Obviously I already removed all media, banned all the users and prevented account creation. I have ip addresses and metadata of the users
Probably should have given all of the evidence to the police instead of deleting some of it.
In most western jurisdictions platform operators are not liable for user content, (as long as they cooperate with the authorities) so nothing to worry about - next time, don’t do anything and just tell the police and ask them what they would like you to do. Maybe they’d even would want to letting them keep posting for a while to gather more data on the offenders, but idk how they deal with selfhosted stuff tbh…
(this is not legal advice)
I would think very carefully before contacting the police. I am not suggesting that you should provide a safe harbor for people sharing CSAM, or obfuscate their crime. You absolutely should take action, but carefully weigh your options before calling the police.
While it may (possibly!) be true in your jurisdiction that platform operators are not liable for user content, police aren’t on “your side”. Even if you assume the highest standards of professionalism from them, they need to represent the interests of the victims (not you) and need to diligently investigate the crime. That means they need to confirm beyond reasonable doubt that you are not involved beyond operating the host.
Just because you self-disclose does not mean that you are innocent. You could’ve been actively participating and when threatened with blackmail you’ve decided to self-disclose to avert guilt.
Another consideration is what else I have on my server. I’m catch and release for pirate movies and TV these days so there’s only 100gb or so. I do have several hundred pirate audiobooks though. Deleting all that before handing my server over will look very suspicious.
With all of this in mind, the only course of action is to talk to a lawyer. A lawyer will know exactly what laws are relevant, and can guide you through the process of self-disclosure while minimising the imposition on you.
If you have a problem and call the police, now you have two problems. That’s not just cliche, it’s true.
Don’t call the cops, call a lawyer.
I mean…I get where you’re coming from, but fuck that!
I’d have deleted the entire matrix server entirely. Washed my hands of the entire thing.
Because you can go to the police, and say “There’s child porn on MY server”, and the cops MIGHT work with you to catch the people actually posting it.
OR
They might take the easy way. There’s a guy here, saying he’s hosting a server with child porn. Arrest him, because we know who he is, and call it a win in the media. Yes thats not how the law works…but it’s how lazy and corrupt cops work.
Cops are never your friend. I’d avoid any interactions with them that you can.
Probably should have given all of the evidence to the police instead of deleting some of it.
Or maybe not. …
In most western jurisdictions platform operators are not liable for user content
Around here, OP would then automatically be a suspect for possession of the material. Possession is a crime. And that is far from funny. Better have a very good lawyer from minute 1.
if the cops are feeling extra “fun”, it’s possession and distribution, since OP operated a server that served CSAM between users. Lawyer up before telling the police “i unknowingly distributed incredibly illegal material from a server I own, here it is”
DO NOT call the police. They will confiscate the server as evidence, and lacking any other suspect, you will be their primary lead. Police aren’t about convictions or justice, they want to consider a case solved.
By law, you are not liable. But because of law enforcement incentives, it will absolutely become your problem.
Anonymously report them. Don’t call police they will come and take the server
Search for posts or contact db0. IIRC they worked with LW admin and others to create a filter for this using a very small AI model. It should be on their Git.
Are you thinking of Lemmy? OP had it on their Matrix chat server.
Abstract solutions for content recognition with a bot on a server is not a platform specific issue. The dev is skilled and likely on Matrix too.
How would that “admin” be helpful on matrix?
It is a bot that identifies CSAM images. They are a very skilled dev. The problem is content recognition on a server. So in abstract, it is the same problem.
The openSUSE matrix server had this happen last year, and the admins came up with a good solution of bots that seems to keep things very clean now. I’m sure they might be happy to help if you asked in their admins group
Nah, the police are not your friend.
Lots of good responses here. That’d be a really scary find, OP, and I’m sorry you’re dealing with that. :(
As much as I also long for justice, I also totally understand the inclination towards just nuking and paving the whole thing and moving on. Some factors that occurred to me:
- Those posting it might be outside your nation’s jurisdiction.
- They might just be bots set loose by unknown actors.
- The above, plus they might be using “zombie” machines to bounce this material around unguarded servers wherever they can. It could be very difficult to ascertain who is behind this.
I agree with others that you should only move forward under the guidance of a good lawyer, because you don’t want to be the most convenient potential suspect they have access to.
If you could log their IPs or other identifying data and anonymously forward suspicions to authorities that would take action on them, that could potentially be a viable option. But again I’d ask a lawyer.
HelloRoot is correct. You should not have deleted anything. You should have simply shutdown the server and contacted the FBI (not the police). Child porn is a serious federal offense and because they committed the offense across state lines (or aren’t in the US at all), FBI wold have jurisdiction. Because you deleted the evidence (a crime, by the way) there’s nothing for them to go on now.
If this ever happens again, shut down the server so no one can connect, and contact the FBI Criminal Division who has their own child crimes division that specifically deals with child pornography.
I’m in France though, keeping it would make me a criminal
Take the above comment and replace references to “FBI” with the French equivalent.
Though, if you keep registration closed, you’re unlikely to have this problem again.
Better delete it in the same minute when you found it.
