Questionable Images and Backups

[dcwhitworth]

Just thought I'd chuck this out here to see if anyone has any experience in this. If we were to encounter an unfortunate situation where some seriously inappropriate/illegal images have been found on our network clearly once appropriate steps have been taken we'd want to remove them. But we would also have multiple copies of them on our backups, does anyone know of the legal implications of this ? Are we required to remove them ? And how the heck would we go about it ?

[kennysarmy]

Ouch!

 

Presumably you can't go editing all your backup tapes etc - so you will just have to put something in place that should you need to recover data that the illegal images are excluded from recovery.

 

Perhaps.

[dcwhitworth]

Ouch!

 

Presumably you can't go editing all your backup tapes etc - so you will just have to put something in place that should you need to recover data that the illegal images are excluded from recovery.

 

Perhaps.

 

Yeah, but then the images would still be stored on the tapes, that's the point that concerns me.

[kennysarmy]

Yeah, but then the images would still be stored on the tapes, that's the point that concerns me.

 

Not sure why it's a concern to be honest - no one has access to your backup tapes surely?

[dcwhitworth]

Not sure why it's a concern to be honest - no one has access to your backup tapes surely?

 

Well no, but we would be knowingly storing the images.

[kennysarmy]

Well no, but we would be knowingly storing the images.

 

But not in a way that anyone could view....

 

The law is generally not an "ass" and common sense should prevail, as long as the backups are secure I don't think you are likely to encounter any issues.

 

Over time your more frequent backup sets will be overwritten anyway, leaving just a few copies.

[CHR1S]

Without taking the discussion to places non of us would want to go, this would depend on the severity of the material and the knock on effects.

 

I wouldn't feel comfortable knowing I was the only person with access to the material that could potentially end my career, even one whiff could be enough. Parents/press finding out and twisting the story.

 

School X knowingly stored "illegal stuff" on their servers shock!

[Steve21]

Surely that's not a decision for you anyway, it'd be police/higher in school decision.

 

As you'd still be restoring/deleting evidence etc too even if you were looking in backups.

 

Steve

[Julian]

You will find the following helpful

 

http://www.cps.gov.uk/publications/docs/mousexoffences.pdf

 

Memorandum of Understanding Between Crown

Prosecution Service (CPS) and the Association of Chief

Police Officers (ACPO) concerning Section 46 Sexual

Offences Act 2003

 

Basically it has been realised that backups are rarely accessed, and that they also hold financial information, that has to be retained, so that you do not have to wipe all tapes / backups, provided that access controls in place keep the material secure.

[IrritableTech]

If there is any suggestion that an file contained illegal material then the police must be involved. They will decide what necessary actions need to be taken. Removing, moving or accessing the evidence it not advised.

[dcwhitworth]

You will find the following helpful

 

http://www.cps.gov.uk/publications/docs/mousexoffences.pdf

 

Memorandum of Understanding Between Crown

Prosecution Service (CPS) and the Association of Chief

Police Officers (ACPO) concerning Section 46 Sexual

Offences Act 2003

 

Basically it has been realised that backups are rarely accessed, and that they also hold financial information, that has to be retained, so that you do not have to wipe all tapes / backups, provided that access controls in place keep the material secure.

 

Interesting, it basically says that the illegal act is knowingly making (or copying) of an image. No criminal act would occur in us backing up images of whose existence we did not know.

 

However, presumably therefore once we did know of their existence, backing them up would technically be illegal.

[kennysarmy]

Interesting, it basically says that the illegal act is knowingly making (or copying) of an image. No criminal act would occur in us backing up images of whose existence we did not know.

 

However, presumably therefore once we did know of their existence, backing them up would technically be illegal.

 

Makes 'common' sense...

[localzuk]

I'd be surprised that the police didn't take the backups also to be honest, in such a situation.

[CapitalBytesSupport]

Hi

The Internet Watch Foundation - IWF - that grade and block such images has a very useful page that list best practices in an instance like yours -

https://www.iwf.org.uk/resources/best-practice-guide

I have not read the act info as posted above, but as per the IWF you should try and delete these images.

Kev

[dcwhitworth]

Surely that's not a decision for you anyway, it'd be police/higher in school decision.

 

Steve

 

True, but as an IT professional I want to be prepared to advise on this decision. My concern is that the knee jerk reaction will be to delete all backups and I want to know whether this extreme step will be required or if there is any advice I can get/give to avoid this.

[dcwhitworth]

Hi

The Internet Watch Foundation - IWF - that grade and block such images has a very useful page that list best practices in an instance like yours -

https://www.iwf.org.uk/resources/best-practice-guide

I have not read the act info as posted above, but as per the IWF you should try and delete these images.

Kev

 

Unfortunately they don't really deal with the issue of backups. If the only recourse to finding dodgy images is to delete your backups (because I don't think trying to manually hack the images out of them is likely to be viable) then I have to say I can't guarantee the integrity of the network because at any point we might be called upon to destroy our backup library.

 

Also in the modern IT age can you truly delete anything ? There are going to be so many backups and shadow copies and persistent disk images that can you *ever* be sure you've deleted them 100% ?