Clarifying the Securing Adolescents From Exploitation-Online Act, or SAFE Act

Bob Johnston's observations:

It appears that early reporting was very misleading and undoubtedly will create urban legend. When I read the first reporting it indicated that anyone with public Wi-Fi, including you or me should we be so foolish, could be prosecuted if someone used it to transport child porn. My immediate reaction was how would someone even know without monitoring all activity? A virtual impossibility.

Later coverage makes it clear that is not the issue and I wonder why the current bill is even necessary other than raising the penalties from $150,000 to $300,000. The current law makes it clear that if anyone sees child porn wherever....that is, not only digitally but also in print, that we must report it to law enforcement or risk prosecution for failure to do so. Knowledge of this law is important for anyone within the digital computer trade whether a forensic investigator, repairman or simply being a friendly neighbor.

Yes. If you help a neighbor fix his/her computer and observe child porn you must report it. When I take a forensic case, I always advise the client of this obligation. When I help a neighbor, I do not as I do not want to offend a friend but am beginning to wonder whether I should advise them as well. Not because I suspect anyone, but just because it could happen.

Do not misunderstand...I abhor child pornography but I do question laws that hold me accountable for reporting to law enforcement what I observe while practicing my trade. I recently saw a prosecution in the State of Connecticut of an attorney who did not see but had believable knowledge of the presence of child pornography on a laptop. He took the laptop and disposed of it. He was prosecuted under the federal statute and convicted. To me that is a stretch of the statute as I understand it. He was an attorney. When will we see the common man similarly prosecuted?

By way of example...I advise a potential client of my obligation to report child porn if I see it and the client decides not to engage me. Is that "believable knowledge"?

Should I report that to law enforcement?

Can I be prosecuted if I do not?

Should I be prosecuted if I do not?

What say you?

Since Bob discussed this in the private Julie Group blog a second issue is being discussed by Declan McCullagh over at CNet:

The definition of which images qualify as illegal is expansive. It includes obvious child pornography, meaning photographs and videos of children being molested. It also includes photographs of fully clothed minors in unlawfully "lascivious" poses, and certain obscene visual depictions including a "drawing, cartoon, sculpture, or painting."

Most reasonable adults, including home Wi-Fi providers or the Web sites affected by this legislation, can figure out what actual child pornography is. But when it comes to photographs of fully clothed minors in "lascivious" poses, and overly risque cartoon anime that might be "obscene" in one area of the country and permissible in another, it becomes trickier--especially when, legally, only a jury can determine whether an image violates local community standards.

The part I find a bit unsettling is the inclusion of pieces of art in these definitions.

Don't Get Burned Twice

As Randy Abrams in his blog piece Don't Get Burned Twice points out, "The current fires in Southern California are causing misery to hundreds of thousands of people ... As is the case with all disasters there are good people rallying to help and bad people trying to exploit the situation for profit. It may be a good time to remind people about some best practices to make sure that the money you earmark for helping people goes to helping people."

He offers some sage advice about how to avoid getting scammed, "First of all, do not respond to email messages soliciting donations, even from legitimate charities. These messages often are not sent by the charity itself. If you get an email from The American Red Cross and you wish to donate to this respected organization, do not use any information in the email as it may have been sent by a scammer that will redirect you to their fake Red Cross web site. Instead, look up the phone number for the Red Cross, or open your browser yourself and type in http://american.redcross.org." He then goes on to say that if the American Red Cross is not your favorite charity, "A site that can assist you with determining the legitimacy and effectiveness of a charity is http://www.charitynavigator.org/." And above all, "do not give cash to people claiming to represent charities. At LAX or other public places a person may approach you claiming to be collecting for victims of this or other disasters. They may even have impressive documents that are easily printed on a home PC. Some of these people are undoubtedly legitimate, but unless you are a psychic you probably won’t know. Take the information about the charity they represent and look it up before you part with your money."

As he says, "A few simple precautions will help prevent you and the victims you seek to help from being victimized."

And congratulations to Randy and his fellow employees at ESET LLC for volunteering their time and money to assist victims.

The opinions expressed in this post are those of the author and should not be interpreted as an official position of The Julie Group.

--Chip Neville

PS. Fellow Julie Group blogger Karoli has a dead-on post, Attention Mainstream Media: Quit Comparing SoCa Fires to Katrina! at odd time signatures.

Should OnStar Shut Your Car Down?

There has been quite a commotion over at Slashdot about General Motors' plan to "install OnStar systems on almost 1.7 million 2009-model cars." It seems our friends at GM plan to incorporate a "feature" which will allow "law enforcement (or anyone who cracks the system) to remotely shut down vehicles." And Lauren Weinstein writes, "Ready to turn over the keys of your vehicle to the cops, or that clever hacker in the next lane? How about that creepy guy following you on a lonely country road?"

These are good points. But so is the point made by the Cal Highway Patrol Deputy Commissioner, Joe Farrow, that about 15 percent of the pursuits are at speeds of 90 miles per hour and greater, and that, "There are some high-speed chases that we have out here that we'd like to bring to a halt." You don't have to be a rocket scientist to figure out that this stuff is dangerous, and as the AP story where Farrow is quoted points out, 404 people were killed in the US last year in high speed police pursuits.

Clearly, there is a balancing act here. We, the public, need to balance the number of injuries and deaths to be prevented by installing OnStar against the certainty that those nasty folks at evil.wicked.hackers.org will try, and for a time succeed, in hacking the OnStar system.

One way to do this balancing would be to demand public hearings in states like California on this issue. And the computer security community needs to be prepared to provide timely and accurate input. Perhaps we should ask the people over at The Shmoo Group, the people who gave us AirSnort and exposed just how vulnerable the WEP encryption scheme is, to try to hack into OnStar just to find out how easy or hard it is to do.

We need some data here folks! This is too important an issue to leave to GM (or slashdot). And GM, if legitimate security researchers need your exalted permission to hack OnStar, you need to be prepared to give it.

The opinions expressed in this post are those of the author and should not be interpreted as an official position of The Julie Group.

--Chip Neville

A Welcome Court Decision

Arstechnica today reports that an Ohio judge understands the issues involved with child pornography laws, teens, and computing. In an entry called Judge bars Ohio's attempt to keep "harmful" Internet content away from minors by Nate Anderson, he reports,

The state of Ohio this week found itself on the losing end of a judicial decision that struck down a state law banning all Internet transmission of content that is "harmful to minors" if the sender should know that someone on the receiving end is a minor.
Federal judge Walter Rice issued a permanent injunction against the law after pointing out the many ways that it could restrict legitimate speech between adults. The Supreme Court has already found that Internet users have reason to believe that there are minors present in every chat room, for instance; under the Ohio law, anything deemed obscene for minors that was uttered in a chat room could therefore possibly lead to prosecution.

The law was first passed in 2002 and immediately challenged by Media Coalition, a group of booksellers, newspapers, and providers of sexual health information. The judge soon granted a preliminary injunction, and the state amended the law in order to avoid several of the original problems. Despite the changes, Judge Rice still found the bill too broad when applied to the Internet, where it can be difficult or impossible to know the ages of every person that one interacts with.

Media Coalition's executive director, David Horowitz, praised the decision. "While we should have adequate legal safeguards to shield children from objectionable content," he said, "those safeguards cannot unreasonably interfere with the rights of adults to have access to materials that are legal for them."

Today, legislators, judges, and informed citizens must insist an end to witch-hunt prosecutions of citizens, in many cases minors, for possession of material that they may encounter due to legitimate online activity.

Consenting adults enjoy broad cultural interests that will occasionally intersect the lives of others. The underlying personalization automata of the internet is indifferent to social norms. Perfectly innocent people's computers are daily assaulted by malware, viruses, and ingenious scripts that can control and contrive artificial and unwelcome content on anyone's computer. If that content comes to the attention of the authorities, the unfortunate party can find themselves accused of crimes they did not commit.

Knowing what we know about artificial intelligences influencing personal computers, we need more judges insisting on free speech who can couple that conviction with an intolerance for nuisance prosecutions based on synthetic digital realities.

- krasicki

The Child Safe Viewing Act of 2007 Tackles the Wrong Problem

The Senate Commerce Committee today passed the Child Safe Viewing Act of 2007 (S. 602), which requires the Federal Communications Commission (FCC) to study the "existence and availability" of filtering technologies for audio and video content transmitted over "wired, wireless, and Internet" platforms, as well as other devices.

The stated purpose of the bill is to develop the "next generation of parental control technology."

While I have no objection to parental controls and filters overall, I am concerned that there is an over-reliance on these devices as a method to shield children from objectionable content while shifting the focus away from the source of the content -- those who create, distribute, and profit from pornography by employing deceptive marketing techniques, adware, and malware as their primary method of distribution.

There's also nothing wrong with studying different methods to protect children. However, this bill calls for the FCC to "consider measures to encourage or require the use of advanced blocking technologies that are compatible with various communications devices or platforms." It goes on to define those platforms as "wired, wireless, and Internet platforms."

The Center for Democracy and Technology released this statement earlier this week in response to the language contained in the measure:

The Senate Commerce Committee today passed the Child Safe Viewing Act of 2007 (S. 602), which requires the Federal Communications Commission (FCC) to study the "existence and availability" of filtering technologies for audio and video content transmitted over "wired, wireless, and Internet" platforms, as well as other devices. CDT does not oppose a purely fact-finding study, but maintains that a neutral, non-regulatory body such as the National Academy of Sciences would be better suited to such a project. More importantly, CDT is concerned that this legislation may represent a step toward expanding the FCC's censorship authority to include Internet content.

This measure aims at the wrong end of the beast. It would be far more productive for the lawmakers in this country to concentrate their resources at the creators and beneficiaries of illegal content on the Internet and leave decisions regarding what parents do and do not wish for their children to view to the parents. This is the view of the Progress & Freedom Foundation as well, as expressed in their paper released earlier this week discussing the implications of content regulation. From their press release:

In his paper, Thierer asserts that there is no need for Congress or the FCC to mandate tools that already exist. Moreover, if the FCC starts "approving" certain technologies, it is likely to slow the development of new blocking technologies.

Thierer's view is that the measure, while well intentioned, would create unnecessary regulation where there is no market failure at work.As he pointed out in his recent Progress and Freedom Foundation book, Parental Controls and Online Child Protection: A Survey of Tools and Methods, "There has never been a time in our nation's history when parents have had more tools and methods at their disposal to help them decide what is acceptable in their homes and in the lives of their children."

Everyone wants to protect children from rogues, no matter what space they inhabit. That's why I taught my kids not to talk to strangers, not to walk anywhere by themselves, and other basic safety measures to keep them safe on city streets, playgrounds, and even their front yard. Safe internet, television and wireless phone use is also a parental responsibility. What I rely on lawmakers and associated agencies to do is enforce the laws to hold the lawbreakers -- those who create, produce and distribute harmful content -- accountable for the harm they do with their selfish acts.

Filtering content on a mandatory basis pushes all of us down the slippery slope of accepting others' value judgments about what is, and what isn't "dangerous content" that should be subject to blocking. This measure calls for the FCC to craft rules that ignore existing rating systems in favor of defining the scope of the filters through some other subjective basis.

Will the art of the Old Masters be deemed to fall into the category of objectionable content? There are some who would say that it should be included if it includes depictions of genitalia, while others (including me) would not. What about sites which discuss legitimate issues surrounding sexuality and relationships? How would mandatory filtering be enforced? Through the telecommunications and cable companies or by the individual?

Filtering technologies have proven inherent flaws that will not disappear, simply because human communication is too complex and too nuanced to be fed into a database of prohibitions. For every rule there are 10 exceptions. The appropriate approach is to identify and prosecute creators and distributors of clearly illegal content, and exercise parental discretion and supervision over Internet, wireless and television viewing.

What do you think? Do filters work? Parents, how do you keep your children protected on the Internet?


The opinions expressed in this post are those of the author and should not be interpreted as an official position of The Julie Group

--Karoli

Bonus Link: Berkman Center for Internet and Technology: 2007 OpenNet Initiative

A Curious Conundrum

There I was, minding my own business - well, complaining about Adware - when the verdict from the Chris Langham trial popped onto the TV. Though I missed the bulk of the news report, I did pick up one of the legal type guys saying something that can be summed up like this:

"These sort of images (child pornography) don't just pop onto your screen. You have to go looking for it".

Now, it's clear that in this case, Langham did indeed "go looking for it", though only he can truly know if the motive was "research" or not.

However. The above statement seemed to come across as a more general, sweeping, non-Chris Langham specific statement.

This is sort of dangerous.

Already, we've had a web browser that fires up illegal porn without the permission of the person using it. There are currently plans in the UK to make certain kinds of extreme porn - rape, for example - illegal. But here's a hijack from a few days ago involving supposedly normal blogs immediately redirecting the end-user to rape porn.

Bam, just like that. Have some potentially illegal porn, on the house. Quick, free, easy and totally without warning.

I have little faith in UK law at the best of times, especially where cases of a technological nature are concerned. To put out the message that you "have to go looking for it" is spurious at best, and not a mindset the public at large should be fooled into believing.

I never liked TV anyway.

Substitute Teachers and School Attendance Software

In recent discussions of the Julie Group's volunteers an interesting observation surfaced that sheds considerable light onto the plight of Julie Amero's experience in the classroom when confronted by the pornado of inappropriate images on a school teacher's computer.

In many schools across the country, the software that monitors attendance makes no accommodations for substitute teachers. The regular classroom teacher's account exclusively controls classroom access and privacy to that classroom's student attendance records.

And attendance is critical to the central administration of the school. Administrators are made aware of unusual absences because regular and substitute teachers enter the data in realtime. Pulling the plug on the computer by a substitute teacher creates a crippling situation for that classroom and potentially the school.

Critics of Julie Amero or other substitute teachers who follow the rules of not shutting off classroom computers do not understand the gravity of doing so. Shutting off that classroom computer compromises critical school administrative functionality that safeguards the students and staff in the event of a true emergency.

Unfortunately, even school administrators are oblivious to the software's catch-22 defect. The software works fine only when regular classroom teachers are all present and accounted for or if all their logins are functioning properly. Otherwise, substitutes are hostage to making sure the computer is not shutdown (because they can't get back in). This is a requirements blindspot in designing the software.

In Julie Amero's case, no one mention the fact that Julie had done the right thing by leaving the computer running and logged in. The inference was that she should have done more to "protect the students". And the prosecution did nothing to disspell this idea either. The public was mistakenly lead to believe that pulling the plug on the computer was a no-brainer and legitimate option. It wasn't and isn't for most substitute teachers.

In fact, Julie did the only thing she could - leave the software running and deal as best she could with an awful classroom crisis. When substitute teachers are put into compromising positions about turning off computers these facts must be presented fairly in their defense. They are justifiably following procedures that keep the system whole and healthy. They have no other real administrative choice.

- krasicki

Recent Decisions of Interest

Recently two court decisions came to the attention of the Julie Group. Both demonstrate an enlightened approach toward ruling on digital porn cases.

The first, from Pennsylvania, is linked from a site called out-law.com run by an international law firm that we are not in any way affiliated with. The link entitled, Pennsylvania court says viewing child porn 'not illegal' goes on to clarify... "A US court has ruled that viewing child pornography on a website without deliberately saving it to a computer is not a crime. The judge said that the state penal code was ambiguous, so he must rule in favour of the defendant."

Anthony Diodoro, a 26-year-old from Delaware County, Pennsylvania admitted knowingly viewing 370 child-porn images online. He also admitted that he had intentionally visited the websites for the purpose of viewing child porn.

State law says that a person must have "knowing possession" of child pornography in order for it to be a crime. A panel of three judges in the Pennsylvania Superior Court concluded that Diodoro could not be convicted of knowingly possessing the images because there was no evidence that Diodoro knew that his computer was storing the images in its internet cache file.

"Because this is a penal statute with an ambiguous term when it comes to computer technology, it must be construed strictly and in favour of the defendant," wrote Judge Richard Klein.

"A defendant must have fair notice that his conduct is criminal," wrote Klein. "Because of the ambiguity, sufficient notice was not provided here. For this reason, we are constrained to reverse [a previous decision] and leave it to the Legislature to clarify the language if it intends to make the mere 'viewing' of child pornography a crime."

The article further discusses this decision.

The second case is detailed in Law.com. The entry called, Appeals Panel 'Reluctantly' Tosses Child Porn Case by Alyson M. Palmer, Fulton County Daily Report discusses a case in which "Judges of the Georgia Court of Appeals last week said they must "reluctantly" issue an opinion that may make it more difficult for the state to prosecute people who look at child pornography." It goes on to give us some details.

A three-judge panel on June 21 reversed the conviction of a North Georgia man on 106 counts of sexual exploitation of children because, the judges found, prosecutors didn't prove that the man knew he had pornographic images stored in his computer hard drive.

In what it said was an issue of first impression in Georgia, the panel of Judge M. Yvette Miller, Chief Judge Anne Elizabeth Barnes and Presiding Judge J.D. Smith narrowly construed what it means to "knowingly" possess child pornography under the state's sexual exploitation law. It's not enough, wrote Miller for the panel, to prove a defendant has pornographic images in the inaccessible cache files of his computer.

The district attorney whose office prosecuted the case, Herbert E. Franklin Jr. of Walker County, said the ruling will make his job harder.

"With the computer savvy folks out there ... it's going to limit our ability to prosecute, I would think," he said.

But the lawyer who won the appeal, Daniel J. Ripper, of Luther-Anderson in Chattanooga, Tenn., said the opinion just gives prosecutors a roadmap for handling child pornography cases. "This is a case that says, 'Here are the facts that you need,'" said Ripper, a member of the State Bar of Georgia who said about half of his work is in Georgia.

In fact, the Julie Group is finding a disturbing number of nationwide prosecutions that are based on pornographic images stored on a person's computer. The unlikely suspects are teachers, police, teens, and others who find themselves fighting for their lives and, in some cases, bankrupting their resources to prove that they were unaware of the computer activity.

Courts are wise to require clarity in the law where it may be ambiguous. Imprecise criminal statutes can lead to conviction by opinion rather than conviction under the law and can ensnare the innocent as well as the guilty. Innocent people are routinely subjected to automations whose sole purpose is to control content on that person's machine with benign (blind?) disregard for the consequences. The authorities too often assume the automations are invited or actively engaged or are unaware of the phenomenon altogether. Instead of tracing the pornography to its source, it is raced to its destinations - often unsolicited destinations.

And laws that make no distinction between motive to possess such material and mere coincidental possession, entrap people who happen to use the internet. Everybody and anybody accused then becomes a target of the state to prove their immoral fitness to fit the crime.

Judges, courts, and juries who demand and honor the concept of innocent until proven guilty beyond a reasonable doubt are not promoting child pornography, violence, or immoral behaviors. They simply assert that innocent citizens are not criminals for co-incidental and the unsolicited, automated behaviors of computers in their charge. This is often referred to as justice.

- krasicki/js

Slow Progress

Despite the appearance that nothing is going on, our volunteers are busy behind the scenes working on some basic needs the group has to create a working relationship and a professional delivery system.

Aside from that we have once again identified some patterns of use and abuse that we will begin to invite all of you to participate in exploring to one degree or another. Some of the detective work will always need to be private.

But some of it is a democratic conversation that only citizens can remediate.

Something all of you can begin to think about is the question of what constitutes fair punishment for a given crime? Julie Amero captured the world's attention by being found guilty of involuntarily exposing students to inappropriate content and potentially being sentenced to forty years in jail (the prosecutor - playing devil's advocate and enjoying the kill - whispered to Julie eighteen years). A teacher put in this position could in some places plea bargain down to a charge of murder and get a lighter sentence. In fact local newspapers described murder cases with far lighter sentences concurrent to Julie's ordeal.

Some of us believe the justice system is broken and absurd when it has to deal with disruptive technologies. For example, pornographers are the first adopters of artificially generated computer behaviors that make machines misbehave in the eyes of the law. Yet the authorities are charging the person closest to the misbehaving machine with the crime.

A teacher exposed to the irresponsibilities of students commandeering computers are easy, unsuspecting targets. Are pornographic pictures suddenly found on infected computers indicative of rampant criminal intent by middle-aged, married, middle-school teachers or is there a more sensible conclusion we can come to?

We'd like you all to think about this and let the world know your thoughts and ideas on fixing these legal issues. We'll attempt to feature the best ideas in later entries.

Word of mouth is often the best educational process we can invest in.

What our Links of Interest Represent

The opinions expressed here will vary among writers as will our links. When we post a link of interest we are pointing out to our readers some of the kinds of issues that are important to all of us.

As a clarification, in the case of Matt Bandy, his case has been resolved and our interest is to use his experience as an example for others to learn from. You will hear more in the coming weeks. Unfortunately, we gave the impression initially that the Bandy case was something we would be pursuing pro-actively when in fact we will be doing some postmortems to glean insight into unresolved cases of the same archetype.

We cannot undo or reopen cases that have been tried. Our interest is in learning from some of those that deserve our scrutiny as a society. The Bandy case is a prime example.

Secondly, we invite developers who work for less than ethical spamming companies, pornographers, or otherwise sleazy operators to contact us when your conscience catches up to you. You can help us prevent or understand malicious machine behaviors better than anyone. Write to ask us for our most confidential contacts and start your conversation there.

Preventing malicious behaviors is a very important goal for everyone. Lift yourself out of the mud here.