312-50V10 · Question #402
A consultant has been hired by the V.P. of a large financial organization to assess the company's security posture. During the security testing, the consultant comes across child pornography on the V.
The correct answer is B. Stop work immediately and contact the authorities.. Discovering child pornography during a security assessment creates an immediate legal obligation to stop work and report the finding to law enforcement authorities.
Question
A consultant has been hired by the V.P. of a large financial organization to assess the company's security posture. During the security testing, the consultant comes across child pornography on the V.P.'s computer. What is the consultant's obligation to the financial organization?
Options
- ASay nothing and continue with the security testing.
- BStop work immediately and contact the authorities.
- CDelete the pornography, say nothing, and continue security testing.
- DBring the discovery to the financial organization's human resource department.
How the community answered
(19 responses)- A11% (2)
- B79% (15)
- C5% (1)
- D5% (1)
Why each option
Discovering child pornography during a security assessment creates an immediate legal obligation to stop work and report the finding to law enforcement authorities.
Continuing work without reporting is a failure to meet the legal mandatory reporting obligation and could constitute concealment of a crime.
Child pornography is a federal crime in the United States under 18 U.S.C. - 2256, and individuals who discover it are legally obligated to report it to authorities such as the FBI or the National Center for Missing and Exploited Children (NCMEC). Continuing work, deleting evidence, or reporting only internally would obstruct justice and potentially make the consultant complicit. The legal obligation to law enforcement supersedes any contractual obligation to the client.
Deleting the material destroys evidence of a crime, which constitutes obstruction of justice and is itself a criminal act.
Reporting only to the HR department is insufficient because child pornography is a criminal matter requiring law enforcement involvement, not solely an internal HR issue.
Concept tested: Legal obligation upon discovery of criminal material during testing
Source: https://www.missingkids.org/gethelpnow/cybertipline
Topics
Community Discussion
No community discussion yet for this question.