{1} Corporate employees with Internet access at the office spend about one-quarter of their time online, accessing sites unrelated to their duties. [2] Many of these employees are visiting sexually explicit sites with a regularity preceded in traffic only by news sites. [3] Moreover, seventy percent of workers who use email admit they received adult-oriented email on the job. [4] The result of all this cyber-philandering is that one in four corporate computers contains pornographic files. [5] The market itself evidences this trend in upwards of 20,000 or 30,000 pornography related Web sites in the United States alone. [6] Of the 56.8 million Web users in December 1998, 32.3 percent visited adult content sites, and that percentage has remained steady for two years despite the rapid increase in Web users over that same period. [7] Unfortunately, many of these adult sites include child pornography and obscene images. After noting the increasing accessibility of child pornography on the Internet, the United Nations convened the first annual conference on pedophilia on the Internet in early 1999. [8] Recent increases in prosecutions of child pornography and obscenity offenses only underscore the reality that no facet of society is immune from this growing problem.
{2} The steady increase in number of related child pornography and obscenity offenses since the Internet came of age in the 1990s makes this subject one important to litigators. As of early 1998, the Federal Bureau of Investigation was looking at over 4,000 suspects for child pornography related offenses and had charged 450 of those suspects, resulting in 83 convictions. [9] Moreover, other jurisdictions have seen a steady increase, particularly among males, in the prosecution of these types of offenses since the Internet took hold. [10] The explanation for these increases lies not in a new debasement of our population's morals but in an immensely simplified process for accessing child pornography and obscenity-the Internet.
{3} Today, the Internet's ubiquity has brought with it an increase in information both good and bad. [11] Child pornography and obscenity are some of this "bad" information now available at the stroke of a computer key. This article addresses the previously neglected topic of litigating Internet child pornography cases in the age of the Internet. [12] This article posits a connection between an increase in these prosecutions and the development and spread of the Internet. A brief history of the development of the Internet will prove a useful foundation for the discussion that follows.
{4} Thirty years ago, on Labor Day weekend, 1969, the Internet was born at the Department of Defense's Advance Research Projects Agency (ARPA). [13] Bob Tayler, the director of the computer research program at ARPA, conceived of putting individual computers together to share resources and save money. [14] The four-node network that ARPA created they called Arpanet. [15] Later dubbed the Internet or the "Net," it has since grown exponentially to reach nearly the entire planet and soon may even extend into outer-space. [16] Many refer to the change that followed adoption of the Internet as the information revolution, supplanting the Space Age with the Information Age.
{5} Even more recently, the information revolution has taken on steam with the development of a graphically based user-friendly interface called the World Wide Web (the Web). In 1990, the Oxford-trained physicist Tim Berners-Lee envisioned geographically separated researchers sharing information through computers. [17] To enable his vision, Berners-Lee developed what he called a hypertext transfer protocol (http), hypertext markup language (html) and the Uniform Resource Locator (URL), the building blocks of today's user-friendly Web. [18]
{6} By 1994, the Internet was no longer a playground for only the academic and defense communities. Pre-Web Internet use required a certain computer savvy that few outside academia possessed. As the easy-to-use Web interface to the Internet grew, so did the Internet's popularity among the masses.
{7} The increase in the number of child pornography and obscenity cases can surely be tied to the concomitant expansion of the Internet, particularly the Word Wide Web and its increased ease-of-use. The Web's relative simplicity has drawn in the entire spectrum of personalities as users, from school children to senior citizens, from rich to poor, from radically conservative to radically liberal.
{8} Before the advent of the Internet and the World Wide Web, computer access to child pornography and obscenity was based mostly in the dial-up bulletin board market. These bulletin boards, known as BBSs (Bulletin Board Services), required users to know the telephone number of the service's dial-in modem [19] and often involved both long-distance charges and a fee for the service. The fee was usually paid for by credit card (thus effectively eliminating access by most minors). It should be noted that many of these BBSs existed for legitimate purposes, including legal research.
{9} Configuring one's computer and modem to dial up these services was not intuitive and required a high level of computer expertise by the user. Additionally, once connected, these services required the user to know the file name desired and to issue special commands to transfer the file from the remote computer to the user's. Once the file arrived, it often needed to be decompressed (compression being a feature that allows the file to transfer more quickly) and then retrieved using a software program [20] that could read the file by its type. For example, a Microsoft Word document typically required one to have Microsoft Word to view the document. Moreover, to read files containing pornographic images, one had to have a picture-viewing or editing program and knowledge of how to use that program to view a graphical image. Most BBS services have now become local Internet Service Providers (ISPs).
{10} The Web's user-friendly approach eliminated the steep learning curve for accessing remote computers over phone lines and for viewing files transferred from those remote computers. By clicking on a hypertext link, [21] icon [22] or a photograph on the Web, one can automatically be whisked to a remote computer's site [23] and often the desired text or images appear on the user's computer screen without any additional effort by the user. The difference between pre-Web and post-Web computerized transfer and viewing of files is comparable to heating a home with self-harvested wood versus heating your home by using your finger to turn on the central heating-what was once work is now a simplistic, push-button pleasure. [24] The arrival of popular ISPs like America Online (AOL) and Microsoft Network (MSN) enabled this dramatic shift in the ease-of-use.
{11} Electronic mail or "Email" [25] was and is the main draw of ISPs, whose software now comes pre- installed on most computers sold in the United States. These software programs open a new world to those trying them for the first time. Besides email, ISPs also provide access to chat rooms [26] and Web sites. From chat rooms, individuals can learn of other resources such as Internet Relay Chat (IRC) (where real-time discussions occur and where files can be transferred during a chat), Newsgroups [27] (a modern day cork board, where files, both text and images, on various subjects are constantly being updated by other users), and Net conferencing with software like Microsoft's NetMeeting (where conversations can include telephony, video telephony, real-time shared programs and shared files).
{12} Email, IRC, Web sites, and easily accessible Newsgroups and chat rooms all were nonexistent when this nation's child pornography and obscenity laws were drafted and passed. Yet these computer services have come to dominate the pornography market's dark underbelly of decentralized distribution. The Internet-driven decentralization of the distribution and possession of illicit images significantly affects the discovery and preservation of evidence and the investigation and prosecution of such cases in our court systems. This article addresses the unique issues raised by these technological developments in litigating child pornography and obscenity cases in federal courts.
{13} Part II addresses federal child pornography statutes and obscenity laws. Part III reviews the relevant case law. Part IV addresses the practical considerations of litigating child pornography and obscenity cases. In addition, Part IV provides a quick lesson in the language of computers to facilitate a discussion of practice pointers and cautionary tales. This article concludes with a structured approach to child pornography and obscenity cases, taking into account the current technological landscape.
1. 18 United States Code § 2252
{14} Congressional interest in balancing First Amendment rights with concerns about obscenity in the wake of the famous Miller v. California case [28] led to our first national child pornography law in 1977. A combination of factors prompted Congress to pass the original federal child pornography statute: The Protection of Children Against Sexual Exploitation Act of 1977. [29] First, the production and availability of child pornography had increased in the 1970s. [30] Second, some members feared that an application of the obscenity test in Miller [31] might allow for a child pornography market. Congress' concern about treading on sacred First Amendment ground can be seen in the decision to adopt a statute in which the distribution of child pornography can be criminalized only if the material were also legally obscene under the Miller test. [32]
{15} The stated purpose of the 1977 Act was to establish federal criminal penalties for the depiction of minors as participants in sexually explicit conduct in pornographic films, books, or other visual media. [33] The Act also increased Federal penalties for interstate traffic in obscene materials depicting children. [34] Congress has amended the provisions of the Act over time to expand its protections. Each important amendment is discussed below.
{16} Shortly after Congress passed the 1977 Act, the United States Supreme Court in New York v. Ferber [35] made significant distinctions between obscenity, applying the familiar Miller standard, and non-obscene child pornography, applying a New York law that was stricter than federal law. Ultimately, the Ferber Court listed five reasons why sexually explicit materials (such as child pornography), while not obscene under the Miller standard, could be restricted without violating the First Amendment. [36]
{17} In response to the Ferber decision, Congress passed the Child Protection Act of 1984, [37] expanding Section 2252 to its full constitutional limits. Congress did this by eliminating the requirement that child pornography be obscene to be actionable and by eliminating a requirement that a commercial transaction be involved. [38] Congress also increased the age of a "minor" from 16 to 18 years. [39]
{18} In 1986, Congress passed the Child Sexual Abuse and Pornography Act of 1986, [40] banning the production and use of advertisements for child pornography. [41] In 1988, Congress enacted the Child Protection and Obscenity Enforcement Act, [42] banning the use of computers to transmit advertisements and visual depictions of child pornography, among other things. [43]
{19} In United States v. Osborne, [44] the Supreme Court held that prohibiting the possession of child pornography, even in the privacy of one's home, "passes muster under the First Amendment." [45] In response to Osborne, Congress enacted the Child Protection Restoration and Penalties Enhancement Act of 1990, [46] which for the first time prohibited the mere possession of child pornography. [47] Congress passed the Child Pornography Prevention Act of 1996. [48]
{20} The Child Pornography Prevention Act of 1996 (found at 18 U.S.C. § 2252A) addressed the use of computer technology to distort or modify visual depictions of pornography to convey the impression that children are involved in sexual activities, regardless of whether minors were actually used in the creation of the images. [49] The presumption underlying the 1996 Act is that we must prohibit even constructive depictions of minors [50] because such depictions create a market for the exploitation of actual children. [51]
{21} Thus, Congress has attempted over the years to respond to changes in technology. Surprisingly, the 1977 Act, as amended, has proven relatively resilient against computer-based violations of its provisions. The relevant text of 18 U.S.C.§ 2252 currently reads as follows:
Certain activities relating to material involving the sexual exploitation of minors
(a) Any person who--
(1) knowingly transports or ships in interstate or foreign commerce by any means including by computer or mails, any visual depiction, if--
(A) the producing of such visual depiction involves the use of a minor engaging in sexually explicit conduct; and
(B) such visual depiction is of such conduct;(2) knowingly receives, or distributes any visual depiction that has been mailed, or has been shipped or transported in interstate or foreign commerce, or which contains materials which have been mailed or so shipped or transported, by any means including by computer, or knowingly reproduces any visual depiction for distribution in interstate or foreign commerce by any means including by computer or through the mails, if--
(A) the producing of such visual depiction involves the use of a minor engaging in sexually explicit conduct; and
(B) such visual depiction is of such conduct;(3) either--
(A) in the special maritime and territorial jurisdiction of the United States, or on any land or building owned by, leased to, or otherwise used by or under the control of the Government of the United States, or in the Indian country as defined in section 1151 of this title, knowingly sells or possesses with intent to sell any visual depiction; or
(B) knowingly sells or possesses with intent to sell any visual depiction that has been mailed, or has been shipped or transported in interstate or foreign commerce, or which was produced using materials which have been mailed or so shipped or transported, by any means, including by computer, if--(i) the producing of such visual depiction involves the use of a minor engaging in sexually explicit conduct; and
(ii) such visual depiction is of such conduct; or(4) either--
(A) in the special maritime and territorial jurisdiction of the United States, or on any land or building owned by, leased to, or otherwise used by or under the control of the Government of the United States, or in the Indian country as defined in section 1151 of this title, knowingly possesses 1 or more books, magazines, periodicals, films, video tapes, or other matter which contain any visual depiction; or
(B) knowingly possesses 1 or more books, magazines, periodicals, films, video tapes, or other matter which contain any visual depiction that has been mailed, or has been shipped or transported in interstate or foreign commerce, or which was produced using materials which have been mailed or so shipped or transported, by any means including by computer, if--(i) the producing of such visual depiction involves the use of a minor engaging in sexually explicit conduct; and
(ii) such visual depiction is of such conduct; shall be punished as provided in subsection (b) of this section.(c) Affirmative defense. It shall be an affirmative defense to a charge of violating paragraph (4) of subsection (a) that the defendant-
(1) possessed less than three matters containing any visual depiction proscribed by that paragraph; and
(2) promptly and in good faith, and without retaining or allowing any person, other than a law enforcement agency, to access any visual depiction or copy thereof-(A) took reasonable steps to destroy each such visual depiction; or
(B) reported the matter to a law enforcement agency and afforded that agency access to each such visual depiction. [52]
{22} The current statute sets forth four basic categories of violations: 1) knowing transportation or shipment of child pornography, 2) knowing receipt or distribution of child pornography, 3) knowing sale of child pornography or possession with intent to sell (with alternate offenses based on geographical jurisdiction and Commerce Clause jurisdiction), and 4) knowing possession (likewise with alternate jurisdiction offenses). [53] In each case child pornography under this section requires a visual depiction of a minor engaging in sexually explicit conduct and the pornography must have actually been produced using a minor engaging in sexually explicit conduct. [54] A need to eliminate these latter requirements is what prompted Congress to pass the Child Pornography Prevention Act of 1996.
2. 18 United States Code § 2252A
{23} Congress passed the Child Pornography Prevention Act of 1996 to curb the effects of computer technology on child pornography prosecutions. After all, technology had made it possible "to produce by electronic, mechanical, or other means, visual depictions of what appear to be children engaging in sexually explicit conduct, depictions that are virtually indistinguishable to the unsuspecting viewer from unretouched photographic images of actual children engaging in sexually explicit conduct." [55] To combat the effects of these technologies, Congress added "child pornography" to the list of definitions contained in Section 2256 and enacted Section 2252A to prohibit the transportation, receipt, distribution, reproduction, and possession of "child pornography." [56]
{24} The relevant text of 18 U.S.C. § 2252A reads as follows:
Certain activities relating to material constituting or containing child pornography
(a) Any person who--
(1) knowingly mails, or transports or ships in interstate or foreign commerce by any means, including by computer, any child pornography;
(2) knowingly receives or distributes--(A) any child pornography that has been mailed, or shipped or transported in interstate or foreign commerce by any means, including by computer; or
(B) any material that contains child pornography that has been mailed, or shipped or transported in interstate or foreign commerce by any means, including by computer;(3) knowingly reproduces any child pornography for distribution through the mails, or in interstate or foreign commerce by any means, including by computer;
(4) either--
(A) in the special maritime and territorial jurisdiction of the United States, or on any land or building owned by, leased to, or otherwise used by or under the control of the United States Government, or in the Indian country (as defined in section 1151), knowingly sells or possesses with the intent to sell any child pornography; or
(B) knowingly sells or possesses with the intent to sell any child pornography that has been mailed, or shipped or transported in interstate or foreign commerce by any means, including by computer, or that was produced using materials that have been mailed, or shipped or transported in interstate or foreign commerce by any means, including by computer; or(5) either--
(A) in the special maritime and territorial jurisdiction of the United States, or on any land or building owned by, leased to, or otherwise used by or under the control of the United States Government, or in the Indian country (as defined in section 1151), knowingly possesses any book, magazine, periodical, film, videotape, computer disk, or any other material that contains an image of child pornography; or
(B) knowingly possesses any book, magazine, periodical, film, videotape, computer disk, or any other material that contains an image of child pornography that has been mailed, or shipped or transported in interstate or foreign commerce by any means, including by computer, or that was produced using materials that have been mailed, or shipped or transported in interstate or foreign commerce by any means, including by computer, shall be punished as provided in subsection (b). [57](c) It shall be an affirmative defense to a charge of violating paragraphs (1), (2), (3), or (4) of subsection (a) that--
(1) the alleged child pornography was produced using an actual person or persons engaging in sexually explicit conduct;
(2) each such person was an adult at the time the material was produced; and
(3) the defendant did not advertise, promote, present, describe, or distribute the material in such a manner as to convey the impression that it is or contains a visual depiction of a minor engaging in sexually explicit conduct.(d) Affirmative Defense. It shall be an affirmative defense to a charge of violating subsection (a)(5) that the defendant-
(1) Possessed less than three images of child pornography; and
(2) Promptly and in good faith, and without retaining or allowing any person, other than a law enforcement agency, to access any image or copy thereof-(A) took reasonable steps to destroy each such images; or
(B) reported the matter to a law enforcement agency and afforded that agency access to each such image.
{25} The term "child pornography" is defined in relevant part as: any visual depiction, including any photograph, film, video, picture, or computer or computer-generated image or picture, whether made or produced by electronic, mechanical, or other means, of sexually explicit conduct, where ... such visual depiction is, or appears to be, of a minor engaging in sexually explicit conduct. [58]
{26} This section follows the basic design of 18 U.S.C. § 2252 but omits the stated requirement that the visual depictions must actually be of minors engaging in sexually explicit conduct. [59] In other words, Congress eliminated several elements that prosecutors must prove in court if prosecutors choose to charge a child pornography offense under 18 U.S.C. § 2252A rather than Section 2252. Thus, child pornography offenses became instantly easier to prove.
{27} Additionally, Congress added "computer disk" to the list of media whose possession is specifically proscribed if they contain child pornography, and they created the new crime of knowing reproduction of child pornography. [60] The two sections also differ slightly in how they apply Commerce Clause jurisdiction for the possession offenses.
{28} Until 1998, Section 2252A's possession offense elements were easier to prove than the possession offense set out in Section 2252. Congress had required the possession of more than one image of child pornography in both original Sections, but Section 2252A only required the possession of three or more individual images, whereas Section 2252 requires the possession of three or more compilations of images. [61]
{29} The original Section 2252 invoked the Commerce Clause to regulate mere possession of child pornography using language requiring the possession of three or more compilations of materials, the mere volume of material suggesting the use of interstate commerce, if not an intent to distribute in interstate commerce. [62] Section 2252A originally changed the Commerce Clause scheme of Section 2252 by requiring possession of three or more images in a compilation or any other matter rather than three or more compilations originally required by Section 2252.
{30} Under the pre-1998 version of Section 2252, an argument could be made that possessing a computer disk containing three or more images of child pornography was not an offense under that section because a computer disk is but one compilation and three are required under the language of that statute. [63] This was true when that statute's original wording "3 or more books, magazines, periodicals, films, video tapes, or other matter" [64] are analyzed using the doctrine of statutory construction called ejusdem generis [65] and its counterpart noscitur a sociis. [66]
{31} These terms of art stand for the proposition that general terms (such as "or other matter") that follow a series of more specifically enumerated terms (such as books, magazines, etc.), refer to items similar in structure and function to the enumerated terms. [67] That is, the words "or other matter," are not a catch all, but refer to any other compilation that can be compared with a book, magazine, etc., of which the statute requires the possession of three or more before proscribing the possession. [68] By eliminating this requirement when it originally passed Section 2252A, Congress made the successful prosecution of smaller quantities of child pornography easier, particularly if those depictions are stored on computer related media. [69] Also, the addition of "computer disk" to the list of compilations in Section 2252A resolved any issue arising in the unlikely case that litigators face a situation where less than three computer disks with relevant images are discovered.
{32} Thus, we see that just before national elections in 1998, Congress amended both Sections to reduce the threshold number of images required under each statute's possession proscription. Congress also compensated for this reduced threshold by adding an affirmative defense to each Section. The threshold number of images required for a proscribed possession was reduced from three compilations to one compilation in Section 2252 and from three images to one image in Section 2252. Effectively, Congress eliminated any numerical threshold as an element of the offense and instead shifted the numerical threshold to apply in the form of an affirmative defense. However, when switching the numerical threshold to an affirmative defense, Congress added some baggage to the existing defense scheme. It is no longer enough to defend against charges under these statutes by showing possession below the threshold amount (set at three "matters" in the new affirmative defense).
{33} The new versions of these statutes require meeting the numerical threshold, plus a showing that the possessor took reasonable steps to destroy each depiction, and reported his predicament to law enforcement, and provided them access to the suspect visual depictions. [70] This new affirmative defense is problematic for several reasons. First, although Congress clearly attempts to protect the innocent interloper from prosecution under these statutes, the innocent interloper receives no such protection. Inadvertent and even accidental access to a suspect site is possible and often will lead to multiple illicit images stored in areas of a person's computer that they may not know exist, let alone know how to access and delete with finality. Second, actually deleting an image may be impossible for the uninitiated masses drawn to the easy-to-use Web (see discussion infra). Finally, prosecutors, defense attorneys, judges and jurors all must of necessity often possess more than the threshold amount of images, if only temporarily, when dealing with these cases. If a defense attorney defends a client against charges under one of these statutes, receives copies of the evidence against her client in electronic form, and reviews that evidence on her computer, is she then required to allow law enforcement to search her computer to assert the affirmative defense? What constitutes a reasonable attempt to destroy such images if they are in electronic form, spread like a virus in unknown places on a defendant's computer? These and other questions revolving around the new affirmative defense to federal child pornography charges remain unanswered and deserve special attention.
3. Elements of Offenses
{34} In United States v. X-Citement Video, Inc., [71] the United States Supreme Court addressed the issue of whether knowledge of both the subject matter and of the age of the performer were elements of the offense under 18 U.S.C. § 2252. The Court concluded that both were elements. [72] Justice Stevens' concurring opinion in X-Citement Video lays out what the Supreme Court may see as the appropriate elements for this offense. Those elements are that a suspect: "
(1) knowingly transports or ships in interstate or foreign commerce by any means including by computer or mails, any visual depiction, if-
(A) the producing of such visual depiction involves the use of a minor engaging in sexually explicit conduct; and
(B) such visual depiction is of such conduct; . . ." [73]
{35} Section 2252A is so new that there is a dearth of case law overall, and no real appellate guidance on the appropriate elements of the offenses set forth in its subsections. [74] Nevertheless, a logical review of the statute and its structure suggests the following elements:
1) That the accused mailed, transported or shipped, received, distributed, sold or possessed with intent to sale, or reproduced in or using a means of interstate or foreign commerce, including through a computer, certain material(s),
2) That the certain material(s) depict child pornography; and
3) That the accused knew the materials depicted child pornography.
{36} Although child pornography statutes have been challenged on Constitutional and other grounds, most federal courts have upheld them. Specifically, Section 2252 has survived attacks claiming vagueness, [75] undue invasion of privacy, [76] overbreadth, [77] lack of Commerce Clause nexus, [78] and its general insufficiency under criminal law. [79] Section 2252A is too new for courts of have examined it as thoroughly as Section 2252, but the two acts are similar enough that precedent will overlap.
{37} There is some considerable controversy however regarding some areas that are applicable to both sections. [80] Some of that controversy revolves around what constitutes "lascivious" and "exhibition" (taken from the definition of sexually explicit conduct that includes "lascivious exhibition of the genitals or pubic area."). [81] Also, The Ninth Circuit Court of Appeals found Section 2252 unconstitutional because it does not contain a scienter requirement and thus chills free speech. [82] The Supreme Court overturned the Ninth Circuit's decision by reading a scienter requirement into the statute. [83] Several other circuits have read a knowledge requirement into the statute, i.e., knowledge that the materials contain minors. [84] Also, several district courts have held that the statute as written requires knowledge that the materials contained minors and is thus constitutional. [85]
{38} As discussed, Sections 2252 and 2252A are similar. Section 2252A is unique in its elements of proof, specifically the elimination of a requirement that the child pornography actually involve a child (defined as a minor engaged in sexually explicit conduct). [86] Congress did this both by limiting the elements and by defining child pornography to include visual depictions that "appear[] to be, of a minor engaging in sexually explicit conduct." [87] Thus, Section 2252A proscribes a drawing depicting child pornography that had no other source than the author's deviant thoughts. All of this has raised a serious debate about the wisdom and constitutionality [88] of this approach to child pornography. [89] Until this debate is fully resolved, litigators should be careful not to rest entire cases on images that legally constitute "child pornography" but fall in the twilight zone of visual depictions that do not involve the use of minors in their production. Often, illicit images are not limited to those that depict children engaged in sexually explicit conduct. Illicit images also include obscenity, and many cases involving illicit images are charged under obscenity statutes.
{39} Child pornography is only one of three categories of sexually explicit expression subject to Congressional regulation despite the First Amendment. [90] The second of these is the oft litigated area of obscenity. As a rule, applying existing obscenity standards to child pornography renders all such depictions obscene. However, not all obscenity involves child pornography. Indeed, those found possessing child pornography are often found possessing obscene depictions that do not involve children. Sometimes, litigators will find individuals who possess no child pornography, but who have in their possession images that are obscene.
{40} Obscenity laws do not prohibit the mere possession of obscene materials. Nevertheless, any individual who possesses obscenity can still be prosecuted under obscenity statutes because it is likely that the obscene materials were transported in interstate commerce. Obscenity does not grow on trees, it must be imported via interstate commerce. [91] In the computer age, most suspects possessing obscenity likely used a computer service to facilitate the transport of obscene materials in interstate commerce or foreign commerce-the quintessential obscenity violation. The most commonly used federal obscenity law is 18 U.S.C. § 1465.
1. 18 United States Code § 1465
{41} In 1955, Congress added Section 1465 to close "a serious loophole" in existing obscenity laws. This loophole allowed obscenity "to be distributed by private automobiles and by trucks." [92] A set of existing obscenity statutes already governed transmission of obscene information, transportation of obscene material by mail, [93] and importation or transport via common carrier, [94] by broadcast [95] and now by private conveyance. [96]
{42} Congress amended Section 1465 in 1988 "to address . . . the use of computers . . . to transmit prurient material." [97] As early as 1985, Senator Trible proposed legislation [98] when the Attorney General suggested that Section 1465 would not prohibit transmission of obscenity via computer. [99] Surprisingly, Congress did not incorporate computer specific language into Section 1465 when the amendments were adopted as part of the Child Pornography and Obscenity Enforcement Act of 1988. [100]
{43} In 1996, however, Congress eventually amended Section 1465 to prohibit the "use of a facility or means of interstate commerce or an interactive computer service" to transport obscenity (probably in an attempt to relieve the government of parts of its burden of proof). [101] Now the government no longer had to prove the precise means of transport used. [102] Other minor changes to the statute were made in 1994. [103]
{44} The text of Section 1465 follows: Transportation of obscene matters for sale or distribution Whoever knowingly transports or travels in, or uses a facility or means of, interstate or foreign commerce or an interactive computer service (as defined in section 230(e)(2) of the Communications Act of 1934 [47 USCS § 230(e)(2)]) in or affecting such commerce for the purpose of sale or distribution of any obscene, lewd, lascivious, or filthy book, pamphlet, picture, film, paper, letter, writing, print, silhouette, drawing, figure, image, cast, phonograph recording, electrical transcription or other article capable of producing sound or any other matter of indecent or immoral character, shall be fined under this title or imprisoned not more than five years, or both. The transportation as aforesaid of two or more copies of any publication or two or more of any article of the character described above, or a combined total of five such publications and articles, shall create a presumption that such publications or articles are intended for sale or distribution, but such presumption shall be rebuttable. [104]
{45} The statute creates three basic prohibitions: 1) knowing transportation of obscene matters in interstate or foreign commerce 2) knowing travel with obscene matters in interstate or foreign commerce, or 3) knowing use of facilities, such as interactive computer services, for the purposes of sale or distribution of obscene matters. [105] The focus is on the movement of obscene matters, not possession thereof.
{46} Unlike the child pornography statutes, the primary obscenity statute has been around long enough to draw the attention of federal appellate courts in important areas, such as the elements of the offense. For Section 1465 those elements are: 1) That the accused engaged in the interstate transportation of obscene material, [106] and 2) That the transportation was for the purpose of sale or distribution. [107] 3) That the accused had knowledge that the materials so transported were sexually oriented (knowledge of the exact content is not required). [108]
{47} Section 1465 does not apply to intangible objects such as phone calls to dial-a-porn services. [109] However, the Sixth Circuit Court of Appeals has held that although images transported through a computer and phone line may be intangible, their manner and form are not so ephemeral as to make computers a safe-haven for the obscenity market. [110] The same court reasoned that Congress intended to pass comprehensive legislation on the subject of transportation of obscene materials and that transportation of obscene images using computers and phone lines falls withing the plain meaning of the statute. [111]
2. 18 United States Code § 1462
{48} National concern about the proliferation and distribution of pornographic materials via computers prompted Congress to enact the massive Telecommunications Act of 1996. Congress, thereby, added a computer provision to Section 1462 of the federal criminal code. The Telecommunications Act of 1996 also included the now defunct Communications Decency Act of 1996 (CDA), [112] which attempted to control computer-based indecent [113] communications and images in a broad way since found unconstitutional. [114]
{49} The challenged portion of the CDA (Section 502, amending 47 U.S.C. §§ 223(a) and 223(d)) provided in part that any person in interstate or foreign commerce who, "by means of a telecommunications device," "knowingly . . . makes, creates, or solicits" and "initiates the transmission" of "any comment, request, suggestion, proposal, image or other communication which is obscene or indecent, knowing that the recipient of the communication is under 18 years of age," "shall be criminally fined or imprisoned." [115]
{50} The now-stricken language also made it a crime to use an "interactive computer service" to "send" or "display in any manner available" to a person under age 18,
any comment, request, suggestion, proposal, image, or other communication that, in context, depicts or describes, in terms patently offensive as measured by contemporary community standards, sexual or excretory activities or organs, regardless of whether the user of such service placed the call or initiated the communication. [116]
{51} Also successfully challenged was language that made it a crime for anyone to "knowingly permit[] any telecommunications facility under [his or her] control to be used for any activity prohibited" in §§223(a)(1)(B) and 223(d)(1). [117] There was no quarrel with the statute to the extent that it covered obscenity or child pornography, which were already unlawful before the CDA's adoption. [118]
{52} The only lasting, relevant change that the Telecommunications Act of 1996 made to Section 1462 was the addition of the language in each paragraph, "or interactive computer service (as defined in section 230(e)(2) of the Communications Act of 1934)"; and, in the second paragraph, "or receives," and "or importation." [119] This language has not been the subject of any court challenge to date.
{53} The relevant text of Section 1462 follows:
Importation or transportation of obscene matters
Whoever brings into the United States, or any place subject to the jurisdiction thereof, or knowingly uses any express company or other common carrier or interactive computer service (as defined in section 230(e)(2) of the Communications Act of 1934 [47 USCS § 230(e)(2)]), for carriage in interstate or foreign commerce--(a) any obscene, lewd, lascivious, or filthy book, pamphlet, picture, motion-picture film, paper, letter, writing, print, or other matter of indecent character; or (b) any obscene, lewd, lascivious, or filthy phonograph recording, electrical transcription, or other article or thing capable of producing sound . . .
Whoever knowingly takes or receives, from such express company or other common carrier or interactive computer service (as defined in section 230(e)(2) of the Communications Act of 1934 [47 USCS § 230(e)(2)]) any matter or thing the carriage or importation of which is herein made unlawful . . . .
Shall be fined under this title or imprisoned not more than five years, or both, for the first such offense and shall be fined under this title or imprisoned not more than ten years, or both, for each such offense thereafter. [120]
{54} Courts have ruled that the elements of the offense under 18 U.S.C. § 1462 include:
1) That the accused used a common carrier (such as a computer service), [121]
2) That the accused transported obscene material in interstate commerce, [122] and alternatively
1) That the accused received certain matters in interstate shipment, [123]
2) That the accused had knowledge of the contents of those matters at time of the receipt, [124] and3) That the certain matters were obscene. [125]
{55} Probably the most interesting area of litigation in federal computer-based obscenity law is the application of the community standard test established in Miller. Some argue that the structure and operation of the Internet, not to mention how people use it, make application of a local community standard to the Internet problematic at best [126] or at worst unconstitutionally vague and overbroad. [127] Some argue for a national community standard [128] and others in this author's experience have used this soft spot to advocate elimination of federal obscenity laws altogether. Most conservative courts, will continue to instruct that the standard for obscenity is a local community standard. Litigators should prepare for this issue in every computer-based obscenity case until it is resolved by our highest courts.
{56} If for no other reason than the uncertainty surrounding the potentially varying applications of the Miller test, prosecutors should use obscenity laws only when other means fail to address the discovered misconduct. More basic criminal laws may be able to satisfy the need for justice without risking the strength of a conviction on uncertain areas of our law.
A. United States v. Maxwell
{57} The Air Force broke new ground when it decided to prosecute one of its members for using a personal computer to transmit and receive pornographic materials over the Internet. [129] Most federal computer-based child pornography and obscenity cases before Maxwell involved entrepreneur carriers (including some BBS operators and ISPs), but not consumers or end users, nor did they involve the Internet. In December of 1991, Mr. Roger D. Dietz, a California subscriber to America Online (at the time only about 215,000 users strong) reported to the FBI that some subscribers of America Online (AOL) were using the service to send and receive child pornography. [130] He gave the FBI a sample of some images he had discovered on the service. [131] Mr. Dietz also sent an email to AOL officials listing the screen names and communications of those subscribers he thought were involved in the illicit trade. [132] As a result of Mr. Dietz' activities, the FBI opened an investigation. [133]
{58} AOL had anticipated a federal search warrant and began gathering the communications from its servers connected to the screen names that Mr. Dietz had given them. [134] The FBI obtained the warrant using much of the same information and then presented it to AOL after AOL had already gathered most of the information required by the warrant. [135] As a result, AOL gave the FBI more than 12,000 pages of email messages and nearly 40 high capacity computer disks that contained visual images. [136] Unfortunately for Colonel James A. Maxwell, Jr., Commander of the Goodfellow Training Center at Goodfellow Air Force Base, Texas, one of his screen names was among those Mr. Dietz had provided, and thus his emails and images were eventually seized. [137]
{59} Once the FBI realized that an Air Force member was involved, they provided the relevant information to the Air Force Office of Special Investigations (AFOSI) who opened their own investigation into Col. Maxwell's activities. [138] As part of their investigation, the AFOSI obtained a search authorization from the designated military magistrate for Goodfellow AFB. [139] They then searched Col. Maxwell's on-base home for any matters related to the transmission and possession of child pornography and other obscene matter. [140] The AFOSI seized Col. Maxwell's personal computer, which was later searched. [141] Three images of child pornography found on the computer were eventually used to convict Col. Maxwell at his subsequent court-martial. [142] Col. Maxwell was convicted of four specifications under Article 134 of the Uniform Code of Military Justice (UCMJ). [143] One of the specifications was for violating 18 U.S.C. § 2252 [144] and another was for violating 18 U.S.C. § 1465. [145] The other two specifications focused on the communication of indecent language to another male military member who was also a member of AOL's service and to whom Col. Maxwell had sent various email messages of a sexual nature. [146]
{60} On appeal to the Air Force Court of Criminal Appeals, Col. Maxwell claimed several errors had occurred at trial. [147] These included, 1) the search authorization lacked probable cause (and the good faith exception did not apply), [148] the search authorization violated his expectation of privacy, and was issued by an unqualified search authority; 2) 18 U.S.C. § 2252 lacks a scienter requirement and is thus unconstitutional, [149] 3) 18 U.S.C. § 1465 cannot be used to proscribe transmission of computer images, [150] 4) private communications cannot be criminalized as indecent language, [151] 5) the visual depictions did not constitute child pornography, [152] 6) use of copies of the seized images violated the Best Evidence Rule, [153] 7) the instructions to the members were incorrect as to 18 U.S.C. § 2252 and 18 U.S.C. § 1465, [154] and 8) the decision to refer his case to trial was a result of unlawful command influence. [155] The Air Force court found no error. [156] The Air Force court held that Col. Maxwell had a reasonable expectation of privacy in his email service, [157] but that those involved in executing the search warrant were acting in good faith. [158]
{61} On appeal to the Court of Appeals for the Armed Forces, Col. Maxwell raised five issues: [159] 1) the validity of the search warrant, [160] 2) the propriety of the search authorization, [161] 3) the propriety of the judge's instructions on scienter and on community standards, [162] 4) the constitutionality of the indecent language specification, [163] and 5) the appropriateness of his sentence. [164]
{62} The Court of Appeals disagreed with the Air Force court on the good-faith exception issue, reversed the conviction as to the two indecent language specifications under the military criminal code and remanded the case for a new hearing on the sentence as a result of their ruling. [165] The basis for the Court of Appeals' reversal was an error in the execution of the search warrant that the FBI served on AOL. [166] AOL had anticipated and prepared for the warrant by drafting a program to search its servers for data connected with its members' various screen names. Members were allowed to have five screen names per account. [167] These screen names made it possible for a member to use the service without divulging personal information such as a real name or addresses. [168] Col. Maxwell used the screen names Redde1 [Ready one] and Zirloc, among others. [169] He used only the screen name Zirloc when speaking with Launchboy (the male military member whom he engaged in sexual conversations). [170] When Mr. Dietz had given AOL a list of members' screen names, the only name he provided connected to Col. Maxwell was the screen name Redde1. [171] It was this information that AOL used to gather data for the FBI's search warrant before actually having seen the warrant or its language. [172]
{63} When the search warrant for the FBI was prepared, someone changed all of the screen names to capital letters, thus changing Redde1 to REDDEL (mistaking the 1 [one] for an l [small letter L]). [173] There was no user on AOL with a screen name REDDEL. [174] However, AOL gave the FBI data connected to Redde1 because they relied on the language of Mr. Deitz's initial complaint not on the language of the search warrant (which was defective in this respect). [175] In other words, if AOL had never received Mr. Deitz's list, but acted only on the warrant, the FBI (and thus the AFOSI) may never have found the evidence eventually used to convict Col. Maxwell. Furthermore, the FBI's search warrant did not list any other name connected with Col. Maxwell, yet AOL voluntarily provided all of the information for all of a member's screen names for any user whose screen name they had from Mr. Dietz. [176] Thus, although Mr. Deitz may have only provided one of a user's five screen names, and although the warrant may have only asked for one of a user's five screen names, AOL gave the FBI data connected to all five screen names for any given member. [177] Here, Zirloc was one of these extra screen names first brought to light by AOL's voluntary expansion of the search warrant, a screen name for which no probable cause existed to search data connected therewith. [178]
{64} The Court of Appeals did not overturn the conviction because of the scrivener's error in transcribing Redde1 to REDDEL, but rather on AOL's providing other screen names not listed in the warrant (such as Zirloc here). [179] The court's concern was that often the five screen names AOL provides are assigned to different family members and thus represent separate individuals. [180] The court was unwilling to consider the search and seizure of those unrelated individuals' data to be in good faith. [181] Likewise, the Court refused to validate the search of Zirloc on grounds that the search was private or conducted in plain view or the that name would have inevitably been discovered. [182] The only evidence on the indecent communications charges was evidence derived from the screen name Zirloc, so the Court threw out the conviction on those two specifications. [183] This left the United States Code-based child pornography and obscenity specifications for analysis.
{65} Surprisingly, at trial the defense requested the judge instruct the members on a narrow, community-based standard of obscenity. [184] The judge rejected the defense request and instead gave the members an instruction that obscenity is judged from the viewpoint of a "nationwide community as a whole." [185] The Court of Appeals found this instruction to be improper, proposing instead an Air Force community standard when the United States Code is the basis of a charge. [186] The court also suggested that an appropriate standard in computer-based obscenity cases may be the community of subscribers to a particular ISP (such as AOL here) or the community of users of a BBS, reasoning that these communities are identifiable, expansive and more uniform and connected than other communities. [187] The court really did not rule on which standard would be applicable, only that the national standard was inappropriate and that among the various possible standards, the amorphous national standard was more favorable to Col. Maxwell than any of the other possible, more "homogeneous standards." [188] Thus, the error in applying that standard in his case was harmless. [189]
{66} Finally, the defense contended that 18 U.S.C. § 2252 requires as an essential element of proof that the accused actually knew, not merely thought, that the actors in the charged images were minors. [190] The Court of Appeals recognized that the statute requires knowledge of the character of the material and the age of the individuals posed in the materials. [191] However, the Court refused to require that the government prove the accused knew the actual age of the subject of the materials. [192] Rather, all the government must prove, in such cases, is that the subjects were minors and that the accused believed they were minors. [193] The Court noted that here the file names of the images and email messages admitted into evidence on this specification were substantial circumstantial evidence that the accused believed the images depicted minors. [194] The Court also recognized that a reasonable belief the subjects were of legal age may be a defense. [195]
{67} The defense in Maxwell relied heavily on United States v. X-Citement Video [196] in its unsuccessful claim that "actual knowledge" is needed for the "use of a minor" element of Section 2252. [197] Strangely, the Court of Appeals addressed the Supreme Court precedent with a reference to Congressional intent. [198] The Court of Appeals recognized the Supreme Court's holding that a scienter requirement applies to both the character of the material and the age of the participants, but it complained that surely Congress did not intend the "insuperable barrier" to prosecution that the Supreme Court's holding in X-Citement Video seems to create. [199]
B. Other Cases
1. X-Citement Video
{68} In United States v. X-Citement Video, Inc., [200] the United States Supreme Court reversed a Ninth Circuit Court of Appeals' ruling that held 18 U.S.C.§ 2252 was unconstitutional on its face because it did not contain a knowledge requirement. [201] The Supreme Court found a proper reading of the statute shows that it does require a knowledge element. [202] The case is not a computer-based child pornography case, but rather involved the prosecution of a videotape dealer for distributing sexually explicit tapes of a 17-year-old girl to an undercover police officer. [203]
{69} X-Citement Video is really an exercise in sentence diagraming. The Ninth Circuit reasoned the term "knowingly" in 18 U.S.C. § 2252 modifies only the surrounding verbs: transports, ships, receives, distributes, or reproduces. [204] "Under this construction, the word 'knowingly' would not modify the elements of the minority of the performers, or the sexually explicit nature of the material, because they are set forth in independent clauses separated by interruptive punctuation." [205]
{70} However, the Supreme Court found that this created an absurd result and decided Congress must have intended the more logical construction-that "knowingly" modifies both the character of the material and the age of the participants. [206] The Court found that in the past, statutes without specific knowledge requirements had been read to include them, particularly where those statutes criminalize otherwise innocent conduct (such as handling materials as here) and carry harsh penalties. [207] The Court found a presumption in favor of a scienter requirement should apply to each of the statutory elements of such crimes. [208] Public welfare offenses are exempt from the principle favoring scienter, but the Supreme Court found that 18 U.S.C. § 2252 is not a public welfare offense.
{71} The Court noted that unlike obscenity cases, the age of the performers is the crucial element that distinguishes between innocent and criminal conduct; thus, the knowledge requirement must apply to that element. [209] After a thorough review of the legislative history, the Court was persuaded that Congress intended that the term "knowingly" apply to the requirement that the depiction be of sexually explicit conduct. [210] However, the Court was less clear whether the requirement extend also to the age of the performers. [211] To conclude it did not would involve grammatical acrobatics [212] unsupported in the legislative history. [213] The court finally reasoned that applying the knowledge requirement to all the elements of this offense eliminated any doubt that the statute was constitutional. [214] The Court conclusive held "that the term 'knowingly' in Sec. 2252 extends both to the sexually explicit nature of the material and to the age of the performers." [215]
{72} The Court of Appeals in Maxwell may be at odds with the X-Citement Video case. The lower court avoids such an obviously incongruent position by recognizing that the knowledge requirement applies to both elements, but only at the level of belief. [216]
2. United States v. Hilton
{73} In United States v. Hilton, [217] Judge Gene Carter granted a motion to dismiss a charge under 18 U.S.C. § 2252A, finding the statute unconstitutionally vague and overbroad. [218] The District Court found the statute unconstitutionally vague because the definition of "child pornography," which includes visual depictions that "appear to be[ ] of a minor" as well as those that are of a minor, [219] fails to clarify with sufficient definiteness the conduct which is prohibited. [220] The Distict Court found the statute unconstitutionally overbroad because a substantial amount of protected expression involving young-looking adults or even youthful-adults will be chilled by the statute. [221] The motion raised other challenges to the statute that Judge Carter found to be groundless. [222]
{74} Interestingly, on the aspect of the statute's proscription of images that merely appear to be of children, the Court held the statute was content neutral, and to that extent constitutional. [223] Quite simply, "the government's purpose in including language regulating images that appear to be of children engaged in sexually explicit activities is to address harmful secondary effects [224] flowing from the existence and availability of such images rather than to suppress the individual. [225]
3. United States v. Thomas
{75} In the first-ever federal criminal conviction for transmitting obscene materials over a computer network, [226] United States v. Thomas, [227] the Sixth Circuit Court of Appeals upheld the convictions of two BBS owners and operators, Robert and Carleen Thomas, for violating 18 U.S.C. §§ 1462 and 1465. [228] Robert Thomas alone was charged and acquitted of violating 18 U.S.C. § 2252. [229]
{76} The Thomases began running a BBS in 1991. [230] The focus of their BBS was sexually-explicit materials that they obtained from local adult bookstores. [231] The Thomases scanned the contents of their purchases and made them available to subscribers on their BBS. [232] Their California-based BBS was called Amateur Action Computer Bulletin Board System ("AABBS") and received visitors with the phrase, "Welcome to AABBS, the Nastiest Place On Earth." [233] Often, they would also mail materials to individuals who placed orders through their BBS. [234]
{77} Three years into their business, the United States Postal Service Inspector received a complaint from a resident of Tennessee. [235] An agent from the postal service went undercover, visited the BBS site, ordered several video tapes, and sent emails and engaged in chats with one of the Thomases. [236] Eventually he obtained a warrant for the Thomases' computer system where the evidence used against them at trial was found. [237] The trial was held in a Tennessee federal court. [238]
{78} On appeal, the Thomases claimed that 18 U.S.C. § 1465 did not apply to intangible objects such as the 0's and 1's that made up the scanned images available on their BBS. [239] They also claimed that Congress did not intend to regulate computer transmission of obscenity under the same statute because the statute was silent on the subject. [240] As to the intangibility of computer-transmitted images, the court reasoned that the form of the images during transmission is not controlling but rather the form before and after transmission. [241] The Sixth Circuit noted that the images began as hard copy images scanned into a computer and subscribers who obtain the images through the BBS could print out hard copies as well. [242]
{79} When it addressed whether computer transmission can be charged under Sections 1462 and 1465, the Court noted that the statutes are comprehensive and expansive and include unstated means of interstate commerce, particularly means unknown to Congress at the time. [243] Finally, relying on the Air Force Court of Criminal Appeals decision in Maxwell, the Sixth Circuit cited with approval that court's reasoning that
[t]he use of the terms 'transports,' 'distribution,' 'picture,' 'image' and 'electrical transcription' leads . . . to the inescapable conclusion the statute is fully applicable to [computer-based receipt and transmission of obscenity]. . . . It is clear Congress intended to stem the transportation of obscene material in interstate commerce regardless of the means used to effect that end.
{80} The Sixth Circuit also approved of the trial court's jury instruction that expert testimony is not required to prove the prurient appeal of the materials at issue. [245] The Thomases had complained that expert testimony should be required when sexually-explicit materials are directed at a deviant group (i.e., individuals interested in sado-masochism, bestiality, etc.). [246] The Court criticized the use of experts on obscenity generally and held that experts are not required to explain images that are the best evidence of what they represent. [247] Evaluating the need for expert witness testimony in computer-based cases is but one of many practical considerations for litigators.
{81} It is one thing to grasp the history, structure and precedent of our child pornography and obscenity statutes, it is quite another to apply them to a new, explosively evolving medium-the Internet. To understand the Internet properly and how it may affect child pornography and obscenity prosecutions, one must understand the medium more fully. To further this end, I have provided a technical review of concepts that will arise while investigating, prosecuting, defending and appealing computer-based violations of child pornography and obscenity laws.
{82} Of the many possible approaches to a summary review of something so expansive as the Internet, the one dictated by the logic of this article is to start big and get small. Therefore, what follows is first, a brief explanation of what the Internet is, then, an explanation of its components, including personal computers and their components. Finally, a discussion of software applications used on both personal computers and the Internet will round out the necessary technical review.
1. The Internet
{83} The Internet is really just one way of using existing communications infrastructure to communicate. We all use telephones every day. These telephone calls are generally voice-switched, meaning that when we place a call, the telephone company maintains a permanent circuit between the two (or more) telephones that are in use, allowing the signals, usually analog voice signals, to pass unhindered.
{84} The Internet uses packet-switching to allow communications. The packet-switching protocol was developed originally to facilitate communications between computers at remote locations, often over existing telephone lines. One of these protocols' technical names is TCP/IP (Transmission Control Protocol/Internet Protocol). [248] Packet switching allows data to be broken up in to small, identifiable packages and sent over various routes to the same destination. Computers that understand and use the protocol can create the data packets, send them, receive them and reassemble them in their original form. The protocols are written so that computers speaking different languages (represented by the operating systems Windows, DOS, UNIX, MacIntosh, etc.) can still communicate using the protocols.
{85} When one computer connected to the Internet makes a request for information or wants to send information, the request travels generally through a phone line to the telephone company's central office (for home users) or through network wires and servers (for corporate users) to an Internet Service Provider (ISP). ISPs simply act as central switching locations for these requests much like telephone companies do for voice phone calls. The ISP's computers then route the information first to the regional network [249] to which they are connected, then through either one of four major network access points in United States [250] or directly through the national commercial backbone [251] and back again through a similar route to the computer at the other end of the transaction. The national commercial backbone is as much an icon of interstate commerce as the interstate highway system, the national railroads or our hub-and-spoke airline system.
{86} The World-Wide Web (the Web) is just one way of using the Internet, though it has become the dominant way. [252] The Web uses special protocols that make the user interface extremely simple-literally a point-and-click world. The Web consists of documents written in hypertext markup language (html) and transferred between computers using hypertext transfer protocol (http). Hypertext is a term that refers to the ability to link documents together, usually textually, but also in other ways. Hypertext linking allows a user to click on a word in a document to call up another document related to that word. The linked document can include text, still images, sounds, and video. For example, this document is hypertext-linked. You can click on an endnote and the computer screen will bring that endnote into view. In the endnotes are additional links to other computers systems that call up the documents cited in the endnote. Hypertext links (and other links) work with any identifiable item on a viewable page, including icons or images.
{87} Since Arpanet's inception, each computer connected to the Internet has been assigned a numerical address such as 205.245.172.72. Because these numbers do not tell the average person much about the computer they represent, domain names can be used to represent them. Domain names such as INTERNET.COM are really shortcuts to these numerical addresses. World-Wide Web browsers can easily connect to a computer by typing in a domain name in the form of a uniform resource locator or URL, such as http://www.internet.com. This URL for example tells the Web browser software on your computer to use hypertext transfer protocol to connect to the Domain Name System (DNS) to discover and connect to the address behind "INTERNET.COM" on the World-Wide Web. {83} Additionally, individual users can be assigned addresses on the Internet as well. Generally, these take the form of email addresses such as USER@INTERNET.COM. ISPs use these addresses to gather messages sent over the Internet to their customers. When a customer connects to their ISP, they can then get to their messages much like one can walk into a post office and access a post office box. Some ISPs keep copies of email messages on the ISP's computers, but most do not keep them once the customer gets to them. Some email software stores email messages that have been read or deleted indefinately until action is taken to permanently rid them from the system.
{88} When we speak of the Internet, just as when we speak of telephone service, we are not speaking generally of something visible or tangible, rather we speak of something conceptual. The Internet is the concept of how all of the processes described above work to enable computers to communicate. The Internet is not really a computer or even a set of computers, though computers help run it. The Internet is really just the communications system that computers use to interact, literally a super highway for information. In this sense, the substance of the Internet is ephemeral-all of the substance is in the computers that use the Internet. However, it still makes sense to speak of computers synonymously with the Internet for the same reason it makes sense to speak of telephones synonymously with telephone service. One is a tool for using the other.
2. Personal Computers
{89} Computers are simple tools. They take input and provide output. Input can come from a keyboard, a mouse, a microphone, a video camera, a scanner, a disk, a diskette, a CD-ROM, or another computer (such as over the Internet). Output can go to a screen, a printer, speakers, a disk, a diskette, recordable CD, or another computer (such as over the Internet). The "computing" [253] occurs between the input and the output. Because computers are machines, the input and output they process must be in a form understandable to a machine. That form is a binary digit, also called a bit.
{90} A bit is the smallest unit of data in a computer. A bit has a single binary value, either 0 or 1, representing "on" or "off." [254] Most computers are designed to store data and execute instructions in bit multiples called bytes. Generally, there are eight bits in a byte. The value of a bit is usually stored as either above or below a designated level of electrical charge in a single capacitor within a memory device. [255]
{91} Memory devices can include temporary memory devices and permanent memory devices. Generally, when one speaks of a computer's memory, one is speaking of its temporary processing memory, not its permanent storage capacity. Permanent storage capacity on modern personal computers most often comes as hard-disk space. Understanding how memory and storage capacity interact is important for practitioners, particularly given that relevant evidence is much more likely to be found in one but not the other.
{92} When a computer is started, it requires immediate input. The awakened computer turns to its input devices in a predetermined order. Normally, the first input comes from a built-in hard-disk drive. [256] This drive is a permanent storage device where instructions for the computer have been stored and will remain stored even when the computer's power supply is turned off. A hard-disk drive is a plate that spins like a record. Data is retrieved from the spinning disk through a moveable arm that hovers above the disk as it spins.
{93} Among the instructions the computer first receives is the operating system it will use. The most common operating systems are Windows, DOS, MacIntosh, and UNIX. Crucial parts of the operating system are then loaded into the computer's temporary memory. Temporary memory is much faster because it is solid state, otherwise everything could be run from the permanent memory of the hard-disk. The hard-disk is slower because it requires mechanical action to store and retrieve the millions of bytes the computer will need to perform its various tasks. Once the operating system is up and running, the user can then run software programs that work under that operating system.
{94} Computers run these software programs by taking them from the permanent storage of the hard disk and loading them into temporary memory where they can be found more quickly. For example, when a user wants to use a word processing program and provides that input to the computer, the computer will find the program on its permanent storage and load a copy of much of that program into its temporary memory. When the user types a message with the program, the message is similarly only in temporary memory until the program or the user saves a copy of that message in a more permanent form such as on the hard-disk drive or a floppy diskette.
{95} Hard disk drives are classified by their storage capacity. Today, their storage is measured in gigabytes. Just as there are 8 bits (0's or 1's) in a byte, there are 1000 bytes in a kilobyte (KB), there are 1000 kilobytes in a megabyte (MB), there are 1000 megabytes in a gigabyte (GB) and there are 1000 gigabytes in a terabyte (TB). As an example of this, the text and instructions stored by my wordprocessor in creating this article up to this point are equal to about 170KB of data, or 170000 bytes. A hard drive that can store 1.6GB of data could store about 1000 copies of this article. That would be true if all of a hard drive's storage was available to a user, but it is not.
{96} Hard drive storage must be managed and organized. Otherwise, the computer does not know where to find what it needs in the milliseconds it has to decide such things. DOS (Disk Operating System), and now Windows, handles the management of hard disks by dividing a drive into allocation units called sectors (sometimes called clusters). The size of these units and how full each one is impacts the amount of disk space available on the computer system. For example, if the size of these units were 1KB and a message were typed with just one letter or number in it, say the letter "X," it would only require about 1 byte of storage space when you saved that message to the hard disk drive. However, because the disk drive is divided for management purposes into 1KB units, the computer would place that small message in one of those large 1KB units and declare that unit off-limits to any more data, though the unit has the capacity to hold nearly 1000 times that amount of data. If it allowed more data into the unit, it might confuse and garble that data with your message. The unused space in these allocation units is called slack space.
{97} The message can be later retrieved and added to. For example, one could add "Y" and "Z" to the "X" previously typed. The allocation system would fill more of the original unit with the combined size of the new file (3 bytes). Adding more than 1KB of text would completely fill up the previously spacious allocation unit (thus leaving no slack space) and start to fill up another allocation unit, leaving slack space there to the extent it could not fill the entire unit with data from the expanded message. Slack space is a fruitful area for evidence gathering because of how slack space reacts once files are reduced in size or deleted.
{98} Were one to retrieve the message when it read "XYZ," taking up 3 bytes of our imaginary 1KB allocation unit, and change it back to read "X," taking up only 1 byte, one would have reduced the file size but the file would still be located in the same allocation unit.. Most programs handle this reduction by changing the end-of-file marker rather than by actually erasing the "Y" and "Z" from the allocation unit. The allocation unit remembers its high water mark, so to speak, so that by looking beyond the end-of-file marker, using specialized software, one can see the "Y" and "Z" from the previous draft of the message. Often, particularly on systems short on storage space, new files start to fill those allocation units that had been previously used for other files. Sometimes, the new files take up less of the allocated unit than the old file, leaving some data from the old file exposed like a shirttail showing beneath a dinner jacket. Understanding this, clarifies why investigators speak of searching slack space for data. With special software programs designed for that purpose, the data in the allocation units can be viewed directly, revealing parts of data that the user thought was long deleted or overwritten.
{99} Continuing with the example of the XYZ message, assume one deleted that message. DOS leaves the message in the allocation unit but notes to itself that the unit is available for new data. A new message may be typed that reads simply "A." Assume the computer stored this new message in the same allocation unit as the old message. Anyone with an interest and the appropriate software program can view that allocation unit and see the "YZ" from the previous message. The "X" would not be visible because the same physical space has been replaced with the data representing the letter "A." [257] Thus, looking at the allocation unit one would see "A^YZ," where ^ represents the end-of-file marker. If the data from the original "XYZ" message was incriminating, having the "YZ" among the available evidence would be useful. Knowing that the evidence came from the slack space connected to the file "A" allows litigators to more fully know their evidence and its strengths and weaknesses. This is just one way slack space can contain information the user thought was "deleted."
{100} When files are deleted using DOS (and Windows), the operating system does not actually discard any information, rather, it merely makes note to itself that the allocation units taken up by the deleted file are again available for use. [258] Thus, deleted files can be retrieved with software designed to look for those operating system clues indicating a file was once active, reversing the indicator to make the file accessible once more. A deleted file is really not a deleted file, it is merely organized differently.
3. Software Programs
a. File Headers
{101} Software programs generally divide their work into files, such as the XYZ word processing file in the above example. However, each software program has features that require its files to be tailored to work best using that program. Thus, most programs add headers to files. These headers are not visible when working in the program itself. Headers explain why when one tries to retrieve a spread sheet using a word processor, the program will produce an error. It read the header and did not find anything familiar. Software programs can also recognize files related to the program by the file name extension, such as .DOC for a Microsoft Word document.
{102} Headers are so-called because they are the first information in the file if one looked at it "unclothed." Again, special software is required to view these headers and the information in them is often decipherable only by an expert in that software program. These headers can include information like the file name, the font that is used, or what printer to use. Graphical files, more common in child pornography and obscenity investigations, also include headers with similar information.
{103} As an example of what a header contains, the message used in the "XYZ" example takes up approximately 1 byte of data per character. However, once the letter "X" is typed and saved in a full-featured word processor, that one letter message takes up about 1,200 bytes, over 1200 times as much data-most of it header data. [259] Thus, although part of an old, overwritten file might be missing, such as the "X" covered by the "A" in the example above, if the information represented by the "YZ" may be contained in that files header information, providing a much fuller picture of what the original file was like, particularly if that information includes the file name. In this sense, headers are like DNA-instructions for building something larger. Investigators have learned to capitalize on this feature of software.
{104} Currently, law enforcement investigators use software programs that search for headers of graphic files. [260] One such program gathers the 100,000 bytes [261] of information that follow each header it finds. Often, this approach can recreate once-existing images that have long been lost to the software programs resident on the computer. Of course, expert testimony would be needed to explain the process used to recover the evidence in this and many other situations related to computer-based prosecutions.
b. Cache
{105} Software programs also leave other crumbs behind that are useful to investigators, prosecutors and defense attorneys alike. Most browser software creates a "cache" [262] of the Web pages the user has visited. This cache clears or empties itself occasionally or the user can empty it manually or even set it not to save any data. The concept behind a browser cache is that when surfing the Web, lots of information must be sent over data lines. Time can be saved if that information only has to be transferred once. So, during a visit to a Web site, such as a popular news site, the browser will cache the entire page, including the graphics that make up the colorful presentation of the page, and any photographs depicted on the page when visited. The next time the page is visited, the browser will look in the cache and determine if there is anything there it can use to build the current Web page without downloading that information through Internet data lines. This makes the browser work much more quickly. This effect is noticeable when revisiting a site during a browsing session if one observes how much more quickly a page loads (comes into view) on the second and subsequent visits. A browser cache may contain incriminating evidence if a user has visited Web sites will illegal content. Moreover, some cache files enable a skilled investigator to recreate what the user was doing during a browsing session.
c. Recently Used Files
{106} Besides the browser's cache, most browsers also keep track of the most recent URLs visited. This tracking system is usually in the form of a drop-down menu just below where URL addresses are entered in the software. This list of visited Web sites can be quite lengthy. If any of the listed sites contain illegal materials, the list provides circumstantial proof of intent because it only tracks addresses that the user actually typed into the browser, refuting any claims the sites were inadvertently visited. A similar list of sites visited by clicking through to the site with a hyperlink is also maintained by most browsers, but these lists could represent inadvertent access and are thus not as helpful to prosecutors.
{107} Windows programs also are keen to keep track of the most recently used files. Thus, a Windows- based word processor conveniently lists the last four or five files on which a user has worked. More importantly for purposes of this article, a graphics viewer will keep track of the last four or five images viewed by a user. The Windows 95 and 98 operating systems also keep track of the most recent documents opened in all programs on the system. Combined, these tracking devices can also help recreate what a user was doing and it what order things were done. For example, an investigator can probably tell that a user first opened a document listing obscene graphics and then viewed those graphics in the order listed. Often, this is very useful circumstantial evidence toward proving intent.
d. System Information
{108} Among other things, operating systems keep track of system information such as how big a file is, when it was originally written or created and when it was last accessed or modified. This information can be useful in proving that a particular image was accessed during a charged period. The operating system relies on the accuracy of the individual system's internal clock for the dates and times of these entries. These internal clocks are powered by internal batteries when the power supply is turned off. As the battery's power wanes, so will the accuracy of the clocks and the dates in the system's logs. Thus, an investigator must check the accuracy of the clock at the time of the alleged offenses. If the offense occurred much in the past, this may be difficult if not impossible to do. If the offense is a continuing one, (i.e., continued possession of child pornography on the computer's hard drive) then it is simply a matter of noting at the time of seizure that the time and date indicated by the computer are correct. As a further complication, savvy users can manipulate system data such and the file creation times and dates and even the computer's clock. To that extent, even if the clock is correct at the time the system is seized, the evidence may be at best unpersuasive or at worst unreliable.
e. Internet Software
{109} There are several platforms for communicating over the Internet that require specialized software. Some of these platforms did not exist as little as four years ago, so four years hence, there will likely be other platforms for communicating over the Internet that this article cannot anticipate. Most ISPs provide these services free of charge, including the software needed to run them. The most common can be "roughly grouped into six categories: (1) one-to-one messaging (such as 'e-mail'), (2) one-to-many messaging (such as 'listserv'), (3) distributed message databases (such as 'USENET newsgroups'), (4) real time communication (such as 'Internet Relay Chat' and 'Net Conferencing'), (5) real time remote computer utilization (such as 'Telnet') [263], and (6) remote information retrieval (such as 'FTP,' [264] 'Gopher,' [265] and the 'World Wide Web').
{110} Most of these methods of communication can be used to transmit text, data, computer programs, sound, visual images (i.e., pictures), and moving video images." [266] Some of these platforms require more discussion because of their importance to those involved in child pornography and obscenity on the Internet.
1) Email
{111} Email is the most commonly used Internet software. There are approximately 96 million email users in the United States today, up from 8 million in 1991. [267] Email programs facilitate sending messages directly to a specific user. Currently, high-end email programs allow users to include HTML in their messages. This means that entire Web pages, other computer programs, sound and video can be sent via email to other users. Often, Web-based promotions require subscribers to those promotions to provide their email addresses. These addresses are then sold and marketed, though often one can opt out of the marketing part. Sometimes, Web sites will collect information about a user when they visit that site. Browsers can be configured to prevent most private information from being gathered in such a covert manner, but once someone has the combination of an email address and what Web sites a user has visited recently, they know a lot about the user and often take advantage of that knowledge by sending unsolicited email, sometimes called "Spam."
{112} Spam can include obscenity and child pornography. This means that a user may open his or her electronic mail box one day to find they are now in possession of child pornography. This possibility gained notoriety with the "Melissa" virus. That virus, circulated in late March of 1999, was an email virus with an attached document listing pornographic Web sites. [268] As explained above, deleting such an unsolicited file is not enough, investigators can still retrieve it. Moreover, sometimes unsolicited emails, once opened, can whisk a user to a Web site, even starting the Web browser for the user. For example, an unsolicited email advertising an adult oriented Web site, once opened, can start the browser and open the advertised Web page all without the user having done anything other than open his or her email. A record of the visit to that Web site will be stored in various places on the computer as described above, as will any graphical images portrayed on that Web page. Defense counsel should also carefully review evidence in such cases for possible defenses based on unsolicited email.
{113} It is important to note that email addresses provide no authoritative information about the addressee. This is true because the sender may have used what is called an "anonymous remailer." [269] These programs, available without cost through various Web sites, allow people to send email anonymously by effectively stripping the original email of any identifying information (such as information from the message's header) and replacing it with untraceable information. This means that litigators should not rely on the accuracy of email addresses to prove identity in cases where identity is contested. For example, if an incriminating email message is found on an accused's computer system showing it came from a charged accomplice or from an alleged victim, the email address alone would not prove the identity of the accomplice or victim.
{114} Finally, another important aspect of email messages is that most email programs keep copies of every message a user ever wrote, every message the user ever received, and every message the user deleted. Some offer the possibility of "shredding" an email message, presumably the equivalent of actually deleting it, but the email file may still be retrievable using the methods described above.
{115} An entire industry has arisen around electronic evidence recovery, centered mostly on recovering email messages and word processing documents, particularly "erased" documents and email. This industry has developed software tools that are specific to each email system. Such recovery software can find each hidden element of an email, such as header and router information, then it searches for these elements, strips the email out of oblivion, and recreates it in essence, resurrecting what was once thought lost. The electronic recovery industry is a byproduct of our society's growing dependence on email both at work and at home, made famous by Microsoft's taint in the Federal Government's antitrust lawsuit as a result of various recovered email messages. [270]
{116} It is important for litigators to know how the email program at issue in their case processes messages. Each program functions differently with regard to how many messages are saved and where they are saved, at what point they are saved and how messages are deleted. The best way to test these variables is to get on the machine in question and start up the email program. Moreover, both the prosecution and defense will do well to employ electronic evidence recovery experts in illicit image cases.
2) Listservs
{117} The Internet also contains automatic mailing list services sometimes call "listservs" (abbreviated from List Server) and "mail exploders." These email lists facilitate communications about particular subjects of interest to a group of people. For example, someone interested in Supreme Court opinions can subscribe to a listserv that focuses on that subject. Listservs allow subscribers to keep abreast of developments or events in that particular subject area, including areas such as child pornography and obscenity. The subscriber can submit or "post" messages on the topic (or sometimes not on the topic) [271] to the listserv. The messages are posted when the user enters the listserv's email address, such as OPINIONS@COURT.GOV. The message is then automatically (or through a human moderator overseeing the listserv) sent to everyone who subscribes to the listserv. Just as with any other email, a recipient of such a message can reply to the message, but here the reply will be distributed to everyone on the mailing list. There are thousands of mailing list services on the Internet, collectively with hundreds of thousands of subscribers. Listservs can be open or closed. If they are open, that means that anyone can subscribe and a computer program handles all subscriptions. If they are closed, a human moderator must accept a user's subscription before it becomes valid and active. [272]
3) Newsgroups
{118} Distributed message databases, such as USENET [273] newsgroups, serve a similar function as listservs. User-sponsored newsgroups are extremely popular. They are organized by topics and subtopics and topics under the subtopics. One example is: alt.binaries.pictures.flowers. A newsgroup with this title is an alternate newsgroup, thus the "alt" in the name. The newsgroup deals in binary files (usually graphic images), and this group focuses on pictures of flowers. There may even be a subtopic under flowers that focuses on daffodils for example (alt.binaries.pictures.flowers.daffodils). Of course, many newsgroup topics involve pornography and some specialize in child pornography and obscenity. [274]
{119} Open discussions can occur in these newsgroups, some of them are even threaded, meaning a response to a particular posted message is represented on the computer screen as being connected to that message only. However, unlike with listservs, users need not subscribe to a discussion mailing list in advance. Rather, the newsgroups and their most recent messages are accessible at any time. Some USENET newsgroups are "moderated" but most are open to all. "In moderated newsgroups, all messages to the newsgroup are forwarded to one person who can screen them for relevance to the topics under discussion." [275]
{120} Messages, including replies, posted to USENET newsgroups are disseminated using "ad hoc, peer to peer connections between approximately 200,000 computers (called USENET "servers") around the world." Generally, when a message is posted to a newsgroup, it is forwarded automatically to all adjacent USENET servers that provide access to that newsgroup (some ISPs block access to the more questionable newsgroups). Eventually, the message is distributed to all USENET servers. Each such server temporarily stores all the messages for all the newsgroups, some for differing periods of time and others based on space limitations. While they are temporarily stored on the servers, users can access them using software that is usually provided by their ISPs. Messages are accessed differently by different newsgroup software programs. Some programs download all the messages on the USENET server about the selected topic. Others only download the header information so that the user can first decide which messages he or she wants to view and then download only those messages. [276] Often, child pornography and obscenity investigations yield logs of newsgroup messages and the assumption is often made that the accused viewed all of the messages (often images) listed in such logs.
{121} However, litigators should learn whether the newsgroup software in question functioned in such a way that would imply the accused actually viewed the files. The possibility exists that a user only downloaded the headers. Sometimes the headers contain enough information that they are relevant evidence in a child pornography or obscenity prosecution but may lack weight given their limitations. The list of newsgroup message headers is not proof itself that the users actually read the messages (or viewed the images) represented by the headers. Other evidence of incriminating activity will likely exist if a user tasted of the forbidden fruit.
{122} The USENET servers automatically and periodically purge the old messages from each system. This is done to make room for new messages. This means that investigators may find a reference to a newsgroup file on a suspect's computer that is no longer available on that newsgroup. Newsgroups function automatically and never require direct human intervention or review. [277]
{123} There are newsgroups on more than fifteen thousand different subjects. In 1994, approximately 70,000 messages were posted to newsgroups each day, and those messages were distributed to the approximately 190,000 computers or computer networks that participate in the USENET newsgroup system. Once the messages reach the approximately 190,000 receiving computers or computer networks, they are available to individual users of those computers or computer networks. Collectively, almost 100,000 new messages (or "articles") are posted to newsgroups each day. [278]
4) Internet Relay Chat
{124} Real time communication is the most commonly used form of communication for serious child pornography and obscenity traders. Each of the foregoing platforms merely allows for the transmitting of messages that can be later read or accessed. However, Internet users can engage in immediate "real-time" dialog with others on the Internet using "Internet Relay Chat" (IRC). IRC is the most common software used for this type of communication. The software to run IRC is freely available on the Internet at no cost. The discussion of IRC that follows must be more detailed because of the popularity of this platform among illicit traders.
{125} IRC allows two or more users to type messages to each other that appear on the others' computer screens practically as they are typed. IRC has been compared to a telephone party line using a computer and keyboard rather than a telephone. [279] IRC consists of various separate networks of IRC servers. These servers are computers that allow users to connect to IRC. The largest networks are the original EFnet (sometimes hosting 32,000 people at once), Undernet, IRCnet, DALnet, and NewNet. [280]
{126} Generally, the user runs a program called a "client" to connect to a server on one of the IRC networks. The server relays information to and from other servers on the same network. Once connected to an IRC server on an IRC network, the user joins one or more "channels" and converses with others there. Some of these networks have more than 12,000 channels, each devoted to a different topic. Conversations can be public (where everyone in a channel can see what the others type) or private (where two people who may or may not be on the same channel can exchange messages). [281] This is how illicit image traders meet. They then branch off into their own private discussions where they can also share files (generally images) as they speak. IRC allows a user to connect directly with another user's computer for the purposes of exchanging files. Thus, traders can meet in the chat rooms and then exchange "addresses" where they can connect to the other's computer and access images that user has collected and wishes to distribute. Fortunately for investigators, most IRC software saves logs of these conversations and transactions on the user's computer system, complete with dates and times.
{127} Most channels [282] are shared among all IRC servers on the same network. However, there are some channels that are not shared by all servers on the network but exist only locally on that server. This fact has broad implications for the interstate commerce requirements of some laws. If a trader is using a channel that is not shared by all servers and the server in use is in the same state as the user, proving an interstate commerce nexus, while not impossible, will be more difficult. This difficulty may also arise when two users engage in private conversations with each other. During private conversations, the network servers (often in another state) are no longer in use--the computer becomes directly connected without a mediating server--usually the interstate commerce nexus.
{128} Each IRC user is known by a "nick" (short for a nick name). On some IRC networks, nicks do not belong to anyone, nor do the channels. This means that someone in a chat with the nick "attorney@law" may be a different person from the one who used that same nick the previous day. For practitioners, this makes it difficult to rely on nicks to prove identity. Also, if a particular channel is focused on illicit trade, this fact can make it difficult to pin that trade on any one person.
{129} Channels are run by channel operators (called "ops"), who can control the channel by choosing who may join (by "banning" some users) and who must leave (by "kicking" them out). Sometimes ops even limit who may speak by making their channel "moderated." Channel ops have complete control over their channel, and their decisions are final, but ops are really just users of these networks. The servers that make up the IRC networks are run by IRC admins and by IRC operators (called IRC ops). Often, these admins and IRC ops receive complaints about the use of a server for illicit trading. However, the most they can do is provide evidence of the misuse of their servers because they cannot control the content of the channels run on the servers, as content is determined by users who do their own policing. IRC admins and IRC ops can sometimes identify users by their Domain Name System (DNS) address, that numerical address discussed above that identifies each computer on the Internet. [283] Once identified, those who abuse IRC can be dealt with by whoever provides that user'sInternet access.
{130} IRC scripts are sets of commands that allow IRC clients to function. Most users do not create their own scripts, but borrow them from other users. Some of these scripts have been modified to perform unwanted functions such as getting into a user's account, deleting all of a user's files, and reading their mail, etc. Some of these scripts are preprogrammed to set up a pornography trading ring. For example, some scripts advertise on other channels the trading of illicit images and then run their own channels dedicated to trading such images (for example, an advertisement may offer exchange of teen images on a 2 for 1 basis, meaning the visitor must provide two illicitimages to receive one from the channel).
{131} IRC channels can be set to operate without a user present. [284] Once a user turns on this equivalent of an autopilot, they are susceptible to giving someone else control of their computer. Illicit traders like to find channels that have opened themselves up to this and engage in their dark art on someone else's turf (computer). Another way this can happen on IRC is through what is called a "trojan" (Trojan horse), a program that acts much like the well-known computer viruses. Once these programs are run, they give control of a users computer over to someone else and allow them to steal account passwords, modify or erase files on the user's systems and use their computer as a springboard for illegal activities, including the trade of illegal images. [285] Litigators should be aware of the possibility that an otherwise innocent user may have allowed another to control their computer through IRC, thus explaining the presence of illicit materials on their system. [286]
{132} IRC should not be confused with other chat services offered by the major ISPs and by some private software companies such as ICQ. These services also allow their subscribers to chat as described above, but they generally do not allow branching into a private conversations where files can be shared directly, as with IRC. Nevertheless, illicit traders, many of whom have not yet discovered IRC, may frequent these other chat rooms and then exchange files via email, FTP or Web sites.
{133} Computers and the Internet create special evidentiary problems for litigators, many of which require the use of experts to analyze, resolve and ultimately prove. These problems must be addressed during the investigation of any computer-based child pornography or obscenity case. Some of these issues include the expectation of privacy in computer systems [287] and email boxes, [288] limits on intercepting Internet-based communications, and application of privacy laws to BBSs, listservs, and Newsgroup postings. [289] The application of basic privacy law to the search and seizure of computer evidence is beyond the scope of this article. Excellent and thorough reviews of privacy law issues and others raised by computer evidence already exist. [290] Equally important are the practical considerations that investigators must consider when handling and gathering computer evidence. [291]
{134} Computers are tools for processing and analyzing data. They are also storage devices. Their role as storage media creates an interest in their evidentiary value. However, they must be treated somewhat more delicately than other storage media because of their interactive capabilities. Most computer storage media are magnetic. They can be erased if they pass through any magnetic field and thus require special care during transport and storage. Also, when an investigator prepares to seize a computer, it would be unwise to turn on an idle machine immediately. Individuals engaged in illicit activities may have prepared for the possibility of unwanted intrusion into the system by setting a startup trap. These traps may immediately begin to wipe out all the data on the computer's hard drive if ever the system is booted without special precautions that only the owner knows or a special password is not entered at random times. Also, computers connected to the Internet can be remotely controlled and a suspect may be able to erase incriminating evidence from a distance. Investigators are trained to handle such situations, but often make mistakes.
{135} Another trap for the unwary can occur during the simple analysis of the data on a computer. Untrained investigators may immediately begin viewing files on the system, unaware that by doing so they are changing the system data logs discussed supra-data logs that may prove identity and intent if they remain unaltered. Any use of the system can change the system from its original state (at the time of seizure). Altered evidence, particularly if altered by law enforcement officials, may leave room for reasonable doubt at best, or at worst lead to a suppression of that evidence or even dismissal of the case. Trained investigators will create copies of all of all seized computer-based media and then search the copies, leaving the originals relatively untouched.
{136} Litigators should be careful to learn exactly how investigators handled the evidence in any given computer case. Even investigators working from copies may have created issues at the time the copies were made. For example, copies can be made by connecting two computers. If one of the computers is routinely used for investigating child pornography and obscenity offenses and the other is the seized computer, investigators must ensure that their methods do not allow for the inadvertent transfer of data from the investigator's computer (which likely has child pornography or obscenity evidence on it) to the seized computer.
{137} Defense counsel in particular should be aware of the possibility that a computer's components may have been used before their installation in the accused's system. For example, if an accused purchased a used hard drive or computer from a friend or a computer shop, some information on the hard drive may have come from a prior owner. Moreover, computer repair could conceivably also contaminate a hard drive with illicit materials and the customer would never know it.
{138} Computer-based evidence in the courtroom is nothing new to litigators. The rules of evidence present no insurmountable obstacle to the admission of evidence merely because it comes from or was generated by a computer. That said, a common obstacle to computer-based evidence in a courtroom is authentication. Often, litigators will require expert witnesses to lay a foundation for computer-based evidence and to explain its significance to the trier of fact.
{139} It is precisely the ability of technology to alter reality that led Congress to pass 18 U.S.C. § 2252A, making even virtual depictions of child pornography illegal. That same ability makes laying a foundation for computer-based evidence of all types harder than for other evidence. Computer-based evidence is often digital. Digital evidence is easily malleable. Suspects can consciously alter system information, such as the computer's date and the dates and times reflected in the logs for file creation, access and modification. Thus, proving that a log says a document was created on a certain date at a certain time is not necessarily enough foundation to make it so. Witnesses who observed the computer's date and time near the event in question may be needed. Sometimes an inference can be drawn from the computer having the correct date and time when it was seized, but that inference may not go far if the event in question was sufficiently distanced from the date of seizure. Also, just because a document looks like the product of a computer program rather than human composition does not make it so. Virtually any document with the appearance of a computer program's output can be mimicked by a moderately skilled human being. Nevertheless, the possibility of alteration should only affect the weight of evidence, not its admissibility.
{140} Computer-based child pornography and obscenity cases require expert witnesses. This is true because of how investigators recover evidence in such cases. The process can be compared technically to the complicated procedures used to analyze urine for drug metabolites. Investigators do not just open a seized computer to find illegal images stashed in the case, they must use a scientific process to recover the evidence that is otherwise undetectable to the unaided human eye. The reports yield a list of files found on a seized computer, the dates those files where created, accessed and modified and often include a description of the software and procedures used to extract evidence from the system. Finally, the reports include copies of the evidence investigators discovered in their analysis.
{141} Often, the investigators can act as expert witnesses to explain how the evidence was seized and preserved and often how it was discovered on the hard drive of a suspect's computer. In other cases, forensic technologists, FTs for short, or software forensics consultants may be required. This is a growing field of expertise that will only grow larger as our dependence on technology increases. [292] Whatever the source, experts must educate the trier of fact about how computers work in much the same way that a discussion of technology was required before a discussion of this and other practical issues was possible. At a minimum, defense counsel should have an independent expert review the government's analysis and provide guidance or testify if there are contested issues regarding the foundation or weight of computer-based evidence. For example, the defense, in an attempt to raise doubt about the age of a depicted individual, may need its own expert to show how easy it is to use commercial software to make adult images appear to be children.
{142} Using popular and widely-available graphics programs, such as Adobe Photoshop or Corel Draw, even a beginning computer user can alter scanned photographs to increase or decrease breast size or add or remove body hair. Breast size and body hair are currently the touchstones of determining the age of depicted females. Every child pornography statute requires the government to prove the minority of the depicted individual. [293] The most common way to do this is with expert testimony. In evaluating cases where depictions are of individuals who appear to be minors but may be adults, litigators will need to consult with pediatricians or other similar experts.
{143} Experts in this area rely on Tanner Staging, named after the British pediatrician James M. Tanner. In the mid-1960s Dr. Tanner evaluated the development of breasts, pubic hairs and the age of menarche in a longitudinal study of females. His studies were published in the American Journal of Diseases of children in 1969 and 1970. [294] His studies determined that the mean age of menarche was 13.5 years. Although never intended to be used for age determination, the five stages of development that Dr. Tanner documented have become such a standard. These five stages basically standardize the correlation of greater breast size and development (in females) and increased pubic hair (in both males and females) to an increase in chronological age. [295]
{144} Tanner staging has never been tested in a non-clinical environment. That is, no studies of its reliable application to mere images of minors have ever been conducted. Rather, Tanner staging was developed in a clinical environment where physicians and researchers were able physically to observe the children in question. The method nevertheless lends itself well to evaluating visual depictions if the depictions are clear and portrayed from the right visual perspective. Clinical environments allow for a three-dimensional experience, whereas computer-based visual depictions are one-dimensional. Thus, an awkward pose or fuzzy focus can dramatically affect application of Tanner staging to such deficient images. For example, a female who is standing may appear to have larger breasts than when that same female is in a reclined position. Moreover, because Tanner staging requires the opinion of an expert, usually a physician, it is an area ripe for a battle of the experts.
{145} In the December 1998 issue of the journal, Pediatrics, Dr. Tanner and Dr. Arlan L. Rosenblum coauthored a letter to the editor urging physicians not to apply "Tanner Staging" to suspected child pornography images in an effort to determine chronological age. [296] They noted, "no equations exist estimating age from stage, and even if they did, the degree of unreliability in the staging--the independent variable would introduce large errors into the estimation of age, the dependent variable. [297] Furthermore, the unreliability of the stage rating is increased to an unknown degree by improperly performed staging, that is, not at a clinical examination but through non standardized and, thus, unsuitable photographs." [298] This letter may have a chilling effect on physician expert testimony regarding Tanner Staging of illicit images.
{146} Ammunition in the battle of experts is also provided by the many studies suggesting factors that can alter typical Tanner staging. Some of these factors include genetics, [299] race, [300] nutritional status, [301] chronic illness, [302] chromosomal abnormalities, [3] geographic location, [304] cigarette and alcohol use, [305] altitude, [306] and socioeconomic and ethnic factors. [307] Other studies have attacked the foundation of the original Tanner stages directly. [308] Additionally, experts will also be the first to agree that digital alteration and physical alterations (such as shaving pubic hair) add to the unreliability of applying Tanner staging to photographic images, including graphically reproduced photographs created for use on a computer. Tanner staging will be less important for cases charged as a violation of 18 U.S.C. § 2252A because even if a picture were altered digitally or otherwise to represent a child, that depiction is nonetheless illegal. This is just one example of how our world is truly becoming more virtual. Now that Congress has criminalized virtual acts (such as virtual child pornography), the issue of criminal intent will play a more important role in our jurisprudence than ever before.
{147} While the ubiquity of the Internet brings a myriad of illicit materials, our society must find ways to weed out individuals who should be punished for having sought out and reveled the "gutter of the information superhighway" from those who get splashed with filth from the equivalent of a passing vehicle. Some argue that pornography is so bad and so pervasive that we should employ a reckless standard of criminal intent to distinguish those who had the requisite mens rea from those who did not. Rather than focusing on lowering the standard because the harm to children is so great, we should consider raising the standard because the potential harm to free speech and the Internet are also so great. The result might be a well-balanced compromise.
{148} Not too long ago, child pornography and obscenity were marketed and delivered by traditional means of communication-writing to inquire and order, making payment, waiting for delivery, opening a package, and saving the filth under the mattress or some equivalently secret spot. These traditional means of communication and storage were powerful evidence of the criminal intent or mens rea of the actor. Today on the Internet one can now literally stumble upon someone's digital equivalent of a mattress stash, and like that damn spot that plagued Macbeth, outing the evidence is nearly impossible. Current investigative techniques for computer-based evidence will permit agents to find anything that ever appeared on your screen or passed through your wires, whether you intentionally sought out the material or not and whether you deleted it or not. In today's child pornography and obscenity market, no payment is required, no order is necessary, delivery is instantaneous and comes from a decentralized source ( the Internet), and storage is automatic. None of the indicia of criminal intent once used to proscribe child pornography and obscenity apply to Internet-based materials. How one establishes mens rea in the Information Age is the question. The answer lies beyond mere possession of illicit materials and focuses on repetitive conduct. [309] Congress has abandoned this approach by lowering, rather than raising the numerical threshold for possession offenses involving illicit images. Moreover, computer-based evidence of repetitive conduct depends on systems data, such as time and date, that are often unreliable. Although our laws prohibit one-time violations, practical considerations dictate that enforcement come only with a subsequent visit or repeated violations. This is not to say that everyone gets one free bite at the apple. Rather, investigators and litigators should carefully review the evidence to learn whether they have uncovered evidence of an unintentional detour (few dates involved, even if multiple files [310] are recovered), or whether they have found that equivalent of a sewer rat (multiple dates involved, even if few files are recovered). In sum, Congress should consider a standard based on repetition rather than numbers in order to protect the innocent interlopers of the Web.
{149} Big Brother is watching you. Computers have become George Orwell's big brother, saving evidence of our every intentional and unintentional keystroke and mouse-click for government scrutiny. One wrong click on the Internet may whisk a user unwillingly to an illicit site and one unsolicited email may open Pandora's box. Even if that unwary user leaves that site or deletes that email immediately, his or her storage media will be full of the evidence of that unfortunate and unintentional detour. Our current laws do not discriminate against those who merely soil themselves on such an Internet detour, however unintentional. Thus, until our laws are refined, justice and the freedom of legitimate information will depend on the wise discretion of prosecutors who understand the Internet, who understand computers and who can differentiate between criminals and commoners in a virtual world. Should all else fail, there will always be good defense attorneys.