dcwhitworth Posted December 7, 2015 Posted December 7, 2015 Just thought I'd chuck this out here to see if anyone has any experience in this. If we were to encounter an unfortunate situation where some seriously inappropriate/illegal images have been found on our network clearly once appropriate steps have been taken we'd want to remove them. But we would also have multiple copies of them on our backups, does anyone know of the legal implications of this ? Are we required to remove them ? And how the heck would we go about it ?
kennysarmy Posted December 7, 2015 Posted December 7, 2015 Ouch! Presumably you can't go editing all your backup tapes etc - so you will just have to put something in place that should you need to recover data that the illegal images are excluded from recovery. Perhaps.
dcwhitworth Posted December 7, 2015 Author Posted December 7, 2015 Ouch! Presumably you can't go editing all your backup tapes etc - so you will just have to put something in place that should you need to recover data that the illegal images are excluded from recovery. Perhaps. Yeah, but then the images would still be stored on the tapes, that's the point that concerns me.
kennysarmy Posted December 7, 2015 Posted December 7, 2015 Yeah, but then the images would still be stored on the tapes, that's the point that concerns me. Not sure why it's a concern to be honest - no one has access to your backup tapes surely?
dcwhitworth Posted December 7, 2015 Author Posted December 7, 2015 Not sure why it's a concern to be honest - no one has access to your backup tapes surely? Well no, but we would be knowingly storing the images.
kennysarmy Posted December 7, 2015 Posted December 7, 2015 Well no, but we would be knowingly storing the images. But not in a way that anyone could view.... The law is generally not an "ass" and common sense should prevail, as long as the backups are secure I don't think you are likely to encounter any issues. Over time your more frequent backup sets will be overwritten anyway, leaving just a few copies.
CHR1S Posted December 7, 2015 Posted December 7, 2015 Without taking the discussion to places non of us would want to go, this would depend on the severity of the material and the knock on effects. I wouldn't feel comfortable knowing I was the only person with access to the material that could potentially end my career, even one whiff could be enough. Parents/press finding out and twisting the story. School X knowingly stored "illegal stuff" on their servers shock!
Steve21 Posted December 7, 2015 Posted December 7, 2015 Surely that's not a decision for you anyway, it'd be police/higher in school decision. As you'd still be restoring/deleting evidence etc too even if you were looking in backups. Steve
Julian Posted December 7, 2015 Posted December 7, 2015 You will find the following helpful http://www.cps.gov.uk/publications/docs/mousexoffences.pdf Memorandum of Understanding Between Crown Prosecution Service (CPS) and the Association of Chief Police Officers (ACPO) concerning Section 46 Sexual Offences Act 2003 Basically it has been realised that backups are rarely accessed, and that they also hold financial information, that has to be retained, so that you do not have to wipe all tapes / backups, provided that access controls in place keep the material secure. 1
IrritableTech Posted December 7, 2015 Posted December 7, 2015 If there is any suggestion that an file contained illegal material then the police must be involved. They will decide what necessary actions need to be taken. Removing, moving or accessing the evidence it not advised.
dcwhitworth Posted December 7, 2015 Author Posted December 7, 2015 You will find the following helpful http://www.cps.gov.uk/publications/docs/mousexoffences.pdf Memorandum of Understanding Between Crown Prosecution Service (CPS) and the Association of Chief Police Officers (ACPO) concerning Section 46 Sexual Offences Act 2003 Basically it has been realised that backups are rarely accessed, and that they also hold financial information, that has to be retained, so that you do not have to wipe all tapes / backups, provided that access controls in place keep the material secure. Interesting, it basically says that the illegal act is knowingly making (or copying) of an image. No criminal act would occur in us backing up images of whose existence we did not know. However, presumably therefore once we did know of their existence, backing them up would technically be illegal.
kennysarmy Posted December 8, 2015 Posted December 8, 2015 Interesting, it basically says that the illegal act is knowingly making (or copying) of an image. No criminal act would occur in us backing up images of whose existence we did not know. However, presumably therefore once we did know of their existence, backing them up would technically be illegal. Makes 'common' sense...
localzuk Posted December 8, 2015 Posted December 8, 2015 I'd be surprised that the police didn't take the backups also to be honest, in such a situation.
CapitalBytesSupport Posted December 8, 2015 Posted December 8, 2015 Hi The Internet Watch Foundation - IWF - that grade and block such images has a very useful page that list best practices in an instance like yours - https://www.iwf.org.uk/resources/best-practice-guide I have not read the act info as posted above, but as per the IWF you should try and delete these images. Kev
dcwhitworth Posted December 8, 2015 Author Posted December 8, 2015 Surely that's not a decision for you anyway, it'd be police/higher in school decision. Steve True, but as an IT professional I want to be prepared to advise on this decision. My concern is that the knee jerk reaction will be to delete all backups and I want to know whether this extreme step will be required or if there is any advice I can get/give to avoid this.
dcwhitworth Posted December 8, 2015 Author Posted December 8, 2015 Hi The Internet Watch Foundation - IWF - that grade and block such images has a very useful page that list best practices in an instance like yours - https://www.iwf.org.uk/resources/best-practice-guide I have not read the act info as posted above, but as per the IWF you should try and delete these images. Kev Unfortunately they don't really deal with the issue of backups. If the only recourse to finding dodgy images is to delete your backups (because I don't think trying to manually hack the images out of them is likely to be viable) then I have to say I can't guarantee the integrity of the network because at any point we might be called upon to destroy our backup library. Also in the modern IT age can you truly delete anything ? There are going to be so many backups and shadow copies and persistent disk images that can you *ever* be sure you've deleted them 100% ?
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now