NETCLEAN REPORT 2019
A REPORT ABOUT CHILD SEXUAL ABUSE CRIME
1 INTRODUCTION
INTRODUCTION p. 4–5 EXECUTIVE SUMMARY p. 6–7 ABOUT THE REPORT p. 8–9
RESULTS
EIGHT INSIGHTS INTO CHILD SEXUAL ABUSE CRIME p. 10–11 PART ONE: LAW ENFORCEMENT SURVEY p. 12–13 1. The spread of live-streamed child sexual abuse p. 14–17 2. Victims of live-streamed child sexual abuse p. 18–19 3. Offenders who consume live-streamed child sexual abuse p. 20–25 4. How child sexual abuse material is stored p. 28–31 5. Apps and platforms are used to store and distribute child sexual abuse material p. 32–33 6. Emerging technologies – trends, challenges and opportunities p. 36–40
PART TWO: BUSINESS SURVEY p. 44–45 7. Businesses’ use of policies and action plans to protect their IT environment from child sexual abuse material p. 46–47 8. Businesses’ use of technologies to protect their IT environment from child sexual abuse material p. 48–49
PART THREE: MAPPING OF TECHNOLOGIES p. 52–53 Binary hashing p. 54 Robust hashing p. 55 Artificial Intelligence p. 56 Keyword matching p. 57 Filter technology p. 58 Blocking technology p. 59
IN CLOSING
TECHNOLOGY – A DRIVER OF BOTH PROBLEM AND SOLUTION p. 60 SAFEGUARDED CHILDREN IN 2018 AND ACKNOWLEDGEMENTS p. 62
2 3 INTRODUCTION BY USING TECHNOLOGY TO About John F. Clark and NCMEC John F. Clark is president and CEO of the National Center OUR ADVANTAGE WE for Missing & Exploited Children (NCMEC). Clark has an extensive law-enforcement background, including 28 years with the United States Marshals Service (USMS). CAN PREVENT CRIME Clark was appointed director of the USMS in 2006 as its ninth director, a post he held for five years. Throughout AND SAFEGUARD his career, Clark has been a leading child advocate. NCMEC The National Center for Missing & Exploited Children is CHILDREN a private, non-profit corporation in the US, whose mission is to help find missing children, reduce child sexual exploitation, and prevent child victimization. NCMEC works with families, victims, private industry, law By John F. Clark, President and CEO enforcement, and the public to assist with preventing child abductions, recovering missing children, and providing National Center for Missing and Exploited Children (NCMEC) services to deter and combat child sexual exploitation.
I am proud and honoured to have been given the in person, adding a new dimension to this crime. Similarly, as this report shows, child sexual abuse material topic high up on the agenda. Not only does it gather opportunity to introduce the NetClean Report 2019. Live-streaming services, examined closer in this report, is also stored across all available devices and spaces, from and present insights from law enforcement professionals Child sexual abuse crime is a complex crime and has pushed this development further. computers and laptops, to mobile phones, USB sticks and that work with these crimes every day. It is also unique sharing knowledge is key to both understanding in online storage spaces such as cloud storage. in the focus that it puts on the business world’s response and working to stop it. Over the past five years, As is the case on all platforms, live-streamed child to protecting their internal IT environments. This needs the NetClean Report has contributed to a better sexual abuse material is generated in several different It is frequently said that technology is the driver of this to be discussed more. understanding of child sexual abuse crime and the ways – either voluntarily, by coercion or by force. problem. However, it is also a possibility and means to 2019 report adds yet more much needed insights. However, live-streaming comes with its own challenges. do something about it. By using it to our advantage we When employers ensure that their employees do not The streaming takes place in real time, on encrypted can prevent crime, safeguard children and stop offenders. commit reprehensible crimes that might also physically As the central hub for cybertips from all US based channels and with no trace left afterwards unless Equally important to prevent this crime is building and affect children in their vicinity, they are also taking platform providers, the National Center for Missing someone records or takes screenshots of the stream. sharing knowledge about all aspects of it. a tactical, moral and ethical step to protect the and Exploited Children (NCMEC) is acutely aware of the workforce of tomorrow. growing problem of child sexual abuse material across Another problem that needs to be considered with the What we are seeing today is encouraging. Instances the globe. In 2013 the number of cybertip reports received development of technology is on which platforms child of child sexual abuse, historical and current, are being We all need to collaborate. The online world belongs by NCMEC was 1,106,072. In 2018 this had increased to sexual abuse is discussed and material shared. It is easy discussed in the media and by decision makers across to everyone, and we must make it a safe space for 18,462,424 reports about online child sexual abuse. to assume that offenders leave old platforms and move North America and Europe, shining a light on issues future generations. I believe that initiatives like the with the latest technology and trends onto the latest fora that we previously allowed to be ignored. The topic has NetClean Reports and other initiatives to understand Digital development has enabled offenders to produce for communication. However, it is not as simple as that. moved higher up on the political agenda and awareness child sexual abuse in the context of developing and share child sexual abuse material at a previously There is still activity on fora that were commonly used of the importance of dealing with it is increasing. technologies are vital to ensuring a sustainable impossible scale. In addition, the last decade’s develop- 15 years ago. Old spaces are not deserted because new approach to stamping out child sexual abuse. ment of social media platforms and gaming platforms ones come along, instead the problem and dissemination The NetClean Report is an important document and has enabled offenders to reach children directly, and of online child sexual abuse expands and develops across tool that adds to the knowledge base about this crime abuse them over the internet without meeting them all available platforms. and helps create the awareness needed to keep this
4 5 NETCLEAN REPORT 2019 EXECUTIVE SUMMARY
The NetClean Report 2019 is based on two different Victims and offenders The survey showed a wide spread of how much material Technology in place enquiries. One with law enforcement as is always the Both victims and offenders of voluntarily or induced is already known to the police when they start analysing Eight in ten businesses also reported having technology case in the NetClean Reports, and one enquiry designed self-produced live-streamed child sexual abuse were a new case. In some cases all the material is previously in place to comply with their policy. Six in ten use filter to understand businesses’ response to the problem of reported to come primarily from the US and Europe. unseen, in some cases all material is already known, with solutions, often as part of an employee monitoring tool. child sexual abuse material in their IT environments. Important to note is that a large proportion of the most cases landing in between these polarised findings. One in ten businesses reported using a detection solution. The report also includes a third section where we present respondents are from the US and Europe, and that an overview of technologies and methods available to most police officers work primarily on cases close Apps and services One in ten reported having found child sexual abuse businesses to stop child sexual abuse material. to where they are based. Therefore the result does A large number of apps and services are used for material in the organisation’s IT environment. not necessarily represent the global situation. producing, sharing and storing child sexual abuse In preparation for the NetClean Report 2019 we surveyed material. The surveyed police officers reported that Comments on the findings law enforcement officers to garner their opinions and Victims of distant live-streaming were reported to come Skype is the most common app used for live-streamed The NetClean Reports include insights by experts who insights into the problem of live-streaming. We also looked primarily from Asia (a majority from the Philippines), but child sexual abuse. For cloud services, Dropbox and work in different ways with the issue of child sexual abuse. at trends, how child sexual abuse material is stored and also from Europe, Russia and the US. Offenders of distant Google services were most frequently reported to be You will find their comments after each different section how technology developments present both challenges live-streamed child sexual abuse were reported to come used for storing and sharing child sexual abuse in this report. Their observations add additional context and opportunities. from North America and Europe, but also Asia, Russia, material. Snapchat, Facebook and Kik were the and depth to the survey findings. Australia and New Zealand. most commonly mentioned social media platforms. In the business part of the report we questioned The result of the surveys provide an overview that helps companies with more than 5,000 employees, to see There was a big difference in opinions as to whether Encryption and AI us as a society to understand child sexual abuse crime whether they have policies, action plans and technology there is an overlap between offenders who groom/extort The biggest trends reported were an increase in cloud better. As for NetClean’s core clients (businesses and large in place that address the fact that their IT environment children and offenders who order distant live-streaming, storage, encryption and smartphones. Encryption were organisations), it is important to us that we do not only might be used to facilitate the consumption of child splitting the opinion of the surveyed police officers in half. reported to be the biggest challenge for law enforcement, say that it is important for businesses to protect their sexual abuse material. but darknet and cloud storage were also frequently IT environment, but also comprehensively – why. A large majority of respondents reported that it is mentioned. The technological developments that were Live-streamed child sexual abuse common to find other types of child sexual abuse seen as most helpful to law enforcement in child For more information about our knowledge building work, The results showed that live-streamed child sexual material in investigations that include evidence sexual abuse investigations was Artificial Intelligence, please read all our reports. Follow our work by reading abuse is increasing. However, opinion is split on of live-streamed child sexual abuse. but also different investigation software and sharing our blog, and for an overview of technologies used to whether this crime can be classed as frequently of data/intelligence. stop and detect child sexual abuse material see section occurring, or uncommon. Storage spaces three of this report and our blog series: Technical Model Laptops, mobile phones and USB sticks are the most Business policies and action plans National Response. www.netclean.com Voluntarily and induced (through grooming or sexual common spaces to store child sexual abuse material, Nine in ten businesses reported having a policy in place extortion) self-produced live-streamed child sexual abuse but it is also very common to store material on cloud that states that it is prohibited to handle child sexual abuse were both reported to be common types of live-streamed services. Mobile phones are the type of storage space in the company’s IT environment. Eight in ten reported material in investigations. However, distant live-streamed that is increasing the most, followed by USB sticks having an action plan to deal with the discovery of child child sexual abuse, such as paid for webcam shows, and external hard drives, and cloud storage. sexual abuse material in place. were reported to be less common.
6 7 NETCLEAN REPORT 2019
The enquiry, an online survey, was The respondents were all IT/IT Part three: Mapping of technology undertaken between 29 April and Security professionals who either Part three of the report is an ABOUT THE NETCLEAN 30 August 2019 and administered operate as the primary decision overview of technologies and through Griffeye’s user portal. maker in their company, or share methods available to businesses 450 police officers from 41 countries equally in this role with others. to stop child sexual abuse material. REPORT 2019 participated in this year’s survey. The survey was conducted The texts are a revision and 50.4 percent of the respondents between 24–27 June 2019. abridgement of the longer articles are from North America (of which published on NetClean’s website, 46.4 percent are from the US), The survey was conducted as an which explain technologies and The NetClean Report 2019 is the fifth report in this series. and 40 percent come from Europe. anonymous online web interview. methods in more detail. The aim of the report is to ensure greater awareness of and more insight Partnering with Origo Group and More information is available on into child sexual abuse crime; to contribute to effective ways of stopping In this year’s report we look Market Probe International utilising www.netclean.com/technical- at the following: a proprietary specialty B2B panel model-national-response/ the dissemination of child sexual abuse material; and, ultimately, 1. Live-streamed child sexual and ITDM was targeted accordingly. to reduce sexual abuse of children. abuse – extent and development. With a non-profit recruitment 2. Location of victims of method, C-Suite Executives, live-streamed child sexual abuse. Directors, and Managers that INTERVIEWS IN THE REPORT: 3. Offenders who consume live- have key decision-making To contextualise the results of the streamed child sexual abuse. authority were sourced. study, we have conducted interviews 4. How child sexual abuse material with a number of distinguished is stored. In the survey, questions were experts in this field, listed here 5. Apps and platforms used for asked about the following: in the order in which they appear distribution of child sexual 1. Whether the business has in this report: abuse material. a corporate policy in place that
6. Emerging technologies – trends, states that it is prohibited to John F. Clark challenges and opportunities. handle child sexual abuse President and CEO, National Center for Missing material within the company’s and Exploited Children (NCMEC) These areas were selected IT environment or on company Cathrine Hagström Hägg Head of Unit and Detective Inspector, Swedish based on intelligence gathered in devices. Cybercrime Center, International Sexual previous NetClean Reports, and 2. Whether the business has Exploitation of Children, National Operative from conversations with police technologies in place to detect Department – Sweden officers and other stakeholders or block child sexual abuse Eric Oldenburg Law Enforcement Liaison, North America, about what they believe is currently material in the business Griffeye relevant to the issue. IT environment. Jim Cole 3. Whether the business has an Supervisory Special Agent, Homeland Security Part two: Business survey action plan to deploy if child Investigations, Special Agent in Charge Nashville, TN – USA Part two of the report is based on sexual abuse material is found in Anna Borgström a survey conducted with one hundred the organisation’s IT environment. Chief Executive Officer, NetClean businesses with 5,000 employees 4. Whether child sexual abuse Pat Gelsinger or more, all operating in the US. material has ever been found Chief Executive Officer, VMware in the business IT environment.
The data in this report is the result of present an overview of technologies The respondents contributed by filling LAW ENFORCEMENT SURVEY: 450 RESPONDENTS FROM 41 COUNTRIES Geographic distribution two different enquiries: One with law and methods available to businesses out a survey anonymously. The police Argentina, Australia, Austria, Belgium, Bermuda, Bosnia and Herzegovina, of respondents: enforcement, as is always the case in to stop child sexual abuse material. officers are all users of Griffeye Analyze; Brazil, Canada, the Cayman Islands, Colombia, Cyprus, Denmark, El Salvador, USA 46.4 % the NetClean Reports, and one enquiry a digital investigation platform used Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, United Kingdom 17.3 % designed to understand businesses’ Part one: Law enforcement survey by law enforcement professionals Lithuania, Malta, Mexico, Netherlands, New Zealand, Norway, Paraguay, Sweden 5.3 % response to the problem of child Part one of this report is based on to analyse large volumes of images Romania, Slovenia, Spain, Sri Lanka, Sweden, Switzerland, Thailand, Turkey, Australia 4.0 % sexual abuse material in their data collected from police officers and videos. Griffeye is NetClean’s Ukraine, the United Kingdom, the United States and International organisations Canada 3.8 % IT environments. The report also across the globe who work on cases sister company. (e.g. INTERPOL or EUROPOL) Others 22.6 % includes a third section where we pertaining to child sexual abuse crime.
8 9 RESULTS
EIGHT INSIGHTS INTO CHILD SEXUAL ABUSE CRIME
THE SPREAD OF VICTIMS OF APPS AND PLATFORMS ARE EMERGING TECHNOLOGIES LIVE-STREAMED LIVE-STREAMED USED TO STORE AND DISTRIBUTE – TRENDS, CHALLENGES 1 CHILD SEXUAL ABUSE 2 CHILD SEXUAL ABUSE 5 CHILD SEXUAL ABUSE MATERIAL 6 AND OPPORTUNITIES – Split view on whether live-streamed child – Many victims of voluntarily or induced – Skype is the most common platform for – Trend: Increase in use of cloud storage, sexual abuse is common or uncommon. live-streamed child sexual abuse come live-streamed child sexual abuse. encryption and smartphones. – Voluntarily self-produced live-streaming from the US and Europe. – Dropbox and Google services are frequently used – Encryption is the biggest challenge. is most common. – Victims of distant live-streamed child to store and share child sexual abuse material. – Artificial Intelligence, investigation software, – Distant live-streaming is less common. sexual abuse come primarily from Asia, – Snapchat, Facebook and Kik are commonly and sharing of data/intelligence is most helpful. but also from Europe, Russia and the US. – Live-streaming is increasing. mentioned social media platforms. – One in five police officers have used AI tools in their investigations.
BUSINESSES’ USE OF BUSINESSES’ USE POLICIES AND ACTION OF TECHNOLOGIES OFFENDERS WHO HOW CHILD PLANS TO PROTECT THEIR TO PROTECT THEIR CONSUME LIVE-STREAMED SEXUAL ABUSE IT ENVIRONMENT FROM CHILD IT ENVIRONMENT FROM CHILD 3 CHILD SEXUAL ABUSE 4 MATERIAL IS STORED 7 SEXUAL ABUSE MATERIAL 8 SEXUAL ABUSE MATERIAL – Offenders come from Europe and North America. – Laptops, mobile phones and USB sticks – Nine in ten businesses have a corporate – Eight in ten businesses have technology in place. – Opinions differ as to whether there is an are the most common storage spaces. policy in place. – Six in ten companies use filter solutions. overlap between offenders who groom/extort – Storage on mobile phones shows – Eight in ten businesses have an action – One in ten companies have found child and offenders who order webcam shows. the biggest increase. plan in place. sexual abuse material. – Offenders in possession of evidence of – There is both known and unknown material live-streamed child sexual abuse material also in most investigations. collect other types of child sexual abuse material.
10 11 LAW ENFORCEMENT SURVEY
– LAW ENFORCEMENT SURVEY –
Live-streamed child sexual abuse, storage of child sexual abuse material, and emerging
technologies – challenges Topics covered in the NetClean Report 2019 The NetClean Reports cover current elements of child sexual abuse crime. In this year’s report and opportunities we look more closely at:
Live-streamed child sexual abuse - Extent and development of live-streamed child sexual abuse - Location of victims of live-streamed child sexual abuse - Offenders who consume live-streamed child sexual abuse
Storage of child sexual abuse - How child sexual abuse material is stored - Apps and platforms that are used for distribution of child sexual abuse material
Emerging technologies - Trends - Challenges - Opportunities
This part of the report is based on a survey with police officers across the globe who work on cases pertaining to child sexual abuse crime. 450 police officers from 41 countries answered this year’s survey. They all answered anonymously, and provided invaluable information for a better understanding of this global problem. We would like to direct a big thank you to all of those who took the time to complete the survey.
12 13 LAW ENFORCEMENT SURVEY LAW ENFORCEMENT SURVEY
The spread of live-streamed 1 child sexual abuse – Split view on whether live-streamed child sexual abuse is common or uncommon. – Voluntarily self-produced live-streaming is most common. – Distant live-streaming is less common. – Live-streaming is increasing.
LIVE-STREAMING records the live-stream, no material captures can find their way into SPLIT VIEW ON WHETHER “ The last two cases I had the FREQUENCY OF LIVE-STREAMED CHILD Live-streaming is mentioned as is saved. Therefore, what we look at investigations of child sexual abuse. LIVE-STREAMED CHILD videos were 70 percent or more SEXUAL ABUSE IN POLICE INVESTIGATIONS a challenge and an increasing problem here is evidence of live-streamed child SEXUAL ABUSE IS COMMON live-streamed content that had in the last three NetClean Reports. sexual abuse; captures of the abuse 2. Induced self-produced OR UNCOMMON been recorded.” 1. In the 2016 report live-streaming was in the form of images and videos. live-streamed child sexual abuse Answers from the surveyed police 11. 1 . one of four challenges most frequently This is live-streaming that is a result officers show a split view on whether “ Last case I worked was 90 percent mentioned by the surveyed police Three different types of grooming or sexual extortion. In the evidence of live-streamed child sexual screen captures of live-streams.” 2 . officers. In the 2017 report one in ten Live-streamed child sexual abuse takes case of grooming the child is coerced abuse is common or uncommon in police officers said that live-streaming on many guises, but we have chosen into live-streaming while they are in their investigations. Nearly four in ten “ So far this year we have not is increasing in chatrooms and chat in this report to categorise it into the a state of undress and/or engage in (37.7 %) of the surveyed police officers had a live-streamed child applications. And in the 2018 report, following three types: sexual behaviour. In the case of sexual reported that the material is common sexual abuse case.” live-streamed child sexual abuse was extortion they are threatened or forced or very common in their investigations. 2 . mentioned both in connection to 1. Voluntarily self-produced into live-streaming the abuse. However, just a few percent more “ I have not yet come across trafficking and use of cryptocurrencies. live-streamed child sexual abuse (41.9 %) reported that it is uncommon a live-stream sex abuse case.” 1 . Voluntarily self-produced live-streaming 3. Distant live-streamed or very uncommon. The rest, one fifth In the 2019 report, we look at how features children or teenagers who child sexual abuse of the police officers, reported that it Very uncommon 15.6 common live-streamed child sexual voluntarily, with mutual consent, Distant live-streaming is webcam is neither common nor uncommon. Uncommon 26.3 Neither common nor uncommon 18.7 abuse is in general; different types of engage in live-streaming in which shows that are ordered by an adult Common 26.3 live-streaming; and how it is developing. they are in a state of undress and/or viewer. In the live-stream an adult is The added comments also showed Very common 11.4 engage in sexual behaviour. It might also present and is either physically their divided views: Don´t know/do not wish to comment 1.8 Live-streamed child sexual abuse only be intended for a boyfriend/ involved in the abuse, or coercing or Live-streamed child sexual abuse is girlfriend, or posted via a game or forcing the child into conducting transmitted online in real time to the app without sexual intent. Because sexual acts. viewer. Unless the viewer deliberately of the sharing nature of the internet >>
14 15 LAW ENFORCEMENT SURVEY LAW ENFORCEMENT SURVEY
THE SPREAD OF LIVE-STREAMED CHILD 1 SEXUAL ABUSE
>> VOLUNTARILY SELF-PRODUCED Several of the respondents added that sixty percent of the respondents DISTANT LIVE-STREAMING “ […] I come across material when LIVE-STREAMING IS INCREASING LIVE-STREAMING IS MOST it can often be very difficult to deter- answered that it is common or very IS LESS COMMON looking through illegal material More than half of the respondents COMMON mine whether material is voluntarily common to come across evidence In contrast to the two other categories, and it is mostly recorded from reported that live-streaming is on the Somewhat contradictory to the results produced or induced. of induced live-streamed child sexual the respondents reported that distant the screen and from Asia.” increase. One fifth of the respondents above, nearly seventy percent of the abuse material. More than one third live-streaming, such as paid for cam answered that it is neither increasing respondents reported that captures of “ ‘Apparently’ voluntarily self-produced of the respondents also reported that shows, is less common. Half of the Other forms of live-streamed nor decreasing. voluntarily self-produced live-streamed material can sometimes be hard to induced live-streamed child sexual respondents answered that distant child sexual abuse child sexual abuse is common or distinguish from induced material. abuse is the most common type of live-streaming is uncommon or very Nearly half of the respondents also “ It is becoming an increasing very common in their investigations. Teenagers (or younger) interacting live-streaming in their investigations. uncommon, and nearly one quarter specified that there are other types of problem.” More than half reported that this is the with adults posing as much younger said that it is neither common nor live-streaming, although they are less most common form of live-streamed contemporaries is clearly common- “ The vast majority is live-streaming uncommon. common. According to the surveyed “ Uncommon at present in material that they come across. place.” groomed victim videos.” police officers this is primarily material my experience, but appears However, this result might depend that comes from secret filming or to be on the increase Several of the respondents commented “ […] It is difficult to judge whether it is “ Often the videos appear to be of on the type of investigations that the hacked cameras, but it can also be when considering cases that voluntarily self-produced material voluntarily or by grooming/threats.” children responding to prompting respondents work on, as one in ten already recorded child sexual abuse of colleagues in same office.” most often depicts teenagers. from the screen they are visible police officers reported that distant material being live-streamed to Induced self-produced live-streamed in, eg such as via Skype, Omegle live-streaming is the most common someone else. “ Increased in the form of “ Teenagers are the most common child sexual abuse is common and this is being recorded by form of live-streaming material in self-production live-streaming that I have dealt with.” Captures of induced live-streamed the suspect.” their investigations. “ Hacked webcams streaming footage (example teenage girls child sexual abuse is reported as or cams when the IoT protocols of live-streaming for what they “ I primarily see self-produced sexting slightly less common than voluntarily “ We don’t often see live-streaming the device was not secure enough.” believe is a teenage boy).” videos by teenagers.” produced material. However, nearly but it is common to see remnants in case it occurred. Often paid for “ Secret filming.” exchanges with south east Asian countries where the mother will “ Recorded video of child exploitation expose children to the camera. material streamed via live-streaming If we are lucky (as an investigator) platforms.” we will have screen recordings WHETHER LIVE-STREAMED CHILD SEXUAL ABUSE HAS INCREASED OR DECREASED IN MOST COMMON TYPE OF LIVE-STREAMED or similar which can be used FREQUENCY OF DIFFERENT TYPES OF LIVE-STREAMED CHILD SEXUAL ABUSE CHILD SEXUAL ABUSE THE LAST THREE YEARS as part of their prosecution and safeguarding of the children.” 0.2 Very Uncommon Neither Common Very 1. 21. uncommon common nor common 9. 22. uncommon
Voluntarily self-produced 6.7 % 10.5 % 16.1 % 46.8 % 19.9 % live-streaming
Induced self-produced live-streaming 6.2 % 14.8 % 17.7 % 46.8 % 10.5 %
Distant live-streaming 17.5 % 33.0 % 23.7 % 18.0 % 3.0 %
Other* 11.8 % 5.1 % 26.7 % 1.1 % 0.3 %
* Primarily secret filming, hacked cameras or already recorded child sexual abuse material being .1 live-streamed. Respondents were not required to tick all categories, Therefore the total percentage does .0 not add to a hundred percent in all categories. Voluntarily self-produced live-streaming 53 Decreased 0.2 Induced self-produced live-streaming 36.1 Neither increased nor decreased 22.3 Distant live-streaming 9.4 Increased 56.0 Other 1.5 Don´t know/do not wish to comment 21.4
16 17 LAW ENFORCEMENT SURVEY LAW ENFORCEMENT SURVEY
Victims of live-streamed “ Everywhere, including UK, US, Russia, Different countries to their own respondents answered that they did not Europe etc as well as third world In contrast to the other two types know the answer to where victims of child sexual abuse countries.” of live-streamed child sexual abuse, distant live-streamed sexual abuse are more than seventy percent of the located. This is probably connected to 2 “ UK, US, Russia, Eastern European respondents answered a different the first question about live-streaming, – Many victims of voluntarily or induced live-streamed child countries.” country to their own when looking at where four in ten respondents answered distant live-streamed sexual abuse. that evidence of live-streamed child sexual abuse come from the US and Europe. “ All over the world, UK, Eastern A large majority answered Asia, sexual abuse was uncommon or very – Victims of distant live-streamed child sexual abuse come primarily Europe, Asia, US.” followed by Europe (with a slight uncommon in their investigations. weight towards Eastern Europe) from Asia, but also from Europe, Russia and the US. VICTIMS OF DISTANT LIVE- and Russia. “ As said previously these type STREAMED CHILD SEXUAL ABUSE of cases are uncommon.” COME PRIMARILY FROM ASIA, Unable to answer BUT ALSO FROM EUROPE, Also in contrast to the other two “ Have not encountered this type The surveyed police officers were the respondents, more than eighty type of live-streamed child sexual RUSSIA AND THE US categories, more than one fifth of the of case.” asked (based on their investigations) percent listed their own country. abuse is in other parts of the world. According to the surveyed police to specify from where victims of This indicates that the results may officers, victims of distant live- live-streamed child sexual abuse be skewed to primarily reflect that Eastern Europe, Russia and Asia streamed child sexual abuse (webcam BREAKDOWN OF THE SHARE OF RESPONDENTS THAT ANSWERED EITHER THE come, based on category of type the large majority of police officers When looking at the countries that shows) are primarily from Asia. More COUNTRY WHERE THEY OPERATE, THIS COUNTRY IN ADDITION TO OTHER COUNTRIES, OR SOLELY OTHER COUNTRIES WHEN ASKED WHERE VICTIMS ARE FROM of live-streaming. work on investigations close to home, the respondents mentioned instead than four in ten of the respondents therefore not accurately painting of or in addition to their own country, mentioned Asia, and nearly one fifth Voluntarily self- Induced self-produced Distant live-streamed MANY VICTIMS OF VOLUNTARILY a picture of the global situation. nearly a quarter still mentioned mentioned the Philippines specifically. produced live-streamed live-streamed child child sexual abuse OR INDUCED LIVE-STREAMED Europe and nearly one fifth answered Other Asian countries that were child sexual abuse sexual abuse (webcam shows) CHILD SEXUAL ABUSE COME It is therefore possible to conclude the US. Some geographical areas and mentioned were Thailand, Cambodia, Respondents who mentioned 56.2 % 56.2 % 18.7 % the country where they FROM THE US AND EUROPE from the results that many victims countries, from where there were no Vietnam, Taiwan, Malaysia, Korea and operate Responses were similar for ‘voluntarily of both voluntarily and induced of very few respondents, were also India. Respondents who mentioned 26.2 % 26.4 % 6.5 % self-produced live-streamed child live-streaming come from the US repeatedly mentioned. These were the country where they sexual abuse material’ and ‘induced and Europe. But it is not possible to primarily Eastern Europe, Russia “ Philippines, Taiwan, India, operate, but added one or more countries self-produced live-streamed child conclude what the frequency of this and Asia. Cambodia.” sexual abuse material’. Answers Respondents who mentioned 5.7 % 10.8 % 72.4 % a different country to the one indicated that victims are primarily “ Asian countries.” that they operate in from North America and Europe. LOCATIONS OF VICTIMS OF VOLUNTARILY SELF-PRODUCED LIVE-STREAMED CHILD Respondents who answered 7.6 % 6.5 % 2.4 % Nearly half of the respondents “ The cases we have seen are that victims come from all SEXUAL ABUSE AND INDUCED SELF-PRODUCED LIVE-STREAMED CHILD SEXUAL ABUSE answered that victims come from the primarily from the Philippines.” over the world Voluntarily self- Induced self-produced Distant live-streamed US (slightly lower for induced child produced live-streamed live-streamed child child sexual abuse sexual abuse), whereas one third child sexual abuse sexual abuse (webcam shows) Europe and Russia answered that they come from Europe. North America* 45.8 % 41.7 % 8.5 % In addition to Asia, fourteen percent COUNTRIES MENTIONED IN ADDITION TO OR INSTEAD OF WHERE THE RESPONDENTS OPERATE USA 43.1 % 36.6 % 8.1 % of the respondents reported that Canada 2.8 % 2.3 % – For North America most respondents victims of distant live-streamed Voluntarily self- Induced self-produced Distant live-streamed answered that victims are from the US, Mexico 1.0 % 0.4 % 0.4 % abuse come from Europe. One in produced live-streamed live-streamed child child sexual abuse Europe* 29.6 % 33.0 % 13.9 % child sexual abuse sexual abuse but Canada and Mexico were also twenty police officers (5.4 %) specified Western European countries 24.3 % 18.5 % 6.3 % North America* 18.6 % 18.9 % 4.9 % mentioned. Eastern European countries and one Eastern European countries 5.9 % 8.0 % 5.4 % USA 12.9 % 12.4 % 2.4 % in twenty (6.3 %) mentioned countries Russia 6.3 % 6.5 % 9.0 % Canada 1.0 % 1.6 % – For Europe, the countries mentioned in Western Europe. Nearly one in ten Asia* 3.8 % 3.3 % 42.2 % Mexico 1.4 % 1.1 % 0.8 % reflect where the respondents are Philippines – – 18.4 % also reported that victims are from Europe* 23.1 % 22.7 % 17.9 % from. Countries mentioned include the Thailand – – 3.1 % Russia and the US. Western European countries 21.9 % 15.1 % 8.1 % United Kingdom, Sweden, Denmark, Cambodia – – 1.3 % Eastern European countries 6.7 % 7.6 % 9.8 % Norway, Germany, Ireland, the Nether- Australia and New Zealand 4.2 % 3.3 % – “ Mainly seen to originate in the old Russia 8.6 % 9.7 % 14.6 % lands, Switzerland, Austria, Spain, South America 1.7 % 2.2 % 2.7 % Eastern block/Eastern Europe and Asia* 5.7 % 5.9 % 74.8 % Greece, France, Italy, Austria, Latvia, Africa – – 1.3 % Russia.” Philippines – – 33.3 % Romania, Slovenia, and Croatia. All over the world 5.9 % 5.0 % 1.3 % Thailand – – 5.7 % Other** 1.7 % 2.5 % – “ I see these cases more common Cambodia – – 2.4 % The country where they operate Don´t know/unable to answer 1.0 % 2.5 % 21.1 % out of eastern Europe.” Australia and New Zealand 1.9 % 1.6 % – At first glance, the results showed that South America 1.4 % 0.5 % 3.3 % * Includes answers where respondents have answered North America, Europe or Asia without specifying Africa – – 2.4 % the victims come primarily from the US a country or more specific region. “ Western Europe.” ** Specification of other: Respondents have answered western or Caucasian. and Europe. However, when the results * Includes answers where respondents have answered North America, Europe or Asia without specifying were matched against the location of The respondents answered an open question and could provide many different answers. a country or more specific region.
18 19 LAW ENFORCEMENT SURVEY LAW ENFORCEMENT SURVEY
Offenders who consume 3 live-streamed child sexual abuse – Offenders come from Europe and North America. – Opinions differ as to whether there is an overlap between offenders who groom/extort and offenders who order webcam shows. – Offenders in possession of evidence of live-streamed child sexual abuse material also collect other types of child sexual abuse material.
Looking at each type of live-streaming, to home, and don’t necessarily reflect If Eastern Europe is removed from the Distant live-streaming The Middle East was also mentioned for both groups were similar with the surveyed police officers were what the global situation looks like. European cohort, it shows five percent Responses regarding the location of in the answers regarding offenders, regards to Europe and North America. asked (based on their investigations) on its own. Asian countries/regions offenders were more widely spread. but not regarding victims. The answers >> to specify which countries offenders As with the question about victims, mentioned several times were China, More than one fifth of the respondents
come from. this indicates that many offenders Philippines, Malaysia, India, Pakistan answered North America, nearly BREAKDOWN OF THE SHARE OF RESPONDENTS THAT ANSWERED EITHER THE COUNTRY come from the US and Europe. and the Middle East. a quarter answered Europe. However, WHERE THEY OPERATE, THIS COUNTRY IN ADDITION TO OTHER COUNTRIES, OR SOLELY OFFENDERS COME FROM However, it does not indicate that sixteen percent also answered Asia, OTHER COUNTRIES WHEN ASKED WHERE OFFENDERS ARE FROM EUROPE AND NORTH AMERICA there are no offenders in countries “ Asia, China, Philippines and other more than five percent answered Voluntarily self-pro- Induced self-produced Distant live-streamed Similar to the question about not mentioned. countries like Russia.” Russia, and just as many answered duced live-streamed live-streamed child child sexual abuse victims, responses about voluntarily Australia and New Zealand. Similar child sexual abuse sexual abuse (webcam shows) self-produced live-streamed child Asia and Russia “ Australia, USA, UK, Asian Countries.” to the question on victims, nearly one Respondents who mentioned 64.0 % 60.4 % 57.3 % the country where they sexual abuse material and induced Other geographical areas that were fifth of the respondents said that they operate self-produced live-streamed child mentioned by one in twenty police “ India, Pakistan, Greece.” don’t know or are unable to answer. Respondents who mentioned 22.9 % 28.1 % 15.6 % sexual abuse material were very close officers, or more, were Asia and Russia. the country where they in numbers. The respondents reported “ United States, Europe, Australia, operate, but added one or more countries that offenders are primarily from New Zealand.” North America (USA) and Europe Respondents who mentioned 5.9 % 4.3 % 20.8 % a different country to the one (the same countries were mentioned “ USA, Germany, Norway.” LOCATIONS OF OFFENDERS WHO CONSUME VOLUNTARILY SELF-PRODUCED LIVE-STREAMED that they operate in when asked where victims are from). CHILD SEXUAL ABUSE, INDUCED SELF-PRODUCED LIVE-STREAMED CHILD SEXUAL ABUSE Respondents who answered 7.2 % 7.2 % 6.3 % Four in ten (slightly less for induced AND DISTANT LIVE-STREAMED CHILD SEXUAL ABUSE “ US, Russia, India and Asian that victims come from all child sexual abuse) reported that Countries.” over the world offenders come from North America, Voluntarily self- Induced self-produced Distant live-streamed produced live-streamed live-streamed child child sexual abuse and more than one third that they child sexual abuse sexual abuse “ Russia/Ukraine Philippines/ COUNTRIES MENTIONED IN ADDITION TO OR INSTEAD OF WHERE THE RESPONDENTS OPERATE come from Europe. North America* 41.0 % 38.7 % 22.4 % Thailand.” USA 36.9 % 33.8 % 21.1 % Voluntarily self-pro- Induced self-produced Distant live-streamed “ All over, but primarily USA.” Canada 2.5 % 1.8 % 0.6 % Different Asian countries mentioned duced live-streamed live-streamed child child sexual abuse Mexico 1.2 % 2.7 % – Although there were not enough child sexual abuse sexual abuse “ USA and western Europe.” Europe* 32.4 % 34.2 % 24.8 % answers to draw any firm conclusions, North America* 16.4 % 23.2 % 7.3 % Western European countries 21.3 % 23.0 % 15.5 % the survey results showed a slight USA 12.4 % 10.0 % 7.3 % The country where they operate Eastern European countries 4.9 % 5.4 % 4.3 % discrepancy in the Asian countries Canada 2.0 % 0.7 % – However, again similar to the question Russia 5.3 % 4.5 % 5.6 % mentioned in relation to location Mexico 2.0 % 3.6 % – about victims, a breakdown of the Asia 7.0 % 6.8 % 16.1 % of victims and offenders. Countries Europe* 10.4 % 13.7 % 9.0 % results showed that nearly nine in ten Australia and New Zealand 2.9 % 2.3 % 5.6 % mentioned in relation to victims were Western European countries 5.2 % 4.3 % 4.2 % South America 1.6 % 1.8 % 1.9 % of the respondents answered their own the Philippines, Thailand, Cambodia, Eastern European countries 2.6 % 7.6 % 5.2 % Africa – 0.5 % – Russia 10.5 % 5.8 % 9.4 % country. The results most likely reflect Vietnam, Taiwan, Malaysia, Korea All over the world 5.3 % 5.0 % 3.7 % Asia 10.4 % 10.1 % 25.0 % the fact that the majority of police and India. For offenders, the countries Same country as victim 0.9 % 0.9 % – Australia and New Zealand 0.7 % – 1.0 % officers are working on cases close mentioned were (in order of frequency) Unknown or unable to answer 3.6 % 5.3 % 19.9 % South America 1.3 % 2.2 % 2.1 % the Philippines, India, Pakistan, China, Africa – 0.7 % – * Includes answers where respondents have answered North America or Europe without specifying Thailand, Malaysia, and Indonesia. a country or more specific region. * Includes answers where respondents have answered North America or Europe without The respondents answered an open question and could provide many different answers. specifying a country or more specific region.
20 21 LAW ENFORCEMENT SURVEY LAW ENFORCEMENT SURVEY
OFFENDERS WHO CONSUME 3 LIVE-STREAMED CHILD SEXUAL ABUSE
>> OPINIONS DIFFER AS TO WHETHER “ I don’t believe they differ. I think “ […] The risk of paying for live Same offenders “ In my experience the people who “ I have seen that offenders are not THERE IS AN OVERLAP BETWEEN there is a strong correlation with streamed sexual abuse, I can only Police officers who answered that the pay/access these kinds of services easily convinced to send payment OFFENDERS WHO GROOM/EXTORT those who would live-stream, groom assume, is that the risk of detection offenders who will pay for webcam play an active role in grooming over the Internet for fear of being AND OFFENDERS WHO ORDER and extort children, and also move is far too high for the low level shows and those who groom and activities. They may be trying to get identified, but that if they feel they WEBCAM SHOWS to hands-on offending.” offender, as most only appear to sexually extort children are the new videos/pictures to share with are anonymous they will groom The surveyed police officers were have basic technological knowledge same, commented that this may their community and climb in this and extort children online at also asked whether they believe “ I would say that in my experience, and confidence in hiding their be for several different reasons. way in their pyramidical structure.” every opportunity.” that offenders who pay for distant that about half of the offenders actions online.” live-streamed child sexual abuse I have investigated have sextorted Several said that offenders will use any Perceived anonymity WHETHER THERE IS AN OVERLAP BETWEEN (webcam shows) are the same children and also paid for abuse Different offenders: means available to access child sexual The respondents who answered OFFENDERS WHO GROOM/EXTORT CHILDREN ON ONLINE PLATFORMS individuals who groom and sexually to be streamed.” Live-streaming is seen as less risky abuse material and sexually abuse that offenders move between AND OFFENDERS WHO PAY FOR DISTANT extort children on other platforms. In direct opposition, others said that children, and will act on any opportunity grooming/ extorting victims and LIVE-STREAMED CHILD SEXUAL ABUSE Different offenders: live-streaming is seen as less risky that they are given. Some likened it to paying for distant live-streamed (WEBCAM SHOWS) Their opinions on this differed greatly. Live-streaming is seen as more risky than grooming, as there is more an addictive behaviour. child sexual abuse (web shows), One third of the respondents answered The police officers who were of the distance to the victim. Or that but mentioned that it is less common, that they are the same individuals, and opinion that it is different offenders live-streaming is a stepping stone “ I think anyone with that mind-set commented that this is as a result 2 .9 one third answered that they differ. One who groom or sexually extort children to committing hands-on child and sexual interest will take part of perceived risks with anonymity, 1.0 quarter of the respondents answered and who pay for live-streamed webcam sexual abuse. in any related forms of deviant and a perceived distance to the child. that they don’t know or don’t have shows, reported different views on why behavior if given the opportunity.” enough experience of both types this is so. Some commented that most “ There is, in my opinion, a desire for “ Given an opportunity and under . of crime to answer. offenders don’t need or want to pay offenders to feel “safe”, using distant “ In my opinion and the offenders standing of the different platforms for the abuse, or that live-streamed pay to view sites offers a greater that I’ve dealt with personally. offenders can move between them . “ No real correlation between child sexual abuse is seen as more perceived safety than the offender Offenders will do what ever it takes but I believe it too less common. offenders that live-stream and of a risk than grooming. making the approach to individual to get their “fix” any way that they We have found that those using 2. those that groom through other adults or children, perhaps in their can. They act in much the same live-stream appear to be more applications from what I have “ My experience is that those own country, with a greater perceived ways that a person who is addicted reluctant or even confident to directly They are different individuals 31.0 dealt with. While there are a extorting are not paying for distant risk of capture by law enforcement.” to an illicit substance does.” engage with children. They appear They are the same individuals 32.8 They can be the same individuals, but it is rare 4.6 variety of applications used in live-streamed, they know they can to be of a mentality that their They can be the same, but it varies 5.7 this crime, most of what I see get it themselves.” “ The contact the people are having Other respondents commented webcam offending has a higher Don’t know/don’t have enough experience 25.9 revolves around an offender using [in distant live-streaming] is adult- that offenders will use both paid degree of anonymity due to the the same means repeatedly. They “ In my opinion if a suspect can get it to-adult. They are not involved in live-streamed child sexual abuse fact the victims are often in poor seem to feel safe/comfortable for free they will always go that route the child and generally don’t interact and material acquired from grooming and remote locations with less with a specific app/software and first. I see more offenders trying to with the child. I believe this distances or sexual extortion as a means chance of Law Enforcement will continue to use it until they extort children personally online themselves from the situation and of payment or access to “climb” Agency involvement.” feel it has been compromised. via webcam, or other means, than are different to those who intentional- in organised forums of offenders I see them paying for live streamed ly converse with children.” (where you only get access to “ In my experience offenders tend to videos/webcam shows etc.” certain “levels” if you upload new stick with one platform or the other, “ I believe that it is more rare that and unseen material to the forum). >> so if they are grooming and eliciting the same types of individuals engage images and video from children on in both activities. I believe that the social media platforms, that is what people that pay for streaming they concentrate on.” services are those who have not necessarily reached the point of committing hands-on offences yet.”
22 23 LAW ENFORCEMENT SURVEY
OFFENDERS WHO CONSUME 3 LIVE-STREAMED CHILD SEXUAL ABUSE
>> OFFENDERS IN POSSESSION OF WHETHER OFFENDERS WHO ARE IN POS- Hands-on child sexual abuse material Innocent, grooming, sextortion “ Hands-on offending does happen MOST COMMON TYPES OF CHILD SEXUAL EVIDENCE OF LIVE-STREAMED SESSION OF EVIDENCE OF LIVE-STREAMED produced by another offender and hands-on material but the majority of suspects ABUSE MATERIAL THAT POLICE OFFICERS CHILD SEXUAL ABUSE ALSO HAVE OTHER COME ACROSS IN INVESTIGATIONS THAT CHILD SEXUAL ABUSE MATERIAL TYPES OF CHILD SEXUAL ABUSE MATERIAL The most common type of child More than six in ten of the surveyed are image collectors and while INCLUDE EVIDENCE OF LIVE-STREAMED ALSO COLLECT OTHER TYPES OF sexual abuse material found in the police officers also reported that possible would place hands-on CHILD SEXUAL ABUSE CHILD SEXUAL ABUSE MATERIAL . 1.9 investigations is hands-on child sexual it is common or very common to if the situation presented itself 11. . . To further try to understand offenders 2. abuse material produced by another find innocent material or grooming many are not actively seeking one.” .0 who possess evidence of live-streamed offender. This is the material that is material. They reported that it is . 12. child sexual abuse material, the 20. most often referred to when speaking slightly less common to find sexual It is, although less common than the surveyed police officers were asked about child sexual abuse material in extortion material or hands-on child other types, interesting to note that one whether these offenders also collect general terms. More than six in ten sexual abuse material produced in three police officers answered that or store other types of child sexual respondents answered that this is by the suspect themselves. it is common or very common to find abuse material, or if they only engage the most common type of material hands-on child sexual abuse material in live-streamed child sexual abuse. .2 found, and nine in ten of the surveyed “ It can be hard to tell sometimes produced by the suspect themselves. police officers answered that this type if the materiel is from grooming/ Another third of the respondents Eight in ten of the surveyed police of material is common or very common. sexual extortion if there is no chat answered that this is neither officers reported that it is common from messaging services such common nor uncommon. . Very uncommon 5.4 as snapchat, kik and skype.” or very common to find other types Uncommon 1.9 Voluntarily self-produced material Innocent images 7.5 of child sexual abuse material in Neither common nor uncommon 2.3 Voluntarily produced child sexual Voluntarily self-produced material 12.6 investigations that include evidence Common 20.7 abuse material was reported as nearly Child sexual abuse images and videos 64.8 Very common 58.2 of live-streamed child sexual as common, more than eight in ten Grooming material 6.5 Don´t know/do not wish to comment 11.5 Sexual extortion material 5.0 abuse. Less than one in ten (7.3 %) reported that such material is common Hands-on child sexual abuse images answered that it is uncommon or or very common. However, only one or videos 3.5 very uncommon to find other in ten of the surveyed police officers types of material. All types of material reported this as the most common According to the surveyed police type of material. “ Pretty much guaranteed.” officers, nearly all types of child sexual abuse material is commonly found “ 50/50 between voluntary and “ They are almost always in in investigations that also include child sexual abuse images.” possession of other child evidence of live-streamed child FREQUENCY OF OTHER TYPES OF CHILD SEXUAL ABUSE MATERIAL, THAT POLICE OFFICERS COME ACROSS IN INVESTIGATIONS abuse material.” sexual abuse material. THAT INCLUDE EVIDENCE OF LIVE-STREAMED CHILD SEXUAL ABUSE
Very Uncommon Neither Common Very uncommon common nor common uncommon
Innocent images (for example holiday images that have ended up in collections of 0.5 % 10.1 % 21.6 % 44.2 % 21.1 % child sexual abuse material)
Voluntarily self-produced material (images or videos that for example teenagers take – 3.0 % 11.1 % 58.8 % 24.6 % themselves, but that end up in collections of child sexual abuse material)
Grooming material (images and videos that children have been coerced into producing 1.5 % 7.5 % 23.6 % 49.7 % 16.1 % as a result if being groomed for sexual purposes)
Sexual extortion material (images or videos that children have been forced to produce 1.5 % 21.6 % 32.2 % 31.7 % 9.0 % as a result of being threatened)
Hands-on child sexual abuse material by another offender (images or videos of hands on 1.0 % 1.5 % 7.0 % 44.2 % 46.2 % sexual abuse that has been produced by someone else and downloaded by the suspect)
Hands-on child sexual abuse images or videos (that have been produced by the suspect 7.0 % 27.1 % 28.6 % 23.6 % 6.5 % himself/herself
Respondents were not required to tick all categories, Therefore the total percentage does not add up to a hundred percent in all categories.
24 25 COMMENT TO INSIGHT 1–3
CATHRINE HAGSTRÖM HÄGG Head of Unit and Detective Inspector, Swedish Cybercrime Center, International Sexual Exploitation of Children, National Operative Department, Sweden
LIVE-STREAMING IS ON THE INCREASE In all our cases, offenders have been in possession of other types of child My unit works exclusively with channels, primarily Skype, but also this type of crime raises is if distant international sexual exploitation Messenger and WhatsApp, where live-streamed abuse is a substitute for sexual abuse material. of children, so I can only comment the conversation moves on to children. sex tourism. According to colleagues on distant live-streamed child sexual These are also the channels where in other countries this does not seem abuse, and not on the other types of the abuse takes place. to be the case. Consumption of live-streaming mentioned in the report. live-streamed child sexual abuse There are several reasons why this rather seems to further the addiction We saw our first case of live-streaming crime is especially prevalent in the and fuel a desire to travel to in 2010. This type of crime is on the Philippines. It is a poor country, participate in hands-on abuse. increase, still, we have only handled and one where the population approximately forty cases so far. communicates well in English, A lot of investigative challenges making international communication This type of crime presents a long Western countries easy. There is a well-established list of challenges. The biggest We only investigate Swedish offenders, sex-industry, limited police resources, challenge is to detect the offence however countries that are often a developed IT-infrastructure, cheap and the offenders in the first place. mentioned in the context of offenders mobile phones, and simple ways It is difficult to establish whether are the US, the UK, France, Germany of making international money payment for a show has been for and Australia – large Western countries transactions. The big difference an adult sex show or for abuse with, in general, well-to-do populations. between the Philippines and other of children. South East Asian countries is Adult facilitators probably the common use of Working across borders is difficult The victims come primarily from the the English language. – people are not registered in the Philippines, but we have also seen same way everywhere, and in order indications of victims coming from Other types of child sexual to interview a child one needs to Colombia, South Africa and Romania. abuse material make a request for international Our biggest case to date featured In all our cases, offenders have been assistance, which can be a lengthy a Swedish man who subjected in possession of other types of child procedure. It can also be difficult twenty-five children in the US to sexual sexual abuse material. However, to get information from platform abuse online through live-streaming. except for the US case, we have providers in other countries. There In this case the children were groomed not found evidence that they have is also the fact that these types of and threatened by the offender himself. themselves groomed or threatened cases contain enormous amounts children. Only in one case have we of material made up of lists of calls, Cases from the Philippines always found images of hands-on abuse chat logs, screenshots and evidence involve adults who facilitate the abuse. by the offender himself. of payment, which all need to be Contact often starts on Philippine investigated and matched. dating sites for adults, from where Our sample is too small to draw any the conversation moves to private conclusions, but the question that
26 27 LAW ENFORCEMENT SURVEY LAW ENFORCEMENT SURVEY
How child sexual abuse 4 material is stored – Laptops, mobile phones and USB sticks are the most common storage spaces. – Storage on mobile phones shows the biggest increase. – There is both known and unknown material in most investigations. “ Cloud storage seems to be coming When asked which devices have “ Pretty much every type of device more prevalent with offenders increased, one third answered storage has increased its storage size.” To understand how to find and laptops and mobile phones. Nearly “ I wouldn't put much space between sharing links to cloud storage, rather on mobile phones. One fifth answered tackle child sexual abuse material it as many answered USB sticks or these - I think mobile is really on the than risk sending / receiving images.” that computers and laptops, cloud “ Storage capacity in all devices is important to understand how it is other portable devices. This makes rise, but USB devices that can go storage, and USB sticks and external has increased.” stored and collected, and if the methods computers/laptops, mobile phones from mobile devices to PC/Mac “ Most cases the offender has imagery hard drives have increased. >> for storing material is changing with and USB sticks the most common as well.” stored on computer related device. developing technologies. storage devices that child sexual However more often larger quantities “ Phones and cloud storage have WHETHER THERE HAS BEEN AN INCREASE abuse is found on in police More than one in six also answered of images are stored within the both increased significantly.” IN TYPES OF DEVICES / STORAGE SPACES TO STORE CHILD SEXUAL ABUSE MATERIAL LAPTOPS, MOBILE PHONES investigations. When not only that they find child sexual abuse cloud. This makes it difficult to OVER THE PAST THREE YEARS? AND USB STICKS ARE THE MOST asked what they find, but also what material on tablets and half of the trace.” “ Computer hard drives and portable COMMON STORAGE SPACES is most common, these three types respondents answered that they find storage devices.” 9. Pretty much all possible storage of storage were also clearly rated it on cameras and memory cards. Half of the surveyed police officers . devices are commonly used to store as the most common by the answered that they find child sexual “ Cloud based trading. Offenders child sexual abuse material, according surveyed police officers. Online storage abuse material on social media apps. commonly use chat programs to to the surveyed police officers. Nearly Eight in ten respondents answered One third answered that they also share links where there are buckets half of the respondents answered that “ Computers/Laptops, that they find child sexual abuse find it stored in e-mails. and buckets of illegal materials in they come across child sexual abuse Mobile Phones, USB or material on cloud storage solutions, the folders.” material on almost all storage spaces. other portable devices.” which makes cloud storage nearly STORAGE ON MOBILE PHONES as common as USB sticks and other SHOWS THE BIGGEST INCREASE Nearly sixteen percent answered that Physical devices “ Portable devices become more portable devices. This was also rated More than eight in ten of the surveyed it is the increase in storage capacity on More than nine in ten of the surveyed common if the computers or as the fourth most common type police officers answered that storage all types of devices, such as larger hard 2. police officers answered that they find laptops are shared.” of storage space by the surveyed on different types of devices has drives, that has driven the increase child sexual abuse on computers, police officers. increased in the last three years. in different types of storage spaces. Yes 82.6 No 7.8 Don’t know/don’t wish to comment 9.6
DEVICES AND OTHER STORAGE SPACES, THAT ARE USED TO STORE CHILD SEXUAL DEVICES AND OTHER STORAGE SPACES THAT ARE USED TO STORE ABUSE MATERIAL, THAT POLICE OFFICERS CHILD SEXUAL ABUSE MATERIAL RATE AS MOST COMMON INCREASE IN TYPE OF DEVICE OR STORAGE SPACE, USED TO STORE CHILD SEXUAL ABUSE MATERIAL, OVER THE PAST THREE YEARS
9 . Overall Rank Rank Distribution 100 9 .1 35 . 1. Computer/laptops 9.2 30 80 2. Mobile Phones .2 3. USB or other 25 21. 21. portable devices 60 20 1 .2 0. . 4. Cloud storage solutions 1 . (i.e. dropbox or similar 15 40 2.9 5. Social media apps 6. Tablets 10
20 7. Camera/memory cards . 5 2. .9 8. E-mail 0 0 9. Ftp Computer/ Mobile USB sticks Tablets Cameras/ Cloud Social Ftp E-mail Increase in Increase in Increase in Increase in Increase in Increase in Increase in Increase in laptops Phones and other 66.2 memory storage media 6.9 32.9 use of use of use of USB use of use of micro use of cloud use of social storage space 96.5 93.1 portable cards solutions apps computers/ mobile sticks and tablets SD cards storage media/apps on devices laptops phones external 2.6 4.3 21.3 3 15.7 devices 50.6 79.2 48.5 Lowest Rank Highest Rank 88.7 21.7 33 harddrives 18.2 Respondents were asked to grade the three most The respondents were able to tick several answers. common storage spaces that they come across. The respondents answered an open question and could provide many different answers.
28 29 LAW ENFORCEMENT SURVEY LAW ENFORCEMENT SURVEY
HOW CHILD SEXUAL ABUSE 4 MATERIAL IS STORED
>> THERE IS BOTH KNOWN AND Latest case No clear trend SHARE OF CHILD SEXUAL ABUSE IMAGES AND VIDEOS THAT WERE ALREADY KNOWN/CLASSIFIED IN THE RESPONDENTS LATEST CASE
UNKNOWN MATERIAL IN MOST There is a fairly even spread in the The numbers don’t present a clear INVESTIGATIONS answers to how much material was trend of how much material is generally 20 The police officers were also asked to already known or classified from the unknown or known in a case. This quantify how much material is known start of the police officers’ latest indicates that there is both a lot of 1 . 15 and already classified as child sexual investigations. known material in circulation, but also 12.0 abuse when they start on a case. that a lot of new material is being 9. 10.0 This is important for many different Four in ten of the respondents produced. 10 . . . .0 reasons. One is to understand how answered that more than fifty percent .0 .0 . . much old material is in circulation, of their latest case consisted of In nearly all cases there is unclassified, 5 and to know how much new material already known material. One in twenty previously unseen child sexual abuse is produced. Another reason is to answered that as much as hundred material, and in many these unknown 0 understand the caseloads that law percent of their latest case consisted images and videos are a large share 0 1–9 10–19 20–29 30–39 40–49 50–59 60–69 70–79 80–89 90–99 100 enforcement professionals are dealing of known material, and nearly one in of the case. These images do not only with, and the amount of work that they ten said that more than ninety percent need to be classified for the future, have to undertake when analysing was already known. In contrast, nearly they are also important in the work child sexual abuse cases. six in ten answered that less than fifty to identify and safeguard child victims. percent of their latest case consisted SHARE OF CHILD SEXUAL ABUSE IMAGES AND VIDEOS THAT WERE ALREADY KNOWN/CLASSIFIED IN THE RESPONDENTS The respondents were asked to of already known material. Nearly one Simultaneously, the numbers show AVERAGE CASE (IF THEY WERE UNABLE TO SPECIFY THEIR LATEST CASE) first report how much material was in ten said that their latest case that in many cases a large share of the already known in their latest case. contained no previously known images and videos are already known, 20.0 20 If they did not know this, they were material at all, and one in ten said pointing to the help law enforcement asked to estimate their “average” case. that only up to ten percent was can get from being able to filter images 1 .1 Sixty-four percent of the respondents known before. out so that they do not have to look 15 12.9 answered the first question, thirty-six through all the material. 10. percent answered the second. Average case 10 .2 Of the respondents who estimated .1 .0 .9 .9 their average case, half reported that fifty percent or more of their cases 5 . . normally contain already known 1.2 0 material, whereas the other half reported that their average case 0 1–9 10–19 20–29 30–39 40–49 50–59 60–69 70–79 80–89 90–99 100 usually has less than fifty percent known material.
30 31 LAW ENFORCEMENT SURVEY LAW ENFORCEMENT SURVEY
Apps and platforms are used to store and eight in ten, answered that they come MOST FREQUENTLY MENTIONED CLOUD STORAGE SERVICES, THAT THE POLICE OFFICERS distribute child sexual abuse material across child sexual abuse files stored REPORTED SEEING IN THEIR INVESTIGATIONS OF CHILD SEXUAL ABUSE MATERIAL. SHARE OF RESPONDENTS THAT NAMED THE SPECIFIC CLOUDSTORAGE SERVICE* 5 on Dropbox. Nearly half mentioned Google Drive or Google Photos,
– Skype is the most common platform for live-streamed child sexual abuse. one quarter mentioned Mega and Dropbox 0. one quarter mentioned OneDrive. – Dropbox and Google services are frequently used to store and Google Drive/ Google Photos . share child sexual abuse material. “ Dropbox has become the main cloud Mega 2 .1 storage app we have been finding.” – Snapchat, Facebook and Kik are commonly mentioned social media platforms. Onedrive 2 . “ iCloud and Google drive are the most common.” iCloud 19. In a number of different questions, “ Skype is the predominant child sexual abuse, and that it is Box .1 the police officers were asked which platform used. Also used is KIK a problem for all platform providers. “ Dropbox, iCloud, MEGA, Google apps and online services are used and Snapchat etc.” It may also indicate that the bigger Drive.” Yandex 2. to store and distribute child sexual the platform, and the more users, Adobe 2. abuse material. In the case of “ Any of the hundreds of private the bigger the problem. “ Dropbox and Google Drive; However Creative cloud
live-streaming the services are chat sites like ooVoo and Zoom. both of these cloud servers have used to distribute the abuse itself These private chat apps are DROPBOX AND GOOGLE sent us CyberTips whenever hash 0 20 40 60 80 100 rather than the material. exploding in use.” SERVICES ARE FREQUENTLY USED values are matched.” t er ser ces e t e se eral t es clu e l c r a l u r e src le. TO STORE AND SHARE CHILD r p le p l u ree a a u er t er cl u st ra e s lut s pr e perat rs. SKYPE IS THE MOST COMMON “ Omegle, LiveMe, TikTok.” SEXUAL ABUSE MATERIAL SNAPCHAT, FACEBOOK AND The respondents answered an open question and could provide many different answers. PLATFORM FOR LIVE-STREAMED The police officers were asked which KIK ARE COMMONLY MENTIONED CHILD SEXUAL ABUSE “ Kik, Instagram, WhatsApp, Discord, cloud storage services they come SOCIAL MEDIA PLATFORMS The surveyed police officers were Snapchat, Facebook Messenger.” across in their investigations into child The police officers were asked which MOST FREQUENTLY MENTIONED SOCIAL MEDIA PLATFORMS AND CHAT APPS, THAT THE POLICE OFFICERS REPORTED SEEING IN THEIR INVESTIGATIONS OF asked which applications, services sexual abuse material. Forty different social media platforms and chat apps CHILD SEXUAL ABUSE MATERIAL. SHARE OF RESPONDENTS THAT NAMED or technologies they come across in The results show that all possible services were mentioned in total. they come across in their investigations THE SPECIFIC SOCIAL MEDIA PLATFORM OR CHAT APP* their investigations of live-streamed platforms are used for live-streamed The large majority of respondents, into child sexual abuse material. child sexual abuse. They mentioned Forty-nine different platforms and Snapchat 2. a wide range of social media platforms apps were mentioned in total. Half of Facebook 0. and chat apps with live-streaming the respondents mentioned Snapchat, technology, video call apps and video Facebook and Kik. A third of the Kik 9. meeting services, live video apps, MOST FREQUENTLY MENTIONED APPS, PLATFORMS AND TECHNOLOGIES, THAT POLICE respondents mentioned Instagram Instagram 1. OFFICERS REPORTED SEEING IN THEIR INVESTIGATIONS OF LIVE-STREAMED CHILD SEXUAL web-based chat apps and chat apps ABUSE. SHARE OF RESPONDENTS THAT NAMED THE SPECIFIC APP/PLATFORM* and WhatsApp. WhatsApp 0. for gamers. In total sixty-four different Tumblr 1 .1 apps, platforms and services were “ SnapChat predominantly, also Kik, Skype 9.1 mentioned by name. Skype 9 WhatsApp, Hangouts, HeyNow.” TikTok .1 Snapchat 29.9 The most commonly mentioned “ Kik, Snapchat, Instagram, Facebook.” Twitter .1 Facebook** 2 .0 apps/platforms were Skype followed Omegle .1 Kik 2 .0 by Snapchat, Facebook, Kik and “ Kik, Snapchat, WeMe ... pretty Telegram .0 Omegle. WhatsApp, TikTok, LiveMe, Omegie 19. much any video/chat app.” Instagram, Zoom and Periscope were WhatsApp 12. 0 10 20 30 40 50 60 also frequently mentioned. “ Facebook, Instagram, Snapchat.” Tiktok 9. t er ser ces e t e se eral t es clu e e t sc r e e e e e a e at LiveMe 9. atstep a l l. “ Skype is by far the biggest one. The respondents answered an open question and could provide many different answers. Instagram . There is no protection on that platform. Contact is usually made Zoom .0 on some other social media platform Periscope .9 such as Facebook, Instagram, KIK, THE PROACTIVE PLATFORMS MYLOL, etc ... but then moved to 0 5 10 15 20 25 30 35 40 It is important to note, that being among the most commonly mentioned apps or platforms does not automatically mean that Skype to record the video stream.” t er apps e t e se eral t es ere acet e a esse er tter utu e sc r they have the biggest share of the crime. In some cases the platforms that do most proactive work on this issue and report c r t c a u er atr ulette atur ate at e ue s at a atstep. found material to law enforcement, show up more in investigations. The results should therefore be seen to indicate that cl. ace esse er a ace e the mentioned platforms are commonly used for child sexual abuse crimes. However, the results should not be seen as The respondents answered an open question and could provide many different answers. an indication that the platforms that are not mentioned are not used to share/stream child sexual abuse material.
32 33 COMMENT TO INSIGHT 4–5
ERIC OLDENBURG Law Enforcement Liaison, North America, Griffeye
EASY PRODUCTION AND SHARING DRIVES I believe this ease of access THE SPREAD OF CHILD and facility to quickly share SEXUAL ABUSE MATERIAL material is one of the main drivers behind the sharp Child sexual abuse material is today demands that law enforcement identify depending on the type of investigation. stored on all possible devices and where the material is located in the For example, on a peer to peer increase in the spread of shared in all sorts of fora on the world, get a search warrant for that undercover investigation most images internet. The nature of sharing place, and wait for the platform and videos will probably be known. child sexual abuse material. information follows the development provider to respond and deliver the On the other hand, in a self-production of technology which throws up new data in a safe way. This causes delays case, most images will probably be challenges for law enforcement. that makes it more difficult to safe- new. Overall though, my experience guard victims in a timely manner. is that known files typically outweigh The ease of sharing links new material. Online storage, like cloud storage, Mobile phones presents a different challenge to law Mobile phones and mobile apps are The number of known images at the enforcement than physical devices other examples of ease of access beginning of an investigation is also do. Sharing a large collection of files driving the spread, and also production, entirely dependent on the intelligence on a hard drive, or sharing all images of child sexual abuse material. Nearly and databases of known hashes that on a phone requires a lot of effort everyone has a mobile phone, and they each law enforcement professional and is difficult to do. Cloud storage, are cheap, have good cameras, and has access to. That is why it is so however, makes it possible to share feel very private and secure as people important to collaborate and share an entire mass of material by just always carry them with themselves. intelligence. The consequence of sharing a link on a forum, social media Using mobile apps it is also very easy not sharing is that law enforcement platform or through direct messaging. for offenders to access collections professionals risk duplicating the Duplicates of millions of images can of material. efforts of others and wasting time reach more people much quicker than that could be used to identify victims. they ever could before. I believe this I believe that the increasing numbers ease of access and facility to quickly of mobile phones seen in investigations This is also important to address from share material is one of the main is also linked to the increase in self- a mental health point of view. Working drivers behind the sharp increase in the produced material by children and on child sexual abuse investigations, spread of child sexual abuse material. teenagers themselves. Whether they constantly exposed to child sexual produce material voluntarily or as abuse material, is psychologically very Slower and more complicated a result of grooming or extortion, difficult. Being able to filter out already investigations they typically use their mobile phone. known material not only reduces risk of Cloud storage has also made investi- duplicating work, it also reduces expo- gations slower and more complicated. Known images vary depending sure and trauma. The less time law With material on hardware the police on investigation enforcement professionals spend look- can seize and get immediate access The quantity of child sexual abuse ing at unnecessary child sexual abuse to a computer or USB stick. Working to material known at the beginning material, the longer they will have the gather information from cloud storage of an investigation varies widely mental strength to keep doing the job.
34 35 LAW ENFORCEMENT SURVEY LAW ENFORCEMENT SURVEY
Emerging technologies 6 – trends, challenges and opportunities – Increase in use of cloud storage, encryption and smartphones. – Encryption is the biggest challenge. – Artificial Intelligence, investigation software, and sharing of data/intelligence is most helpful. – One in five police officers have used AI tools in their investigations.
INCREASE IN USE OF CLOUD Increases in encryption and smart- Apps, link sharing and P2P “ Use of cloud storage appears to “ The use of cellular devices to store “ Cellular/mobile devices and tablets/ STORAGE, ENCRYPTION AND phones were mentioned by one fifth Other trends mentioned were develop- be increasing year on year with and distribute child sexual abuse laptops are loaded with encryption SMARTPHONES of the respondents. This includes ment of mobile applications, and an offenders storing and sharing material across a myriad of Apps by default which makes processing The police officers reported that encryption of apps, mobile phones increase in offenders sharing links links. Devices are often forensically and the storage of that material in the device as well as their backups major technology trends that affect and computers as well as encryption to online spaces (often cloud storage) cleaned making detecting offences third party cloud storage compa- increasingly difficult.” methods for production, storage of cloud services. or websites where child sexual abuse more difficult.” nies.” and distribution of child sexual material can be downloaded, rather “ Devices that automatically encrypt abuse material are increased use of Darknet, social media than sharing the material itself directly. “ Distribution of links which lead to “ Apps that allow covert and encrypted data. Devices that auto-lock down cloud storage, encryption of a range and online gaming Increased use of P2P networks was cloud storage accounts containing communication between offenders and require passcodes to gain entry, of devices and online storage spaces, More than one in ten respondents also mentioned. child sexual abuse material.” and children.” such as smartphones. Apps that and the development and spread answered that increased use of have "My Eyes Only" type secure of smartphones. TOR/darknet (16.1 %), and social “ Cloud storage is quickly going to “ Live-streaming, being recorded using vaults to hide content, such as media and online gaming (14.3 %) overtake mobile phone storage DU recorder or ITube. Then shared what Snapchat uses.” An increase in use of cloud storage being used to produce and share (if it hasn't already). Every case via encrypted chat plaforms like was mentioned by more than one child sexual abuse material are seems to have a Dropbox, Drive, WhatsApp and Telegram between “ Production is made easy by the third of the surveyed police officers. major trends. or Mega connection to it.” offenders. Still large use of Dropbox use of smartphones and distribution links being shared on chat groups.” is, in my experience, made easy by the use of TOR.”
BREAKDOWN OF THE TYPES OF MOST FREQUENTLY MENTIONED EMERGING TREND IN TECHNOLOGIES THAT ARE USED TO PRODUCE, ENCRYPTION SPECIFICALLY “ Cloud sharing. Perpetrators are STORE AND DISTRIBUTE CHILD SEXUAL ABUSE MATERIAL* MENTIONED IN THE SURVEY locating victims through gaming apps a lot more these days.” 35 .9 12 10.1 30 10 >>
25 20. 8 20 19.0 . 1 .1 6 1 . 15 4 10 . .1 .0 .2 2 5 .0 .0 1.2 0 0
Increased use of cloud storage/cloud sharing 33.9 Increase in using links instead of sharing the actual child sexual abuse material 7.1 Encryption of apps 10.1 Increased use of encryption and available encrypted services 20.8 Increase in use of P2P networks 6.0 Encrypted smartphones/ Development and increase of mobile devices 19.0 Increase in live-streaming 4.2 computers 6.5 Increase in use of TOR/darknet 16.1 Increase in apps that don’t keep any content 3.0 Encrypted cloud services 1.2 Increase in use of social media and online gaming 14.3 Increase in use of VPN 3.0 Increase and development of mobile applications 7.7
t er tre s e t e se eral t es clu e t e use rtual ac es et r s sel pr uce c l se ual a use ater al eep a es r a se ru s a re s call clea e e ces.
The respondents answered an open question and could provide many different answers.
36 37 LAW ENFORCEMENT SURVEY LAW ENFORCEMENT SURVEY
EMERGING TECHNOLOGIES ARTIFICIAL INTELLIGENCE, the importance of sharing data and percent of the surveyed police 6 – TRENDS, CHALLENGES AND OPPORTUNITIES INVESTIGATION SOFTWARE, AND growing different intelligence sources officers said that they were helped SHARING OF DATA/INTELLIGENCE like databases of hashes, and work done by just that, improved help from IS MOST HELPFUL by NCMEC(2), Project VIC(3) or CAID(4). social media companies.
>> ENCRYPTION IS THE BIGGEST “ The problems associated with “ The biggest hurdle outside of Artificial Intelligence “ Continued growth of MD5(5) hash “ Online storage and businesses CHALLENGE storage on international servers encryption are ISPs which do not Half of the surveyed police officers sets of known material. More that monitor online storage for Nearly half of the surveyed police and the legal challenges associated retain the needed data to identify answered that different types of importantly the growth of PhotoDNA known hashes.” officers reported that encryption is with that. Also, I have seen a lot subscribers. Many cellular providers technology developments, such of Known Images. Most important the biggest challenge they face in of sharing via anonymous file do not maintain records of session as Artificial Intelligence (AI), Face the use of Photo DNA on movies so “ The implementation of any tools child sexual abuse investigations. sharing websites, especially and login activity. Those that do Recognition, PhotoDNA(1) for video that non matching MD5 values on used by any ISP/ESP that recognizes Fourteen percent (14.4 %) of the on the ‘dark web’.” may only keep them for 60–90 days, and forensic tools for breaking locked movies can be addressed.” child exploitation from the get go respondents specifically answered which is often outside the range smartphones are most helpful to child and is then reported to the that encrypted and locked smart- “ The standard use of hardware of the abuse when reported.” sexual abuse investigations. Most of “ Hash databases that are appropriate jurisdiction.” phones and computers are encryption on smartphones and those, one fifth of the respondents, contributed globally.” particularly challenging. computers.” “ That is the co-op with the social answered that AI is helpful. “ Constant cooperation between media platforms. They are not that “ NCMEC/CVIP(6) are very helpful.” law enforcement and internet Darknet and cloud storage “ Encryption/password protection willing to help the police, and that is “ AI for image detection.” service providers.” Nearly one fifth of the respondents Apps that store very little data a big problem. Use things like letters “ CAID/Project VIC.” mentioned TOR/darknet and cloud on the device i.e. Snapchat.” rogatory/MLAT*, and that result in “ Facial recognition, AI.” No helpful developments storage as technologies that are months and months of waiting, Platform and service providers Nearly seven percent of the particularly challenging. In relation “ VPN services are a particular and then the evidence is gone.” Software and sharing data/intelligence One in ten answered that it would respondents said that they didn’t to cloud storage, several respondents challenge as they mask the true One third of the respondents named be helpful if ISPs and social media feel that there were any technological specified that the major challenge is location where someone is “ The biggest challenge is that the use specific software for investigative work platforms collaborated more with developments that are helpful to jurisdictional issues, for example when accessing data from.” of the DarkNet is constantly rising and analysis. One quarter mentioned law enforcement. Just over three child sexual abuse investigations. the cloud host is based in another and that using mobile applications >> country. Other challenges mentioned “ The vast amount of programs that makes it harder for us to track and TECHNOLOGY DEVELOPMENTS THAT POLICE OFFICERS SEE AS PARTICULARLY HELPFUL were live-streaming and apps that don’t enable a user to show live videos search for these kind of material.” TO CHILD SEXUAL ABUSE INVESTIGATIONS. SHARE OF RESPONDENTS THAT HAVE BREAKDOWN OF TECHNOLOGIES LISTED store content, VPN, ISPs that don’t and keep no records has allowed ANSWERED A SPECIFIC TECHNOLOGY THAT IS HELPFUL* AS HELPFUL IN THE SURVEY
track IP addresses and store informa- offenders a larger group of tion, and apps with user anonymity. children to groom and exploit.” 60 . 25 50 20.1 20 TECHNOLOGY DEVELOPMENTS THAT POLICE OFFICERS SEE AS PARTICULARLY 40 CHALLENGING TO CHILD SEXUAL ABUSE INVESTIGATIONS. SHARE OF RESPONDENTS THAT HAVE ANSWERED A SPECIFIC CHALLENGE* 0.2 15 30 2 .2 10 . 50 .9 20 10.0 10 . 5 . 40 . 2 2 0 0 30 Different types of technologies 55.7 Most commonly mentioned technologies: Mentions of different software for investigative work and analysis 30.2 Artificial Intelligence 20.1 20 1 . 1 . Sharing of data through intelligence data sources 26.2 Face Recognition/Face Detection 8.7 If/when ISPs and social media platforms collaborated that would be helpful 10.0 PhotoDNA for video 6.0 Improved help from social media companies 3.4 Forensics tools for breaking locked 10 .0 . There are no technology developments that are helpful 6.7 smartphones 4.0 .0 2. P2P investigation tools 3.4 t er elp ul tec l es e t e clu e te t rec t l cat ser ces apps Triage tools 2.0 0 Parsing tools 2.0 ecr pt t ls c ert ps r plat r a l e st ra e pr ers a re Encryption 48.9 p ss l t es t use l e u erc er est at s. TOR/darknet 18.7 Cloud storage (including in other countries) 17.8 The respondents answered an open question and could provide many different answers. Live-streaming and apps where content is not stored 8.0 VPN 7.5 ISPs that don’t track IP addresses or store information and lack of cooperation (1) PhotoDNA is robust hashing technology used to identify child sexual abuse material. See section three of the report for a description of PhotoDNA. with social media companies 4.0 Apps with user anonymity 2.3 (2) NCMEC (National Center for Missing and Exploited Children) is the US’ national clearing house for reports on child sexual abuse material for US based platform providers t er c alle es t at ere e t e ere clea t ls e e r ats s e est at s (3) Project VIC is a global partnership between law enforcement and the private sector. It promotes data sharing between domestic and creas l tec sa suspects rtual ac es. international law enforcement agencies working on cases pertaining to sexual exploitation of children. The respondents answered an open question and could provide many different answers. (4) CAID (Child Abuse Image Database) is a national system to enable collaboration between law enforcement agencies working on child sexual abuse cases in the UK. (5) MD5 is a type of binary hash. Read more about binary hashing in section three of this report. * MLAT stands for Mutual Legal Assistance Treaties. Letters rogatory and MLAT are treaty-based mechanisms for seeking foreign law enforcement cooperation. (6) CVIP (National Child Victim Identification Program) is a database of child sexual abuse material maintained by the United States Department See comment by Jim Cole at end of insight 6 for further explanation. of Justice and NCMEC.
38 39 LAW ENFORCEMENT SURVEY COMMENT TO INSIGHT 6
EMERGING TECHNOLOGIES 6 – TRENDS, CHALLENGES AND OPPORTUNITIES
JIM COLE Supervisory Special Agent, Homeland Security Investigations (USA), Special Agent in Charge Nashville, TN
>> ONE IN FIVE POLICE OFFICERS The majority of those (46.2 %) reported “ It can be used as a triage tool to ARTIFICIAL INTELLIGENCE WILL HAVE USED AI TOOLS IN THEIR that the primary gain is that the decide if a device needs to be INVESTIGATIONS AI classifier helps to triage or filter deeper examined or not.” BE A MAJOR GAME CHANGER One fifth of the surveyed police officers material, to locate where to look in the answered that AI is helpful in child caseload or highlight material that is Needs to mature sexual abuse investigations. This likely to be child sexual abuse material. Those who reported that AI technolo- number is also reflected in how many gies are not useful, commented that of the respondents reported having “ Due to the immense amount of the technology still needs to mature, The technological development that is That could be used in both child expectations of it. In the general used AI in their investigations. The digital evidence, the use of AI […] but will be beneficial in the future, having the single most impact on child sexual exploitation and terrorism police community there is a lack of large majority, nearly eight in ten of allows examiners to target potential or that they had just started using it sexual abuse investigations is Artificial investigations. understanding of how AI works, and the surveyed police officers, however images first. This provides both and needed to get more experience. Intelligence (AI). I have used AI for how the algorithms “learn” and there answered that they have not used a benefit in efficiency as well as many years now and in the past two Another future use is resource is a tendency for investigators to rely AI in their investigations. Several a mental boost because it allows “ Technology doesn't seem mature or three years there have been some intensive undercover operations too heavily on the result from the respondents commented that the user to sort out the most likely enough yet....Getting better but incredible developments. where a detective chats with suspects. computer. they would like to. media files first.” still a way to go.” With some human monitoring, that The future of AI could probably be AI driven instead. As a result, expectations are exceeding “ I would like too but haven't taken “ Everything identified by AI still has “ Will be more beneficial as the The future of AI is exciting, and we Or when doing a house search, images the capabilities of the technology. the time to learn the technique.” to be manually reviewed however technology develops.” are still only in the beginning of where from the premises could automatically There is a belief that AI classifiers will pre-categorization of child abuse AI can take us, but it is clear that be matched to see if the location find all child sexual abuse material in “ Would love to try AI in my cases.” images or vetting of known system “ I have only barely started trying visual analytics will change beyond matches unsolved child sexual a case, and that it will find everything files speeds processing time greatly. to apply AI/machine learning in our imagination. abuse series that we have. correctly – which it doesn’t. It is not Triage and locate material my cases but I'm excited to find a result that can be trusted without Of the respondents that used AI “ The image classifiers can surface ways to make it useful.” An example of current really interesting These are just some examples; I think review or that can be used in court, classifiers in their investigations, eight potential child pornography work is a research project that aims that we will see AI move into areas that it still needs to be manually validated in ten reported that they were useful. images more quickly.” to marry the human brain’s neural we are far from contemplating now. and investigated. networks with AI neural networks. The human brain has an amazing Investigative leads Therefore, we need to make sure that capability to understand context, We are still some way from the we train people in the police community WHETHER RESPONDENTS WHO HAVE USED something machines are terrible at. future I’ve painted above, but AI can to understand the strengths and SHARE OF RESPONDENTS WHO HAVE USED ARTIFICIAL INTELLIGENCE TECHNOLOGY/ ARTIFICIAL INTELLIGENCE TECHNOLOGY/ CLASSIFIERS IN THEIR INVESTIGATIONS In this project images are shown to already be very useful. It is already limitations of AI, so that they use its CLASSIFIERS IN THEIR INVESTIGATIONS FIND IT USEFUL a person (police officer) at a faster a good indicator and provider of potential efficiently and correctly. pace than the brain can cognitively investigative leads. . .1 register. The brain still reacts to the Automate manual work 1 .9 1 . content of the image, and violent Instead of just looking at a vast pool I don’t think there will be a time during content elicits a heightened stimulus. of data in a case, image classifiers can my career nor lifetime where we By reading a brain’s EEG, AI can use help us group together images with can blindly rely on computers and those reactions to group images visual similarity and highlight images algorithms. However, in the not too together. In the future this could be that might be of particular interest. distant future we might be able to used during the first sift through of This makes the data both easier and automate up to ninety percent of case data, to help law enforcement faster to review, making investigations what we today are doing manually. go through material faster. more efficient. This will cut down on the time and resources that we have to spend .2 9. There is also work on AI being used for Expectations vs capability reviewing images and will free up text analysis to detect certain text The challenges that we face with time for people to work on more Yes 17.9 Yes 79.5 No 76.2 No 15.4 sequences in chats and messaging AI right now, is the general poor new cases. Don’t know/don’t wish to comment 5.8 Don’t know/don’t wish to comment 5.1 apps to push content for review. knowledge level and people’s
40 41 COMMENT TO INSIGHT 6
JIM COLE Supervisory Special Agent, Homeland Security Investigations (USA), Special Agent in Charge Nashville, TN
ACCESSIBILITY TO TECHNOLOGIES HAS CHANGED THE PLAYING FIELD This is the conundrum that we are dealing with
The results in this report mirrors my Automatic cloud storage Darknet is the biggest challenge – technology is making own understanding of the situation. Similarly, in the past cloud storage I think one of the biggest challenges The technologies mentioned are not had to be actively sought out as an is still darknet and TOR, where child our jobs more difficult new, but what has really changed over add-on. Now every device comes sexual abuse crime still goes largely the past years is the accessibility to, for with automatic and easily accessible undetected. Methods on darknet and and informing us at example, encryption and cloud storage. cloud storage, and there are several encrypted communication means challenges to this. The first is that offenders can establish a type of the same time. Built in encryption we don’t get access to cloud storage trust. This was previously difficult to Previously only used by people with when we execute a residential search do, and it gives offenders opportunity thorough technological know-how, warrant. For that we need a second to engage in really extreme behaviour. encryption is now everywhere, in apps search warrant and another court and devices, and as with everything process, which delays access. Even though many police officers are this presents both positives and aware of the problems with darknet, negatives. In order to protect privacy Another issue is legal challenges to few are investigating it. One reason is and data, encryption is a good thing, accessing data stored outside of US that most law enforcement agencies however it also facilitates crime that borders. An example of this is when around the world are only tasked to uses digital technology, not only child Kik was based in Canada. We could work on cases that fall within their sexual exploitation, but also financial get subscriber information by drafting own jurisdiction. It is often not possible crime, narcotics and terrorism. a US subpoena and going through to determine who’s operating on the the Royal Canadian Mounted Police. darknet or where they are, and this In the past we could submit devices However, to get communications or produces a problem for traditional to mobile phone manufacturers, like images from an account, we needed police work. Apple, to access data on phones. a Canadian search warrant. To get Apple have now moved to a system this, we would need to go through This is the conundrum that we are where they cannot decrypt the phones letters rogatory/MLAT (Mutual Legal dealing with – technology is making that they produce even if they wanted Assistance Treaties) which is an our jobs more difficult and informing to. And we are seeing more companies incredibly long and drawn out process. us at the same time. The law following suit – Facebook, for example, This process could at best take nine enforcement community needs has announced that they will deep months, but often up to three years. to adopt to these challenges, and encrypt Facebook Messenger. This is After that long the information is often we need to be willing to try to learn a major challenge to child sexual gone, or the MLAT is rejected because new technology. We have to be exploitation investigations. legal requirements have changed willing to work cases that may during that time. It ends up being not be in our own jurisdictions. a futile waste of time and effort. We have to work better together, and we have to be willing to do things differently to what we have done before.
42 43 BUSINESS SURVEY
– BUSINESS SURVEY –
Following up on child sexual abuse material in the business environment Protecting business In last year’s NetClean Report (2018) we interviewed businesses and organisations that have NetClean ProActive (software that detects child sexual abuse IT environments against material in organisations’ IT environments) installed on their computers and in their IT environments. The results showed that 1 in 500 employees use their child sexual abuse material work computer to view child sexual abuse material, often on a laptop, outside of business hours and – Use of policies, action using USB sticks. This year we surveyed large corporations from a more general selection, not only NetClean’s own plans and technologies customers, to see how businesses respond to the problem of child sexual abuse material in their IT systems. We surveyed one hundred businesses with 5,000 employees or more, all operating in the US. The respondents were IT/IT Security professionals that are either the primary decision maker in their company, or share equally in the decision-making with others. The survey was conducted as an anonymous online web interview.
This section of the report looks at the following four areas:
Whether the businesses have a corporate policy in place that states that it is prohibited to handle child sexual abuse material within the company’s IT environment or on company devices.
Whether the businesses have an action plan in place to deploy if child sexual abuse material is found in the organisation’s IT environment.
Whether the businesses have technologies in place to detect or block child sexual abuse material in the business IT environment.
Whether child sexual abuse material have ever been found in the businesses’ IT environments.
44 45 BUSINESS SURVEY BUSINESS SURVEY
Businesses’ use of policies and action plans to protect their IT environment from
child sexual abuse material One in twenty of the surveyed “ Record the dates, times and facts “ Immediately notify law enforcement 7 businesses reported that their action of the incident, report to HR, and and place the suspected violator plan includes notification of the authorities.” on a leave of absence for the – Nine in ten businesses have a corporate policy in place. employees’ supervisor or manager. investigation.” – Eight in ten businesses have an action plan in place. Two of the responding companies “ If they somehow get around the specifically answered that they review “ Follow appropriate steps by filter we notify their manager.” the material before reporting to law notifying HR, contacting the enforcement. authorities, and placing them on NINE IN TEN BUSINESSES HAVE Notification of law enforcement “ All the data that we find are “ IT Staff tips off HR and Manager.” suspension until we can confirm A CORPORATE POLICY IN PLACE and internal reporting are most immediately sent to the authorities.” “ After this is found, we review it their involvement which will Company policies are important common actions “ IT Group notifies executive team, and then send to the police.” result in termination.” frameworks for businesses as they When the respondents were asked “ Report to police and ensure we CHRO is contacted. Supervisor define core values and strengthen to describe the action plan, keep the evidence.” of employee is contacted.” “ This material is reviewed after “ Immediate termination and reports company culture. They are designed notification of law enforcement, being discovered and sent to to the Police.” to define and reinforce acceptable and internal reporting, securing of Internal notification Action to secure evidence the authorities.” unacceptable behaviour and conduct evidence and suspension and/or One third of the surveyed businesses One in five of the businesses stated “ To fire that offender and alert police.” in the workplace, and the standards termination of employment were reported that they notify someone that their action plan includes Suspension and termination that employees are expected to meet. mentioned most frequently. internally, most commonly this was HR instructions to secure evidence. of employment Deletion of suspected material They also give an organisation leverage (nearly one in five), but it could also be One in ten of the surveyed companies One in twenty of the surveyed to act, providing opportunity to Notification to law enforcement the Executive Team, Head of Depart- “ We would isolate the equipment reported putting the employee on businesses answered that the only terminate employment where serious Nearly half of the total number of ment, Local IT department or other. immediately and remove it from suspension while the case is being action outlined in their plan is to policy breaches have occurred. respondents (60 percent of those who the network. We would then call investigated, and one in five reported delete the illicit material. have an action plan in place) reported “ We immediately have human in an incident response team to that any employee found in possession Nine in ten of the surveyed businesses that their action plan prescribes resources respond.” investigate.” of child sexual abuse material will have “ We delete the images and other reported that they have a company notifying law enforcement. their employment terminated. stocks of proof.” policy in place that states that it is “ It is reported to HR and CTO.” “ We immediately freeze the user prohibited to handle child sexual “ After the discovery we immediately account and do a 48-hour “ We gather all documentation, person “ We detect it then take it down abuse material in the company’s IT include the authorities and “ Manager escalates to Department investigation.” is put on suspension, authorities are and delete the software.” environment or on company devices. collaborate with the investigation.” Head, Department Head alerts contacted.” Human Resources, HR informs “ Ensure proof of violation, see how
Nearly one in ten companies reported “ We contact the correct authorities me and CIO to engage background they were able to get around the POSITIONS TO BE REPORTED TO that they do not have such a policy immediately.” check.” filter, and report it.” INTERNALLY ACCORDING TO in place. THE ORGANISATIONS’ ACTION PLANS
EIGHT IN TEN BUSINESSES HAVE 20 AN ACTION PLAN IN PLACE SHARE OF BUSINESSES THAT REPORT BREAKDOWN OF THE DIFFERENT REPORTED ACTIONS OUTLINED IN 1 A plan of action outlines a procedure to HAVING A CORPORATE POLICY IN PLACE SHARE OF BUSINESSES THAT REPORT THE ORGANISATIONS’ ACTION PLANS THAT STATES THAT IT IS PROHIBITED TO HAVING AN ACTION PLAN IN PLACE 15 follow if child sexual abuse material is HANDLE CHILD SEXUAL ABUSE MATERIAL TO DEPLOY IF CHILD SEXUAL ABUSE found in the business IT environment. WITHIN THE COMPANY’S IT ENVIRONMENT MATERIAL IS FOUND IN THE 50 It provides the organisation with a OR ON COMPANY DEVICES ORGANISATION’S IT ENVIRONMENT 10 framework for steps to take and 40 1 actions to be executed, to ensure that 5 29 the situation is handled in a way that 1 30 2 the company considers most correct. 21 0 20 19 HR 17 Eight in ten businesses reported that 11 Employee supervisor 6 Executive team 4 they have an action plan in place to 10 Head of department 3 deploy if child sexual abuse material is 1 Local IT 2 0 found in the business IT environment. Other (CFO, CIO, Legal dep, CTO) 4 Notify law Report Secure Termi- Put Delete Confront Other/ Unspecified 3 enforce- internally evidence nate employee the the unclear The respondents could identify several different ment 29 employ- on sus- person answers* More than one in ten businesses 21 material job titles to be informed after child sexual abuse 0 48 ment pension 4 1 8 stated that they do not have an 91 19 11 material had been found in the organisation. Yes 91 Yes 80 action plan of this sort in place. Therefore the numbers in this graph add up to No 8 No 15 * Includes general answers such as tighter control of child sexual abuse material, handling things more than the total number of those that report Don´t know 1 Don´t know 5 cautiously and effectively fight the spread of child sexual abuse material. to someone internally (29 ).
46 47 BUSINESS SURVEY BUSINESS SURVEY
SHARE OF BUSINESSES THAT REPORT BREAKDOWN OF THE DIFFERENT TECHNOLOGIES THAT BUSINESSES REPORT Businesses’ use of technologies to HAVING TECHNOLOGY IN PLACE TO DETECT USING TO DETECT OR BLOCK CHILD SEXUAL ABUSE MATERIAL OR BLOCK CHILD SEXUAL ABUSE MATERIAL IN THE ORGANISATION’S IT ENVIRONMENT protect their IT environment from 9 60 2 child sexual abuse material 1 8 50 35 – Eight in ten businesses have technology in place. 40 – Six in ten companies use filter solutions. 30
– One in ten companies have found child sexual abuse material. 20 1 24 10 0 EIGHT IN TEN BUSINESSES One in ten use detection solutions “ I am not aware of such Yes 85 Filter Detection Antivirus Physical Unclear HAVE TECHNOLOGY IN PLACE More than one in ten of the surveyed technologies.” No 13 solutions 59 solutions solutions protection protection Don´t know 2 14 5 There are different technologies businesses stated that they use Employee 6 used 8 monitoring available to prevent child sexual detection technologies to protect “ It can be done manually.” tools 35 abuse material being viewed, stored their IT environment from child Other filter or distributed in the business IT sexual abuse material. “ Because we don’t think that this solutions 24 environment or on company devices. happens on company networks.”
These include different blocking tools “ Technologies that detect this type BREAKDOWN OF THE DIFFERENT REASONS REPORTED FOR WHY TECHNOLOGIES (often in filter solutions) and detection of material and alert us, so we can ONE IN TEN COMPANIES ARE NOT BEING USED TO DETECT OR BLOCK CHILD SEXUAL ABUSE MATERIAL tools. An overview of technologies react properly.” HAVE FOUND MATERIAL used to detect and stop child sexual One in ten businesses reported that abuse material is outlined in section Other solutions they have found child sexual abuse 5 three of this report. One in twenty of the respondents material in the business IT environ- reported that they use antivirus ment. They reported having found the 4 More than eight in ten businesses solutions. One in twenty also material in a wide variety of ways; by stated that they have technology in responded that they use different IT specialist in different check-ups or 3 place to detect or block child sexual kinds of physical protection instead IT scans, by someone else reporting abuse material in the business of IT solutions (such as surveillance it to IT, or with the help of technology. IT environment. cameras, microphones or physical 2 law enforcement protection present). Nearly nine in ten respondents reported 1 1 SIX IN TEN USE FILTER that they have not found child sexual 1 SOLUTIONS “ Cameras, Microphones, etc.” abuse material in their IT environment.
Six in ten of the surveyed businesses 0 reported that they use some kind Nearly one in ten of the respondents Important to note is that it is customary Unaware Can be done Don’t think Not our Have general of tech- manually it happens problem filters of filter solution to protect their gave unclear answers, such as in organisations to keep information nology 5 4 3 1 1 IT environment from child sexual enterprise resource planning (ERP) about cases where an employee has abuse material. systems or protocols that are used been found to handle child sexual when children go physically missing. abuse material to a very tightly defined SHARE OF BUSINESSES THAT REPORT BREAKDOWN OF HOW THE SITUATION WAS HANDLED BY THE ORGANISATION HAVING FOUND CHILD SEXUAL ABUSE “ Various blocking and filtering and limited group. Therefore, the MATERIAL IN THE ORGANISATION’S technologies.” One in ten have no results most likely reflect whether child IT ENVIRONMENT 6 technology in place sexual abuse material has been found “ Internal firewall, software to More than one in ten of the surveyed in the particular region and during the 11 5 block browser sites.” businesses reported that they don’t time that the respondent has been in have technology in place to detect his or her current position. 4 More than one third specified that or block child sexual abuse material. they use filter solutions as part of an When asked why, they primarily Law enforcement was notified 3 employee monitoring tool, such as answered that they are unaware of and employee fired
Hubstaff, Teramind, BrowseReporter technology that can detect or block In cases where child sexual abuse 2 or SentryPC. Employee monitoring child sexual abuse material, that it can material had been found in the tools are used to track employee be done manually or that they are of respondents’ organisations, the 1 web or application use, monitor the opinion that this kind of material surveyed businesses answered that chats and keystrokes, and to also does not appear in business networks, they handled it by notifying law 0 Yes 11 filter and make specific types of and that they therefore do not need enforcement, conducting an internal Notified Firing of Carried out No 86 police employee investigation online content inaccessible. to protect their IT environment. investigation, and firing the employee. Don´t know 3 6 4 3
48 49 COMMENT TO INSIGHT 7 AND 8 COMMENT TO INSIGHT 7 AND 8
ANNA BORGSTRÖM PAT GELSINGER Chief Executive Officer, NetClean Chief Executive Officer, VMware
THE WILL TO ACT NEEDS BUSINESS INTEGRITY TO BE FOLLOWED UP WITH AND ETHICAL LEADERSHIP EFFECTIVE TECHNOLOGIES
It is gratifying to see that so many While securing, timestamping and It is encouraging to see that fourteen Today is the fastest day of techno Drivers like the UNs’ Sustainable At VMware, we use our own products of the surveyed businesses have recording evidence is helpful to the percent of the businesses report using logical evolution for the rest of your Development Goals highlight the and technology to solve our most policies and action plans in place police, freezing or restricting access detections tools, which are arguably life; today is also the slowest day of fact that companies must act in critical challenges — the same ones to stop employees from consuming to networks or devices, or confiscating much more effective in this case. technological evolution for the rest the interest of the future of the planet faced daily by every IT organisation. child sexual abuse material. This equipment also risks alerting the These technologies detect on image of your life. This provides us with and humanity. One of the goals, A great example of this is our approach must be followed up by effective suspect. As a result the individual content level, and are specifically incredible possibilities. SDG 16.2 – End abuse, exploitation, to build security intrinsically into our policy compliance. might delete material kept on other designed to find child sexual abuse trafficking and all forms of violence platform to eliminate a host of cyber devices at work or at home. material. Will we expand the life of every human against and torture of children, threats and security complexity. Action plan on the planet and eradicate diseases is to secure a prosperous future Child sexual abuse material poses It is also important to note that the Why detect? that have plagued mankind? Can we for all children, and all businesses Now more than ever, the tech a risk to IT environments. It is child sexual abuse material itself The NetClean Report 2018 showed ensure modern education for every have a great stake in this. community has an individual and therefore vital that businesses have should be handled as little as that 1 in 500 employees use their work child on the planet, lift the remaining collective responsibility to engage an action plan in place to secure possible. As it is illegal to possess, computers to consume child sexual 10 % of the planet out of poverty, and Child sexual abuse is a problem and act. This applies not only to our evidence correctly, ensure the welfare it should not be saved, copied abuse material. Therefore, this year's reverse the implications of climate that has migrated online with the own businesses but also to shaping of any employee who might have or shared. result showing that only one in ten change? While we cannot predict the development of technology, and we global policy and regulatory frame- seen the content, and to manage the businesses had detected child sexual future, we can say that technology will must ensure that the dissemination works to ensure that technology offender who has downloaded the Effective technologies abuse in their IT environment was play a significant role in these efforts. of child sexual abuse material is serves the greater good. At VMware, abuse material to the IT environment. Most of the surveyed businesses surprising. One possible explanation disrupted in all services that we we strive to be a force for good. Next, notifying law enforcement is report that they have filter technologies for this discrepancy is that incidents Technologies also amplify human provide. Companies must act swiftly, crucial. It is only when the incident in place to protect their IT environment are usually kept within a very small behaviour, both the good and the responsibly and demonstrate leader- is investigated that more material from child sexual abuse material. group of people and that the survey bad. This is why it is critical that we ship and integrity to ensure that we is found, and children can be Although many filter technologies respondent was not aware of all cases. act responsibly in relation to the are doing everything we can to safeguarded. offer different kinds of measures to technologies that we create and the safeguard children. stop inappropriate content – often It is also very possible, as shown services that we provide; shaping Handling information adult pornography – child sexual by the statistics on what type of them so that they are used in the The human factor needs to be abuse material is normally not a technologies are applied, that busi- way that was intended. considered carefully in these types prioritised threat. In addition, they nesses are not effectively protecting of cases, and information about rarely find child sexual abuse material their IT environment against child discoveries need to be kept to a very on an image content level. As a result sexual abuse material. Companies small group of people. One reason their effectiveness is limited*. Antivirus believe their solutions are efficient, is that other employees might find solutions have even more limited but child sexual abuse material it difficult to continue working with capabilities to find and stop child is still going undetected, and a suspected colleague while evidence sexual abuse material. remains a hidden problem. is gathered, which could risk alerting the suspect. VMware is a leading innovator in enterprise software. The company’s cloud, networking and security, and digital workspace offerings, provide a dynamic and efficient digital foundation to over 500,000 customers globally, aided by an ecosystem of 75,000 partners. Headquartered in Palo Alto, California, VMware is committed to being a force for good, from its * Read more about filter technologies and detection technologies in section three of this report. breakthrough innovations to its global impact.
50 51 MAPPING OF TECHNOLOGIES
- MAPPING OF TECHNOLOGIES -
Business and technology – mapping
of available methods to Overview of technologies and methods available to businesses to stop child sexual abuse material The internet is a complex multi-layered place which stop child sexual abuse provides many ways for offenders to share child sexual abuse material. Therefore, there is no one technology or solution that alone can police the internet against online child sexual abuse material. To effectively fight the spread of child sexual abuse material, different technologies must be applied by all who use the internet and have an interest in making it a safe space for future generations. This includes viable business planning.
If all businesses and organisations in the world – billions of computers and networks – took appropriate action, the opportunity to find and disrupt the spread of online child sexual material would increase infinitely.
Child sexual abuse crime is a complicated crime, one that is not easy to understand nor fight, but what is clear is that specialist technologies must be applied to stop the dissemination online.
There are a number of technologies that can be applied by businesses, and in this last section of the report we present an overview of technologies and methods available to businesses to stop child sexual abuse material. The articles are a revision and abridgement of longer and more technically detailed articles published on NetClean’s website.
More information is available on www.netclean.com/technical-model-national-response/.
52 53 MAPPING OF TECHNOLOGIES MAPPING OF TECHNOLOGIES
HASHING TECHNOLOGY/DIGITAL FINGERPRINTING HASHING TECHNOLOGY/DIGITAL FINGERPRINTING Binary Hashing Robust Hashing
Binary hashing is used to fingerprint and discover online child sexual abuse material Like binary hashing technology, robust hashing is used to fingerprint and on a content level, i.e. it identifies the actual images and videos depicting child sexual discover online child sexual abuse material on a content level. In contrast abuse. Hashing technology is a secure, fast and reliable technology that is used in to the binary system, robust hashing technology looks at the actual visual various ways, e.g. in detection tools, digital investigation tools and crawlers. It is used content of an image rather than just the binary data of the image file. by law enforcement, NGOs, businesses and platform providers. When new child sexual A widely used hashing technology is PhotoDNA. It was developed abuse material is found, the image or video is classified as illegal and given a hash specifically to detect child sexual abuse material, and is used today value, a unique digital fingerprint. These fingerprints are added to databases that are by law enforcement, NGOs, businesses and platform providers. used in different kinds of software used to identify child sexual abuse material.
THE TECHNOLOGY ITS USE STRENGTHS AND LIMITATIONS THE TECHNOLOGY ITS USE STRENGTHS AND LIMITATIONS Robust hashing ensures that the input As with binary hashing, PhotoDNA As with binary hashing, robust hashing A binary hash is created by a mathe- Hash values are produced by law Binary hashing is efficient and reliable. data produces a hash value that will classification is made by law technology detects only already known matical algorithm that transforms the enforcement agencies and select Binary hashes are non-reversible and as match any image with the same enforcement and a number of NGOs. and indexed material. However, the data of a file, whatever size it may be, NGOs that work to combat child sexual they will only detect classified material visual content. Like binary hashes, The hashes are added to databases, robust technology is also able to detect into much shorter fixed-length data, abuse. When unknown material is and identical files, the risk that the PhotoDNA hash value cannot be which can be used to match and images that have been slightly altered, a hash value. The hash value acts as found, a hash value is calculated and technologies using binary hashing reversed into an image. detect known child sexual abuse which widens the search. the file’s fingerprint, allowing software added to a database. Specialised will flag the wrong material is material. to find and identify it. software can then run matches extremely low. Whereas two copies of the same The choice of technology always against these databases and look image in different file formats will Law enforcement use PhotoDNA depends on the context and purpose The conversion is arbitrary, however for exact copies of the material on The technology also works very fast. produce completely different binary hashes in the same way that they use of the search taking place. The reason the algorithm always transforms the for example social media sites, and Typically, binary hashing matches hashes, robust hashing technology binary hashes, and web crawlers use why robust hashing is not always used same input data into the same output in IT environments that are protected are almost instant, and detection can detect the image even if a slight both binary hashes and PhotoDNA instead of binary hashing is that it, data. The output data cannot be by detection software. takes up limited processing power. alteration, such as resizing or change hashes when trawling the net. although it is very fast, is slower than reversed or traced back to the original This is crucial for businesses and of file format, has been made. This is binary hash matching. Instead of an input data. This secure feature means Law enforcement agencies use organisations with IT environments because the recognition is based on Unlike binary hashes, robust hashes instant match, the complete image has that an image cannot be recreated hashes to find pertinent material in where speed and processing power the visual content of the image, are more frequently used in environ- to be analysed for a PhotoDNA match, from a hash value. investigations and for evidence are of the outmost importance. rather than the binary file data. ments where detection in real-time which takes more processing power. authentication, while some NGOs and is not of critical importance. Social Therefore, depending on the search, social media companies send out web The limitation of binary hashing media platforms are one example of one or the other, or the technologies crawlers to actively search out known technology is the same as its this. Another is that businesses can combined, might be most effective. material and take actions to remove it. strengths: That it can only detect deploy a secondary and wider robust Businesses and organisations use already known and indexed material. search in their IT environment after detection software to safeguard their Although this limits the scope for binary hashing technology has made IT environment, to comply with policies detection and removal of images, it a match. The robust search then and ethical values and work towards guarantees accuracy as only material scans nearby lying files to search the Sustainable Development Goals. that has been classified by law for nearly identical material. Detection software is also used to enforcement professionals, and protect employees, especially IT nothing else, is detected. professionals, from the risk of being exposed to child sexual abuse material.
54 55 MAPPING OF TECHNOLOGIES MAPPING OF TECHNOLOGIES
Artificial Intelligence/ Keyword Matching Machine learning
Artificial Intelligence, AI, and machine learning is increasingly being used in Keyword matching is widely used in everything from search engines to child sexual abuse investigations, by helping to recognise, categorise and triage online advertising campaigns to media monitoring tools. In the search material. It is a rapidly developing technology, which shows a lot of promise for for child sexual abuse material, its function is to match words or this type of investigative work. Unlike hashing technologies, AI classifiers have phrases, in filenames or in text, that have been listed as suspicious the potential to recognise new and previously unclassified child sexual material. and worth investigating.
THE TECHNOLOGY ITS USE STRENGTHS AND LIMITATIONS THE TECHNOLOGY Keyword matching relies on the quality STRENGTHS AND LIMITATIONS One machine learning technique is AI shows great future potential for AI classifiers are unique in that they Keyword matching in its simplest of the keyword lists, how words have Keyword matching is fast and takes artificial neural networks (ANN), finding, analysing and removing child have the ability to detect previously form is lists of words, phrases or been combined and how relationships up very limited processing power which are based on efforts to model sexual abuse material online. unknown material. This increases the groupings that match directly against between words have been scored. compared to analysis of images. information processing in the human scope for detection, and identification for example filenames, chatlogs, It is also quite easy to get started. brain. The adage is that Artificial AI classifiers are being developed at and safeguarding of previously documents or websites, to identify ITS USE Even a limited keyword list will Intelligence is learning without speed to assist with law enforcement unknown victims. The technology is if they are relevant or not. Files containing child sexual abuse provide value from the start, and the instruction or programming. investigations, and aside from law developing fast, and will continue to material are often named in specific process to refine and build lists to enforcement, industry is also develo revolutionise the fight against online In addition to exact matching, matches ways, hence the importance of make them better is straight forward. ANN are adaptive systems that ping AI applications to detect child child sexual abuse exploitation. can also be case invariant. This means, keyword matches to filenames. change based on external or internal sexual abuse material. One example for example, that even if capital letters They are often combinations of However, keyword matching is also information that flows through the is Google’s AI classifier that can be However, an AI classifier is not a are used, the match will still be made. words, scrambled words or very highly complicated. The quality and network, i.e. the system is learning, used to detect child sexual abuse hundred percent reliable, and it will specific terms used by offenders value of keyword matching is directly and the networks infer functions material in networks, services and make mistakes. It is, in essence, only Next level is fuzzy matching, which to describe certain types of material. related to the quality of the list that from this learning. This is important on platforms. as good as the data that it has been will match even if there are variations, is used. This makes intelligence and in systems where the complexity of provided with. If the data is flawed or made by mistake or on purpose. This Lists of known keywords can be deep knowledge of the subject the data or task makes the design There is also a clear case for too limited, the AI will draw the wrong includes simple spelling mistakes, used by law enforcement to triage necessary, and that much time is or function by hand difficult. businesses and organisations to conclusions, and even with the most letters being switched around, double and identify pertinent material, and needed to maintain a list in order use this technology. When a child high-quality data, it will still make letters, the letter A swapped by platform providers and businesses for it to be effective. As child sexual ANN learn and adapt through sexual abuse image is detected in mistakes. Hence, it still relies heavily with 4, or E for 3 etc. to highlight suspected files. abuse material is rarely a prioritised assessing data, and in order to an IT environment, other files on on human verification to ensure that area, this means that many lists draw the right conclusions they must the device can be searched with the AI classification is right. The match can be further refined by Modern web filters, which are used by are lacking. train on high volumes of quality data. the help of an AI classifier. It is also attaching different values to different most businesses, also use keyword An AI application is only as good as possible to schedule these types of Another limitation is that when an words, and different words in relation matching in a number of ways to look Also important to note is that a match the data on which it has trained. searches in the IT environment. AI classifier makes mistakes, it is to each other. at content and produce a probability does not automatically mean that If the data is flawed the system will usually very difficult, if not impossible, score to determine how likely it is that the file contains child sexual abuse draw the wrong conclusions and to backtrack why it has made a Although not classified as keyword a site contains certain content, and material, it is only an indication, become inefficient, or unhelpful. particular mistake. matching, further development of whether it should be blocked or not. yet the file still needs to be reviewed. This is why, for optimum results textual analysis with AI algorithms (output) it is crucial to have high is used to analyse larger volumes quality data and to structure the of text for semantic summaries, training in such a way that the translations, and correction of system draws the right conclusions. spelling to name a few examples.
56 57 MAPPING OF TECHNOLOGIES MAPPING OF TECHNOLOGIES
Filter Technology Blocking Technology at the ISP Level
Filter technologies are used to protect businesses’ and organisations’ Blocking technologies are built to pick up and block domains and URLs that are IT environments from cyber threats and other harmful traffic. There are known to contain online child sexual abuse material. It can take place on the different types of filtering options, but as a basic rule all filter technologies Internet Service Provider (ISP) level of the internet, where content travels through look at web traffic that passes in and out from IT environments to providers’ networks. In business’ networks, blocking normally takes place through decide what can pass through. These methods work at different layers different filter solutions. Even though blocking on an ISP level does not fit in of a network, which determines how specific the filtering options can be. with standard business precautions when protecting IT environments, it is an important practice in the fight against online child sexual abuse material.
THE TECHNOLOGY The four most common ways in ITS USE Filtering technologies look for suspect which a filtering solution prevents Most, if not all, businesses and THE TECHNOLOGY expensive and can slow down traffic leading to heavy over-blocking. behaviour, surf patterns, links, known web pages from being loaded onto organisations take steps to secure There are five main different blocking through the networks significantly. As a result it is hardly ever used. “bad” domains or specific patterns a user´s device are: their IT environment against a multi- technologies for provider networks. The technology also raises questions in different ways. tude of threats with the help of filter The majority operate using lists of about the users’ integrity and how the ITS USE Blacklists. Lists of websites known technologies. However, whereas sites known to contain child sexual internet should or shouldn’t be policed. Blocking technologies are built to pick Large corporations can have a million to contain malware and viruses. blocking of child sexual abuse is often abuse material. These are compiled by up and block domains and URLs that DNS requests every second. Looking When a request to visit a website included in one way or another in filter different stakeholders, among others URL blocking solutions: are known to contain online child in detail at all that traffic would require matches a blacklisted website, solutions, it is rarely, if ever, the focus INTERPOL and the Internet Watch This is a hybrid of the technologies sexual abuse material. DNS is the most enormous data power. Therefore, the request is denied. of the technology. Foundation. If the blocking solution mentioned above. Instead of analysing commonly used technology, used by instead of one solution trying to do matches a search for a web address all data, this technology looks at many ISPs around the world to protect it all, companies install different Category. Blocks websites that belong STRENGTHS AND LIMITATIONS against the information it has on its specific pages that have been put their networks from being used for solutions that work in layers and to a certain group of websites, such as Filter technologies are only as effective list, the request will be blocked. on a blocking list. The technology criminal purposes. Although this is look at different parts of the traffic. pornographic sites or gambling sites. as the intelligence put into the solu- is scalable, more difficult (although a start, there is much more work to tions – such as the lists of keywords, Domain Name Server (DNS) blocking: not impossible) than DNS to get be done in this area to make sure that DNS Filtering Content filtering. Prevents access or of domains or URLs known to A DNS filtering solution is a specific around and blocks URLs rather than all ISPs block child sexual abuse in DNS filtering checks website requests to items within, for example, an contain harmful material. Keeping type of web filter that operates as a whole domains, allowing for a less their networks, and do it using the against a database of prohibited e-mail or website. The request is those lists up to date requires a lot middleman between a client computer heavy-handed approach. most effective technology. addresses/domains and either allows allowed, but the response is inspected of work and continuous updates. and the web server that it is trying the requested webpage to be displayed at the proxy server to determine if to access. DNS technology is cost Proxys and firewalls: STRENGTHS AND LIMITATIONS or refuses the request. it contains anything meeting Traditional filter solutions focus on effective, but comes with the drawback Blocking lists can also be held in Blocking on a general level is a configured criteria. It is used to security threats such as business that it is easy to circumvent. Further, proxy servers or firewalls. This is somewhat blunt tool as it does not URL filtering block for example viruses, e-mail intelligence, service disruptions, most businesses use their own DNS a technology that is frequently used detect new material or bring new URL filtering is a more sophisticated attachments, advertisements etc. ransomware, fishing etc, and unfortu- and not the ISPs, with the consequence by businesses. The disadvantage intelligence to law enforcement. and granular technology that can nately, child sexual abuse material that most traffic from businesses is to this technology on ISP level, is be used to block access to specific Keyword filtering. Blocks access comes far down the list. As a result, not picked up by DNS Blocking. As it that the quality of traffic will be However, blocking is needed because websites or parts of websites to specific content by keyword filter technologies are used to block blocks on domain level, there is also heavily reduced, and it is expensive large amounts of child sexual abuse known to contain malware. without necessarily blocking access child sexual abuse material, but they a risk of overblocking. as it is difficult to scale down the material is still stored, shared and to an entire category of websites. are less effective than they could be. volume of data that is being looked at. distributed through the open internet Deep Package Inspection (DPI): and on unencrypted websites. This technology has the capability Blocking technologies in of looking at the actual content rather the operators’ router: Blocking covers a large part of the than URLs, and at all the traffic that A cheap and simple solution is the internet, and is very important to flows through the ISPs networks. possibility of operators blocking IP- stop spread of online child sexual It is also very difficult to get around. addresses directly in their own routers. abuse images, and the revictimisation The drawback, and the reason why This is a heavy-handed solution, as it that happens every time an image it is not used much, is that it is will block all pages on the IP-addresses, or film is shared.
58 59 CONCLUSION TECHNOLOGY – A DRIVER OF BOTH PROBLEM AND SOLUTION
Anna Borgström, Chief Executive Officer, NetClean
Technology has developed at an unprecedented speed a double-edged sword. Prior to moving online, child sexual over the past couple of decades. Large parts of the globe abuse was far less discussed and largely confined to the have access to the internet, mobile phones are ubiquitous, dark and murky places of humanity. Today we have the and there is an infinite amount of ways to communicate possibility to detect the crimes and safeguard children. across the web. The possibilities for what we can accomplish online are mind-boggling. There are many different tools to aid this work. There are tools designed specifically to block child sexual As with everything else, technology has also moved child abuse material in Internet Service Provider networks, sexual abuse online. Live-streamed child sexual abuse is and technology that can detect how material is shared one development, and an increasing problem which we in P2P networks. NetClean specialises in technology had not heard of a decade ago. We frequently think about designed to detect child sexual abuse material on laptops it as a crime that happens far away, but this report shows and IT systems belonging to employers of every size. that is happening everywhere, also so right where we are. The police have access to tools ranging from forensic Children across the world are being subjected to sexual programmes that extract data from devices, to pro- abuse online, and their vulnerability when it comes to grammes that sort and analyse the large quantities of live-streamed offences is great. images and videos that occur in criminal investigations.
Technology is now the driving factor behind how material Artificial Intelligence is opening up a whole new world is produced, distributed and stored. All mobile phones of possibilities, and will be a game changer in the fight have a camera, a factor which has markedly influenced against child sexual abuse. However, as with all technology how material is produced, and the almost infinite ways it is not in itself a holy grail. To be truly effective, we have of communicating online drives the dissemination of to also scale already existing technology on all fronts the material. Phones, USB sticks, laptops and external so that we can meet the challenges of today and hard-drives are capable of storing increasingly large tomorrow in a comprehensive way. amounts of data, and in addition there is the possibility to store data online. And while technology is continuing to be refined and developed, the crime of child sexual abuse and the Technology also plays a pivotal role in police investigations. welfare of future generations is also gaining more Examples of that are challenges following E2E encryption importance on political agendas across the world. and built-in encryption, and the difficult nature of This means more recourses, more involvement, investigations on darknet/TOR. and more tangible desire and knowledge to generate real action and efforts to stop child sexual abuse. However, technology is not just a driver of the problem, Technology, knowledge and collaboration is the it also presents solutions to fight it. It is, for better or worse, key to achieve this.
60 61 3,707 CHILDREN SAFEGUARDED FROM SEXUAL ABUSE DURING 2018
The police officers who participated in the survey were asked how many children their unit had safeguarded from sexual abuse in 2018. Together they had rescued 3,707 children.
ACKNOWLEDGEMENTS READ AND DOWNLOAD
We would like to extend our gratitude to the 450 police We would like to thank the businesses that answered THE NETCLEAN REPORTS officers who participated in our research and took the our survey in the US, for taking the time to answer time to share their knowledge and expertise with us. the survey and for providing us with a better The NetClean Report 2019 is the fifth annual report about child sexual abuse The work that they do is invaluable and life changing understanding of how child sexual abuse material crime produced by NetClean. All the reports can be read and downloaded on for each of the 3,707 children that they safeguarded is tackled in large organisations. www.netclean.com. in 2018, and for all children rescued prior to that. Finally, we would like to thank all individuals that About NetClean We also want to direct a big thank you to our sister commented on the report. Your insight and expertise NetClean develops world leading technology solutions to fight child sexual company Griffeye, for asking their customers to provide us with the opportunity to contextualise abuse. Our solutions are used worldwide in business IT environments, participate in the survey on our behalf. and bring further meaning to our research. by large and medium sized businesses, government agencies and public sector organisations. The technology reacts when it detects the digital Thank you! fingerprint of an image or video that law enforcement has classified as child sexual abuse, to keep workplaces free from child sexual abuse material.
62 63 64