Ride the Lightning

SHERIFFS WHO SEND US CHILD PORNOGRAPHY

November 7, 2008

Not for the first time, yesterday we received child pornography via FedEx from our attorney client, who had been given it by a sheriff’s office in Virginia. It was on a CD marked “Sterile.” In our world, that means no CP. Or it’s supposed to mean no contraband. But there it was, which meant (sigh) we had to call our assigned detective in the Fairfax City Police Department and advise him that we were in possession of child pornography, in accordance with our protocol with the Department.

When he heard that a sheriff’s department had distributed the child porn, he laughed. He could afford to laugh. Not us. Because the CD had been identified as sterile, it had been placed in a folder on our server. We had to selectively wipe that folder. We also performed a long erase of the backup tape from the server, thereby overwriting every inch of mylar. We hashed the CD contents and completely scanned our analysis computer to verify that no data was transferred. We destroyed the CD and notified both our attorney and the hapless sheriff’s office. Our amused detective and friend confirmed that we had done everything according to the book, still laughing at the misadventures caused by his colleagues.

This, of course, is how new policies are created. In our case, as of today, whenever we have a case that might involve CP, we review the data in a non-persistent virtual environment to confirm no contraband is present, since we apparently can't even rely on law enforcement to comply with the law. The files associated with the virtual environment are stored on an individual hard-disk drive assigned to the case. Upon review, a file listing including hash values of the items is generated. Upon conclusion of the review, the files associated with the virtual environment are wiped and/or the storage device is wiped. If no contraband is present, the original storage media will be available for additional review and files can be uploaded to the server or forensic workstation if required.

Out of a major nuisance a new policy is born. Just another day at the office. “Sterile” my foot!

E-mail:      Phone: 703-359-0700