Security → Computer technician finding illegal activity

I have replaced hard drives and cleaned up viruses and malware - but none of the things I do would ever find child porn on a computer. I don't look at files, pictures, or any other personal information. Sure, if it was the desktop background, but that is about it.

But there are periodic news articles about someone that brought their computer to geek squad, and then got arrested for child porn or other illegal activity.

When you drop off a computer for repair, do you have an expectation of privacy? What if you had naked pictures of you or your spouse, or you were a professional photographer and had images of others, or your tax return, or emails...

Geek Squad is legendary for vacuuming customer's computers.

If you mix immaturity, inability and corporate mentality all together; Geek Squad is what you get - no matter how well you half-bake it.

Imo there is absolutely NO expectation of privacy once your computer leaves your home, or even while within your home.........these days there is simply NO expectation of privacy.
That really should not be any issue......when even a in-experienced computer user can so easily "hide" their private info.
Plus external drives are great means of keeping things private..........very little if anything of a real private nature should remain on a computer.......

**** Understand the use of encryption.

There was a case of that in my local area not too long ago. A guy brought his computer in for repair (likely because of malware) and he was busted for child porn. No, it was not Geek Squad but some independent computer tech. Apparently the tech went rummaging through his files, found the CP then called the cops.

First of all, there is never any reason to take a machine in for "malware clean-up." But most people don't know the difference in malware or hardware issues, so I can't really blame them for that. But this particular guy in my town wins the Darwin award for thinking all of his illegal files would be safe.

The thing about child porn is even though I fully understand why it is illegal, I think there is a lot of room for abuse. For instance, what if a disgruntled computer tech plants it on someone's machine just for lulz? What if an angry spouse plants it on the other spouse's machine? There is really no way to prove who did what when more than one person has physical access to a machine. This is why it is imperative that people take responsibility for their own data. Don't trust it in anyone else's hands. If you have to take a machine in for repair, remove the hard drive and tell the technicians to use their own. If that's not possible, then encrypt your sensitive files.

Some people think CP should be legal. While I understand their position that mere bits of data shouldn't be illegal, could you imagine what it would be like if it were legal? Imagine searching your favorite adult site and finding a "kiddie" category section. That would be, um, a bit disconcerting to say the least. It'll never happen, which is why I would never trust other people with physical access to my machines. There's simply no telling what they may do (either maliciously or accidentally).

I think that last part you could have left out altogether.

For me C/P is illegal and hopefully it will stay that way. If that became legal, every censorship law becomes voided.

However, as I came here due to search history mentioning C/P in the early days of XP without a firewall and an internal modem for connection, I am fully aware search history doesn't mean a lot with an inexperienced user, but as you back up all data when doing serious maintenance or wiping to start again, if you come across scan results suggesting images, you would have to consider it, otherwise I tend to keep a persons data their own and will not try to become the law unto myself, it makes for good business.

Historically, child pornography wasn't illegal in the early '70s. Ironically, Hugh Hefner, Bob Guccione, and possibly even Larry Flynt got on the bandwagon to outlaw child pornography because they felt threatened by the competition from the publishers of child pornography.

Yes, it was very disturbing to see a child porn section in an adult bookstore; I stopped patronizing that store over the CP.

As for how to find files easily ...

Yes you do. However, this is really a trust/ethics issue. While you may expect it, your expectations may not be honored. I'd expect that there are a lot of technicians out there that do a scan for pics and MP3s during the course of their work and make a copy for themselves.

Remember you're handing your data off to people who are just over minimum wage, not highly trained experts.

Is it a wallpaper/ Links to very odd files or images right on the screen? Not everyone hides things.
Doing DSL installs I easily saw all sorts of stuff on the computers without even trying.

That's true, especially if you have to look for reasons behind software problems. Still you have to have some sort of decorum.

Morals come into it, but if your worried about morals of the user and a computer initially, then I'd hope you are alert enough to worry about the lock on the front door.

I guess what NormanS is trying to say, look there first and if you do not like it, do not process without a discussion with the owner about what is next.

Child porn pictures can be pushed to a person's computer while engaging in otherwise lawful activities.

When I first began installing satellite internet systems in 2000, I went thru a learning curve concerning content on customer computers

For a while, after I had everything going, I would open up the customers favorites and launch the top item in the list to demo how much faster the page loaded compared to their previous dial up - assuming they would be familiar with that particular page
After one such demo resulted in a XXXXXX rated photo that had us both stuttering and reaching for the close button, I never ever ever opened anyones favorites again

This is sort of a tangent from OP
Back in olden days of satelite internet it was necessary to have a phone connection to complete one step in the account activation process
Occasionally a customer did not have a phone line so they would bring their box into the store and I would activate the system there then bring everything to site and setup the dish etc

On this one occasion I brought the pre configured computer back
Present when I fired up the computer was the mom and granny
What popped up when I launched the browser was a XXXXX video
I am telling you - the force of our three jaws hitting the floor had to have registered on the Richter scale across the planet
I was pretty much run out of there at gun point for bringing that *hit into their house - accusations and threats following me out the driveway

Couple days later the granny called up to apologize
She had busted her grandson a few days before I got their computer for looking at porn and their computer had got some sort of malware from it....

+1 I have found things just by a matter of seeing the file name go by my eyes. Recent docs history or bookmarks history or cache, or even the actual files. An idiot on my corporate network (many years ago, pre-corporate proxy) kept not only his porn and mp3s, but images of his wife giving birth on his network share.

You can't miss some file names going by the backup routine: HotTeenAnalXXX.jpg; "PamAndersonXXTommyLeeBJ.mov"; "JenGivingBirth.jpg"; or NickelbackNoise.mp3

When I see that, I did have to give a heads up to the user to knock it off and get rid of it.

I don't riffle through files and otherwise respect privacy, the exceptions being either corporate policy issues or the law, such as if you even see a hint of CP, you have to confirm what it is. You are required by law to report any CP found and if you don't you are culpable at least in my state.

-Jim

I fully agree. Historically people would give confidential information about themselves to their priest or medical professional with the expectation that this information would be kept confidential.
I see IT professionals in a similar way. Confidential information is often accessible to us in the normal course of our work and it is a matter of professional ethics to keep it confidential (and in some countries this is law).

Being confronted with evidence of criminal activity however also raises an ethical question (and there may not be an easy answer).

No reasonable expectation of privacy. It applies to anything though, including financial data. Which should be encrypted and stored on self-encrypting thumb drive.

So, story time. Back when I worked for a small shop, over jeeze it'd be 14ish or more years ago. We had a guy bring in a computer saying he had problems printing images. So, being the guy who dealt with all the shitty crap and all that I simply went to look for some images and it was full of kiddie porn, and it just got worse from there. It sears your soul, the type where you close your eyes years later and you still see them.

I can understand it, if you're browsing somewhere like the dirty underbelly(a chan) and it gets on there. I can understand accidents, screwups. Being an idiot. But when you've got 1100+ pictures, not a chance. Regardless, here you've got to report it here failure to do so, is a crime. Being not much more than a teenager at the time though and having to go through a 3mo trial and being a witness for it? Damn it all to hell, never was I happier to see the judge throw the book at the guy. He got the max sentence allowed under the law. They were all of kids in his neighborhood.

Snooping and just generally digging around without purpose is poor professionalism and WILL get you fired from my business.

There are many ways to find information without snooping. Due to the nature of the material and association with spyware/malware, running a scan of the system could result in folder/files being exposed.

If in the normal course of repair/troubleshooting you come across the files, you have the somewhat legal duty to report what you found to authorities... Not sure of the law, but many places have laws that ignoring the crime is essentially a crime.

However, snooping and just generally being an idiot happens too often with immature techs, regardless of their age.

So hard to find good help.

At work, we have about 20GB of space partitioned off just for us to send files over during the course of software installations. One of my tasks was to figure out why software installs failed. Nobody puts anything on these partitions but on this one laptop, they did. I discovered 10GB of porn. How do I know it was porn? Because the names of the files were self-descriptive. Nothing happened to him.

Had VP get fired (forced to quit) because he would browse animal porn on his desktop.

Had a lady keep nudes of herself on her computer workstation. She was in her 50's.

My standard disclaimer whenever someone brings me a computer to work on is:"I will respect the privacy of your data, however I will look into any area that the problems you're having may lead me to. That being said is there anything on the computer that you would not want me to see?". If the answer is yes I would tell them to bring it back when they had removed said items. Also if the work was invasive enough I always backed up their data to one of my computers or DVD. If I have to do that you can bet I checked to make sure I wasn't putting anything illegal into my possession. Not doing so is just stupid. Things can happen and you better have your ass covered.

I think you're a little overzealous. I did that kind of stuff for a decade and such a disclaimer was never necessary.

Maybe, maybe not. I know someone who had a big hassle because he had no disclaimer and when he turned a computer over to the police, he got sued. He won but it was a hassle. The person involved eventually did time. If it had been found he ignored it he could have been in the same boat. He found the offending material when backing up files so he could wipe the computer and reinstall.

Anyone can get sued. A disclaimer doesn't prevent that.

No, but it gives pause to the person turning the computer in for work. I have had 2 taken back. One came back the other didn't.

Also the covering your ass reference was in regard to checking what you're bringing into your possession, not the disclaimer protecting you. The disclaimer is to make people think.

I think as long as you mention the concerns over certain items and the reasons behind it, including the legal implications of some if necessary, then you're clear of the issue with you being held responsible. At least I hope it would be held as true.

If it comes back to bite them because they carry on and you are questioned, then you hold no ties to the business relationship or friendship at the extreme, your opinion was made clear straight away, and their decision from that point is theirs only. Responsibility should never fall on party 2, because of party 1's own actions at this point, which is why I have trouble with the grey surrounding "after the fact" when it straying into said argument. If you were unaware of files because you didn't go looking because it was a plain graphics card exchange, then you are clear. If you see something like animal pron and it disgusts you; then as you have made it clear before proceeding, then you should be still covered. From that point on if it is there it isn't your problem.

But severity and the return trip to see the same concerns over tech work would be troubling in both your business and personal ethics. I would hope if someone was of that nature, they wouldn't come back to you for work. However it paints a picture of me "hiding my head under the carpet", which does allow room for concern over my character.

A point made by GadgetsRme helps avoid the confrontation and would be a wise business option for your needs.But if it is broken and said articles can not be removed, then you have a dilemma of how you as a tech have to move forward, because they can be shady and you will end up exposed to content you might otherwise as a tech avoid or not believe in.

I've worked with plenty of disgusting stuff that I'd rather have not. My concern is the illegal items that can get you in trouble if for some reason you get caught with them in your possession. You can say that shouldn't be a problem, I will not take that chance. I check.

I just don't tell people what I'm doing. They never know something is "in my possession". It just gets fixed or I go back to the customer with a "Hey, here's a game-stopper issue."

10 years, never been sued.

Agreed. I would even venture to say that most people have more personal information on their computers than they do in their own wallets, and who would willingly hand over their wallet?

This is not a day and age to be too trusting or too ignorant which may arguably be the same thing.

Your Start Menu is a mess.

It is not.

I dont drop off my computer for repair but as far as hd rmas or sells I at least do a short dod on them to at least stop the less inclined people. If i did drop it off I would not trust a person for this regardless of how honest or reputable lets say a certain company is all it takes is one person there and there can be a lot of curiosity when dealing with other peoples stuff. I know many people that are computer illiterate and its amazing how much information they leave right at a couple clicks reach, private photos and bank statements in my docs and recent docs, browsing history... The funny thing is they dont even know how to get back to those folders at times so they might feel a little bit more confident giving it to the person to check it out, thinking theyre in the clear.
When i do fix others pcs I will let them know I will only be going into what I need to do to fix the problem, but if theres anything they see private or important and measures such as a wipe exist some basic info they can give me to find it will help without me viewing them.