Monday, October 31, 2011

1st Circuit handles issues of required knowledge and jurisdiction in CP case

In United States v. Salva-Morales, 660 F.3d 72 (2011), released today by the First Circuit, the court analyzed two important issues: (1) whether a defendant must have actual knowledge of child pornography and (2) how to prove interstate or foreign commerce. A total of 176 images of child pornography were found on the defendant's two computers.

Salva-Morales did not testify, but several witnesses claimed he was not the sole user of the computer. A fornesics examine testified that "one hard drive indicated that twenty-two different users had saved files to it and that it was impossible to tell conclusively from the forensic data on the drives who had saved the pornographic files." The government, however, presented evidence to show that he was often alone in his business when the files were accessed. The court acknowledged that the evidence in this case was not as strong as is typically, but the case was nonetheless sufficient.

The question that the court struggled with was jurisdiction. According to statute, "The matter containing the visual depiction described above has either to have been (1) “mailed, or ... shipped or transported in interstate or foreign commerce,” or (2) “produced using materials which have been mailed or so shipped or transported, by any means including by computer....” 18 U.S.C. § 2252(a)(4). There was no great evidence to prove the files were transmitted through the Internet, though Kazaa was installed in the computer. The court noted "that the defendant need not know of the nexus so long as it exists."

The interesting argument in the case came from the government's backup argument on jurisdiction. Because the hard drives containing the images were both manufactured in Singapore, they suggested that copying images to them or from one to the other satisfied the transportation in foreign commerce requirement. The court acknowledged this argument, but refused to rule on it because the jurisdictional issue had already been decided.

Friday, October 28, 2011

Verb tense distinctions in exploitation statute

In a recent Ninth Circuit case, United States v. Williams, 659 F.3d 1223 (2011) a defendant made a rather pointless, yet clever, argument. Williams was seeking to show that an individual must personally produce child pornography in order to be convicted of advertising for distribution.

Under the federal sexual exploitation of children statute, 18 U.S.C.A. § 2251, "[a]ny person who ... knowingly makes, prints, or publishes ... any notice or advertisement seeking or offering (A) to receive, exchange, buy [etc.] ... any visual depiction, if the production ... involves the use of a minor engaging in sexually explicit conduct ... shall be punished.... § 2251(d)(1).

Williams's argument was on the verb tense. Since the statute uses the word "involves" rather than "involved", Congress intended for the statute to require the defendant to have actually produced it, rather than to have received it and redistribute the images. Of course, the court produced sufficient explanation for striking down such an argument, but it was clever.

Tuesday, October 25, 2011

Two domains, one folder: Prosecution can bring two charges

The Sixth Circuit recently held that a hosting account having two domain names directed to it allowed the defendant to be charged with two counts of transportation of child pornography (and therefore was not multiplicitous or a violation of double jeopardy).

In United States v. Richards, 659 F.3d 527 (6th Cir. 2011), Richards argued that because all of the data was located in the same folder, it was irrelevant whether he had two distinct domain names. The court noted, "the sites could have operated at the same time and drawn different images from the same folder because they were on different domains."

While that is certainly the case, the domain name should not be the key here. Even if only one domain name existed, it could have been accessed on multiple computers and "drawn different images from the same folder." The domain names are irrelevant. If a person were to register a hundred domain names for one website, they should not automatically be subjected to a hundred counts. Rather, the approach would vary using the court's citations from other circuits.
  • United States v. Schales, 546 F.3d 965, 979 (9th Cir. 2008) - “[W]here a defendant has stored sexually explicit images in separate mediums, the government may constitutionally charge that defendant with separate counts for each type of material or media possessed.” To apply Schales to Richards, there should only be one count. It was saved in one single medium. Though it could have been accessed through different domain names does not change the medium.
  • United States v. Gallardo, 915 F.2d 149, 151 (5th Cir. 1990) (“With respect to the child pornography statute [18 U.S.C. § 2252(a)(1)], each separate use of the mail to transport or ship child pornography should constitute a separate crime." Under this standard, Richards should have been charged a different count for each visit to the site and access of the files.

Friday, October 21, 2011

Expert witness ordered to pay victims for creating morphed CP

As part of his expert witness testimony, an Ohio attorney used photos from a stock image website to morph photos that digitally created the illusion of a child engaging in a sexual act. The argument was that if it was skillfully done, it would be difficult to tell if a person was truly in possession of child pornography.

Soon thereafter (in 2004), an investigation began, and FBI agents searched the attorney's home and vehicle. Ultimately, he was required to make a public apology in the Cleveland Bar Journal.

In 2007, the families of the children filed suit against him seeking civil damages as allowed under 18 U.S.C. § 2255 which are a statutory minimum of $150,000 per victim. The district court dismissed, finding that granting the relief would be counter to the defendant's Sixth Amendment rights, and that an Ohio statute provides "immunity from state child pornography prosecutions for expert witnesses." The Sixth Circuit reversed and remanded, holding that there is no exception for expert witnesses.

On remand, in Lora v. Boland, 2011 U.S. Dist. LEXIS 121572 (N.D. Ohio 2011), the district court found that he did not have to create these morphed images to prove his point and that his actions were not protected by the Constitution or statute. Therefore, the court awarded damages of $150,000 to each victim.

RELATED CASE: Released yesterday was a case that addressed mandatory restitution under 18 U.S.C. § 2259. In United States v. Fast, 820 F. Supp. 2d 1008 (D. Neb. 2011), a child pornography victim was awarded attorney's fees, medical and psychiatric care, occupational therapy and lost income.

Tuesday, October 18, 2011

French researchers claim to have compromised Tor network

The Onion Router (Tor), which has been providing online anonymity for almost a decade, may soon find its usefulness to be greatly diminished.

A French engineering school claims to have found a way to compromise a Tor network. The group claims that one-third of the Tor nodes are not properly secured, and hackers can "easily infect and obtain system privileges." From there, they use DOS attacks and packet spinning to ultimately decrypt each communication.

The claims can be viewed by clicking here (though the videos are in French). Tor plans to release a new version in late October, though it is uncertain if the updates will address these claims.

The Tor network has long been used to allow web surfers to hide their tracks while online. A user's online communications are sent through a multiple nodes, each carrying the data with multiple layers of encryption. The technique allows one to commit illegal activities while online without leaving a trail of evidence behind.

RELATED NEWS: In case you hadn't heard, Tor even has an app for Android phones called Orbot.

Friday, October 14, 2011

Court finds CFAA loss claim without actual damage

An Illinois federal court ruled in Farmers Ins. Exchange v. Auto Club Group, 2011 WL 4888889 (N.D. Ill. 2011) that a claim for damages under the Computer Fraud and Abuse Act (CFAA) can be brought for loss incurred as a result of an investigation into the CFAA violation, regardless of whether any actual economic damage occurred (such as destroying a hard drive with a hammer). This is an ongoing split across the country - whether there can be a loss when there is no damage, and the court here thoroughly evaluates both sides.

The court also provides a list of examples of damage that can be recovered under 18 U.S.C. § 1030. Damage is "any impairment to the integrity or availability of data, a program, a system, or information." As courts have found, that may include:
  • Destruction, corruption, or deletion of electronic files
  • Physical destruction of a hard drive
  • Any diminution in the completeness or usability of the data on a computer system
And here is what doesn't count as damage:
  • Mere copying of electronic information from a computer system - even giving to a competitor
  • Disclosure of trade secrets
  • Impaired the integrity of databases
This same conclusion that loss is possible without damage was upheld in EF Cultural Travel BV v. Explorica, Inc., 274 F.3d 577 (1st Cir. 2001) (see also A.V. ex rel. Vanderhye v. iParadigms, LLC, 562 F.3d 630 (4th Cir. 2009)). After a brief search, I found no circuit court has found to the contrary, though district courts across the country have done so.

Reddit closes "jailbait" section after CP post

Reddit, a popular website where users post links and photos of various content on the Internet, recently shutdown its popular "jailbait" section. It had often been used to post pictures of girls found on Facebook or other social media that did not contain nudity, but were not posted for innocent purposes, either.

On Monday, a user posted a clothed picture of a 14-year-old girl he claimed to be his ex-girlfriend. He also mentioned that he had nude pictures, quickly drawing the attention of some 70 users requesting a copy. Shortly thereafter, he relented and posted a nude photo.

Within hours, the section was taken down, and the following message appeared:
"This subreddit has been shut down due to threatening the structural integrity of the greater reddit community."
Reddit was started in 2005 and is the 112th most popular website according to Alexa. The site is known for its culture of free speech, which allowed for subreddits like "jailbait".

Wednesday, October 12, 2011

Seventh Circuit sets rules for CP evidence

An Indiana man was found guilty of distribution of child pornography. The problem? There was no evidence to demonstrate that he distributed any child pornography.

He was a second-level administrator of a website that was used to share child pornography, and he admitted to viewing images on the site. He thanked users for posting, promoted and deleted users, and other administrative tasks. Nearly 100 of the 450 or so users posted images, but no evidence was admitted to show that he was one of them.

The prosecution sought to admit photos of hardcore child pornography found in the defendant's home in order to demonstrate "'intent and motive' to join the conspiracy to distribute child pornography." The problem, as the Seventh Circuit found, was that these images were not posted on the site and only demonstrated possession. Further, the government had less prejudicial images that could have been introduced instead of the hardcore images.

On appeal, the Seventh Circuit reversed, finding that the court (1) did not exercise its FRE 403 discretion because it did not review the images before presenting them to the jury, (2) "its probative value was not substantially outweighed by the risk of unfair prejudice," and (3) the admission was not harmless error. With regard to 403 discretion, the court noted, "One cannot evaluate in a Rule 403 context what one has not seen or read."

The case is United States v. Loughry, 660 F.3d 965 (7th Cir. 2011).

Monday, October 10, 2011

DHS develops technology to predict illegal acts

Do you remember the feeling you felt watching Minority Report, knowing that our government would one day have a "pre-crime" department? That day might be sooner than you think.

In documents obtained by the Electronic Privacy Information Center (EPIC) by open-government request, it was learned that the Department of Homeland Security has been developing a program known as Future Attribute Screening Technology, or FAST.

While the system could soon be used in airports, its development was for events like concerts or sporting events. Essentially, attendees enter a mobile screening center and stand in the middle of the room. Sensors measure the person's pulse, temperature, breathing, facial expressions, movements, pupil dilation, and other actions. Using that data, trials have shown an accuracy rate of nearly 80% at detecting possible future bad acts (such as taking a camera into a concert). 

DHS's Privacy Assessment is available here.
EPIC's documents can be viewed here.

Tuesday, October 4, 2011

SCA's protections apply to foreign citizens

Just a quick rule: According to a recent ruling by the Ninth Circuit, the SCA's application to "all persons ... means any person, including foreign citizens." A party was trying to obtain Hotmail e-mails from an Australian citizen, but Microsoft objected, arguing that the SCA prevents it. (Suzlon Energy Ltd. v. Microsoft Corp., 2011 U.S. App. LEXIS 20018 (9th Cir. 2011)).

Saturday, October 1, 2011

North Carolina modifies rules for ESI

Effective today, the North Carolina Bar Association has modified their civil procedure rules regarding electronically stored information (ESI). Unlike the federal rules and those adopted by most states, it includes a provision stating that ESI includes metadata that provides information related to "the date sent, date received, author, and recipients." Other metadata is not included without party agreement or court order.

Otherwise, the adoption includes the rules of most states (and the federal rules) regarding ESI:
  • Adds ESI to the definition of discoverable materials.
  • The court can set conditions for discovery and specify cost allocation.
  • ESI that is not reasonably accessible because of undue burden or cost may be ordered for good cause.
  • Discovery meeting should include a plan for ESI, preservation, and "the media form, format, or procedures by which such information will be produced."
  • Failure to provide ESI as a result of routine, good-faith operation of an ESI system is non-sanctionable without exceptional circumstances (referred to in the federal rules as the "safe harbor" provision).
  • If electronic information protected by privilege is disclosed, the receiving party must return or destroy the information.
By the most recent count, fourteen states have yet to adopt special ESI rules, including Colorado, Florida, Georgia, Hawaii, Illinois, Massachusetts, Missouri, Nevada, New York, Oregon, Pennsylvania, Rhode Island, Washington, and West Virginia. Some courts within these states have adopted e-discovery rules. For a list of applicable rules for each state, click here.