11 ms·

> The image found on Rettenmaier’s hard drive was in an unallocated space, which typically requires forensic software to find So say someone, known or unknown,

> The image found on Rettenmaier’s hard drive was in an unallocated space, which typically requires forensic software to find So say someone, known or unknown, emails you a bunch of unlawful zeros and ones, you open it or it displays automagically. Or you accidentally type a web address wrong and go to unlawful pictures dot com. Anyway, you delete the file(s) and / or clear your browser cache. Your file system deletes the entry in the allocation table (or however it works) but the drive still has the relevant magnetic / electrical charges to recover the file using a data recovery tool. Are you still in possession of the unlawful zeros and ones if you've deleted the files in the only manner you are aware of - assuming the average person doesn't understand the underlying technology???

meowface 9y ago
The data merely being present on your hard drive isn't enough for law enforcement to make a strong case. They'd also need to prove how it got there, and why.
- TheSpiceIsLife 9y ago
  That is also my understanding. So in the case where, as suggested in another comment, where a computer tech, or anyone with access to you device, plants the material in order to collect the bounty, while probably annoying and stressful, should auto-resolve during the investigation / discovery. Still a bit of a worry. Edit: fixed a thing
  - gowld 9y ago
    Yes, it will auto-resolve, after you spouse divorces you and obtains custody of your children, and your employer fires you.
- manfredo 9y ago
  An interesting Defcon talk on the subject: https://youtu.be/NG9Cg_vBKOg https://youtu.be/NG9Cg_vBKOg The last case is most relevant to this topic. All the other ones are about people trying to steal company info.
- idoh 9y ago
  That is not always true. Possession alone can sometimes be a crime if the crime has strict liability. See https://kellerlawoffices.com/child-pornography-accidental-possession-defense-possible/ https://kellerlawoffices.com/child-pornography-accidental-po...
  - deleted 9y ago
    [deleted]
- oceanghost 9y ago
  It's a great way to frame people.
hnaccy 9y ago
There's likely an affirmative defense, e.g., less than three images and you took reasonable measures to destroy them. https://www.law.cornell.edu/uscode/text/18/2252A https://www.law.cornell.edu/uscode/text/18/2252A
- gizmo686 9y ago
  That less than three image requirement seems really strict. If my browser were to simply pre-fetch a child porn site, I would probably have more than 3 illegal images on my computer.
- AFNobody 9y ago
  If there is a limit and the goal is offense, you simply send double it.
dmix 9y ago
I don't think a few files are enough to do a child porn conviction. There's enough plausible deniability there. But I could be wrong...
- LastMuel 9y ago
  Even so, simply going to court on something like this could have staggering consequences.
- AFNobody 9y ago
  The accusation and court costs (which you would not be refunded for) would likely be career destroying by the time it was resolved.
  - smnrchrds 9y ago
    And if you have children, they will be taken from you until the issue is resolved, which can take months or years. And googling your name always brings up articles about the charges on the first page. Exonerations rarely get the same attention or media coverage as accusations, if they even get any. TL;DR Your life is pretty much ruined forever.
    - gowld 9y ago
      http://bgr.com/2017/03/17/right-to-be-forgotten-us-laws/ http://bgr.com/2017/03/17/right-to-be-forgotten-us-laws/
  - jaclaz 9y ago
    A real life example (2004): https://www.computerworld.com/article/2529338/networking/how-spyware-nearly-sent-a-teacher-to-prison.html https://www.computerworld.com/article/2529338/networking/how... https://www.wired.com/2008/11/proof-porn-pop/ https://www.wired.com/2008/11/proof-porn-pop/ https://web.archive.org/web/20110716163331/http://www.sunbelt-software.com/ihs/alex/julieamerosummary.pdf https://web.archive.org/web/20110716163331/http://www.sunbel... that shows how a "random" accusation can severely de-stabilize someone's life.
userbinator 9y ago
a bunch of unlawful zeros and ones ...and I feel that is the root of the problem. I'm against real pedophiles and child abuse as much as anyone, but it feels to me like possession of otherwise illegal digital or virtual information should really be decriminalised, simply due to its immensely malleable and interpretable nature. It reminds me of things like "illegal primes" and such. Moreover, people can already perform, in the virtual world of games, acts that would be highly illegal in the real world --- and yet this still remains legal. Maybe after we get over the War on Drugs...
- mc32 9y ago
  Laws can persevere in the face of technology which pretty much rendered them obsolete. But they remain artefacts of a different time. Let me present you Japan requiring vanilla porn which depicts pubic hair on and around reproductive areas of people to be fuzzed: https://en.wikipedia.org/wiki/Pornography_in_Japan#Censorship_laws https://en.wikipedia.org/wiki/Pornography_in_Japan#Censorshi... They seem to date from back in the Meiji restoration period. But this is Japan which is also known for the Soaplands, so go figure.
- nezzle 9y ago
  You can also commit crimes in novels or roleplaying games that are illegal. That's different from supporting a market that causes child abuse. Possessing digital/virtual information that required abuse endorses abuse. Entropy is our friend here; only an extremely rare set of bits results from child abuse. You won't just find it. Even fiction or photoshop is illegal. Your argument is much more applicable here, but seeing how society treats even inactive pedophiles as criminals rather than sick, I don't think it'll be very popular.
  - coldtea 9y ago
    >Possessing digital/virtual information that required abuse endorses abuse. So, like a violent (e.g. decapitation video) that nevertheless plays on all major outlets?
- edanm 9y ago
  "[...] but it feels to me like possession of otherwise illegal digital or virtual information should really be decriminalised, simply due to its immensely malleable and interpretable nature." I'm not really sure what you mean here. What makes something being "digital" or "virtual" special? Isn't the content/message more important than the way it is stored and transmitted? I mean, concretely, you really think if someone has an illegal picture on their computer, and you can prove they were aware of it, that should be treated differently than them having that same picture only printed? If someone sends an email to hire an assassin, is the fact that it was a digital message so relevant?
sathackr 9y ago
IANAL but I have read a ton of case law on similar subjects involving possession. In the case of Rettenmaier, the possession laws work almost identical to drug possession laws. When the contraband is not in actual possession(physically on the persons body, in pocket, etc...) then they must use the rules of constructive possession. (At least in FL, and many other states are similar) For constructive possession, they must prove: 1. The person had knowledge of the presence of the contraband 2. The person had the ability to exercise dominion and control over the contraband. There used to be a 3rd rule "Knowledge of the illicit/illegal nature of the contraband" -- but IIRC that one got thrown out a few years ago making most possession crimes strict-liability. For files in unallocated space, without any other evidence, neither of the rules could be satisfied and a good lawyer would get it dismissed before it ever went to trial. Now, if in an interview, the subject 'confesses,' then they may have 'evidence' of either rule, and the case can go to a jury for the facts to be decided. There was a case in FL(a quick search didn't find it again) of a person driving a box truck full of marijuana that had a padlock on the doors to the cargo compartment. They were pulled over and the officers could smell the marijuana from outside the truck. They were convicted but the case was overturned on appeal because there was no evidence that the driver knew what marijuana smelled like (no knowledge of its presence) and no evidence that the driver had a key to the locked cargo compartment (no ability to exercise dominion or control) https://www.law.cornell.edu/wex/constructive_possession https://www.law.cornell.edu/wex/constructive_possession http://www.justiceflorida.com/when-is-someone-in-constructive-possession-of-drugs/ http://www.justiceflorida.com/when-is-someone-in-constructiv...
- jacobevelyn 9y ago
  Thanks for all the info! The case you described also sounded familiar to me so I set out trying to find it. No luck though; the closest I could come was California v. Acevedo[^1] and its related cases like United States v. Chadwick. [1]: https://en.wikipedia.org/wiki/California_v._Acevedo https://en.wikipedia.org/wiki/California_v._Acevedo
  - joering2 9y ago
    Amazing case. I dont think however it will stand the test of time today. A driver that supposedly doesnt know how marihuana smells (how do you prove he does or does not) drives across the state moving tons of contraband so long as he does not posses a key to the truck's locker.
awesomepantsm 9y ago
There was a case I read which said roughly that, yes, if you clear your cache, and are not technically savvy enough to know the files could be recovered, then as far as you knew, the files were actually gone, and you no longer "possess" them legally. Of course, proving that you are an idiot is always a great start to a trial, but it's worked in the past.
- duxup 9y ago
  Well if you are technically savvy... maybe you'd go a step further too and then you do think they're gone, its a whole other question... or the same one.
- zenhack 9y ago
  I don't think not knowing enough about computers to realize that "delete" doesn't actually delete the data qualifies someone as an idiot.
saas_co_de 9y ago
> Anyway, you delete the file(s) and / or clear your browser cache If you are in possession of evidence of a crime you are supposed to report it to the police. If you delete it you are destroying evidence of criminal activity. For an alternative scenario: suppose you find a dead body in your living room. Should you A) call be police B) hack it up in your bath tub and dump it in the river. Even if you do B you probably won't get convicted of murder, but you are probably going to be under investigation for a lot longer than A.
deleted 9y ago
[deleted]
TACIXAT 9y ago
The case got dismissed because of that, which is really unfortunate because they found child pornography on 5 of his other devices when they searched his home.
- TheSpiceIsLife 9y ago
  I’ve read sentencing remarks on other cases where, although the initial evidence would have been struck for whatever reason, the weight of evidence found upon subsequent searches during the investigation resulted in the case still going to trial and a guilty verdict being handed down. Some of those cases have gone to appeal and been reversed by higher courts. Such is the nature of an adversarial court system predicated upon the rule of law. We, as a society, have, and continue to, make these trade offs. Having been ground through the court system for drug trafficking, and been lucky enough to have the evidence struck at pre-trial conference due to a very similar case where the defendant was found guilty but the decision later reversed on appeal due to illegal police search... I, personally, reserve my judgement on all cases that make it to trial, and prefer to read about them as a curiosity. Edited to add: I strongly support the idea that law enforcement shouldn’t be searching people’s homes illegally, and that anything found as a result of such a search should be in admissible. We need strong privacy protections, and if that means some crime goes under reported... well, so be it.
_qbxp 9y ago
I've wanted to run forensics tools on my computer for a while, just to see what type of information I leave behind. Will that old resume I deleted 5-years ago show up on my HD? Will my personal backup SMS files that I copied to a Veracrypt volume and deleted with BleachBit still be retrievable? Not sure how to be able to access the "real-deal" forensic tools.

meowface 9y ago

The data merely being present on your hard drive isn't enough for law enforcement to make a strong case. They'd also need to prove how it got there, and why.

TheSpiceIsLife 9y ago
That is also my understanding. So in the case where, as suggested in another comment, where a computer tech, or anyone with access to you device, plants the material in order to collect the bounty, while probably annoying and stressful, should auto-resolve during the investigation / discovery. Still a bit of a worry. Edit: fixed a thing
- gowld 9y ago
  Yes, it will auto-resolve, after you spouse divorces you and obtains custody of your children, and your employer fires you.
manfredo 9y ago
An interesting Defcon talk on the subject: https://youtu.be/NG9Cg_vBKOg https://youtu.be/NG9Cg_vBKOg The last case is most relevant to this topic. All the other ones are about people trying to steal company info.
idoh 9y ago
That is not always true. Possession alone can sometimes be a crime if the crime has strict liability. See https://kellerlawoffices.com/child-pornography-accidental-possession-defense-possible/ https://kellerlawoffices.com/child-pornography-accidental-po...
- deleted 9y ago
  [deleted]
oceanghost 9y ago
It's a great way to frame people.

hnaccy 9y ago

There's likely an affirmative defense, e.g., less than three images and you took reasonable measures to destroy them. https://www.law.cornell.edu/uscode/text/18/2252A https://www.law.cornell.edu/uscode/text/18/2252A

gizmo686 9y ago
That less than three image requirement seems really strict. If my browser were to simply pre-fetch a child porn site, I would probably have more than 3 illegal images on my computer.
AFNobody 9y ago
If there is a limit and the goal is offense, you simply send double it.

dmix 9y ago

I don't think a few files are enough to do a child porn conviction. There's enough plausible deniability there. But I could be wrong...

LastMuel 9y ago
Even so, simply going to court on something like this could have staggering consequences.
AFNobody 9y ago
The accusation and court costs (which you would not be refunded for) would likely be career destroying by the time it was resolved.
- smnrchrds 9y ago
  And if you have children, they will be taken from you until the issue is resolved, which can take months or years. And googling your name always brings up articles about the charges on the first page. Exonerations rarely get the same attention or media coverage as accusations, if they even get any. TL;DR Your life is pretty much ruined forever.
  - gowld 9y ago
    http://bgr.com/2017/03/17/right-to-be-forgotten-us-laws/ http://bgr.com/2017/03/17/right-to-be-forgotten-us-laws/
- jaclaz 9y ago
  A real life example (2004): https://www.computerworld.com/article/2529338/networking/how-spyware-nearly-sent-a-teacher-to-prison.html https://www.computerworld.com/article/2529338/networking/how... https://www.wired.com/2008/11/proof-porn-pop/ https://www.wired.com/2008/11/proof-porn-pop/ https://web.archive.org/web/20110716163331/http://www.sunbelt-software.com/ihs/alex/julieamerosummary.pdf https://web.archive.org/web/20110716163331/http://www.sunbel... that shows how a "random" accusation can severely de-stabilize someone's life.

userbinator 9y ago

a bunch of unlawful zeros and ones ...and I feel that is the root of the problem. I'm against real pedophiles and child abuse as much as anyone, but it feels to me like possession of otherwise illegal digital or virtual information should really be decriminalised, simply due to its immensely malleable and interpretable nature. It reminds me of things like "illegal primes" and such. Moreover, people can already perform, in the virtual world of games, acts that would be highly illegal in the real world --- and yet this still remains legal. Maybe after we get over the War on Drugs...

mc32 9y ago
Laws can persevere in the face of technology which pretty much rendered them obsolete. But they remain artefacts of a different time. Let me present you Japan requiring vanilla porn which depicts pubic hair on and around reproductive areas of people to be fuzzed: https://en.wikipedia.org/wiki/Pornography_in_Japan#Censorship_laws https://en.wikipedia.org/wiki/Pornography_in_Japan#Censorshi... They seem to date from back in the Meiji restoration period. But this is Japan which is also known for the Soaplands, so go figure.
nezzle 9y ago
You can also commit crimes in novels or roleplaying games that are illegal. That's different from supporting a market that causes child abuse. Possessing digital/virtual information that required abuse endorses abuse. Entropy is our friend here; only an extremely rare set of bits results from child abuse. You won't just find it. Even fiction or photoshop is illegal. Your argument is much more applicable here, but seeing how society treats even inactive pedophiles as criminals rather than sick, I don't think it'll be very popular.
- coldtea 9y ago
  >Possessing digital/virtual information that required abuse endorses abuse. So, like a violent (e.g. decapitation video) that nevertheless plays on all major outlets?
edanm 9y ago
"[...] but it feels to me like possession of otherwise illegal digital or virtual information should really be decriminalised, simply due to its immensely malleable and interpretable nature." I'm not really sure what you mean here. What makes something being "digital" or "virtual" special? Isn't the content/message more important than the way it is stored and transmitted? I mean, concretely, you really think if someone has an illegal picture on their computer, and you can prove they were aware of it, that should be treated differently than them having that same picture only printed? If someone sends an email to hire an assassin, is the fact that it was a digital message so relevant?

sathackr 9y ago

IANAL but I have read a ton of case law on similar subjects involving possession. In the case of Rettenmaier, the possession laws work almost identical to drug possession laws. When the contraband is not in actual possession(physically on the persons body, in pocket, etc...) then they must use the rules of constructive possession. (At least in FL, and many other states are similar) For constructive possession, they must prove: 1. The person had knowledge of the presence of the contraband 2. The person had the ability to exercise dominion and control over the contraband. There used to be a 3rd rule "Knowledge of the illicit/illegal nature of the contraband" -- but IIRC that one got thrown out a few years ago making most possession crimes strict-liability. For files in unallocated space, without any other evidence, neither of the rules could be satisfied and a good lawyer would get it dismissed before it ever went to trial. Now, if in an interview, the subject 'confesses,' then they may have 'evidence' of either rule, and the case can go to a jury for the facts to be decided. There was a case in FL(a quick search didn't find it again) of a person driving a box truck full of marijuana that had a padlock on the doors to the cargo compartment. They were pulled over and the officers could smell the marijuana from outside the truck. They were convicted but the case was overturned on appeal because there was no evidence that the driver knew what marijuana smelled like (no knowledge of its presence) and no evidence that the driver had a key to the locked cargo compartment (no ability to exercise dominion or control) https://www.law.cornell.edu/wex/constructive_possession https://www.law.cornell.edu/wex/constructive_possession http://www.justiceflorida.com/when-is-someone-in-constructive-possession-of-drugs/ http://www.justiceflorida.com/when-is-someone-in-constructiv...

jacobevelyn 9y ago
Thanks for all the info! The case you described also sounded familiar to me so I set out trying to find it. No luck though; the closest I could come was California v. Acevedo[^1] and its related cases like United States v. Chadwick. [1]: https://en.wikipedia.org/wiki/California_v._Acevedo https://en.wikipedia.org/wiki/California_v._Acevedo
- joering2 9y ago
  Amazing case. I dont think however it will stand the test of time today. A driver that supposedly doesnt know how marihuana smells (how do you prove he does or does not) drives across the state moving tons of contraband so long as he does not posses a key to the truck's locker.

awesomepantsm 9y ago

There was a case I read which said roughly that, yes, if you clear your cache, and are not technically savvy enough to know the files could be recovered, then as far as you knew, the files were actually gone, and you no longer "possess" them legally. Of course, proving that you are an idiot is always a great start to a trial, but it's worked in the past.

duxup 9y ago
Well if you are technically savvy... maybe you'd go a step further too and then you do think they're gone, its a whole other question... or the same one.
zenhack 9y ago
I don't think not knowing enough about computers to realize that "delete" doesn't actually delete the data qualifies someone as an idiot.

saas_co_de 9y ago

> Anyway, you delete the file(s) and / or clear your browser cache If you are in possession of evidence of a crime you are supposed to report it to the police. If you delete it you are destroying evidence of criminal activity. For an alternative scenario: suppose you find a dead body in your living room. Should you A) call be police B) hack it up in your bath tub and dump it in the river. Even if you do B you probably won't get convicted of murder, but you are probably going to be under investigation for a lot longer than A.

deleted 9y ago

[deleted]

TACIXAT 9y ago

The case got dismissed because of that, which is really unfortunate because they found child pornography on 5 of his other devices when they searched his home.

TheSpiceIsLife 9y ago
I’ve read sentencing remarks on other cases where, although the initial evidence would have been struck for whatever reason, the weight of evidence found upon subsequent searches during the investigation resulted in the case still going to trial and a guilty verdict being handed down. Some of those cases have gone to appeal and been reversed by higher courts. Such is the nature of an adversarial court system predicated upon the rule of law. We, as a society, have, and continue to, make these trade offs. Having been ground through the court system for drug trafficking, and been lucky enough to have the evidence struck at pre-trial conference due to a very similar case where the defendant was found guilty but the decision later reversed on appeal due to illegal police search... I, personally, reserve my judgement on all cases that make it to trial, and prefer to read about them as a curiosity. Edited to add: I strongly support the idea that law enforcement shouldn’t be searching people’s homes illegally, and that anything found as a result of such a search should be in admissible. We need strong privacy protections, and if that means some crime goes under reported... well, so be it.

_qbxp 9y ago

I've wanted to run forensics tools on my computer for a while, just to see what type of information I leave behind. Will that old resume I deleted 5-years ago show up on my HD? Will my personal backup SMS files that I copied to a Veracrypt volume and deleted with BleachBit still be retrievable? Not sure how to be able to access the "real-deal" forensic tools.