A/HRC/12/23 page 13 3. Criminalization of perpetrators and the penalties imposed 59. Penalties vary considerably from State to State, from lengthy prison terms to fines, based on the age of the child and the type of child pornography. In the United States the dissemination of child pornography over the Internet is punishable by a fine and imprisonment of 5 to 20 years. In Peru the law imposes more severe penalties if the victim is under the age of 14; belonging to a child pornography ring is another aggravating circumstance. In Italy, in addition to criminal penalties, the authorities may seize the guilty party’s possessions as well as any proceeds obtained from child pornography. 60. Some laws leave it to the judge’s discretion to impose a fine and/or imprisonment on a producer of child pornography (Indonesia and Japan). 4. Legal responsibility of Internet service providers (ISPs) 61. In the United States and Australia there are penalties for Internet service providers and domain hosts who do not report child pornography sites to the police within a reasonable period of time. In South Africa an ISP must take whatever steps necessary to prevent its services from being used to host or distribute child pornography material. The ISP must notify such activity to the police, as well as the abuser’s particulars (name and Internet Protocol (IP) address); the ISP is also obliged to keep a record of that information for use as evidence in legal investigations and proceedings. 62. The United States and South Africa have laws that authorize the police to order an ISP, in the context of a criminal investigation, to keep a record of data about a specific person or IP address, pending issuance of the appropriate warrant requiring disclosure of that information. 63. In Thailand ISPs are required by law to keep child pornography and data concerning the user of such sites stored for at least 90 days. 64. Another problem that the police increasingly face is data encryption. The United Kingdom and Australia have already passed laws to help the police gain access to password- or encryption-protected computers and materials. Those laws require the owners of computers protected by a password or containing encrypted data to collaborate with the police. Refusal to cooperate is punishable by imprisonment. 65. Most national legislations do not require ISPs, telephone service providers or banking services to report the detection of pornographic sites involving children on their networks or to cooperate with the authorities in that regard. 5. Principle of extraterritoriality 66. Many States (Italy, Japan, South Africa, Switzerland and the United States) invoke the principle of extraterritoriality with regard to cases of child exploitation or abuse by one of their nationals while abroad. Other countries, however, continue to apply the principle of double jeopardy.