[ender7]

You should definitely consult legal counsel before and during talking to the authorities (which you should also do). The laws surrounding CP in particular are outdated and do not fit well into the digital world. For example, simply looking at CP can be a crime, which can make it difficult to report unless you know the right words to say. Always consult counsel in these cases.

[some_furry]

Definitely talk to legal counsel, but I can already tell you what the FBI told me when I asked them about this exact situation in a hypothetical:

"You didn't ask for it or seek it out did you? Someone else uploaded it to your server and you don't want it? Report it to us, then delete it once we've collected our evidence."

That's probably representative of the average agent's disposition, but make sure your ass is covered first.

[balls187]

> Report it to us, then delete it once we've collected our evidence.

This seems very ominous.

[Frondo]

Why does that seem ominous? Genuine question. What would be a non-ominous response from the FBI in this situation?

[unclebucknasty]

Part of what makes it ominous is that the agent is too casually requesting that the host open the gates, and suggesting that the host has zero-risk, simply because he/she states his/her innocence.

This, when it seems pretty obvious that they'd have to do some investigation of the host, if only to rule out his/her degree of involvement.

[Frondo]

Yes, you're right, like I said in my other reply, I'd assumed the parent poster's engagement with the agent had been trimmed down for the sake of the story, that there was more substance they left out because that was the overall thrust of the story.

And I think you're also right that they'd do some investigation, but I imagine the investigation would be over very quickly. This "people are uploading filth to my website" situation isn't so uncommon like it once was (back in my day, sonny!!).

The chance that that individual is trying to buddy up to the FBI in order to escape detection is more of a Hollywood fantasy than how real life would play out. These agents are human beings too, and they know that if someone's coming to them to ask for help, they're all on the same page.

[unclebucknasty]

>I imagine the investigation would be over very quickly

You're most likely correct. I'd add that even with the agents being human beings, there may still be some protocol that they are compelled to follow in vetting the host. I'd want to know that going in.

That's still not to say that this would end badly for the host. It's just that, given that the tone of the response is correct (even if shortened) , there is clearly more involved. And, when you have a representative of an agency with pretty broad powers, deep resources, and potential mandates soft-pedaling what's at stake, it can have a pretty ominous feel to it.

[fnordfnordfnord]

Something written from the FBI, like a receipt that the FBI has received the evidence and it is therefore of no consequence if the files are deleted. Something that will keep him out of jail if by chance another unrelated law enforcement agency happened to be investigating and became upset or suspicious because evidence was disappearing.

[Frondo]

Ok, fair enough. I assumed that that was a somewhat trimmed-down version of the actual discussion, for the sake of telling their story briefly.

I didn't imagine that the FBI would literally have a 30-second conversation with someone who claimed to have child porn in their possession, with no actual follow-up or action steps discussed.

But I can see how that would seem problematic if you did take it literally.

[balls187]

"Collecting evidence" seems extremely broad. What is the evidence collection process? Access granted to servers, wire sniffing, seizing of hardware? How long will that process take? What recourse is available should the FBI seize hardware?

I know the parent commenter said they would speak with a lawyer, I just wouldn't take comfort in a casual remark by an FBI agent.

[steanne]

not to me. ominous would be "we'll delete it once we've colected our evidence."

[caligastia]

Never never trust the FBI. That's how they nailed DotCom, instructing him to let them collect 'evidence' against someone else, then they used it against him. Seems like you're in a hornet's nest, and you're not even making any money for your trouble.

[unclebucknasty]

>This seems very ominous.

It does. Likewise with the casual questioning of guilt and suggestion that his/her answers will simply be taken at face value.

[lifeformed]

Why would they self report it then?

[stickfigure]

You sound like someone that expects human beings in positions of authority to operate rationally.

[unclebucknasty]

Guilty people also self-report crimes to which they are obviously close and for which they assume they'd fall under suspicion anyway. A fairly heavily trafficked, public website featuring CP images may well already be under investigation.

In any case, self-reporting does not absolve one of suspicion; else it'd be easy to get away with pretty much anything.

[fnordfnordfnord]

One might self-report if they were involved, suspected they were under investigation, and wanted to give the appearance that their involvement was unwitting.

[unclebucknasty]

Exactly. Beyond my own liability, the other question I would want answered is whether I could potentially be compelled to cooperate in some long-term investigation. If so, then what could that mean in terms of time and expense, and is it worth it?

[roel_v]

The alternatives are

- shut it down right now

- take a 'wait and see' approach. Then one day during the course of a bigger investigation they find that your server is hosting CP. Also, you apparently knew about it and didn't do anything (admittedly proving this will be quite difficult and unlikely, but still). In that case, they'll come down on you like a hammer.

Better be proactive. And if you're paranoid about the feds jailing an infrastructure provider who actively came to them asking for help (do you have any examples of where this happened? even just an investigation?), then all you have left is option 1.

[unclebucknasty]

The alternative I'm suggesting is to retain legal counsel to determine what my actual alternatives are and their associated potential costs/risks.

[DasIch]

You are not seriously asking whether it's worth it to help law enforcement stop child abuse?

[unclebucknasty]

Yes, I am.

Volunteering to help stop child abuse and being compelled to participate in an investigation of unknown depth, breadth, duration, and resource burden (time, money, etc.) to you are two completely different things.

If you've never been involved in litigation or other legal situation wherein you couldn't just stop the process whenever you chose to, it might be more difficult to imagine the stress and costs involved, as well as the loss of control over one's own life.

It's nice to think that it's worth it at any cost (and at the sacrifice of one's other life responsibilities). But, of course, given that one can volunteer to make such a sacrifice without waiting to be compelled by a police investigation, then anyone who has not already chosen to do so might be wise to consider whether it's really a manner in which they can afford to help.

(EDIT: conciseness)

[mschuster91]

> "potentially be compelled to cooperate"

In the US, you're likely to be left alone with all the associated costs. Help the cops all right, but if I do their work for them, I don't want to bear all the costs.

[praptak]

Talking to cops is a bad idea. I'd only do that if I had to and even then I'd minimize the exposure: https://medium.com/human-parts/good-samaritan-backfire-9f53e...

Also, the abuse already happened, you are only stopping the dumber CP collectors from sharing images of it.

[DasIch]

That abuse has already happened sure but it will probably continue. You want to follow any trace you can find to suppliers. Shutting down demand might also help in eliminating any economic incentives that might exist on the supply side.

[Goladus]

> You are not seriously asking whether it's worth it to help law enforcement stop child abuse?

How about you donate all your time, money and resources stopping child abuse.

[DasIch]

Nobody is talking about donating all time, money and resources of anyone towards that goal.

In any case if you create a platform (you possibly profit from) that is used to distribute child pornography you are faced with restrictions that the rest of the public understandbly isn't.

I see no reason OP shouldn't be legally compelled to cooperate in an investigation in at least the same way a witness can be.

[Goladus]

> Nobody is talking about donating all time, money and resources of anyone towards that goal.

That is exactly what you implied by mocking the fact that the OP even asked the question.

> I see no reason OP shouldn't be legally compelled to cooperate in an investigation in at least the same way a witness can be.

This is irrelevant to the question of whether the OP should look out for personal interests. You implied that one should not be so selfish as to even ask the questions about personal risks and costs. You mocked the very idea that he might ask such a question.

Before you make such a callous and judgmental comment, you should really think about what you would yourself sacrifice to cooperate with law enforcement. If you had, you would not have been so myopic. You would't question the seriousness of the question, even if you still thought that cooperation was necessary.

[fnordfnordfnord]

You say that as if the cost of helping is near zero. What if authorities decided that your hobby project's server was interesting to their investigation, and subsequently showed up at your home with a warrant to seize every electronic device in your home/business, including the server that hosts your business, as well as unrelated things like cell phones, video game consoles, etc?

[DasIch]

So instead of going to the authorities directly, describing the situation and offering to work together you propose sticking your head in the sand, trying to deal with the problem on your own and hoping the authorities won't ever come across child pornography on your site?

Especially at a scale where you need automated systems to deal with the problem, law enforcement will inevitably notice sooner or later. I can't help but fell that it's not going to go over well with them (and it shouldn't), if they notice you deleted that content and possibly destroyed evidence in the process.

Technology companies and law enforcement have cooperated on this issue for a long time very successfully. They have experienced people working on nothing but this kind of thing and you're not going to deal with some local low level idiot that barely manages to deal with noise complaints. There is no reason to be paranoid and to believe they are going to act stupid.

[kw71]

Is there an automatic script to thumbnail images? That simply multiplies the number of problem images in your data store.