Child pornography laws – case for reason over emotions in legislation

There are few topics as controversial and unambiguous at the same time as child pornography. While everyone agrees that sexual exploitation of children is heinous crime and lot of resources has to be concentrated on ending it, questions of what exactly constitutes of child pornography, how to fight to what extend it should be prohibited (production? possession or just gaining access?) remains unanswered. Furthermore due to sensitivity of subject it often causes knee jerk reaction and stream of emotional, rather than rational, arguments which is visible especially in public legislation debates. After all who would ever oppose laws that enables law enforcement to fight child pornography more efficiently, even if civil liberties are left behind in the process. However, even putting aside this aspect, laws often goes to far within their own frameworks or lack coordination between various bills that tries to grasp their straws. That was the case with convention on cybercrime as well as number of national laws.

Convention on cybercrime, signed in 2001 and effective for 10 years now, contains title on child pornography, defined as ‘content related offence’. Furthermore legislators went as far as providing definition of what is child pornography, definition which is rather strict as it includes “a person appearing to be a minor engaged in sexually explicit conduct” and “realistic images representing a minor engaged in sexually explicit conduct”. While reasoning behind such wording is not hard to explain – often it is hard to judge if person is really minor, the implications are quite serious. First of all, it is possible to prosecute someone for producing computer images of child pornography, which might be morally questionable but certainly no children are harmed in the process. Problem becomes even more complex given that many jurisdictions omits ‘realistic’ part in their statues. Case in Sweden, which reached Supreme Court, concerned manga translator who was fined for downloading drawings presenting minors in sexual context. As the case made its way through appeal process, important aspect was whether drawn figures could classified as a person. Prosecution argued that even specific characteristic which were common for manga characters (huge eyes, distinctive anatomy) did not change the overall qualification. While court of appeal upheld this line of reasoning, ultimately supreme court overruled the verdict, saying that drawings were not realistic enough to fall under legal definition. On the other in the US, man was given 15 moths in federal prison after pleading guilty to possession animated pornographic images of minors. While drawings were not manga characters there were not far off in terms of realism. As it is stated in plea agreement one of them depicted “Bart Simpson cartoon character (a minor) standing up and receiving oral sex from the Maggie Simpson cartoon character (a toddler) who is also nude“. Important to note that it is still plea agreement – not unlikely signed due to fear of harsher sentence. Similarly manga collection was ruled to be child pornography, after defendant entered plea bargain under advice of his lawyer.  Attorney reasoned that due to obscenity of images he would be found guilty by jury (problem of entering plea bargains out of fear is a topic for another article). These examples from two sides of the Atlantic shows how important might be such distinction. The problem of stricter approach is obvious – people have gone to jail due to committing an act where no one was even remotely harmed. Furthermore it should be questioned what such statues aims to achieve. Is it in place to catch potential child abusers – which is a stretch and in many countries probably unconstitutional one, or perhaps even thoughts about intercourse with minors deserve punishment. However if the latter is the case, even leaving out thought crime aspect, why laws are limited to drawings? Would literary description be treated the same. Ultimately victimless crime aspect makes such provisions most disturbing, and it is hard not to think about slippery slope aspect.

Second, thinking about convention on cybercrime, essential is that in many cases law enforcement is solely responsible for discovering internet child pornography rings, way before public prosecution comes into action. In such scenario it is often up to computer forensic technicians to decided whether person depicted is minor or not. Also if person has to just ‘appear’ to be minor, what about professional pornography labelled as ‘schoolgirs’ and ‘teens’. Does fact that everybody really knows that porn stars are over 18, makes it exception to the law? Danger of this kind of approach is uncertainty of law and putting too wide interpretation margins in judiciary process. In case of criminal law, where convictions significantly burdens convicted it is unacceptable, especially that there are little advantages resulting from it. Finally the very inclusion of child pornography in cybercrime convention is questionable, and in my opinion is example of poor legislation. Catalogue of ‘cybercrimes’ could extended ad infinitum, by just adding ‘committed using computer’. While it could be argued that crime such as fraud significantly changed its structure and form by including computers, in case of distributing child pornography, other than scale of possible distribution, there is hardly difference between video tape, dvd, and hosting a hidden service. Bottom line is whether there is a point in adding another piece of legislation. If the aim of convention would be to harmonize legislation of different countries, than it has to be noted that there is already in place Convention on the Protection of Children against Sexual Exploitation and Sexual Abuse. Which does include its own articles on child pornography. Furthermore in case of convention on cybercrime, there is possibility of opting out of the ‘generated images’, ‘appearing as minor’, ‘possessing child pornography in a computer system or on a computer-data storage medium’ and ‘ procuring child pornography through a computer system for oneself or for another person’ parts which make it rather poor instrument of harmonization.

Unfortunately it seems that sensitive nature of the problem seriously hinders putting effective laws in place. Moral panic which leads to convicting people of possession manga certainly does not help with adequate distribution of law enforcement resources, always limited in case of computer crimes. Also it seems unlikely that significant changes will happen in near future, as once laws are in place there are few people who would try to soften them. The sad truth is that such process is counter productive to crime detection, something that we cannot afford in this case.

EP directive 2013/40 on attacks against information systems – metasploit legal (somewhat)

Recent EP directive which replaced Council Framework Decision 2005/222/JHA at first glance doesn’t seem too differ much than retired document – specifically it attempts to push the law into territory of more sophisticated attacks without tinkering too much with already set guidelines and nomen omen framework. Most significant is probably mention of botnets. Approach to up-to-date network security problems gives hope of reasonable and professional law.  Unfortunately, the directive copies many troubling solutions that were part of the original document.

Some attention should be paid to preamble, which in most cases is – and let’s face it – padding. Here however, it is important to get a grasp of thought process behind the law, as unfortunately its purpose is not always obvious. First of all, lot of pressure is directed towards larger scale, more economically damaging attacks, including mentioned botnets. It seems that current trend of cybercrime prevention will be set more to protect enterprise targets rather than individual, ‘private’ networks. Even though it might seem almost cliche – big corporation gets more from law than common citizens, it is hard not to agree with the assessment. Attacks on single computers are common and almost impossible to trace most of the time. Furthermore in purely quantitative terms, damages to economy are certainly more significant when companies are affected. It is almost needles to say that in modern times, with increasing reliance on digital services a successful breach can disable smaller company. Second, as usual with EP directives, need of harmonization is emphasized. Again, it is quite obviously fair point, especially because of borderless nature of cybercrimes. Perhaps more important point is underlining importance of providing adequate training for law enforcement and judiciary. In Poland problem of lack of qualifications becomes especially visible when dealing with lesser crimes. These are reported to local police stations, where common officers does not even know how to approach the subject. Observing current situation it becomes obvious that significant shift in policy is required – it is no longer possible to afford not to train every policeman in at least basics of cybercrime. Finally, compared to earlier act, part about respecting privacy and protecting fundamental rights has been extended. To what degree is it reaction to NSA leaks remains open case.

Continue reading “EP directive 2013/40 on attacks against information systems – metasploit legal (somewhat)”