Maryland Legislators Pass Bill That Would Keep Most Teens From Being Prosecuted For Sexting

from the more-helping,-less-hurting dept

It's been a delayed reaction, but legislators are finally trying to do something about the horrific outcomes that result from advances in technology colliding with laws that have been on the books for decades. Smartphones are omnipresent and teens are using them just like adults use them. Sexting -- the sending of explicit images to willing recipients -- shouldn't be illegal. And yet it is because some of those participating in this consensual distribution of explicit images are minors.

Operating under the belief that no one engages in sexual acts until they reach the age of consent, law enforcement has managed to turn this form of communication into a lifetime of misery for participants. Perhaps the most disturbing aspect of using child porn laws to prosecute minors for sexting is the fact that actual sexual acts would be legal under the same set of laws.

Rather than allow parents to handle sexting by minors, prosecutors have stepped in to turn consenting teens into sexual predators, even if they've done nothing more than send images of themselves to another teen. There's a massive logical leap that needs to be made to turn a teen photographing their own body into their own child pornographer, but cops and prosecutors have been willing to bridge that gap over reality to prematurely end these teens' lives. Charges stemming from child porn charges -- even when the teen has done nothing but "exploit" themselves -- come with a lifetime of downsides, thanks to sex offender statutes.

Maryland's legislature is trying to mitigate the damage done by existing laws -- ones passed by legislators who could not have possibly foreseen teens willingly (and easily) distributing sexual images amongst themselves. The absence of any actual child pornographer isn't something addressed by child porn laws, so the Maryland legislature has decided to make it a bit more difficult for prosecutors to convert questionable judgment calls by teens to criminal charges.

A bill that defines how to handle juveniles charged with sexting in Maryland passed in the House with a wide majority on Wednesday.

The bill, which passed on a vote of 131-8, doesn’t legalize sexting for juveniles, but it defines certain cases that aren’t a part of child pornography laws.

In addition to defining certain cases, HB0180 states that a juvenile in violation would not be committed to custody — unless there are extraordinary circumstances — and would not be subject to register as a sex offender.

It's not great. (But it's still pretty good.)

"Great" would be terminating any prosecutorial options for the consensual sharing of explicit images between teens. But it's better than what's out there now, which allows prosecutors who've never exercised discretion in a positive way from railroading teens into a lifetime of sex offender list misery.

What it does do is blunt the most harmful edges of existing law. Non-consensual sharing would still be a crime, but no teen can be considered a producer or possessor of child porn unless they're over the age of 18. It also considers sexting to be a crime if the participants are more than four years apart in age, something that aligns sexting provisions with state law on consensual sexual acts between teens.

But there are still concerns. First, the bill [PDF] may have been passed but there's no guarantee it will become law. Second, it still gives prosecutors a lot of leeway when it comes to prosecution of edge cases. But hopefully it will deter the sort of insanity that inspired this legislation.

All three House bills were drafted in response to a case in 2019 involving a teenage student who sent an illicit video of herself with a male to two of her friends, a video that was distributed by one of the friends to the rest of their high school.

Instead of helping, a school resource officer believed the teenager committed a crime, Lisae Jordan, executive director and counsel of Maryland Coalition Against Sexual Assault, wrote in testimony to lawmakers.

The student was charged in Juvenile Court with child pornography and obscenity.

It really takes a sick mind to view someone who's being subjected to abuse as a criminal. But that's just how some people think. This bill, if passed, will prevent idiots like this from treating the victims of non-consensual sharing of intimate images from being treated as child pornographers. Anything that strips discretion from people who've proven incapable of exercising it wisely is better than doing nothing.

Filed Under: child porn, csam, maryland, sexting

Senate Waters Down EARN IT At The Last Minute; Gives Civil Liberties Groups No Time To Point Out The Many Remaining Problems

from the this-is-still-a-bad-bill dept

As expected, the EARN IT Act is set to be marked up this week, and today (a day before the markup) Senators Graham and Blumenthal announced a "manager's amendment" that basically rewrites the entire bill. It has some resemblance to the original bill, in that this bill will also create a giant "national commission on online child sexual exploitation prevention" to "develop recommended best practices" that various websites can use to "prevent, reduce, and respond to the online sexual exploitation of children," but then has removed the whole "earn it" part of the "EARN IT" Act in that there seems to be no legal consequences for any site not following these "best practices" (yet). In the original bill, not following the best practices would lose sites their Section 230 protections. Now... not following them is just... not following them. The Commission just gets to shout into the wind.

Of course, we've seen mission creep on things like this before, where "best practices" later get encoded into law, so there remain significant concerns about how this all plays out in the long run, even if they've removed some of the bite from this version.

Instead, the major "change" with this version of EARN IT, is that it basically replicates FOSTA in creating a specific "carve out" for child sexual abuse material (CSAM, or the artist formerly known as "child porn"). It's almost an exact replica of FOSTA, except instead of "sex trafficking and prostitution" they say the same thing about 230 not impacting laws regarding CSAM. This is... weird? And pointless? It's not like there is some long list of cases regarding CSAM where Section 230 got in the way. There are no sites anyone can point to as "hiding behind Section 230" in order to encourage such content. This is all... performative. And, if anything, we're already seeing people realize that FOSTA did nothing to stop sex trafficking, but did have massive unintended consequences.

That said, there are still massive problems with this bill, and that includes significant constitutional concerns. First off, it remains unclear why the government needs to set up this commission. The companies have spent years working with various stakeholders to build out a set of voluntary best practices that have been implemented and have been effective in finding and stopping a huge amount of CSAM. Of course, there remains a lot more out there, and users get ever sneakier in trying to produce and share such content -- but a big part of the problem seems to be that the government is so focused on blaming tech platforms for CSAM that they do little to nothing to stop the people who are actually creating and sharing the material. That's why Senator Wyden tried to call law enforcement's bluff over all of this by putting out a competing bill that basically pushes law enforcement to do its job, which it has mostly been ignoring.

On the encryption front: much of the early concern was that this commission (with Attorney General Bill Barr's hand heavily leaning on the scales) would say that offering end-to-end encryption was not a "best practice" and thus could lead to sites that offered such communication tools losing 230 protections for other parts of their site. This version of EARN IT removes that specific concern... but it's still a threat to encryption, though in a roundabout way. Specifically, in that FOSTA-like carve out, the bill would allow states to enforce federal criminal laws regarding CSAM, and would allow states to set their own laws for what standard counts as the standard necessary to show that a site "knowingly" aided in the "advertisement, promotion, presentation, distribution or solicitation" of CSAM.

And... you could certainly see some states move (perhaps with a nudge from Bill Barr or some other law enforcement) to say that offering end-to-end encryption trips the knowledge standard on something like "distribution." It's roundabout, but it remains a threat to encryption.

Then there are the constitutional concerns. A bunch of people had raised significant 4th Amendment concerns in that if the government was determining the standards for fighting CSAM, that would turn the platforms into "state actors" for the purpose of fighting CSAM -- meaning that 4th Amendment standards would apply to what the companies themselves could do to hunt down and stop those passing around CSAM. That would make it significantly harder to actually track down the stuff. With the rewritten bill, this again is not as clear, and there remain concerns about the interaction with state law. Under this law, a site can be held liable for CSAM if it was "reckless" and there are reasons to believe that state laws might suggest that it's reckless not to do monitoring for CSAM -- which could put us right back into that state actor 4th Amendment issue.

These are not all of the problems with the bill, but frankly, the new version is just... weird? It's like they had that original "earn" 230 idea worked out, and were convinced that couldn't actually work, but were too wedded to the general idea to try to craft a law that actually works. So they just kinda chucked it all and said "recreate FOSTA" despite that not making any sense.

Oh, and they spring this on everybody the day before they mark it up, giving most experts almost no time to review and analyze. This is not how good lawmaking is done. But what do you expect these days?

Filed Under: 4th amendment, best practices, child porn, commission, csam, earn it, encryption, section 230, states

Cloudflare Makes It Easier For All Its Users To Help Stop Child Porn Distribution

from the this-is-good dept

We recently wrote about how Senators Lindsey Graham and Richard Blumenthal are preparing for FOSTA 2.0, this time focused on child porn -- which is now being renamed as "Child Sexual Abuse Material" or "CSAM." As part of that story, we highlighted that these two Senators and some of their colleagues had begun grandstanding against tech companies in response to a misleading NY Times article that seemed to blame internet companies for the rising number of reports to NCMEC of CSAM found on the internet, when that should be seen as more evidence of how much the companies are doing to try to stop CSAM.

Of course, working with NCMEC and other such organizations takes a lot of effort. Being able to scan for shared hashes of CSAM isn't something that every internet site can do. It's mostly just done by the larger companies. But last week Cloudflare (one of the companies that Senators are demanding "answers" from), did something quite fascinating: it enabled all Cloudlfare users, no matter what level of service, to start using Cloudflare CSAM scanning tools for free, even allowing them to set their own rules and preferences (something that might become very, very important if the Graham/Blumenthal bill becomes the law.

I highly recommend reading the entire article, because it's quite a clear, interesting, and easy to read article about how fuzzy hashing works (including pictures of dogs and bicycles). As the Cloudflare post notes, those who use such fuzzy hashing tools have intentionally kept at least some of the details secret -- because being too public about it would allow those who are producing and distributing CSAM to make changes that "dodge" the various tools and filters, which would obviously be a problem. However, that also results in two potential issues: (1) a lack of transparency in how these filtering systems really operate and (2) an inability for all but the largest players to make use of these tools -- which would be disastrous for smaller companies if they were required to make use of such things.

And that's where Cloudflare's move is quite interesting. In providing the tool for free to all of its users, it keeps the proprietary nature of the tool secret, but it's also letting them set the thresholds.

If the threshold is too strict — meaning that it's closer to a traditional hash and two images need to be virtually identical to trigger a match — then you're more likely to have have many false negatives (i.e., CSAM that isn't flagged). If the threshold is too loose, then it's possible to have many false positives. False positives may seem like the lesser evil, but there are legitimate concerns that increasing the possibility of false positives at scale could waste limited resources and further overwhelm the existing ecosystem. We will work to iterate the CSAM Scanning Tool to provide more granular control to the website owner while supporting the ongoing effectiveness of the ecosystem. Today, we believe we can offer a good first set of options for our customers that will allow us to more quickly flag CSAM without overwhelming the resources of the ecosystem.

Different Thresholds for Different Customers

The same desire for a granular approach was reflected in our conversations with our customers. When we asked what was appropriate for them, the answer varied radically based on the type of business, how sophisticated its existing abuse process was, and its likely exposure level and tolerance for the risk of CSAM being posted on their site.

For instance, a mature social network using Cloudflare with a sophisticated abuse team may want the threshold set quite loose, but not want the material to be automatically blocked because they have the resources to manually review whatever is flagged.

A new startup dedicated to providing a forum to new parents may want the threshold set quite loose and want any hits automatically blocked because they haven't yet built a sophisticated abuse team and the risk to their brand is so high if CSAM material is posted -- even if that will result in some false positives.

A commercial financial institution may want to set the threshold quite strict because they're less likely to have user generated content and would have a low tolerance for false positives, but then automatically block anything that's detected because if somehow their systems are compromised to host known CSAM they want to stop it immediately.

This is an incredibly thoughtful and nuanced approach, recognizing that when it comes to any sort of moderation, one size can never fit all. And, by allowing sites to set their own thresholds, it actually does add in a level of useful transparency, without exposing the inner workings that would allow bad actors to game the system.

That said, I can almost guarantee that someone (or perhaps multiple someones) will come along before too long and Cloudflare's efforts to help all of its users combat CSAM will somehow be incorrectly or misleadingly spun to claim that Cloudflare is somehow helping sites to hide or enable CSAM. No good deed goes unpunished.

However if you want to support actual solutions -- not grandstanding nonsense -- to try to deal with CSAM, approaches like Cloudflare's are ones worth paying attention to. This is especially true if Graham/Blumenthal and others get their way. Under proposals like the one they're suggesting, it will become virtually impossible for smaller companies to take the actions necessary to meet the standards to avoid legal liability. And that means that (once again) the big internet companies will end up getting bigger. They all have access to NCMEC and the necessary tools to scan and submit CSAM. Smaller companies don't. Cloudflare offering up its scan tool for everyone helps level the playing field in a really important way.

Filed Under: child porn, csam, fuzzy hashing, infrastructure, tools
Companies: cloudflare

DOJ's Latest Child Porn Site Takedown Shows Encryption Isn't Really Stopping The Feds From Fighting Child Porn

from the welcome-to-basic-detective-work dept

The DOJ just delivered a counterargument to its own anti-encryption rhetoric. Attorney General William Barr, Deputy AG Jeffrey Rosen, and FBI Director Chris Wray recently spent some time decrying the increasing use of encryption to secure personal communications.

The latest attack on encryption was prompted by Facebook's announcement that it would be adding end-to-end encryption to its Messenger service. Three governments (US, UK, Australia) joined forces to tell Facebook it was wrong. They promised Facebook's inability to snoop on its users' messages would allow thousands of child porn producers and consumers to escape justice.

And yet the DOJ, FBI, and others are still managing to track down and arrest criminal suspects -- all without having access to encryption backdoors or compromised communication services. As Jason Koebler reports, another child porn investigation has led to the takedown of a dark web site.

The Department of Justice announced on Wednesday that it has seized and shut down Welcome to Video, one of the world’s largest dark web child porn websites in a worldwide law enforcement action.

Law enforcement has arrested 337 alleged pedophiles in 38 countries around the world and has rescued 23 children from abusive situations as part of the operation, the DOJ said in a press conference on Wednesday.

No backdoors were needed to track down the owner of the server or hundreds of the site's visitors. For that matter, the FBI didn't even need a warrant. The FBI did not deploy its infamous NIT (Network Investigative Technique) to track down site users. The flaw was the payment system linked to the site. Users may have thought their Bitcoin transactions couldn't be traced back to them, but they were wrong.

According to an indictment, law enforcement was able to track users of the site on the blockchain not because of the design of Bitcoin itself, which is pseudonymous, but because “virtual currency exchanges were required by US law to collect identifying information of their customers and verify their clients’ identities.”

Many financial records are third-party records. No warrants needed. Investigators sent Bitcoin to the child porn site's wallet multiple times, managing to suss out the wallet's owner. Somewhat conveniently, the owner's phone number and email account were listed with the exchange. Investigators then began digging up info on other users who were sending Bitcoin to the same wallet, using the mandated data collection to unmask site visitors. Coinbase was handed a subpoena and Coinbase handed over users' info.

The DOJ's overwrought anti-encryption arguments aside, there's another concerning aspect of this investigation -- one the DOJ is far less willing to discuss. As Koebler points out, the DOJ apparently let the site operate for months, if not years, to track down as many site visitors as possible.

The indictment [PDF] indicates investigators were aware of the site's existence since 2015. At some point between then and the operator's arrest in March of 2018, investigators purchased site credits and downloaded child porn. The indictment does not say when the DOJ took control of the site and/or shut it down. It doesn't appear the FBI or any other law enforcement agency continued to run the site after its seizure (as the FBI has done in other cases), but it is disturbing multiple law enforcement agencies felt it was better to leave the site up and running -- and victimize more children in the process -- than shut it down as soon as possible with the understanding some site visitors might escape prosecution.

The facts of this case undermine the DOJ's assertions about the necessity of encryption backdoors to successfully investigate and prosecute child porn producers and distributors. This case even undercuts its arguments about cellphone encryption, as the FBI's testimony [PDF via Cyrus Farivar] shows it didn't have to make any effort at all to access the contents of an arrestee's phone.

Q. Did he have a cellphone on him at the time you encountered him?

A. Yes.

Q. Did you seize that?

A. Yes.

Q. Did he voluntarily provide the password --

A. Yes.

Q. -- passcode to it?

A. Yes.

Encryption isn't the roadblock the DOJ's rhetoric makes it appear to be. It may make some investigations more difficult, but it certainly doesn't make them impossible. The DOJ can still protect children without making communications less secure for millions of people. It's not zero sum. It's a tradeoff -- something the DOJ is familiar with. It trades the continued exploitation of children for a few more prosecutions when it takes on child porn sites. If it's willing to allow children to be hurt to save children, you'd think it would be a bit more cautious when suggesting the public should give up its security in exchange for the DOJ's idea of "public safety."

Filed Under: child porn, doj, encryption, fbi, investigations
Companies: welcome to video

DOJ Using The FOSTA Playbook To Attack Encryption

from the watch-out dept

For years now, the various DOJ folks pushing to break encryption have whined and complained that the tech industry won't even consider having an adult conversation about encryption. This, of course, has never been true. Indeed, in just the past few weeks we've highlighted two separate examples of attempts to bring together law enforcement folks and technology/cryptography experts to see if there are legitimate ways to move the conversation forward. That first one came up with an interesting and useful framework for judging any conversation about "lawful access" to encrypted communications, while the second demonstrated just how much various tech companies have been doing over the years -- in particular in helping law enforcement deal with the issue of child abuse.

And what do they get for all that? First, a horrific article in the NY Times that accurately highlights the awfulness of child sexual abuse online... but oddly frames the efforts that various tech companies have put into helping law enforcement as... evidence of not caring about the problem. And, of course, suggests that encryption is part of the problem:

After years of uneven monitoring of the material, several major tech companies, including Facebook and Google, stepped up surveillance of their platforms. In interviews, executives with some companies pointed to the voluntary monitoring and the spike in reports as indications of their commitment to addressing the problem.

But police records and emails, as well as interviews with nearly three dozen local, state and federal law enforcement officials, show that some tech companies still fall short. It can take weeks or months for them to respond to questions from the authorities, if they respond at all. Sometimes they respond only to say they have no records, even for reports they initiated.

And when tech companies cooperate fully, encryption and anonymization can create digital hiding places for perpetrators. Facebook announced in March plans to encrypt Messenger, which last year was responsible for nearly 12 million of the 18.4 million worldwide reports of child sexual abuse material, according to people familiar with the reports. Reports to the authorities typically contain more than one image, and last year encompassed the record 45 million photos and videos, according to the National Center for Missing and Exploited Children.

This is following the FOSTA/SESTA game plan. Highlight legitimately horrific examples of horrible things that people have done (in FOSTA's case, sex trafficking; here child porn). Then, follow it up by blaming the internet platforms and technology even if those platforms have actively helped law enforcement over and over again. Encryption is repeatedly suggested as truly evil.

Increasingly, criminals are using advanced technologies like encryption to stay ahead of the police.

"Advanced technologies"? And then:

Offenders can cover their tracks by connecting to virtual private networks, which mask their locations; deploying encryption techniques, which can hide their messages and make their hard drives impenetrable; and posting on the dark web, which is inaccessible to conventional browsers.

And again:

Tips included tutorials on how to encrypt and share material without being detected by the authorities.

Yes, encryption can be used to hide bad stuff. No doubt about it. However, it also protects the privacy and security of everyone else as well. There are real tradeoffs here to be discussed -- and we shouldn't forget that one element in that discussion is that law enforcement does have other tools to track down and find those involved in child porn. That encryption blocks some evidence does not mean there are not other ways for them to collect evidence -- as we've seen in many other cases.

But, given that Attorney General William Barr has been on an anti-encryption kick lately, as has FBI Director Chris Wray, it shouldn't be a huge surprise that they've teamed up for a DOJ "symposium" more or less building on the NY Times article (for which the DOJ appears to have been a major source), in which there appears to be an an entirely one-sided lineup of speakers to discuss the scary sounding:

Lawless Spaces: Warrant-Proof Encryption and Its Impact On Child Exploitation Cases

Barr is speaking, as is Wray. So is Deputy Attorney General Jeffrey Rosen, who also spent the summer trashing encryption. There are also two foreign speakers. There's Peter Dutton, the Home Affairs Minister from Australia, who lead that country's efforts to backdoor encryption with a bunch of ridiculously misleading claims about how companies that offer encryption should be blamed for anyone using it for illegal activity. Then there's the UK's Home Secretary, Priti Patel, who we had just mentioned earlier this week for her statements that encryption "empowers criminals."

There does not appear to be a single cryptographer on the program. There does not appear to be a single technologist on the program. There does not appear to be anyone who can provide even the slightest counterweight to the idea that encryption is just a tool for criminals. Contrast this to the sessions we talked about at the opening of this piece. The Carnegie Endowment and Stanford each actually invited people from a variety of different viewpoints and made sure to have actual experts involved. The DOJ is not doing that. This is pure theater as part of a public relations campaign to undermine the encryption that keeps us all safe.

Yes, you can point out very real and horrifying examples of people abusing just about any technology. But in a sane world, you then start looking at the actual size of the problem, the actual risks, the alternative approaches, and the costs and benefits associated with all of them. Not a single person on the DOJ's list of speakers seems equipped to do that. Given that we've quoted each and every one of them right here on Techdirt staking out an extreme anti-encryption standpoint over and over again, suggests that, unlike the tech industry, which has held and participated in various discussions, the DOJ just wants to set up scare mongering stories in the press before pushing for legislation that will destroy encryption and put us all at risk. For our safety.

As you'll recall, AG Barr himself had ominously warned that if the tech industry didn't "engage" then eventually there would be some sort of "incident" to "galvanize public opinion" against encryption:

Obviously, the Department would like to engage with the private sector in exploring solutions that will provide lawful access. While we remain open to a cooperative approach, the time to achieve that may be limited. Key countries, including important allies, have been moving toward legislative and regulatory solutions. I think it is prudent to anticipate that a major incident may well occur at any time that will galvanize public opinion on these issues.

Well, the industry was willing to engage and explain the costs of undermining encryption. But rather than understand that, it now looks like Barr is working overtime to manufacture that "major incident" to galvanize public opinion against their own security. It's a shame the NY Times decided to help.

Filed Under: child porn, chris wray, doj, encryption, fosta, going dark, moral panic, peter dutton, priti patel, william barr
Companies: facebook, google, ny times

Maryland Appeals Court Says Sexting Teen Is A Child Pornographer

from the just-like-state-lawmakers-intended-i-guess dept

Far too many prosecutors in far too many states have trouble reading child porn statutes. Instead of reading them how they're intended to be read -- to punish adults who victimize minors -- they read them to include the criminalization of minors participating in sexting. When these pictures and videos are shared, these justice system components become contortionists in order to treat subjects of recordings as their own child pornographers.

If only the courts weren't so willing to help. Instead of stopping this abuse of the law, they become part of the problem, offloading it on legislators who just aren't all that willing to alter existing child porn laws. Some legislators no doubt believe minors should be treated as sex offenders for engaging in sexting, even when the sexual acts themselves are legal. It's the documentation that's the problem.

Mark Joseph Stern of Slate has uncovered another one of these unfortunate incidents. This one is more unfortunate than most because of the actions of one of the recipients of the recorded sex act.

In 2016, a 16-year-old Maryland student known as S.K. in court documents sent a brief cellphone video to two friends. The clip depicted S.K. performing oral sex on an unknown man—a legal activity in Maryland, where the age of consent is 16. She sent the video as part of a game in which the friends attempted to “one-up” each other with “silly photos and videos.” A few months later, S.K. had a falling-out with one recipient of the video, a 17-year-old boy known as K.S. He began to mock S.K., allegedly writing that she was a “slut” on classroom blackboards. He then reported the video to the school resource officer, Eugene Caballero.

Once the school cop was dragged into this, it was all over. Cops have a very small set of tools and they apply them carelessly to situations that don't demand this specialized equipment. S.K. went to a meeting with the school resource officer under the assumption he was going to help stop the distribution of this video. Of course, Caballero wasn't going to help with that. Caballero was just collecting evidence to be used against S.K., who at this point was arguably the victim of revenge porn, given the unauthorized sharing of the video she'd recorded. Caballero took her statement and passed it on to state prosecutors. This was the end result:

Maryland then charged S.K. with illegally distributing child pornography and displaying an obscene item to a minor. She was found guilty by a juvenile court, which found her delinquent as a distributor of child pornography. The court sentenced S.K. to supervised probation and placed her on electronic monitoring. Her punishment required her to report to a probation officer periodically, allow him to visit her home, obtain permission before leaving the state, submit to weekly drug urinalysis, and complete an anger management course.

S.K. challenged the sentence, pointing out that the law does not provide for charging the subject of alleged child porn with child pornography production. Like a lot of these laws, the language unfortunately appears to allow victims of child porn production to be treated as perpetrators. You are your own child pornographer, says the Maryland Court of Appeals [PDF].

The court compares other states' poorly-written laws with Maryland's poorly-written law and comes to the conclusion that a minor victim of revenge porn is the producer of child pornography.

We refuse to read into the statute an exception for minors who distribute their own matter, and thus we believe S.K.’s adjudication as delinquent under CR § 11-207 must be upheld.

That reading seems sympathetic to the state's arguments. It said the state law was put in place to punish any distribution of child porn, no matter who created it. Even if porn contained a recording of two consenting minors (both participants were above the legal age of consent), the creation and distribution of the recording was a criminal act. The court looks at the law and decides the legislative intent was to treat minors as their own pornographers.

Here, S.K is prosecuted as a “child pornographer” for sexting and, because she is a minor, her actions fell directly within the scope of the statute. The General Assembly has consistently expanded the scope of the statute to assist in the eradication of any form of child pornography. As written, the statute in its plain meaning is all encompassing, making no distinction whether a minor or an adult is distributing the matter.

Therefore, based on this intent and the unambiguous language, we believe S.K.’s conduct falls within the purview of the statute.

It then tosses in a half-hearted apologetic shrug.

In affirming this adjudication, however, we recognize that there may be compelling policy reasons for treating teenage sexting different from child pornography.

The dissent says this is wrong. A plain reading of the law makes it clear the state shouldn't be punishing subjects of child porn as child pornographers. This is a failure of the court, according to the dissent, not a failure of legislation.

As provided by S.K., the statute creates a dichotomy “between the pornographer, or “person,” and victim, or “minor” so that these two actors are different individuals[.]” 1 Therefore, I conclude that the plain language of Crim. Law § 11-207(a)(4)(i) does not permit S.K. to be delinquent for transmitting a visual representation of herself. There is ambiguity in Crim. Law § 11-207(a). (“We have said that there is an ambiguity within a statute when there exist two or more reasonable alternative interpretations of the statute.” Bellard v. State, 452 Md. 467, 481, 157 A.3d 272, 280 (2017)). When such ambiguity exists, “the job of this Court is to resolve the ambiguity in light of the legislative intent[.]”

If the court really wanted to examine legislative intent, it could have started by examining statements of intent made by the court itself in other cases.

In reflecting on a Petitioner’s First Amendment challenge to his conviction of photographing a minor engaged in sexual conduct in violation of § 11-207(a)(2), this Court asserted that “we balance the right to freedom of expression against the right of the State to protect children against sexual exploitation.” Id. at 36, 641 A.2d at 878 (emphasis added). Therefore, the Court illuminated the General Assembly’s intent to protect children against sexual exploitation under Crim. Law § 11-207(a). In the case at bar, S.K. was not being exploited by someone else. She made a video depicting consensual sexual conduct. The General Assembly did not seek to subject minors who recorded themselves in non-exploitative sexual encounters to prosecution, as reflected by the language of Crim. Law § 11-207(a). Rather, the statute contemplates protecting children from the actions of others that bear negatively upon them.

Since this recording was not abusive and was not a depiction of a minor engaged in a sex act with an exploitative adult, there's no crime here. The sex was consensual as was the recording. And yet, this is only the dissent. Prosecutors in the state are free to punish minors for recording legal, consensual sex acts. Since these recordings only end up in court after someone has shared them with people the recording party didn't want them shared with, the court is allowing prosecutors to punish teens for the terrible things classmates and acquaintances have done to them.

Filed Under: child porn, maryland, sexting

Government Tossing Child Porn Cases Rather Than Discuss Its Torrent-Tracking Software In Court

from the escape-hatches-and-opacity dept

The federal government isn't done tossing cases rather than let defendants have access to slightly more level playing field. A new investigation by ProPublica has uncovered more dismissed prosecutions due to the government's unwillingness to allow defendants to examine the software used to build cases against them.

The cases deal with child porn and BitTorrent distribution. The defendants are hardly the most sympathetic. But, like the cases that exposed the FBI's use of malware to gather identifying information from devices around the world, child porn investigations are on the front line of the government's tech deployments. From the description of the cases covered here, it almost appears the government had enough evidence to see the prosecution through to the end. It just chose not to because continuing the cases would mean turning over info on their tracking software to the accused.

Using specialized software, investigators traced explicit child pornography to Todd Hartman’s internet address. A dozen police officers raided his Los Angeles-area apartment, seized his computer and arrested him for files including a video of a man ejaculating on a 7-year-old girl. But after his lawyer contended that the software tool inappropriately accessed Hartman’s private files, and asked to examine how it worked, prosecutors dismissed the case.

Near Phoenix, police with a similar detection program tracked underage porn photos, including a 4-year-old with her legs spread, to Tom Tolworthy’s home computer. He was indicted in state court on 10 counts of committing a “dangerous crime against children,” each of which carried a decade in prison if convicted. Yet when investigators checked Tolworthy’s hard drive, the images weren’t there. Even though investigators said different offensive files surfaced on another computer that he owned, the case was tossed.

The secrecy in these cases is being aided and abetted by private companies. A nonprofit called the Child Rescue Coalition produces a suite of tools called the Child Protection System. But as ProPublica points out, the details are more complicated than its initial appearance: a kindhearted nonprofit helping law enforcement catch child porn producers and consumers. CRC has ties to TLO, a data brokerage recently acquired by credit reporting agency, TransUnion.

Defendants have asked prosecutors to turn over information about CRC's software in cases where it appears to have possibly drawn the wrong conclusions about downloading and distributing child porn. In those cases, TLO -- not the CRC -- has stepped in to inform the courts that it will not be producing the requested info.

The software’s makers have resisted disclosure of its coding. In May 2013, TLO asked a federal court in El Paso, Texas, to quash a subpoena to reveal the software known as the Child Protection System in a child-porn case. The materials sought, they said, “are protected under the law enforcement privilege and trade secrets laws.” After the judge ordered the software produced, prosecutors instead agreed to a plea deal that favored the defendant; he was sentenced to three years he had already served for “transportation of obscene material.

It's not just private companies pushing prosecutors towards dropping cases. It's also public institutions. Torrential Downpour -- software used to track the sharing of child porn via hash values -- was developed by the University of Massachusetts using government funding. When access to code was requested by a child porn case defendant, the university inserted itself into the case to reject the judge's order to turn over the code.

Its lawyer said in a court document that handing over the software would “destroy its value to the university and its faculty researcher,” citing a $440,000 annual FBI grant. “Releasing it to public view would frustrate public policy and impede law enforcement’s ability to deter peer-to-peer sharing of child pornography,” the lawyer added.

The trove of documents [PDF] ProPublica secured show instances where the evidence prosecutors said they had may not have actually been there, thanks to software or human errors. A recent ruling in favor of letting the defendant have access to Torrential Downpour's code seems to show the FBI relies more on what the software tells it than it can actually see with its own eyes.

Defendant Gonzales argues that Torrential Downpour is material to his defense because the distribution charges are based on child pornography files that Torrential Downpour purportedly downloaded from his tablet but that were not found on the tablet when it was seized by the FBI. Doc. 25 at 8-9. He has presented an affidavit from his expert, Tami Loehrs, confirming that the files are not on the tablet. Doc. 25-5. Loehrs explains in her affidavit that it is critical to Gonzales’s defense to understand how Torrential Downpour functions in order to determine the program’s reliability and accuracy in identifying files that Gonzales is charged with knowingly distributing. Id. at ¶ 17. She further states that based on her many years of research and testing of peer-to-peer file sharing software, including BitTorrent, she has discovered that all of these programs “contain bugs, they do not always function as intended and the data reported by these applications is not always accurate or reliable.”

[...]

Loehrs explained that, because a torrent is simply a text-file containing the hash values – or “fingerprints” – of the target image and video files, a BitTorrent user who downloads a torrent has fingerprints of the target files, even if he has not yet downloaded them. Id. at 22:14-23:8. Loehrs stated that the actual downloading of the target files occurs only when the client software instructs the torrent to search for those files on the BitTorrent network and download them to a designated folder on the user’s computer. Id. at 23:9-25:3. She further stated that a forensic examination of the device used to download the torrent can determine whether the torrent has been used to download the file, and her examination of Gonzales’s tablet revealed no evidence suggesting that he downloaded the files listed in counts one through eight.

It's not just defendants' experts being unable to find the files the government claims they downloaded. Investigators themselves have admitted they can't find files that Torrential Downpour said the accused accessed. An examination of the software being used to build cases should be allowed, but the entities behind the software won't allow it and the government is cutting defendants loose rather than giving them a chance to properly defend themselves against these very serious charges. I supposed it ultimately works out for defendants, but it only encourages the government to tip the scales in its favor again when the next prosecution rolls around with the hopes the next defender of the accused isn't quite as zealous.

Filed Under: bittorrent, child porn, child protection system, defendants, discovery, evidence

YouTube Filters At It Again: Pokemon YouTubers Have Accounts Nuked Over Child Porn Discussions That Weren't Occurring

from the filter-fail dept

It's clear at this point that the automated filtering and flagging done by YouTube is simply not good. Whatever legitimacy the platform might want to have by touting its successes must certainly be diminished by the repeated cases of YouTube flagging videos for infringing content that isn't infringing and the fact that the whole setup has been successfully repurposed by blackmailers that hold accounts hostage through strikes.

While most of these failures center around ContentID's inability to discern actual intellectual property infringement and its avenues for abuse, YouTube's algorithms can't even suss out more grave occurrences, such as child exploitation. This became apparent recently when multiple Pokemon streamers had their accounts nuked due to discussions about child pornography that never occurred.

A trio of popular Pokemon YouTubers were among the accounts wrongly banned by Google over the weekend for being involved in “activity that sexualises minors”.

As the BBC report, Mystic7, Trainer Tips and Marksman all found their accounts removed not long after uploading footage of themselves playing Pokemon GO.

It’s believed the error occurred thanks to their video’s continued use of the term “CP”, which in Pokemon GO refers to “Combat Points”, but which YouTube’s algorithm assumed was “Child Pornography”.

That's pretty stupid and it certainly seems like the reliance for a ban of an entire Google account based on the use of an acronym ought to have come with a review from an actual human being. That human would have immediately understood the context of the use of "CP" in a way the automated system apparently could not. And, to be clear, this wasn't a YouTube ban. It was the elimination of each streamers entire Google account, email and all.

Now, once the backlash ensued, Google got them their accounts back, but that simply isn't good enough. As there is more and more pressure to ramp up automated policing of the internet, at some point, everyone pushing for those solutions needs to realize that the technology just isn't any good.

Filed Under: automatic filters, automation, child porn, cp, false positives, pokemon, youtube filters
Companies: youtube

FBI Decides To Ruin A Man's Life Over Nude Photos Of His Legal Girlfriend He Took Seven Years Ago

from the government-still-full-of-vindictive-assholes dept

You can be in a consensual, legal relationship but still end up a sex offender. That's how child porn laws work. It's legal to have sex, but illegal to take pictures. In Ohio, a 27-year-old man was arrested on child porn charges for taking pictures of his then-17-year-old girlfriend. (h/t Guy Hamilton-Smith)

The affidavit [PDF] from the FBI is a harrowing deliberate misconstruing of the actual events, written in service of destroying a man's life. It makes the man appear to be some sort of child porn-producing fiend, when, in fact, it was just him taking photos of his girlfriend.

As will be shown below, there is probable cause to believe that Edward R. Marrero used a minor to engage in sexually explicit conduct for the purpose of producing a visual depiction of such conduct and such visual depiction was produced using materials that had mailed shipped and transported in and affecting interstate and foreign commerce, in violation of Title 18, United States Code, Section 2251(a).

[...]

On May 18, 2017, Affiant interviewed the pubescent female (Victim). The Victim admitted to being the ex-girlfriend of Marrero. The Victim identified herself and Marrero in a photograph in which Marrero’s hand and mouth were on the Victim’s breast.

On June 28, 2018, affiant telephonically interviewed the Victim. The Victim admitted that the photographs were taken in Cuyahoga County when she was under the age of 18.

Oh, and this:

The Kodak EasyShare camera was not produced in the State of Ohio.

So, there's your "interstate" charge. Because the pictures were taken with a camera not "produced" in Ohio (but obviously sold in Ohio), the government is pretending this satisfies the clause needed to generate a minimum 15-year-prison term.

It all seems very damning, but here are the facts:

Edward Marrero, 27, said while testifying Thursday that he took the photos in April 2011, according to an affidavit written by FBI agent Lisa Hack. At the time, she was 17 years old and he was 20, authorities say.

Marrero is no longer in a relationship with the woman. He testified that he knew she was underage when he took the photos, the affidavit states.

The age of consent in Ohio is 16 years old, but federal law states it is illegal to create, share or possess sexually-explicit images of anyone under the age of 18.

The relationship was completely legal. The pictures somehow aren't, even though no one could legally call the relationship (as it existed seven years ago) "exploitation" or "enticement." But they can call the photos illegal and they can retcon the consensual relationship into a predator/prey dynamic using federal child porn charges.

The testimony referenced above wasn't meant to incriminate Edward Marrero. He was testifying on behalf of another person facing child porn charges. When he detailed the pictures he took while in a consensual relationship with a 17-year-old, the feds decided to swear out an arrest warrant. While Marrero was informed of his Fifth Amendment rights, he most likely thought what he stated in court wasn't incriminating (because the girlfriend was over the age of consent) or that the government would view his statements rationally and not immediately move to have him arrested.

As Guy Hamilton-Smith pointed out on Twitter, the federal government is being as punitive as possible, as quickly as possible. Marrero's initial appearance was greeted with immediate detention and he's been placed in the custody of the US Marshals. All this is happening over photos taken seven years ago by people in a consensual relationship. The accused wasn't producing child porn by any rational definition of the statute. But it can be read in irrational ways to ruin lives just because.

Filed Under: child porn, edward marrero, fbi, photographs, teenagers

Alleged Vault 7 Leaker Charged With Stealing Gov't Secrets, Child Porn Possession, And Copyright Infringement?

from the kitchen-sink-prosecution dept

The US government has taken down another alleged leaker. Joshua Schulte, a former NSA and CIA operative, had his apartment raided by the feds last March. The raid targeted documents showing Schulte had leaked CIA hacking tools to Wikileaks (the "Vault 7" collection). But it uncovered a whole lot of child porn -- 10,000 images on Schulte's personal computer and his file-sharing server that held another 5 terabytes of data.

The first criminal complaint [PDF] by the DOJ contained nothing but child porn charges. It suggests the former government spook didn't practice much opsec when not on the clock. One IRC chat shows Schulte's aware encryption is sometimes only a temporary deterrent if the government really wants to find out what's been sent or shared. But then he apparently went on to provide the government with some easily-accessible evidence.

Based on my review of those Google Searches, I have learned, among other things, that on a number of occasions in or about 2011 and in or about 2012, SCHULTE appeared to search the Internet for child pornography. For example: (i) on or about April 9, 2011, SCHULTE conducted a Google Search for "child pornography" on at least three occasions; (ii) on or about October 15, 2011, SCHULTE conducted Google Searches for "movie where father videos daughter and friend sex" and "movie where father videos child porn"; and (iii) on or about May 15, 2012, SCHULTE conducted a Google Search for "female teenage body by year."

The recently-released superseding indictment [PDF] really starts stacking the charges. In addition to the child porn charges carried over from the original complaint, the government adds charges related to the leaked hacking tools, including unauthorized access with the intent of gathering classified info and theft of government property.

Then the charges get interesting. Schulte is charged with "causing transmission of a harmful computer program" for allegedly altering an intelligence agency "computer system" to give himself access to restricted areas of the system and cover up any evidence he had accessed these files. Apparently, this alteration resulted in other users being denied access.

There's the expected "lying to the feds" charges (making false statements, obstruction of justice) which show Schulte was very cooperative when being questioned about the child porn but apparently not so much when asked about purloined CIA data.

Rolling past the copy-pasted child porn charges, one reaches the most unexpected charge in the indictment: criminal copyright infringement.

From at least in or about September 2015, up to and including at least in or about August 2017, in the Southern District of New York and elsewhere, JOSHUA ADAM SCHULTE, the defendant, unlawfully, willfully, and knowingly did infringe copyrights by the reproduction and distribution, including by electronic means and by making it available on a computer network accessible to members of the public, during a 180-day period, of ten and more copies and phonorecords, of one and more copyrighted works, which had a total retail value of more than $2,500, to wit, without authorization, SCHULTE maintained a computer server that housed thousands of copyrighted movies, television shows, and audio recordings, which SCHULTE shared with others by electronic means and using the Internet.

This appears to refer to the server Schulte set up for IRC chat buddies. It's mentioned in a couple of chat transcripts and was, until 2017, accessible at cryptm.org. There's plenty archived at the Wayback Machine [click at your own risk, I suppose] but this server seems to be the source of the copyright infringement charge. Whether or not any of these files were actually downloaded isn't clear, but they were uploaded and accessible to site visitors. This short list of a small portion of the files hosted by Schulte on his server was put together by Jason Koebler and Lorenzo Franceschi-Bicchierai of Motherboard.

An archived version of his page there shows that he had files related to chess, an episode of South Park, a copy of The 40 Year Old Virgin, textbooks, C Programming textbooks, and a folder called “Facebook Convos.”

Speaking of Facebook, Schulte was apparently maintaining a diary of his criminal justice system experience. (Spoiler alert: it's unpleasant and broken.) The documents are worth reading for a firsthand look at the federal arraignment process and the unpleasant realities of being sentenced to house arrest (with no internet access privileges) while still supposedly an "innocent" person in the eyes of the Constitution. It does get a little weird when he claims he's only been charged with "victimless" crimes given what he's been charged with (leaking CIA hacking tools, child porn). But nothing's been proven beyond a reasonable doubt at this point, so maybe only the copyright infringement charge that will make the final cut.

As Parker Higgins points out on Twitter, this supremely weird addition should be viewed with apprehension. Copyright infringement happens all the time. Much of it has zero profit motive, but the government is apparently more than willing to selectively enforce this law if it seems it might push someone towards a plea deal and save it the trouble of having to prove its case.

Filed Under: child porn, cia, copyright, hacking tools, joshua schulte, leaks, nsa, vault 7