Are internet providers and social networks doing enough to stop illegal images online? Not always! But in Canada, they have a legal obligation to act and by not doing so, it can result in significant fines.
In 2011 the government of Canada introduced a legal act that requires internet providers to report and take action against child sexual abuse material (CSAM) on their networks. The law mandates that internet service providers must report instances where they are informed of an internet address potentially hosting child pornography for public access. Additionally, they are required to report if they have reasonable grounds to suspect that their internet service is being utilized, or has been utilized, to engage in child pornography offences.
An Act respecting the mandatory reporting of Internet child pornography by persons who provide an Internet service
https://laws-lois.justice.gc.ca/eng/acts/I-20.7/page-1.html
Now, most people in their daily lives think an Internet service provider (ISP) is the company you hire to provide you internet access. However, this Act does not limit itself there – the scope of this Act extends beyond that notion. The above mentioned Act defines an Internet service as:
” a service providing Internet access, Internet content hosting or electronic mail. (services Internet)”
Any company or person providing access to the internet, hosting content online, and managing emails is by definition an internet service provider. Therefore, all have a duty to report. So what are they required to do under the Act? If CSAM is publicly available within their control, they must report it to the Canadian Centre for Child Protection.
Duty to report Internet address
2 If a person is advised, in the course of providing an Internet service to the public, of an Internet Protocol address or a Uniform Resource Locator where child pornography may be available to the public, the person must report that address or Uniform Resource Locator to the organization designated by the regulations, as soon as feasible and in accordance with the regulations.
Furthermore, an internet service used for CSAM, either publicly or privately, must report it to a police officer
Duty to notify police officer
3 If a person who provides an Internet service to the public has reasonable grounds to believe that their Internet service is being or has been used to commit a child pornography offence, the person must notify an officer, constable or other person employed for the preservation and maintenance of the public peace of that fact, as soon as feasible and in accordance with the regulations.
And the ISP must also preserve the evidence
Preservation of computer data
4 (1) A person who makes a notification under section 3 must preserve all computer data related to the notification that is in their possession or control for 21 days after the day on which the notification is made.
Destruction of preserved computer data
(2) The person must destroy the computer data that would not be retained in the ordinary course of business and any document that is prepared for the purpose of preserving computer data under subsection (1) as soon as feasible after the expiry of the 21-day period, unless the person is required to preserve the computer data by a judicial order made under any other Act of Parliament or the legislature of a province.
The kicker – Not following any of these requirements can result in $10,000 to $100,000 fine for every subsequent offence.
Offence
10 Every person who knowingly contravenes any of sections 2 to 5 is guilty of an offence and liable on summary conviction,
(a) in the case of an individual,
(i) for a first offence, to a fine of not more than $1,000,
(ii) for a second offence, to a fine of not more than $5,000, and
(iii) for each subsequent offence, to a fine of not more than $10,000 or to imprisonment for a term of not more than six months, or to both; and
(b) in all other cases,
(i) for a first offence, to a fine of not more than $10,000,
(ii) for a second offence, to a fine of not more than $50,000, and
(iii) for each subsequent offence, to a fine of not more than $100,000.
What’s the point?
It is great that companies need to report illegal activity, but how can this help a youth or their family?
What If you are not getting the response you need from your local police?
We have helped families communicate with their local police when an online crime has been committed. Thankfully in cases of CSAM, in our experience, police are very quick and helpful to respond to family’s needs. If you are not getting the help you need, having an organization by law required to report to authorities CSAM can provide the extra pressure needed to get results.
It makes internet providers remove CSAM from their platform.
A young person whose nude, semi-nude, or nearly nude classifies as CSAM being sent or hosted within an online service. It must be removed, reported, and preserved for police investigation.
Thankfully most major social networks have responsive teams dedicated to addressing this very situation!
Situations Where This Act Could Apply
CSAM is being extorted (sextortion) to send money so an image will not be posted (blackmail)
Who could be required to report
• App/program/service used to communicate the threats.
• App/program/service used to where the image was sent through.
• App/program/service used to where the image is being hosted
• Internet provider used by the youth and the extorter.
CSAM is actively being shared with others without consent.
Who could be required to report
• App/program/service used to send the images.
• App/program/service used to where the images are hosted
• Internet provider(s) used to distribute the images
How to Inform an Internet Service
If you have ever asked for help from a social network, you know talking to a real person is very unlikely. Often we are stuck with online report forms. Thankfully, sometimes these reporting forms have description boxes to elaborate on the events being reported. plus in those times when a network has a report email address there are some important things to mention.
Subject: Child Pornography Report
Dear representative of [Company Name]
I am writing to notify you, as an online service within Canada, about a child pornography incident that I wish to bring to your attention. As per Canadian legislation that was passed in 2011,
An Act Respecting the Mandatory Reporting of Internet Child Pornography by Persons who Provide an Internet Service, SC 2011, c 4.
I have identified you as either providing internet access, hosting internet content or electronic mail. Under section 3 of the Act
Duty to notify police officer
3 If a person who provides Internet service to the public has reasonable grounds to believe that their Internet service is being or has been used to commit a child pornography offence, the person must notify an officer, constable or other person employed for the preservation and maintenance of the public peace of that fact, as soon as feasible and in accordance with the regulations.
With this message, I am notifying you that on [insert date and time], an incident of child pornography occurred on your network.
|
[Insert important information: IP Address, Cellphone Number, User Account ID, URL, ETC] |
I urge you to take immediate action and report this incident as required by law. I too will also be notifying the police of this incident in my jurisdiction.
Failure to fulfil a duty to notify police officer. Under section 10 of the Act
Offence
10 Every person who knowingly contravenes any of sections 2 to 5 is guilty of an offence and liable on summary conviction,
(a) in the case of an individual,
(i) for a first offence, to a fine of not more than $1,000,
(ii) for a second offence, to a fine of not more than $5,000, and
(iii) for each subsequent offence, to a fine of not more than $10,000 or to imprisonment for a term of not more than six months, or to both; and
(b) in all other cases,
(i) for a first offence, to a fine of not more than $10,000,
(ii) for a second offence, to a fine of not more than $50,000, and
(iii) for each subsequent offence, to a fine of not more than $100,000.
I would also suggest you review section 4, preservation of computer data & destruction of preserved computer data.
Thank you for your prompt attention to this matter. I look forward to receiving confirmation of the receipt of this message.
Sincerely,
[Your Name]
We have a pre-written letter with all the essential elements that internet service providers should be aware of, or risk a fine for non-compliance. This can be sent as an attachment, text copied into an email, or online report filed.
Everything important is covered – all that needs to be modified are your details (highlighted in red)
What you need to enter
- [Company Name]
This is the online service you are contacting
- [insert date and time]
specify when the incident occurred. often with data management helping the service provider to quickly locate the subject being reported
- [Insert important information: IP Address, Cellphone Number, User Account ID, URL, ETC]
Any identifying information you can share is critical about who is using the online service to commit CSAM.
- [Your Name]
Your name and any contact details for the company to get back to you.
Disclaimer: This resource is designed as information about the laws in Canada, and how we have used them in our line of work. In no way legal advice and for specific questions do connect with a legal representative
