i.e., very time-conduct; extent of activity (i.e., very time-
consuming and to the exclusion of otherconsuming and to the exclusion of other
activity).activity).

Icac peer to peer presentation

Recomendados

Recomendados

Mais conteúdo relacionado

Semelhante a Icac peer to peer presentation

Semelhante a Icac peer to peer presentation (17)

Último

Último (20)

Icac peer to peer presentation