[Report] Combating Child Pornography: Steps Are Needed to Ensure That Tips to Law Enforcement Are Useful and Forensic Examinations Are Cost Effective

GAO-11-334 March 31, 2011 Highlights Page (PDF) Full Report (PDF, 77 pages) Accessible Text Recommendations (HTML)

"The Department of Justice (DOJ) reports that online child pornography crime has increased. DOJ funds the National Center for Missing and Exploited Children (NCMEC), which maintains the CyberTipline to receive child pornography tips. The Providing Resources, Officers, and Technology To Eradicate Cyber Threats to Our Children Act of 2008 (the Act) contains provisions to facilitate these investigations and create a national strategy to prevent, among other things, child pornography. The Act directed GAO to report on actions to minimize duplication and enhance federal expenditures to address this crime. This report examines (1) the extent to which NCMEC determines the usefulness of tips; (2) mechanisms to help law enforcement coordination (i.e., deconfliction); and (3) the extent to which agencies are addressing factors that federal law enforcement reports may inhibit investigations. GAO analyzed the Act and spoke to law enforcement officials who investigate these crimes, selected to reflect geographic range, among other things. Although these interviews cannot be generalized, they provided insight into investigations.

"NCMEC takes steps to obtain feedback from law enforcement on the usefulness of CyberTipline reports; however, it does not systematically collect information on how useful individual reports are for initiating and advancing investigations or about information gaps that limit reports' usefulness. For instance, NCMEC solicits feedback via e-mail or in person quarterly from federal law enforcement liaisons at NCMEC about the overall usefulness of CyberTipline reports. However, according to many law enforcement officials GAO contacted, information in a CyberTipline report may not contain an image of apparent child pornography or may contain old data. NCMEC officials said that they are interested in obtaining additional feedback to enhance the usefulness of its reports and could explore additional methods to gather such information, such as creating a systematic process for obtaining feedback from federal law enforcement. Enhancing its processes for collecting feedback on the usefulness of CyberTipline reports could help NCMEC ensure that reports are as useful as possible to law enforcement. Existing deconfliction mechanisms generally prevent pursuit of the same suspects but are fragmented; DOJ is in the early stages of developing a system to address this fragmentation. Many law enforcement officials GAO contacted reported using various nonautomated (e.g., task forces) and automated (e.g., investigative systems) mechanisms to avoid duplication of effort in investigations. But these officials reported that there is not a single automated system that provides comprehensive case information and deconfliction, which can contribute to difficulties coordinating investigations. As mandated in the Act, DOJ is developing a national system to, among other things, provide law enforcement with a single deconfliction tool. Specifically, DOJ is conducting a needs assessment--which it plans to complete in 12 to 24 months--to use as a basis for system development. However, because DOJ is waiting on the results of the needs assessment to begin system development, it may be several years before the system is operational. Backlogs in the forensic analysis of digital evidence can delay or hinder online child pornography investigations; assessing the costs and benefits of taking extra steps to ensure the integrity of forensic analysis could help determine if there are efficiencies that could reduce backlogs. Forensic analysis of digital evidence consists of the review of information from digital media, such as hard drives, and can prove online child pornography crime. Several factors may contribute to backlogs in forensic analysis, including the steps federal law enforcement agencies believe enhance the integrity of analysis, such as making exact copies of digital evidence to discourage tampering. The FBI takes additional steps it believes enhance integrity, such as separating the forensic examination from the investigation. However, some federal officials and prosecutors GAO spoke with differed on the need for such steps. According to DOJ, the national strategy's working group is in a good position to address backlog issues and having this group assess the costs and benefits of steps taken to ensure the integrity of forensic analysis could help it determine potential efficiencies that could reduce backlogs. GAO recommends that NCMEC enhance its processes to collect feedback to improve tips and that DOJ assess the costs and benefits of steps agencies take to ensure the integrity of forensic analysis. NCMEC and DOJ generally concurred with our recommendations and discussed actions to address them.

It's Cyber Security Awareness Month!

DHS or the National Cyber Security Alliance or someone has declared October National Cyber Security Awareness Month. So if you aren't already aware of your personal information getting pillaged on Facebook by the "What Star Trek Character Are You" application -- or having your computer infected by the "Your Computer May Already be Infected - Download This Tool Now" pop up add," -- or that there is a deposed leader in Nigeria that wants to share $10 million with you -- NOW it a good time to become aware of such things!

And what better time to point out that the good folks at OnGuard Online (a joint effort of a bunch of federal agencies and NGOs) have just released their latest: NetCetera: Chatting with Kids about Being Online.

In Net Cetera: Chatting With Kids About Being Online, OnGuard Online gives adults practical tips to help kids navigate the online world.

Kids and parents have many ways of socializing and communicating online, but they come with certain risks. This guide encourages parents to reduce the risks by talking to kids about how they communicate – online and off – and helping kids engage in conduct they can be proud of. Net Cetera covers what parents need to know, where to go for more information, and issues to raise with kids about living their lives online.

OnGuard Online encourages you to use this guide with your kids, in your school, at your PTA meeting, or anywhere else parents might gather. Feel free to order as many free copies as you’d like, put your own sticker on it, reprint sections in a newsletter or on a website, download a button or link to it, or even reprint it with your own logo. These materials are in the public domain.

To order free copies of Net Cetera, visit bulkorder.ftc.gov. To find out more about reprinting the guide, contact OnGuardOnline@ftc.gov.

OnGuard Online is seeking to partner with school districts on a pilot program using this guide. If your school district might be interested, please contact us at OnGuardOnline@ftc.gov.

There are lots of worms, viruses and other beasties out there on the Internet. You can do a lot to protect yourself and decrease your risks. But ya gotta be smart. I am always amazed by my friends who get lots of telemarketing calls and then complain about them. I ask, "well, at the check out stand when they ask for your phone number, do you give it to them??" They pause with a dumb look on their faces. "Well sure, but..." I shake my head. Dont give no personal information to no one. Dont use your correct birthday. Dont list your actual height. In fact, pretty much make up an entirely fictional character and then live vicariously through it! (okay, joking). Be smart out there; it a dangerous marvelous Internet.

Broadband Data Improvement Act Title II: Protecting Children in the 21st Century Act

Congress spent a good part of Pre-Election and Post-Poor House September “ thinking about the children .”

As has already been blogged about, with the encouragement of Obama-Suppporter-Oprah , Congress passed Sen. Joe VP-Wannabe Biden's PROTECT Our Children Act – which sought to bolster law enforcement and forensics efforts, and put up a few hundred million to this end. Amended to Biden's legislation was Sen. Prez-Wannabe McCain's SAFE Act – which requires Internet services to report known content that exploits children to the National Center for Missing and Exploited Children – a requirement which has already been on the books for 10 years .

Now comes word that Congress was also thinking of the children when it passed S.1492 Broadband Data Improvement Act , sponsored by Sen. Inouye. Amended to Sen. Inouye's legislation was the Protecting Children in the 21st Century Act , originally introduced by Sen. Inouye's friend and fellow non-continental senator, Sen. Stevens ( S. 49 ).

Steven's Protecting Children in the 21st Century Act is Title II of Inouye's Broadband Data Improvement Act . Originally the Protecting Children in the 21st Century Act received a lot of negative reviews . In its current form, the legislative does a few specific, sometimes useful, sometimes confusing, things.

Sec. 212 calls on the Federal Trade Commission to engage in a public awareness campaign “to promote the safe use of the Internet by children.” The FTC already has such a campaign known as OnGuard Online (“OnGuardOnline.gov provides practical tips from the federal government and the technology industry to help you be on guard against Internet fraud, secure your computer, and protect your personal information.”). It's not really clear what Sec. 212 is adding to what the FTC already does. Thus, confusion.

Sec. 213 calls on the FTC to file a Report with Congress. I think the legislation meant for the report to address the FTC's activities in Sec. 212. Unfortunately the language calls on the FTC to file a report with regard to its activities pursuant to Sec. 103. Unfortunately, Sec. 103 of this Act deals with the Federal Communication Commission's obligations to determine whether broadband is being deployed to all Americans in a reasonable and timely manner. So I am just confused. [ REPORT COUNT : 1]

Sec. 214 calls on the Department of Commerce to establish the Online Safety and Technology Working Group, which would basically be a federal advisory group (but not under the federal advisory committee act (FACA) rules – a lot of these committees have been established recently with language to weasel out of FACA). This working group would look at industry efforts to promote online safety, and submit a report to congress within one year [ REPORT COUNT : 2].

Interestingly, the working group will look at internet services obligation to report online child exploitation pursuant to the 10 year old law, 42 USC 13032 – but not Sen. McCain's new parallel obligation to report online child exploitation pursuant to the new PROTECT Our Children Act – I have previously groused over the intelligence of enacting two similar-but-not-the-same laws, leaving it to industry to pay attorneys lots of money to figure out the ambiguities of complying with both. Finally, the new task force will look at one of the Attorney General's long desire items, record retention by internet services – but wait! The new McCain Act in fact has a record retention provision in it (so not only was the McCain SAFE Act not harmonized with preexisting law, but it would appear that the McCain SAFE Act was not harmonized with the Steven's Protecting Children in the 21st Century Act. Or maybe just more confusion).

Sec. 215 imposes a new requirement on the FCC's Erate program . Currently, to receive federal subsidies to support Internet access in schools and libraries, those schools and libraries must certify that they have an Internet Safety Policy in place . Sec. 215 revises that obligation to specify that the Internet Safety Policy must include “educating minors about appropriate online behavior, including interacting with other individuals on social networking websites and in chat rooms and cyberbullying awareness and response.” The State of Virginia has already implemented such an educational program – making Internet safety a required part of the educational curriculum. Many other schools systems have done likewise. But now it's federally required.

Sec. 216 adds yet another statutory definition of the Internet. I may make fun of this in a separate post. What is bizarre is that we have so many different definitions of the Internet, and the definitions are different depending on what crime is involved or what law you have to comply with.

Finally Sec. 221 (yes, the Act jumps from Sec. 216 to 221 – attorneys can't add or I guess count) amends FCC authority so that the FCC has authority to punish “certain activities relating to material involving the sexual exploitation of minors” – in other words, child pornography. Sec. 2252 deals with such things as transportation, distribution, or shipment of this stuff.

Here is the statute as amended – the text in brackets is added so you can see what is going on - the text in bold is the new amended text.

(1) Any person who is determined by the Commission, in accordance with paragraph (3) or (4) of this subsection, to have—

(A) willfully or repeatedly failed to comply substantially with the terms and conditions of any license, permit, certificate, or other instrument or authorization issued by the Commission;

(B) willfully or repeatedly failed to comply with any of the provisions of this chapter or of any rule, regulation, or order issued by the Commission under this chapter or under any treaty, convention, or other agreement to which the United States is a party and which is binding upon the United States;

(C) violated any provision of section 317 (c) [ Acquiring information from station employees ] or 509 (a) [ Influencing, prearranging, or predetermining outcome (of broadcast contests) ] of this title; or

(D) violated any provision of section 1304 [Broadcasting Lottery Information] , 1343 [Fraud by wire, radio, or television] , or 1464 1464 [Broadcasting Obscene Language], or 2252 [Certain activities relating to material involving the sexual exploitation of minors] of title 18 ;

shall be liable to the United States for a forfeiture penalty.

This statute previously dealt with enforcement issues related to broadcast. The new amendment adds a reference to 18 USC 2252 which deals with the transportation, distribution, or possession of child pornography, not in the context of broadcast. Note that child pornography is already illegal to broadcast under FCC authority. 47 C.F.R. §§ 73.4165, 73.3999, 73.4170.

The FCC is an agency of limited resources with an enforcement staff geared towards its regulatory mission. If someone violated 18 USC 2252, for instance by stepping across a state border with a flash drive filled with bad content, this is not usually something that is the FCC's concern. Furthermore, if there is a violation of 18 USC 2252, it is usually DOJ and local police who are best situated to prosecute.

So, in sum, more confusion. I would love to hear from those with enlightenment on these issues.

For those keeping track, we now have six new reports to congress due that deal with online safety for children in one way or another.