5 ms·

One thing to keep in mine. They specifically call out anything involving child pornography isn't covered by this document. The gist I got was, "Don't be a dipsh

One thing to keep in mine. They specifically call out anything involving child pornography isn't covered by this document. The gist I got was, "Don't be a dipshit, run screaming in the other direction if you get even a whiff of it," which is my policy on the subject irregardless of this document.

meowface 7y ago
Yes, agreed. Credit cards and hacking discussions are one thing (partly because they can directly affect your company or customers), but child abuse is a totally different matter. In those cases I imagine you should just report whatever you accidentally stumble upon to law enforcement and stay far away afterwards.
lmkg 7y ago
For a class I took on cybersecurity law, one of the readings mentioned procedures involved for LEOs investigating crimes of that nature. Among other things, the agent was required to use a specific locked-down computer with a custom web browser which would not request image files, because requesting, receiving, or storing (much less displaying) said files would be a criminal act. That work is best left to specialists (and even then, they rotate out regularly for mental health reasons).
ncmecthrowaway 7y ago
There are several situations where you, by nature of your employment and/or the discovery, may be legally required to disclose finding it to certain parties. Running away as you suggest can create legal liability in a few circumstances. Speak with your corporate lawyer and someone at NCMEC if you are based in the United States and come across this situation, especially if it is UGC that your network touched in any way. Any U.S. organization that handles UGC MUST be aware of this, because failure to follow the process can clap back rapidly. IANAL, so ask yours, and I’m only familiar with the U.S. If you accept and transmit UGC, it will happen. Be ready and train your people, and be ready to support them when they collapse mentally from dealing with it (not even to mention the impact to the children). I still have very specific nightmares and refuse to work in UGC/hosting due to this.
- LiquidSky 7y ago
  I used to work as in-house counsel at a machine learning company and we had exactly the system you describe set up: a standard set of procedures for immediate reporting of child pornography found in image batches sent to us by customers, NCMEC notification, quarantining and isolated storage of the data, and offering counseling for affected employees. It didn't happen often, thankfully, but was pretty eye-opening about what's out there.
- whatsmyusername 7y ago
  My plan is to report to the police, report to the company (in that order), and then get a lawyer and touch nothing else of the companies systems until the issue is resolved. I don't give a damn what the company policy is, that shit is so corrosive that I'm not doing anything with it beyond reporting it to the authorities and then protecting myself. edit: What is UGC/NCMEC? Acronym soup.

meowface 7y ago

Yes, agreed. Credit cards and hacking discussions are one thing (partly because they can directly affect your company or customers), but child abuse is a totally different matter. In those cases I imagine you should just report whatever you accidentally stumble upon to law enforcement and stay far away afterwards.

lmkg 7y ago

For a class I took on cybersecurity law, one of the readings mentioned procedures involved for LEOs investigating crimes of that nature. Among other things, the agent was required to use a specific locked-down computer with a custom web browser which would not request image files, because requesting, receiving, or storing (much less displaying) said files would be a criminal act. That work is best left to specialists (and even then, they rotate out regularly for mental health reasons).

ncmecthrowaway 7y ago

There are several situations where you, by nature of your employment and/or the discovery, may be legally required to disclose finding it to certain parties. Running away as you suggest can create legal liability in a few circumstances. Speak with your corporate lawyer and someone at NCMEC if you are based in the United States and come across this situation, especially if it is UGC that your network touched in any way. Any U.S. organization that handles UGC MUST be aware of this, because failure to follow the process can clap back rapidly. IANAL, so ask yours, and I’m only familiar with the U.S. If you accept and transmit UGC, it will happen. Be ready and train your people, and be ready to support them when they collapse mentally from dealing with it (not even to mention the impact to the children). I still have very specific nightmares and refuse to work in UGC/hosting due to this.

LiquidSky 7y ago
I used to work as in-house counsel at a machine learning company and we had exactly the system you describe set up: a standard set of procedures for immediate reporting of child pornography found in image batches sent to us by customers, NCMEC notification, quarantining and isolated storage of the data, and offering counseling for affected employees. It didn't happen often, thankfully, but was pretty eye-opening about what's out there.
whatsmyusername 7y ago
My plan is to report to the police, report to the company (in that order), and then get a lawyer and touch nothing else of the companies systems until the issue is resolved. I don't give a damn what the company policy is, that shit is so corrosive that I'm not doing anything with it beyond reporting it to the authorities and then protecting myself. edit: What is UGC/NCMEC? Acronym soup.