According to recently released statistics from ICAC, an agency whose aim is to make the internet safer for children, only 2% of reported child protection cases are investigated in the United States each year. Often the media seize every opportunity to disparage forensics organisations, child protection charities and law enforcement agencies for not coming up with more effective solutions to these cases, but the reality is that the investigation of illicit image distribution is a wide-ranging and complex area, fraught with difficulties.
Digital forensics professionals will undoubtedly come across such cases as part of their general workload. Sometimes a case will begin with an investigator specifically looking for suspicious images, whilst at other times the illicit nature of the images will be discovered in the course of an unrelated process. Regardless of the initial push, however, it is undoubtedly one of the most taxing and time-consuming parts of the job.
Internet Watch Foundation – on the frontline
The Internet Watch Foundation in the UK understands the issues around child protection investigation better than most. The IWF fields reports from the public about illicit imagery around the internet, and has been dealing with potentially criminal internet content since 1997. The organisation receives around forty thousand submissions per year, and manages to deal with around ten thousand of these.
The psychological repercussions of constantly viewing indecent images of children are not to be overlooked. Most of the cases submitted to the IWF involve more than one image, and the vast majority of content is recycled, popping up over and over again in multiple searches. There is perhaps a sense of becoming, if not immune, at least detached over time, purely to be able to deal with the type of content that must be viewed on a daily basis. A quick scan through any forensics forum will verify that many investigators find it ‘wears them down’ over time, and the need for some form of on the job counselling is widely discussed.
Recognising this, the IWF provides counselling sessions once a month for all employees who deal with child protection issues directly, and indeed frequent counselling seems to be standard procedure in many investigative and law enforcement agencies who regularly come across such content.
But it is not only the psychological challenges that create difficulties when dealing with child protection. The sheer volume of images to analyse, the often wide-ranging nature of the perpetrators, and the difficulty of actually identifying victims means that many such cases go unsolved.
Resource challenges
Investigators frequently have to wade through a huge number of images just to understand whether any inappropriate content is actually being consumed. This means that often, forensic organisations simply do not have the man power to scrutinise every file, analysing it for indecency of content, similarities with other cases, profiling of victims, and so on. We caught up with Ken Mizota from Guidance Software and asked what the main resource challenges are when dealing with child exploitation cases.
“Resources to investigate child exploitation cases are quite scarce relative to the volume of material to review”, Mizota remarks. “ We’ve learned from our customers doing live casework that child pornographers are quick to adopt and utilize new technology. If a child pornographer can add to their collection because the storage technology is more affordable, they will. If technology makes it easier to create or publish more child pornography, they will readily use it. As a result, even small cases easily contain hundreds of thousands of images. Not all images are evidence of child exploitation, but buried in the thousands of images, there may be a victim who needs help.”
Forensic software solutions
So what can be done? Unfortunately there is no one-size-fits-all solution. But there are some pieces of software available that can make scanning images easier, which ultimately reduces the size of each caseload from an entire hard drive’s worth of content down to a handful of images that have been marked as potentially relevant. Investigators can then scan through these for illicit content and ultimately decide whether to continue with the line of enquiry.
Companies such as Guidance Software and AccessData are constantly working to improve on these issues from a technological angle. Currently available packages such as EnCase, Image Analyzer and Forensic Toolkit (FTK) will scan a hard drive for images that appear to contain bare skin, for example, and bring back a number of results for an investigator to look into further. Mizota elaborates on the role of software in alleviating the consumption of pictures of child abuse:
“Digital investigation tools can help to not only expose important evidence, but focus the investigator’s precious energies on understanding the data. Sophisticated data recovery, file carving and signature-based detection expose evidence and categorize known content.
In contrast, a signature-based approach can only eliminate known content. Known content means previously identified exploitative material (e.g. images). Law enforcement agencies like DHS and FBI and even Interpol maintain libraries of hashes of previously identified child pornography. This helps them identify material that is being traded/collected.
So, what about the unknown or new? Digital investigation technologies are available that perform analysis of pornographic materials themselves, and do so faster and more efficiently than ever before. Technologies like EnCase, working together with Image Analyzer, focus the investigator’s effort on the most relevant data, to not only make a case, but shed light on unknown victims.”
And what does the future hold for this area of digital forensics? “I think it is safe to say that advances in technology and communications have outpaced investigative capabilities, factoring in tooling and resources. The percentage of cases that can be investigated promptly is increasing, but the volume marches on steadily. Increasing percentages is positive, but as volume grows, the gross amount of unsolved cases or unknown victims also grows.
The success or failure of child exploitation investigations within digital forensics hinges on cooperation and collaboration. Child exploitation is fostered by technology and also crosses borders and all walks of life. The only rational way to solve such problems is by working together across technologies (from hard disk investigation tools, to image and video analysis, to mobile device forensics) and organizations.
First, and I think foremost, there are initiatives underway within law enforcement communities to share information, collaborate on best practices and techniques, and work together in substantive, scalable ways, across municipalities, states, and even countries. These victim identification initiatives bear the promise of increasing the collective knowledge and expertise of child exploitation investigators. Second, organizations like Guidance Software that build technology, will recognize that through collaboration, and working together, such diverse mutagenic problems can be solved. EnCase and Image Analyzer working together are examples of this approach: Two leading technologies, that both excel at what they do, collaborating to make the work of investigators less laborious and more productive.”
A growing problem
Just how large a problem is the sharing of indecent images of children in the modern age, though? A recent article from the BBC notes that the consumption of pictures of child abuse is at an all-time high. Peter Davies, the director of the Child Exploitation and Online Protection Centre (CEOP), estimates that around fifty thousand people in the UK alone will possess indecent images of children this year, and that 81% of the children featured will be under the age of ten. In the USA, PROTECT’s latest figures show that 300,000 people are trading indecent images of children at any one moment.
Sobering statistics indeed. And according to those who work in the field, the problem only seems to be growing, thus making it even more important for new forensics software packages to take indecent image analysis into consideration. Of course, no piece of software is infallible, and it is possible for files to be missed during a search, but this could just as easily happen with human error, and at least the option of not searching an entire hard drive manually is now open to investigators in digital forensics cases.
