As of June 1, 2024, Vestige Digital Investigations is part of ArcherHall, a leading digital forensics, e-discovery, and cybersecurity service provider.
The Vestige team that you know and trust will continue to serve you at ArcherHall. Our expanded team, capabilities, and infrastructure will allow us to serve you and your clients even better.

WHITE PAPER: Avoiding Civil Liability when Conducting Analysis in CP Matters

White Papers

WHITE PAPER: Avoiding Civil Liability when Conducting Analysis in CP Matters

Author photo
President
MBA, CISA, CSXF, CMMC-RP

NOTICE

This whitepaper on Avoiding Civil Liability in Legal Matters is intended only as an observation and internal position paper for use by Vestige Ltd, for the express purpose of reporting on factual information within a narrow line of cases.  It is for discussion purposes only and does NOT represent legal advice in any form.

The included information in this whitepaper is not, nor should be considered, a legal opinion.  The reader must be aware that these results may not include all case law that might be relevant in a specific set of circumstances.

No portion, in whole or in part, may be duplicated and/or used for any other purposes without the express written permission of Vestige Ltd.

Copyright© 2012, Vestige Ltd.  All Rights Reserved.

AVOIDING CIVIL LIABILITY WHEN CONDUCTING ANALYSIS IN CHILD EXPLOITATION MATTERS

This explanation is offered to digital forensic examiners working state cases who believe that, because they are authorized by state law to receive, possess, and/or view images identified by law enforcement as child exploitation, they do not need consider federal law issues.  As explained below in detail, should a computer forensic analyst violate federal law during the examination of contraband in a state case, the computer forensic analyst will be exposed to civil and criminal prosecution.  While criminal prosecution is, perhaps, unlikely; civil suit brought by third parties can cost analysts enormous amount of money to defend.  I have also analyzed and provided the citation to an Ohio federal case in which a defense expert, Dean Boland, was sued in a civil cause of action for his conduct as an expert in a state child exploitation / CP case.  One month ago, an award of $300,000 was granted to plaintiffs against Mr. Boland.

The lesson learned:  Federal law preempts state law.  Violation of federal law expose you to civil suit from persons (such as the parents of the victim) with whom you, usually, cannot obtain a waiver of their statutory rights.  Do not, therefore, violate federal law.

I.  INTRODUCTION:  CHILD PORNOGRAPHY (CP) CASES AND RISK OF VIOLATING FEDERAL LAW

A.  Federal Law preempts state law exemptions that provide a safe harbor for possession of CP as part of a judicial proceeding.

Many criminal defense attorneys believe that state statutes authorize defense attorneys and their experts to receive, possess, view, examine, and transport images that the prosecution claims to be CP.  A typical state exemption, for example, contains an authorization to possess CP contraband for a legitimate judicial purpose (such  as defending a person in a state criminal action).  Ohio Revised Code Section 2907, for example, contains the following exception to the application of several provisions of Ohio’s CP laws:

This section does not apply to any material or performance that is sold, disseminated, displayed, possessed, controlled, brought or caused to be brought into this state, or presented for a bona fide medical, scientific, educational, religious, governmental, judicial, or other proper purpose, by or to a physician, psychologist, sociologist, scientist, teacher, person pursuing bona fide studies or research, librarian, clergyman, prosecutor, judge, or other person having a proper interest in the material or performance.

It is significant to note, however that federal child exploitation laws, such as 18 USC 2252A and 18 USC 2255, contain no such exemption for any purpose—judicial or otherwise.  Moreover, recent federal case law has held that federal CP laws pre-empt provisions of state law, such as Ohio Revised Code Section 2907 that, arguably, permit criminal defense attorneys and their experts to receive, possess, and/or view contraband images as part of a legitimate judicial purpose.  As Judge Oliver succinctly stated:

Therefore, if Plaintiff [Dean Boland] were to violate 18 USC 2252 and/or 18 USC 2252A, while participating in a judicial proceeding, he would not be immune from federal prosecution by virtue of Ohio’s exception for activities conducted by lawyers.

Boland v. Eric Holder, Case No.: 1:09-CV1614, ND OH, Judge Solomon Oliver, Order dated September 30, 2010 at page 192.

As a result of federal preemption of state law, forensic analysis in CP cases must be conducted in ways that stringently avoid violating federal law, especially 18 USC 2252A and 18 USC 2255.

B.  The consequences of violating federal CP statutes (18 USC 2252A and 18 USC 2255) include risk of criminal prosecution and private cause of action.

Consequences for violating federal CP laws are significant.  In addition to criminal penalties, violating 18 USC 2252A and/or 189 USC 2255 may render a criminal defense expert liable to third parties in a civil action unrelated to the criminal matter in which the expert was originally retained.

18 USC 2252A creates a private cause of action for any person “aggrieved” by a violation of federal CP law.  18 USC 2252A, at subparagraph (f) provides:

(f) Civil Remedies:

(1) In general—Any person aggrieved by reason of the conduct prohibited under [18 USC 2252A] may commence a civil action for the relief set forth in paragraph (2).

(2) Relief—In any action commenced in accordance with paragraph (1), the court may award appropriate relief, including—

(A) temporary, preliminary, or permanent injunctive relief;

(B) compensatory and punitive damages, and

(C) the costs of the civil action and reasonable fees for attorneys and expert witnesses.

In addition to the private cause of action for any person “aggrieved” set forth above, 18 USC 2255 creates a separate private cause of action for any victim of a violation of federal CP statutes.  18 USC 2255 provides, in part:

Any person who, while a minor, was a victim of a violation of [18 USC 2252, 2252A] and who suffers personal injury as a result of such violation, regardless of whether the injury occurred while such person was a minor, may sue in any appropriate United States District Court and shall recover the actual damages such person sustains and the cost of suit; including a reasonable attorney’s fee.  Any person as described in the preceding sentence shall be deemed to have sustained damages of no less than $150,000 in value.

It is imperative that defense experts note that damages awarded to a “victim” under 18 USC 2252 are valued at $150,000 minimum.

These two statutes and the private causes of action that they create have been recently interpreted by the District Court, Northern District of Ohio in Peter Lora et al. vs Dean Boland, Case No.: 1:07CV 2787, ND Ohio, Judge Dan Aaron Polster, Memorandum of Opinion and Order, dated October 20, 2011. In this case, Dean Boland, a criminal defense expert, was held liable to third party minor children [not involved in the underlying criminal case] whose images he used to create a demonstrative exhibit in the underlying criminal case by morphing the images to make it appear that the children were engaged in sexual conduct.  Notwithstanding the stipulation that the children were unaware of this exhibit, and had suffered no damages, the District Court, Northern District of Ohio, awarded the minor children judgment of $300,000 against this defense expert.

Federal preemption, threat of criminal prosecution, and risk of private civil action combine to create unique, substantial risks inherent in providing criminal defense forensic services in CP cases. As computer forensic analysts, you assume  the risk of prosecution by law enforcement and the risk of third party civil suits whenever you undertakes a matter involving electronic data alleged to be CP contraband.  The only way in which to mitigate the risk is to avoid violating federal law.