Is one liable if illegal material is found on one's own server?

Question

This question was prompted by a news article I read earlier today, in which a person described the dilemma they faced on discovering illegal material had been stored by an unidentified third party on their computer system:

He called the police, who told him to print it out and bring it to them. However it is illegal to possess images of child abuse, digitally or in print.

The crime is based on knowing possession, so once a person knows their computer contains such content, and decides not to delete it (or not delete it yet), they probably fall within the law.

So this made me think. If someone does find illegal material, what can they do?

• Even to keep it long enough for police to be notified and attend would still be keeping/possessing it.

• Knowing it's been stored in various backups might mean having to destroy important backups, as some of the most widely used backup and snapshotting systems don't have selective delete capability, you can only keep or delete the entire backup. (ZFS especially, widely used in many file servers for its utter reliability, is designed this way to preserve snapshot integrity: you can delete snapshots but not specific files in them).

• Copying to a device such as a USB stick, even by or with police, may be a concern since in law, this creates a copy on the PC in order to copy it from server to USB stick.

I'm in the UK but interested in other jurisdictions as well. Clearly if you do something like any of these under direction of the police, who you promptly notified, it's not likely you'll be prosecuted, but it would make me (and perhaps many people) very uneasy even so, because it is against the law and there isn't any legal exception created for good cause or "because police told me to".

Also I can imagine in a worst case scenario, a bad file could have been there for months before coming to light, so copies may exist on effectively all data backups that exist - every company backup, and all of them immutable and critical.

So... What exactly is the position, and the appropriate action, and what is the position with critical backups that can't be modified by their nature?

Answer 1

So far as I am aware, all jurisdictions provide some kind of defence to the offence of possessing child pornography (or, for that matter, other illegal items like drugs and weapons) for legal purposes. This is necessary at least for police and others involved in the criminal justice system – if not, it would be difficult to seize the material and admit it in evidence if the defendant pleads not guilty.

In the United Kingdom, it is a defence to prove that you possessed the material for a ‘legitimate reason,’ which is not defined. Note that this is a legal burden, meaning that the defendant must affirmatively prove the existence of a legitimate reason on the balance of probabilities, rather than merely raising reasonable doubt. See the Crown Prosecution Service’s guidance on Indecent and Prohibited Images of Children, under the ‘Statutory Defences’ section:

The defence is made out if the defendant proves that he had a legitimate reason for the conduct in question. This is a legal rather than an evidential burden (R v Collier [2005] 1 Cr. App. R. 9).

“Legitimate reason” is not defined in either Act. In Atkins v DPP; Goodland v DPP [2000] 2 Cr. App. R. 248 it was held that it is a pure question of fact in each case. In cases where it was maintained that the conduct was part of legitimate research, the central question will be whether the defendant was essentially a person with an unhealthy interest in indecent images acting under the pretence of undertaking research or, on the other hand, was a genuine researcher who had no alternative but to have such unpleasant material in his possession. The judgment continued to say that the courts “are plainly entitled to bring a measure of scepticism to bear upon such an enquiry; they should not too readily accept that the defence is made out.”

Relevant statutory provisions

The ‘legitimate reason’ defence is set out in s 1(4)(a) of the Protection of Children Act 1978 and s 160(2)(a) of the Criminal Justice Act 1988. The relevant provision depends on which Act the offence was charged under; the CPS guidance has a section on ‘Which Offence Should be Charged’ for more on this.

In response to the comment below, s 63 of the Criminal Justice and Immigration Act 2008 creates a separate offence of possession of extreme pornographic images. Like the child pornography offences, there is a ‘legitimate reason’ defence – see s 65(2)(a) of the Act. Commentary is available in the CPS guidance on Possession of Extreme Pornographic Images.