There's a further nuance there as well. Say you work for a site that accepts UGC images (like a major social network for example). It's required that you have a team who works with law enforcement to handle investigations / takedown / preservation. Anyone who works for said team unfortunately thus has to see those images and have them, at least temporarily, on their machine, but there is zero legal precedent to protect them. It's a legal grey area and thus I have and continue to recommend anyone in such position to refuse to risk it.
You have the defense of "we are specifically required by law enforcement to do this" which is pretty strong. It's no different from a locksmith being asked by a cop to break into someplace the cop needs to be.
This was my thinking as well. On a huge social networking site I would imagine this comes up an awful lot and to have to see those types of images along with other abuses has got to be difficult. I'm also curious if you see enough of them how it changes your mind and if there have been any studies on it.
Fortunately I know you can integrate with that hashing project (I forget what it's called) where they generate a hash for known images of child porn so those can at least be removed automatically but I don't know how much of a percentage that catches.
Hang on, just to clarify: if someone else puts a file on my PC without my knowledge, without me ever having seen or opened it, he could call the police on me, and it would get me convicted?
The UK is all sorts of fucked up. You're not lawfully allowed to withhold passwords to encrypted data you're in possession of, meaning someone can slip an encrypted USB drive in your bag, you get arrested, and sent to jail for god knows how long because you're unable to give a password to a drive that isn't yours (and maybe doesn't have any password).
I'd never considered that set of circumstances before. The politicians who voted it into law probably didn't consider it either.
And that's exactly the problem: we have layer upon layer of vague and badly-written legislation, which ends up creating terrifying loopholes like the one described above.
My tinfoil hat paranoia is not quite at the level of thinking they're doing it on purpose (although I wonder sometimes).
But it's easy to see that indiscriminate surveillance combined with these vague laws create a situation where anyone could be victimised by the authorities. It's a totalitarian dictator's dream.
It looks that way. Does anyone know what the UK legal position is about forcing someone to unlock their device?
I know you can be jailed here for refusing to hand over an encryption key. I don't know whether your passcode / fingerprint counts as an encryption key in they eyes of the law.
If you refuse to hand over encryption keys in court, after you'd been officially charged that's one thing (though not saying that it's justified either), but if you've been stopped for i.e. mundane traffic check and asked to hand over your phone for inspection, that's totally wrong and oppressive.
I can't believe they both pled guilty! Is it possible in the UK to appeal a conviction if you plead guilty? IANAL, but I think their are some narrow cases where it can be done in the US, for example if you can show that your legal counsel did not provide competent representation.
It is puzzling that they both pleaded guilty. They also both represented themselves in court, so it seems they weren't getting any legal advice at all.
Perhaps they weren't entitled to legal aid? I was under the impression that anyone charged with a criminal offence was entitled but perhaps I'm wrong.
Maybe they just wanted to get the whole thing over with quickly and not face further embarrassment? It's a good example of how these types of charges could easily be used by the authorities to intimidate people. The damage is done whether they are convicted or not.
To answer your question, it seems you can appeal regardless of how you pleaded [0]. But you have to do it within 28 days.
There was a person in Finland mass scraping the alt. newsgroups for porn, and they got some cp on their machine inadvertently. Conviction, publicity and a ruined life promptly followed.
If someone else put 10 kilograms of cocaine in your house without your knowledge, without you ever having seeing or opened it, he could call the police on you and you would get convicted.
The thing that happened to "all that stuff" is called the War on Drugs. It blended in to pretty seamlessly into the War on Terror.
The word "routinely" might be contentious, because we have almost no numbers on it and the law has a way of making things "true" despite reality, but the kind of court you're referring to is just called a court.
You might google the Innocence Project, if you're interested in this sort of thing.
The comments here are overselling the situation. Yes possession of certain child porn images is a crime regardless of intent. However prosecutions are no different from any other crime: they must prove the crime before a jury of your peers beyond a reasonable doubt. There's nothing automatic about it.
This topic always drives hyperbole here on HN and I'm not sure why. Investigators and prosecutors don't waste time trying to entrap innocent web developers. They are kept plenty busy by people who are actually making or distributing child porn. Source for that: I know someone who prosecutes child porn cases. He is kept incredibly busy with obvious scumbag criminals.
Law enforcement's ultimate goal is always to walk the chain of possession back to find the folks who are actually making the imagery--who are actually abusing kids. That is why there is strict liability for possession. It gives investigators a lever to flip distributors to help find the sources.
Possession seems to be a very nebulous concept in English and US law (probably because of their common law systems).
In contrast, German law defines possession as "having effective control" (with some more nuance obviously). Possession is also entirely different from ownership in German law. I can not control an object I have no knowledge of. If you place an object in my house, I only gain possession of it once I discover it.
I think this is one of the cases where the civil law approach of rigorous definitions is clearly superior to the common law approach of establishing precedent.
I won't say that it doesn't happen (bad outliers always exist); however it would be very unlikely you'd be convicted for it.
A few years ago when I worked in computer forensics there was this big myth that if you went on porn websites and one of the images was underage you'd get done for it. However intent is a big part of law and so there would always have to be something along with "just an image" showing some intent to have obtained and viewed it.
> Hang on, just to clarify: if someone else puts a file on my PC without my knowledge, without me ever having seen or opened it, he could call the police on me, and it would get me convicted?
Yes. In such a case, a presumption of innocence would be true in theory but of no value at all in practice. Such an attack could even be carried out remotely -- an attacker could compromise a machine remotely, then plant incriminating evidence on the compromised machine (i.e. child porn, terrorist literature, drug-dealing evidence, etc.), then alert the authorities.
This plausible scenario is another reason to vigorously protect one's computer against external attacks.
Yes. In US law this is called Absolute Liability. Formally, absolute liability means that a conviction does not hinge on the presence of mens rea.
You're likely familiar with this concept in the context of speeding tickets. All that needs to be proven is that you were, in fact, speeding. It doesn't matter if you could not have been aware of your violation due to, say, a speed-limit sign that was blown away by a storm. If you were provably doing 55 in a 45 zone, you have no recourse.
The argument for absolute liability with speeding violations is purely practical, I believe. The reasoning is that it's not a crime, per se, so the trade-off of individual protection vs expediency of trials is deemed worthwhile. Clearly, the same is not true of child pornography convictions.
> Yes. In US law this is called Absolute Liability. Formally, absolute liability means that a conviction does not hinge on the presence of mens rea.
Actually, that's "strict liability".
> All that needs to be proven is that you were, in fact, speeding. It doesn't matter if you could not have been aware of your violation due to, say, a speed-limit sign that was blown away by a storm.
That probably does matter, since exceeding the speed limit properly posted is usually the actus reus of speeding, so even to the extent it is a strict liability offense, the absence of proper signage for any reason (except when the speed limit is either the states maximum highway speed limit or a default limit for some other condition which does not require signage, in which case notice is provided by the law setting the default for the conditions, and the sign is a reminder) makes it so that no offense occurred. [0]
[0] Also, given that states do generally have default speed limits that apply in the absence of signage, one could easily argue that the absence of signage is itself a positive indication that the default speed limit applies, making available a U.S. v. Kantor-style "good faith" defense even under strict-liability principles. [1]
> What's the difference between strict liability and absolute liability
Not a lot, AFAICT; the main differences seem to be:
(1) "strict liability" is the term used in US (and, AFAIK, UK) law (though the latter seems to refer to a criminal offense to which strict liability applies as an "absolute offense"), both criminal and tort, and
(2) "strict liability" can be either an attribute of an offense as a whole or an attribute of an element of (the actus reus of) an offense (that is, there can be a required mens rea for some element of an offense, but if there is an element which does not require any mens rea, the element can be said to have strict liability.) From what I've seen, "absolute liability" is universally a trait of offenses-as-a-whole (though that may be because I've seen less about it, and am less familiar with the systems in which the term applies.)
I don't know about Dropbox, but I do know for a fact Facebook and Tumblr definitely do. It might have evolved since a few years ago, but they used a technology from Microsoft called PhotoDNA [0] to hash all uploaded images and match against known signatures of CP and most definitely involved law enforcement when found.
Is there actually any nation on Earth where powerful and/or connected people can't screw you over if they really want to and if you have no other powerful or connected people on your side? (and no money, etc.)
The thing about this stuff that's really alarming is that any random script kiddie could also do this by coaxing your machine into downloading something. That greatly increases the surface area of people who can screw you. Given the abysmally awful security profile of a lot of consumer software and devices this is very plausible.
> (1)[F1Subject to sections 1A and 1B,] it is an offence for a person—
> (a)to take, or permit to be taken [F2or to make], any indecent photograph [F2or pseudo-photograph] of a child F3. . .; or
> (b)to distribute or show such indecent photographs [F4or pseudo-photographs]; or
> (c)to have in his possession such indecent photographs [F4or pseudo-photographs], with a view to their being distributed or shown by himself or others; or
> (d)to publish or cause to be published any advertisement likely to be understood as conveying that the advertiser distributes or shows such indecent photographs [F4or pseudo-photographs], or intends to do so.
[...]
> 4)Where a person is charged with an offence under subsection (1)(b) or (c), it shall be a defence for him to prove—
> (a)that he had a legitimate reason for distributing or showing the photographs [F6or pseudo-photographs] or (as the case may be) having them in his possession; or
> (b)that he had not himself seen the photographs [F6or pseudo-photographs] and did not know, nor had any cause to suspect, them to be indecent.
There are some amendments in the Sexual Offences Act 2003, but I don't think they turn it into a strict liability offence.
