Covering ourselves when it comes to policing porn viewing

[woody]

It was a while back now when I started a discussion about what procedures should be put into place to deal with pupils who access porn deliberately and there were some good points mentioned at the time - http://www.edugeek.net/index.php?name=Forums&file=viewtopic&t=679

 

But I'd like to turn it on it's head now, and it is something that recently happened here to me that has prompted me to ask about it on edugeek.

 

The other week, I accidently came across an mpeg in a user area that had a very dodgy filename and upon opening it did indeed prove to be of a sensitive and most definatley illegal nature. It sent a shiver down my spine and I felt edgy knowing that 1) it was on the server under my control and 2) I had actually viewed it, even if it did only take me 5 seconds to confirm what it was. Because of the severity of it, I immediately went straight to the headteacher.

 

In our job most of us do come into contact with material that the pupils are viewing. The majority of it turns out to be pin-up posters and the like. But occasionally, we get something more hardcore.

 

My question is, how do we cover ourselves? How do we prove that we are policing what is being viewed on the network, and not looking at that material for our own gratification? Yes you can prove that a user has actually been to a particular site, but what if I have had to access that site on my own computer to identify it's nature in the first instance? Or like my recent experience I had to view the mpeg to make sure it really was what it said on the tin as it were?

 

Does anyone have a policy signed by the headteacher that specifically contains language to cover themselves when it come to viewing such material in the interest of pupil safety? I am certainly going to put something together myself but if anyone has already done this, I would be interested in looking at it.

[webman]

Not sure really, but one way of covering yourself is to ask a member of SMT to be with you when you are investigating.

[_Bob_]

@webman - im not sure this is pratical, you never know when you'll stumble across somthin dodgy.

I have a feeling there was some new legislation brought in recently to cover internet and child porn issues, and that it made some provisions to cover the police and IT professionals conducting investigations. Anyone shed any light on this or am I getting my wires crossed?

[danIT]

I recently had to deal with similar situation. Somebody had a number of indecent but not illegal images and videos saved to his hard drive. There were also a large number of websites in the history folder which had been visited over a period of time.

 

As soon as i came across the images i notified the headteacher. It was then made my job to investigate exactly what the laptop had been used for, dates times files names ect...Everything was documented. Full list of internet history over the past three months, Full list of all software he had installed, list of any other documents i found which we innappropriate, according to our school policy for computer use, which includes both use at home and at school.

 

A statement of what i had found including conversations between the member of staff and myself before i found the images, and also a statement including everything i had done to the laptop to investigate the misuse. Also the document all members of staff sign to agree to use the laptop appropriatly.

 

The laptop was then taken away from me and locked away with the headteacher. Infact head phoned the police as some of the websites logged were suspect.

 

But i agree there should be some sort of school policy written for this kind of access. I agree that i soon as i view images etc of porn nature i am too committing the same offence, but as long as i log what ive done im safe.

 

It needs to be clearer

[TechMonkey]

Problem with that approach Dan is that you have to be very careful if you think anything is suspect at all. We have been given guidelines by county that say if we come across anything suspect/dodgy at all we have to force power off (Out at the plug or pull battery out of laptop), not touch any keys at all, defnitiely not investigate any further, lock the machine away and report it to protect ourselves.

Now this is obviously OTT if it is just smutty. But internally we have decided that if we find something we don't follow links off the main page found, we infomr the other memeber of the team that something was found and if it is a member of staff in form the Head.

[danIT]

i agree its a risky approach and this occasion actually involved a member of staff. I suposse our headteach has always dealt with it in this manner. i remeber we had a student who had masses of images saved to his user area and we had to go through and burn them all onto cd and almost catalogue them. It would seem that the LEA agrees witrh our approach as we have never had any problems with them surrounding such issues.

 

At some point the laptop has to be switched on and a full investigation made, wether this is made internally or externally is a choice. and obviously following guidlines to the letter is the best approach no matter how OTT you may think they are. The LEA supports us and that suits our current procedure.

 

My main point is that thew guidelines arent clear,

 

for instance ive just this minute had a member of staff come to me and say that her son accessed the internet wirelessly at home using her work laptop. Basically shes says that there were some pop ups and he was "intrested" few clicks and he was accessing porn, she wants me to clear and files that may have been downloaded and clear the history. According to our policy this is inappropriate use of school equipment, our school policy for comnputer use applies both in school and at home, manby mebers of staff forget this.

[woody]

Getting SMT to sit with you every time you feel that something is suspicious is not practicle at all. I suppose it must be at the stage where you realise that something is serious. But the thing is, we NEVER know what we might stumble onto and if the page has been viewed on our PC, even if it's only the first link, we need to have something to cover our own backs.

[pete]

if it's a kid looking at dodgy images, we grab the logs, take them to my line manager (deputy head) and then we print example screenshots (in full colour) to show to parents while he's there.

 

if it were a staff member I would do as techmonkey suggested - pull the power, lock the laptop in the finance safe and call the police.

 

We don't have the tools or training to do forensic work and any findings would not stand up in court. I would refuse any request to investigate the laptop and actively prevent anyone else from doing so.

[alan-d]

If you do find anything you could always use these guys .

 

More info on this thread

 

They will do a check of anything you ask them - I don't know what the costs would be but could work out cheaper when you consider the man-hours it would take you to investigate incidents yourself.

 

No I'm not on a commission

[alan-d]

If you do find anything you could always use these guys .

 

More info on this thread

 

They will do a check of anything you ask them - I don't know what the costs would be but could work out cheaper when you consider the man-hours it would take you to investigate incidents yourself.

 

No I'm not on a commission

[woody]

My question really is not about how to investigate missuse. It's how to go about covering yourself if you have to look at unsavoury material.

 

We combat internet missuse from three angles here already. 1) Preventative filtering with our ISP(CLEO); 2) Screen monitoring through AB tutor control; 3) Post logging and reporting through Securus.

 

But all of those don't stop us from personally viewing some websites, and/or files that have been downloaded into user areas. How do we prove that we aren't the offenders other than to have a signed agreement where you promise not to look for your own gratification, and SMT/governors promise to accept that you might have to look for investigative purposes?

[alan-d]

A persistant offender would have all his/her actions logged and there would be a pattern to the misuse. Your logs would show very little in comparison.

 

It's a bit like being a window cleaner in this job, you don't mean to peek but sometimes you see things you'd rather not

[danIT]

would anyone send me there acceptable use guidlines for there school. network use, computer use, etc? anychance?

[alan-d]

PM me your email - I'll send a copy of ours which has just passed OFTED and Auditing

[russdev]

wiki is your best friend here lots of stuff on it

 

http://www.russdev.com/wiki

 

 

 

Russ

[CyberNerd]

Isn't surfing for pr0n part of the job of technical support 8O

 

I can't see management making a fuss if your protecting the kids from inappropriate material - it's in their interest that someone does it. You should probably discuss this further with your headteacher and explain your concerns, I'm sure they will be supportive.

(and trucrypt your hdd just incase )

[bossman]

Also what about the mental scarring from this sort of thing?

Are we offered any sort of councelling, NO!!!

I have come across unsavoury material and i just delete if it is porn or anything unsavoury, but if it was anything to do with Paedophelia whether it be pupil or staff member I would be very careful. I would isolate the account if on the network or the Laptop and inform the following: first the Headteacher if he is not involved secondly LEA and thirdly the police having documented everything first I would then get a valued and trusted memeber of staff to be your witness and to sign any documentation to that fact. Also as you actively engaged in viewing this material whatever it is you are liable to prosecution from the legal position as we as network managers were supposed to be excempt from prosecution due to a white paper going through parliament which at the last minute fell to a revamp and therefore we are not covered.

 

It beggars belief that we, who are given the duty of being responsible for

the safety of the network and it's endusers are in the most vunerable position due to the inadequacies of the law.

 

Rock and a hard place spring to mind on this one.

[woody]

Thankyou Bossman. These are exactly the type of concerns I have. It's the Police involvement that worries me, not what SMT will think.

[bossman]

SMT Hmmmmmm now let me think (mindless stupid tw.ts) springs to mind here hehe.......

 

yes woody your darn right it is m8

 

life is like a game of chess ( youv'e always got to cover your ar.e

[Face-Man]

If your worried about the police take a look at

 

http://www.jisclegal.ac.uk/publications/P2Inappropriateuse.htm

 

If child pornography or obscene materials are found, there is no option but to involve the police. Due to the nature of the crime an institution and its IT department also needs to consider whether anything beyond a superficial investigation is advisable. Current law affecting institutions in Scotland with regard to child pornography is to be found in the Civic Government (Scotland) Act 1982 s 52 and 52A (the Protection of Children Act 1978 is the relevant legislation for the rest of the UK). The current wording of the legislation presents a dilemma for institutions and their investigation teams.

 

This states that

 

'any person who . makes any indecent photograph or is in possession of an indecent photograph or pseudo photograph of a child is guilty of a criminal offence.'

 

 

In strict legal terms this means that if an investigator looks at the images on a desktop he is, according to the letter of the law, technically committing a criminal offence. If when investigating he 'makes' a photograph by copying to preserve the evidence he is committing a criminal offence. There is a defence in law of 'legitimate reason' but the damage may very well have been done before getting to the stage of having to defend a course of action.

 

The logical extension of this is that an institution, in asking that an IT Director or other employee investigates an alleged instance of child pornography, may find itself effectively asking him to unwittingly commit a criminal offence in the course of such an investigation. Although the police have stated that in such circumstances it is highly unlikely that there would be a prosecution, the fact remains that in strict terms of current criminal law a breach has been committed and a risk of prosecution exists.

 

There is currently an added problem, certainly for those institutions based in England and Wales, in that The Sexual Offences Bill 2003 proposes that it is not an offence to 'make' a photograph if you have been authorised to do so (by the police). The implication is that if you have not been authorised you must not investigate. This Bill is a result of the Government's desire, given the publicity surrounding Operation Ore, to have a robust policy with regard to crimes against children. If the Bill becomes law, as presently drafted, any investigation without authorisation will be a criminal offence. It is currently under review and hopefully lobbying will result in an amendment to the Bill. Although this proposal does not apply to Scotland it could reasonably be expected that similar legislation would be enacted here.

 

 

As we need to be vigalent as to what is on our network this presents a problem.... I would just ensure that you report any and everything. Ensure you line manager knows the minute you find anything and then put in place the schools policy.

 

I recently had to get the police in due to images that came in on a memory stick and after showing them to the police they decided the "girl" photographed was over 16 but I was glad I got them in.

[Zentek]

In response to the comments in this Topic so far I would add the following information for anyone who might need to make use of it.

 

Firstly, I would support wholeheartedly what has been suggested by Techmonkey and Pete. Should any School Technician or Network Manager be asked to investigate the existence, or otherwise, of inappropriate material on their employer's behalf, they should proceed very cautiously. If any evidence of illegal material were to be found and the evidence were to be acquired in a manner not compliant with version 3 of the ACPO guidelines, then the likely result is that any "evidence" could be deemed to be inadmissible by a Judge, should the matter end up in a court.

 

Effectively this means that; to pull the plug on workstations, pull the plug and remove the battery on Laptops, and a Server should be powered down in the normal way. This would be the appropriate advice if ACPO compliant evidence were to be collected. After that, isolate and protect the equipment and then ring the LA or the police.

 

However, if the nature of what might be viewed is suspected to be an image of child abuse or an indecent image of a child then, or in fact such an image is viewed then additional "rules" apply.

There is currently in effect a Memorandum Of Understanding between the CPS and ACPO, which sets out the guidelines as to a defence, in law, for circumstances that might lead to someone inadvertently or deliberately viewing or reproducing such an image for the purposes of detecting such a crime. In essence, Police Forensic Specialists would have relied on this MoU in order to carry out their work, although any prosecution of them for carrying out their specific duties would obviously be deemed not in the public interest.

It is now thought that this MoU may, in part, have been superseded by the Sexual Offences Act 2003, which also allows some similar defence.

 

The bottom line is that you should treat any computer equipment/Mobile phone in the manner described above and that you must not, under any circumstances, make copies or print any images that appear to be indecent images of children. If you happen to accidentally view such an image, act as described above. Do not seek advice on the image from the Headteacher, they would not be in a position to judge it any more so than you, and you should not ask anyone else to view that image or encourage them to do so. This would be helping to proliferate any crime.

 

Also consider isolating any backup tapes or devices that may also hold a copy of any questionable image.

 

Most Local Authorities have the ability - in house - to investigate equipment in an appropriate manner. I am sure they would gladly do so upon request from any Headteacher.

 

The above information does not in any way constitute legal advice, but should be considered as good practice; and if complied with should afford the fullest protection to the school and its staff.

 

Should anyone wish to receive a copy of the MoU then just drop us an email and we will forward a copy to you.

 

Andrew Ramsden

Managing Director

Zentek Forensics Ltd

[email protected]

 

Chairman

Zentek Solutions Ltd

[russdev]

Hi Andrew

 

Sound advice...

 

Another thing is document everything get a notebook and write everything you do.

 

Second if call police, also call lea and also get in touch with director of your rbc (if item was view or downloaded from your net connection). Main reason rbc are use to handling these situations for example lot of rbcs are use to being visited by fbi and uk fbi what ever it is called and can help produce logs etc.

 

Russ

[buzzard]

Problem with that approach Dan is that you have to be very careful if you think anything is suspect at all. We have been given guidelines by county that say if we come across anything suspect/dodgy at all we have to force power off (Out at the plug or pull battery out of laptop), not touch any keys at all, defnitiely not investigate any further, lock the machine away and report it to protect ourselves.

Now this is obviously OTT if it is just smutty. But internally we have decided that if we find something we don't follow links off the main page found, we infomr the other memeber of the team that something was found and if it is a member of staff in form the Head.

 

So if the images are in a users area on the server do you unplug the server??

[buzzard]

Problem with that approach Dan is that you have to be very careful if you think anything is suspect at all. We have been given guidelines by county that say if we come across anything suspect/dodgy at all we have to force power off (Out at the plug or pull battery out of laptop), not touch any keys at all, defnitiely not investigate any further, lock the machine away and report it to protect ourselves.

Now this is obviously OTT if it is just smutty. But internally we have decided that if we find something we don't follow links off the main page found, we infomr the other memeber of the team that something was found and if it is a member of staff in form the Head.

 

So if the images are in a users area on the server do you unplug the server??

[bossman]

I would think common sense would prevail here and the user account be suspended so only administrator can access. Switching off the server would indeed be OTT in my opinion. Quite frankly having read all there is on this thread i feel there is very good advice being given out and if people are sensible and follow a set procedure which has been passed by the governing bodies at the school then they have nothing to fear.