Legality of data &quot;chunking&quot; concerning child pornography Recently, I've become interested in distributed, peer-to-peer (p2p) file sharing, including BitTorrent (en.wikipedia.org/wiki/BitTorrent) and the InterPlanetary File System (ipfs.io) (IPFS). This question specifically concerns IPFS. IPFS is very complicated for non-technical people, so I'll try and break it down for the purpose of this discussion: In IPFS, you can add data to the global file system, which produces a "hash" (a string uniquely identifying the data) that you can share with others. Data in IPFS is content-addressed, meaning that instead of using URLs or locations for data, it uses fingerprints of the data itself. This has several useful characteristics: anybody on the network with the same data can serve it to you, reducing the burden on a web server and eliminating the waste of bandwidth that is HTTP; data can remain available even after the original host fails, which makes archiving data much more reliable on IPFS; and there is no central system that can fail, like DNS resolvers, that can prevent the system from operating (aside from, of course, normal internet infrastructure). When sharing on IPFS, you aren't actually sending whole files to peers; instead, these files are broken apart into "blocks" of data which are retrieved separately (and often from different peers altogether). These blocks are re-assembled at the end to form the complete data. Now, suppose someone is sharing child pornography via IPFS. Under U.S. law, the mere possession of child pornography is illegal, so the sender is certainly acting illegally. The recipient of these files, after assembling the blocks to form the files, are now in possession of content that visually depicts minors engaging in sexual activity. However, would an intermediary node (hypothetically) that may have cached a block needed to form the violating data be guilty of possession? The block alone cannot represent the visual activity that constitutes illegal material, and in fact, the hash representing the block can represent any such block with the same data (since the hash identifies the data, not a location), so its entirely possible (if slightly improbable) that the same hash for a block used in child pornography could be a block used to represent part of a Disney movie. For example, these two sentences, broken down into uniquely identifiable chunks of two: I have two cats in my house. I |ha|ve| t|wo| c|at|s |in| m|y |ho|us|e. and You should burn in Hell. Yo|u |sh|ou|ld| b|ur|n |in| H|el|l. You'll notice that both sentences have a common chunk, "in". Under US law, would someone who possesses this block, "in", be responsible for its use in all contexts, such as in the second sentence? Obviously, in real data these chunks are between 256 kilobytes and 2 megabytes, so the chance for collision is greatly reduced, but by design of the system, content addressing allows for the avoidance of duplicate data. My question is how that affects legal regulations concerning said data.
18 U.S. Code § 2252 defines a crime and punishment for knowingly transporting, or reproducing for distribution by any means, visual depictions involving the use of a minor engaging in sexually explicit conduct. Here are some sample jury instructions that rephrase this and give definitions for each of these terms. Here are some others (at p. 469). This law review article discusses the knowledge requirement of this statute. It would be an easy argument that the operators of the intermediary nodes do not have the requisite knowledge of the material flowing over their networks and computers to be implicated by section 2252, especially when they are broken down into chunks that can only be re-assembled at the destination. United States v. Kuchinski, 469 F.3d 853 (9th Cir. 2006) is an example of a case where a defendant was found to not have the requisite knowledge of child pornography that was found in his browser's cache folders. These were complete files, no assembly required. However, the court said: where a defendant lacks knowledge about the cache files, and concomitantly lacks access to and control over those files, it is not proper to charge him with possession and control of the child pornography images located in those files An IPFS user has no more knowledge of the pieces being passed through their computer than this defendant did of his cache (unless of course they are the source or destination).
Although the USA don't like it, there's a department called INTERPOL which is composed by about 150 countries. When a crime is committed and you need to involve another country to solve it, the sovereignty of each County prevents a police officer from one country acting upon another country. That's when the INTERPOL comes in. They usually requests the police from that country to act up. A judge from that country will grant their local police access to the data to be delivered to the country that requested it. Can the police get a search warrant for data 'in the cloud'? Yes. If the servers are located within the boundaries of your own country, it's a normal procedure. But like the above answer states, it's easier to subpoena the records than to execute a search warrant. In a subpoena, the company itself is bound to provide everything the police asks. Can the police get a search warrant for such third party systems? Yes. If there's enough probable cause, the investigation can lead to allow the police to try and discover files that are held by servers that store the cloud data. But if the servers are located outside the country and the company does not have any office opened in the country, a search warrant won't have validity in another jurisdiction and the police can't act without breaking the sovereignty principle. That's where the INTERPOL services are handy. The department is built in the principle of polices from different countries helping each other. The downside is that it's too bureaucratic and it takes a lot of time. For instance if he has a virtual machine hosted by Amazon, would they serve the warrant on Amazon, or on the suspect? Like mentioned by @Viktor, if the company has an office within the bounds of your country, it's easier to subpoena the records because that way the company will filter and provide only the data linked to the suspect being investigated. That is, the subpoena will have both the name of the company (Amazon) and the name of the Suspect, so the company can provide only the necessary files. Update If the police lack sufficient evidence for a search warrant, but an interpol country was, for some reason, willing to work with the police to collect and provide that information would they be able to use it even if they wouldn't have been able to subpoena a US country? Hypothetically speaking, I see your follow-up as a company that do have a local office and the Federal Police was turned down by a judge on a warrant/subpoena. In that case, there's no reason for another's country police to act on their own country. The suspect is a foreign suspect, the crime is a foreign crime and the police has no reason to work on it. But for the sake of argument, let's say that the local police was turned down by a judge for lack of evidence or something and the suspect has been investigated by a foreign country or whatever. If the information that the local police desires to obtain is available through the INTERPOL, it's most likely to be accepted since it's a data stored by an international police department. In your scenario, the foreign police was granted a legal right to search and collected the data for legal purpose. Maybe they can't use it in their own country, but since they followed a safe chain of custody and provided the information to the INTERPOL, that information has legal validity and it is not fruit of the poisonous tree if the chain of custody was maintained.
You're probably making an “international transfer” here, but that doesn't mean it is illegal. The GDPR has a very broad concept of “personal data” and of “processing”. Per Art 4(2), ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction Which I would summarize as: pretty much anything you do with the personal data counts as “processing”. So yes, your non-EU servers would be processing the personal data in HTTP requests, even when those servers aren't directly storing the personal data. Chapter V of the GDPR applies to Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country […] Per this definition, the question whether an international transfer occurred is inextricably linked with the question whether the data is being processed in the destination country. The generally accepted interpretation here is that mere transfer through a country does not constitute processing. For example, if your requests happen to take a network route through other countries, that wasn't an international transfer. But your HTTP server is definitely doing processing, even if it doesn't store the data persistently. If the HTTP server is in a non-EU country, then you have to consider how this transfer of data is protected. You're supposed to uphold the high GDPR data protection standards regardless of where the processing occurs. Some countries have been granted an EU adequacy decision, meaning that their data protection laws are sufficiently similar to EU laws and no extra bureaucracy is needed for that transfer. The transfer still needs to be noted in your privacy notice (compare Art 13(1)(f)). In other cases, you may be able to rely on “standard contractual clauses” (SCCs), which are pre-formulated contracts provided by the EU that translate relevant GDPR aspects into a private contract between the data exporter and data importer. However, you as a data controller must make sure that the data importer is legally able to enter into that contract. For example, the terms of these SCCs are incompatible with US national security laws, meaning that US companies might not be able to enter into the SCCs. There are a couple of other ways to authorize international transfers, but they are mostly relevant for multinational groups of companies, or in exceptional situations. In any case, other GPDR requirements like the need to have a suitable contract with your data processors remain unaffected. Also unaffected is the obligation to implement appropriate technical and organizational measures to ensure the compliance and security of your processing activities (e.g. see Art 24 and Art 32 of the GDPR). For example, this may imply the need to implement suitable encryption. In the wake of the Schrems II ruling that struck down the EU–US “Privacy Shield” adequacy decision, the EDPB published recommendations on extra compliance measures that could allow SCCs to remain valid for EU–US data transfers. But it's not easy to defend data processing activities when potential adversaries include literally the NSA, and measures such as end-to-end encryption (E2EE) are incompatible with cloud services that are more interesting than backup storage. Practically speaking, I would reconsider an architecture that would allow failover of EU data processing operations to non-EU locations, unless those target countries are covered by an adequacy decision. If you need a high availability setup for EU activities, it may be more appropriate to maintain multiple deployments within the EU.
The site would combine the data in novel ways, which is processing the data. Processing personal data which is publicly available is still processing personal data. You would have to take GDPR into account. That does not mean the processing is forbidden, but you need a legal basis for doing it. In many ways, having the informed consent is the easiest legal basis, but there are others. The data subject would have the right to demand information about the data you hold, and to demand the correction of wrong data. There is not necessarily a right to demand deletion, but if consent is withdrawn and you have no other basis for data processing, you have to delete. Note also that the consent basis would mean you have to actively contact the people whose consent you seek before the processing starts, and document how you do it. That makes pay-per-request models difficult. But consider that the news media can process some data about some people without the consent of the subjects of their activities. They just need to balance privacy and other legitimate interests all the time.
This sounds like it would fall under the "extreme pornography" part of the Criminal Justice and Immigration Act 2008. Section 63: (7) An image falls within this subsection if it portrays, in an explicit and realistic way, any of the following— (b) an act which results, or is likely to result, in serious injury to a person's anus, breasts or genitals, and a reasonable person looking at the image would think that any such person or animal was real. (7A) An image falls within this subsection if it portrays, in an explicit and realistic way, either of the following— (b) an act which involves the non-consensual sexual penetration of a person's vagina or anus by another with a part of the other person's body or anything else, and a reasonable person looking at the image would think that the persons were real. What you describe would likely result in serious injury to the victim, and the video appears to be non-consensual. Note that the actual origin is not relevant; if the videos were actually a brilliant piece of special effects and no anuses were harmed that gets you nowhere. The only thing that matters is what a "reasonable person" looking at the videos would have thought. Context might make a difference; if the videos were made by an identifiable company then a reasonable person might assume the producers would have at least obtained consent and complied with their local laws about safety. OTOH if they look like they were filmed on someone's phone and downloaded from some sketchy file-sharing site then a jury is likely to see this as suggesting to the "reasonable person" that the acts shown were real and non-consensual. Edit in response to comment: The law in question says 'An image is “pornographic” if it is of such a nature that it must reasonably be assumed to have been produced solely or principally for the purpose of sexual arousal'. So it can still be porn even if it wasn't filmed consensually. If "pornography" could only refer to consensual images then the prosecution would need to obtain evidence of the consent or otherwise of the participants. This might be impossible if a participant is dead or cannot be identified. Also the definition above matches both the dictionary definition and most people's idea of what makes something "porn"; the point of porn is sexual arousal.
You are responsible for any processing of data that happens under your control – but are you the data controller in this scenario? Since you have no meaningful influence over whether or not this backup happens on the operating system level, there could be a strong argument that you aren't a data controller for these backups. And if you aren't a data controller for that processing activity, you aren't responsible for compliance. However, if you were to integrate directly with relevant Google APIs in order to facilitate backups that could make you a controller. Then, Google would either have to be your data processor (won't be the case here), or you would need a legal basis for sharing the user's data with Google. For example, you could ask for the user's consent before activating such features.
There is actually a rather recent law in Germany which would make nonconsensual distribution of images which could damage the reputation of a person illegal: §201a StGB [de|en] &quot;Violation of intimate privacy by taking photographs or other images&quot;. This law says that: whoever, without being authorised to do so, makes available to a third party a photograph or other image of another person which is of such a nature as to significantly damage the reputation of the person depicted incurs a penalty of imprisonment for a term not exceeding two years or a fine. But even if the person has not already done so, just threatening to commit this crime might also be a crime according to §253 StGB [de|en] &quot;Extortion&quot;: (1) Whoever unlawfully, by force or threat of serious harm, coerces a person to do, acquiesce to or refrain from an act, and thereby damages that person’s or another’s assets for the purpose of wrongful personal enrichment or enrichment of a third party, incurs a penalty of imprisonment for a term not exceeding five years or a fine. (2) The act is unlawful if the use of force or the threat of harm is deemed reprehensible in respect of the desired objective. (3) The attempt is punishable. (4) In especially serious cases, the penalty is imprisonment for a term of at least one year. An especially serious case typically occurs where the offender acts on a commercial basis or as a member of a gang whose purpose is the continued commission of extortion. Considering the repercussions in the Saudi-Arabian culture and legal system for promiscuity, especially for women, it is hard to deny that there is a threat of &quot;serious harm&quot; in this case. So it might be a good idea to file a police report with the police of the federal state where the perpetrator lives. The police of most federal states allow to do that through their respective websites (look for the keywords &quot;Internetwache&quot; or &quot;Strafanzeige&quot;), so there is no need to travel to Germany to do so. This does of course require that there is enough information available to obtain the real identity of the perpetrator, which can be difficult with people you only know through online services.
Would any offence be committed for: Having this on your person? Buying or selling this? Leaving it around for people to plug in to a computer? In the abstract, I don't think that this conduct would violate either Section 36 of the U.K. law or U.S. law, although, obviously, purposefully destroying a computer itself (i.e. actually using the device without the consent of the owner of the computer) would violate many U.K. laws and would also violate many U.S. laws at both the state and federal level. I also don't think that possession or buying or selling this product would be a crime absent some intent that it be used illegally, in which case there might be an "attempt" to commit a crime offense, or an offense that would make one part of a conspiracy to commit a crime. In the "leaving it around" example, there is arguably an intent to use it to harm another improperly, although the phrasing is ambivalent. While many statutes in the U.S. criminalize possession of burglary tools, or drug paraphernalia, sometimes with an associated intent element (although even these crimes often have an express or judicially implied intent to use element), I'm not aware of any statute that criminalize possession of tools for malicious destruction of property. So, if the tools aren't possessed or used in a manner intended as a step in the facilitation of a crime, I don't think that any law is violated. So far as I know, the U.S. does not have a counterpart to Section 37 of the British statute cited above (it isn't a terribly easy thing to search for to definitively rule out the existence of such a law because federal law has many uncodified crimes in unexpected statutes and there are many sets of state criminal statutes, not all of which are codified either). The example giving in the comments by @gnasher729 of possession of a hammer which could be used to do the same things that this object could be used to do is instructive. Arguably, this USB-like tool is more specifically targeted at malicious conduct. But, for example, when I used to work as a radio news reporter, we had a machine that was basically a high powered magnet that was specifically designed to destroy all information on magnetic media. This was, in part, so that it could be reused, but it was also so that confidential interviews wouldn't fall into the wrong hands once they were no longer needed, in much the way that one might shred paper documents. It isn't so implausible to think that a device like this one might be necessary for individuals or firms with national defense secrets embedded in their hardware and software to have on hand in order to destroy a sensitive computer in order to prevent a security breach, if necessary. In a case like that, leaving one of these devices around the office unlabeled might be negligent, but wouldn't have the intent necessary to be an intended crime. And, it is hard to imagine that the device itself, which seems pretty simple, would itself involve any technology that is a national security secret, so it probably wouldn't violate export control laws. Of course, possession, purchase or sale of such a specialized device, or leaving it around unlabeled would certainly be powerful evidence of an intent to use the device in a wrongful manner, and hence, of an attempt to commit a crime. Indeed, possession of such a device or purchase of one might very well be sufficient to establish probable cause to seize the device and arrest the person holding it on charges of an attempt to destroy a computer. But, this device would be merely powerful evidence of an intent to commit a crime, rather than something that is a crime to commit in and of itself. There are no international laws that govern this kind of thing. The only international laws applicable to individuals pertain to war crimes and nuclear and chemical weapons. Even then, most international laws direct member nations to adopt domestic laws on the subject rather than being self-executing.