What if child porn is encountered during research?

[allen.deryke at hushmail.com (Allen Deryke)]

Adrian,

  I would advise a middle of the road approach.  Hand over any 
information you have to the appropriate law enforcement, but do it 
anonymously.

  In the case of something you find on some random perverts computer, 
local law enforcement will probably be the best contact and you could 
probably just speak to someone from a pay phone.

  In the case of the darknet research I would start at 
https://tips.fbi.gov/ and either submit via Tor or send a reasonably 
anonymous email to a contact off of that site.

My reasons behind the anonymous strategy are:
1.) Lawyers are expensive and unless your paying them for a reasonable 
amount of time the best answer they can give you is "It Depends..."
2.) Research in this area is somewhat questionable...  the darknet and 
porn you accessed may be outside your law enforcements jurisdiction, 
however the computer crimes (easily committed during botnet/darknet 
research) likely do fall under their jurisdiction.
3.) Just because your doing the "right thing" doesn't mean your required 
to announce it to anyone
5.) This has worked very for me disclosing vulnerabilities in the past
4.) Anonymous tips make any news story sound cool and interesting... 
kind of like Zorro is stalking the intertubes always ready to save the 
day...

-- Allen


Adrian Crenshaw wrote:
> If the CP in question is encountered while servicing a computer with a 
> known user/owner then reporting it is the ethical right thing to do. 
> However, in the case of darknet research it's next to impossible to 
> know where it came from, and if it was reported everytime a new 
> image/video was found you would be in calling an FBI field office 
> every 20min. This has a huge chilling effect on such research, or at 
> least the publishing of such research. I'm asking a lawyer I know on 
> the issue, and in the mean time being careful where I click.
>
> Adrian
> ------------------------------------------------------------------------
>
> _______________________________________________
> Pauldotcom mailing list
> Pauldotcom at mail.pauldotcom.com
> http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom
> Main Web Site: http://pauldotcom.com