It is a very sensitive topic that requires a solution from our end. I have few servers that I rent to few people. I have all legal permissions and rights to scan over the servers.

I want to prevent people from storing child pornography, animal cruelty or other videos of similar nature. The first priority is to be able to prevent child pornography since it is the most sensitive issue.

I tried searching online for solutions but couldn't find many people even discussing about this issue, I believe mainly because it is considered Taboo topic of discussion.

One of my thoughts was to search the servers for signatures of known files. Is there such a database anywhere?

I know big companies like GoDaddy have such prevention system but as a small company owner what can I do?

  • 17
    I think you can't find an "answer" because there's no technical means to prevent that kind of activity. Know who your tenants are and be prepared to act when you receive warrants, subpoenas, etc. Even if you "prevent" the storage of the files in the United States, at least, you have a duty to report the offenders when it comes to child pornography. – Evan Anderson Jun 20 '14 at 16:49
  • 11
    Are you sure you want to do this? If you actively scan content, then I believe, at least in the US, you lose your safe-harbor protections, ie you become liable for content you host. You really should check with a lawyer. – Zoredache Jun 20 '14 at 17:40
  • 1
    Do you rent these servers for hosting? Only if the servers are hosting materials for public access will the contain such materials in plain text. If the servers only store the material, the users can evade all your detection attempts by storing in encrypted form. You can't even tell what is an image file and what isn't. – Kaz Jun 20 '14 at 19:57
  • 5
    You are naive if you think people are going to host child porn on the clearnet. Most websites and webhosts with cpanel keep logs of web traffic with ip addresses. It's all on the darknet. I know how to access child porn in 30 seconds. Also I can watch animals being slaughtered and people getting lynched on YouTube, as well as other gore and illegal activities (even on other websites). – desbest Jun 20 '14 at 20:39
  • 3
    @desbest Well, the last big CP bust I read about on Wired (last year sometime), they nabbed over 100 people in the US for downloading CP on eMule (or one of those P2P file sharing services that's not BitTorrent). Sooo.... seems like the criminals actually are dumb enough to do this kind of thing on clearnet. Well, some of them are, at least. – HopelessN00b Jun 21 '14 at 19:01

There are various Government and Industry programs that will provide Hashes of "Known Bad" material (eg CP) to hosting providers. You can then hash the files on your servers and compare. Below are a few that I know of:

  1. HashKeeper
    Discontinued, ran by the US DoJ
    Run by the Missing Kids non-profit
    Hashes for software files, mostly for avoiding software piracy

Other Notes:

  1. It's going to be called "CP" everywhere to avoid using the actual term. It's that taboo.
  2. The law in the US are very reasonable when it comes to holding service providers accountable for what their clients put on their servers. Make minimal efforts to prevent abuse, communicate abuse policy to users, and have procedures to deal with policy violations.
  3. CP is about as "sensitive" as it gets. Be sure your response includes contacting authorities immediately upon any known CP violations - do not tamper with the data or server, contact authorities first. Authorities will advise you as to what steps you should follow from there.
  • 8
    3.5. Do not discuss the situation with anybody outside of channels that involve the authorities. Immediately means immediately. Do not try to enforce things on your own. – squillman Jun 20 '14 at 17:57
  • 6
    @squillman Why not? Child porn is not a loaded gun in your face! "There seems to be child porn on the server in such and such directories and files. I've taken the box offline. Only you and I know. Please deal with this and let me know." Sounds simple enough. Do not drag the police state in on your own customers; they could be innocent. How do you know the box wasn't hacked so that they are wrongfully implicated? It's gonna disrupt your business too; your server will probably be seized even though you did nothing. – Kaz Jun 20 '14 at 20:04
  • 7
    @Kaz I'm not saying that I'm necessarily accusing the customer. Let the authorities sort it out. When dealing with this in the past I was advised through legal channels (here in the US) not to discuss the situation. In cases of CP, I'm certainly dragging authorities in - end of conversation. I don't care who's on my box. – squillman Jun 20 '14 at 20:08
  • 8
    @Kaz That's not how it works... The authorities need to investigate and determine who is innocent. In several jurisdictions you can be accessory to the crime for actions such as those. – Jacob Jun 20 '14 at 20:19
  • 7
    I will add the advice that is often so liberally given: contact a lawyer. Immediately. Before contacting the authorities. – Marcks Thomas Jun 21 '14 at 1:39

In addition to Chris's answer about CP, I'd point out that the way the big guys handle this is:

  1. Using databases containing hashed values of known bad material
    • This isn't even a particularly effective solution, because the slightest change changes the hash
    • They will generally, or often maintain their own database, in addition to any publicly-accessible ones
  2. Reporting from users
    • In the form of email contacts (abuse@whatever.tld)
    • Reporting links for sites with user-generated contact (click here to report this)
  3. Paying actual human beings to review content, or authorize content before it's uploaded
    • The MPAA and RIAA, for example, employ dozens of people to scour the web for their copyrighted materials

So, for you, that basically means there's not going to be a great way for you to filter out objectionable material that isn't illegal, because objectionable material needs to be identified by a person. Most of what is identified doesn't ever find its way into publicly-accessible database, and even that which does is pretty easily altered to get around hash checks. So the bottom line is you can't really prevent this type of behavior, and all you can do is react once it happens.

And do be aware, if you start scanning content for one type of objectionable material, you'll be expected to scan for other types. The law varies from place to place, of course, but if you're scanning for CP, animal cruelty videos, and etc., but don't scan for pirated media, if someone uses your server to host copyrighted materials, you'll have a hard time avoiding liability for that. So... well, nothing's ever simple, is it?


Unfortunately, though as Chris S mentioned hashlists do exist, they are useless. The following command will change the hash of a file but leave it completely playable:

$ echo '0' >> pornfile.mp4

The truth is that many companies who deal primarily in user-uploaded video have humans review each and every file. See this related question for the consequences! Therefore if your primary business is user-uploaded video, I highly recommend that your company install such a human-review system.

  • 3
    1. You'd might be surprised by the technological illiteracy of people who collect and distribute CP. The hash lists are still a great tripwire to such activities. 2. Laws vary by country, everyone needs to remember that this is a global site. In the US reviewing every files like you suggest generally forfeits DMCA Safe-Harbor - so doing that is incredibly rare here. Seems like it's very common in other countries. – Chris S Jun 21 '14 at 18:21
  • 1
    @ChrisS: Thank you for the insight, especially regarding the DMCA. I find it disturbing that the law implicitly forbids companies from scanning for such material. I wonder how the US got to the point where, due to the technicalities of law, companies are discouraged from scanning for CP for fear of exposing themselves to infringing Intellectual Property rights. – dotancohen Jun 21 '14 at 18:34
  • 4
    The issue is that the DMCA gives people a get-out-of-jail-free card if they have no idea what content is on their server. Once you've looked at it you can't claim you didn't know what it was. The RIAA and MPAA wrote the law, not politicians and certainly not with the best interests of the people in mind. – Chris S Jun 21 '14 at 18:44
  • 3
    This is not a US peculiarity. The EU Electronic Commerce Directive has similar provisions. It shields providers from all kinds of liability, not just copyright infringement claims. A provider may legitimately argue: I don't know what my users upload and it's not my job to check. Providers are still required to act upon knowledge of wrongdoing, e.g. when notified by a third party. They're in the clear as long as they remove questionable content in the review process, but due to the risk of getting it wrong, being able to maintain ignorance is safer. – Marcks Thomas Jun 22 '14 at 11:26
  • 1
    I understand the nuance. I'm just appalled that the law discourages one from running a simple, inexpensive is_cp(filename) check because that implies that he could run a complicated, expensive is_copyrighted(filename) check. – dotancohen Jun 22 '14 at 11:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.