But according to the e-mails, MediaDefender planned to unleash a peer-to-peer crawler to search unspecified file-sharing networks for child-porn videos and images based on keywords -- such as "young," "kids" and "taboo" -- provided by the AG's office.

Once suspected image files were found, the software would collect the IP address of the machines trading those files and filter for any addresses based in New York. The data MediaDefender collected would then be sent automatically to the AG's office, where investigators would analyze and investigate it, using a MediaDefender application to visit the IP addresses and download the suspect files.

It's unclear whether MediaDefender planned to download the suspected-child porn itself, or leave that to the AG's investigators. Jeffrey Lerner, spokesman for the New York AG's office, refused to comment on the record about whether MediaDefender was downloading child porn, due to "an ongoing investigation."

If the company knowingly downloaded child porn, it could run afoul of federal law, notwithstanding any arrangement it made with state authorities, legal experts say. Either way, several defense attorneys expressed surprise that a law enforcement agency would outsource any evidence collection to a private company.

"It is bizarre," says Martin Pinales, former president of the National Association of Criminal Defense Lawyers. "What they're doing is saying, 'We're going to make you a bounty hunter. We're going to pay you to go collect evidence so that in the future we can prosecute somebody.' But (MediaDefender doesn't) have the training of law enforcement."

"It's a growth industry.."

Although AG's offices obviously need to outsource software development, there are obvious problems with outsourcing the identification of criminals to an external service provider.

A private company that's under contract to collect information for law enforcement investigators has a financial incentive to produce results...

This is already a serious problem with prosecutors. In the hands of a private company the risk of abuse is even greater because the incentives are greater and many of the counter-incentives are removed.

"No software can determine whether a person (in a picture) is 17 or 18," Douglas says, so there are bound to be a lot of innocent IP addresses collected by MediaDefender and sent to the AG, before further investigation weeds out innocent suspects from actual lawbreakers.

Most people can't tell whether a person is 17 or 18 regardless of whether or not they are in a picture, which underlines the absurdity of sending people to prison for years and permanently tracking them as sex offenders in such cases.

San Francisco public defender Adachi says the relationship also conceivably gives MediaDefender the power to decide whom to collect evidence against and whom to let go.

"Say I ... find a web site that's run by my sister-in-law and decide that, 'Geez, I'm not going to turn that over,'" Adachi says. "There's no sworn duty by the private company (collecting evidence for law enforcement) to prosecute people in a fair, evenhanded manner."

Not that such a sworn duty stops AGs from doing exactly this all the time.