Among the challenges facing digital forensic investigators today, the instantaneous nature of online communication is arguably one of the most persistent. Trying to investigate whether a crime has occurred, and if so to bring its perpetrators to justice in a space that is constantly changing, is no simple task. With the Apple App Store alone reportedly growing by up to 1,000 applications per day, keeping up to date with the necessary methods of communication becomes increasingly difficult.
Just in the past twelve months, there have been instances of paedophiles using within-game messaging services to groom youngsters, as well as the wave of recent discussion regarding Isis’ purported use of encrypted messaging app Telegram to communicate.
For those whose specialism is investigating crimes against children, there is another element of online life that makes the job even more challenging: live streaming.
In a report published by the Child Exploitation and Online Protection Centre (CEOP) in early 2013, the live streaming of images and videos depicting children being abused in real time was described as an emerging trend. The report attributes this to a number of factors, including increasing high-speed internet penetration in developing nations; the availability of relatively cheap hardware such as webcams; and a “vast and comparatively wealthy overseas client base.”
The demand for images and videos of child abuse existed long before the internet entered our homes, but there is no denying that the speed of modern communications and the proliferation of cheap, easy to use devices through which relatively anonymous files and messages can be shared is providing easier access to child abuse images and spreading the problem quicker and further afield than ever before.
The internet allows for unprecedented growth in various other fields of communication, too. While in some respects this is undeniably a positive thing – we have more access to worldwide news than ever before, and people in oppressive political regimes have more of a chance to communicate with the rest of the world – it also means that the less savoury online trends enjoy the same chances of expedited growth.
By the time the Europol Financial Coalition Against Commercial Sexual Exploitation of Children Online released their 2014 report – just a year after the CEOP paper quoted above – live streaming in exchange for payment was “no longer an emerging trend but an established reality.”
So what can be done? First of all, we asked Julia Davidson, Co-Director of the Centre for Abuse & Trauma Studies at Middlesex University, to outline some of the main challenges live streaming presents for law enforcement.
“There is currently no good empirical research in this area, so my response is based on anecdotal evidence and information from law enforcement experience. The EFC (European Financial Coalition Against Commercial Sexual Exploitation Online) report that was published in 2014 [stated] that indecent child images have become a currency in their own right and that offenders are increasingly using the dark web and bitcoin to avoid detection.
A challenge also facing law enforcement is the increased use of live streaming to share video [content] of child abuse. Unfortunately live streaming is much more difficult to discover once the stream has ended, and a fast response from law enforcement is necessary. The streaming is often not recorded, making it a form of real time abuse and also ensuring that no evidence remains.
The National Crime Agency in the UK recently undertook an operation that resulted in a sex offender ring, which streamed live sexual abuse of children, including 11 from the Philippines, some as young as six, being dismantled. Challenges in this area include the sad fact that some parents/families allow or enable the abuse for payment, the victims are often from poorer countries and offenders are willing to pay a great deal for the abuse. In this case over £37,000 was paid and 12 countries were involved in the arrest of the offenders.
An additional challenge in identifying and disrupting such rings is that the real time monitoring of streams presents policing, legal and technical challenges particularly across many geographical and jurisdictional boundaries, as offenders use many layers of anonymity online, encryption and multi-passwords, and in this way are often able to avoid detection.”
Devon Ackerman, a Supervisory Special Agent at the FBI, agrees:
“We can’t solve every untold story. In my mind, I think of Hollywood and its production of action movies. We all can think of a movie scene where the “good guy” is locked in a room, or tied to a chair, and is forced to watch as a family member or a friend is tortured. The “good guy” is a defenseless and helpless observer. In the end, even Hollywood understands the normal balance that we innately seek as human beings and the actor escapes, takes their “revenge,” brings satisfaction to the viewing audience, and an end to an imagined storyline.
In real life, those of us in Law Enforcement that have devoted our energy and mental well-being to rescuing innocence lost face a crippling realization that we can’t save them all. We can’t find them all. We can’t identify them all. Don’t misunderstand me – Law Enforcement is passionate, determined, and at times, extremely successful in rooting out child abusers as well as creators and possessors of child abuse material (18 U.S. Code § 2251 and 2252), but as technology advances, so do the means which criminals use to avoid detection.”
All is not lost, however. While it may not be possible to set up and coordinate an international investigation quickly enough to prevent further abuse in real time – that is, while the streaming is actually taking place – it is highly unusual for abusers to simply watch live streamed content without saving any of it on their local machines. The most effective way to combat such crimes is therefore often through analysing collections of child abuse material seized from suspects’ computers, and comparing this against images that are already known to the authorities. In this way, evidence of new abuse images and videos can be collated, and law enforcement agents can then focus on identifying the children involved and ultimately removing them from harmful situations.
But this is easier said than done. The concept of “known images” is a common discussion point at child protection conferences. There are some sets of images that are seen time and time again by investigators; often these have been circulating for many years. With certain sets like these, investigators know who the victims are, and sometimes the original perpetrators have already been brought to justice. These are the “known knowns”. Other images are familiar and are seen fairly frequently, but the victims or perpetrators are not known. These are the “known unknowns”. In the case of preventing further live streaming of child sexual abuse online, however, what investigators need to find and analyse are the “unknown unknowns”.
An “unknown unknown” is an image that is not known to investigators, and has therefore probably not been circulating in child abuse circles for very long. Some of these will be taken by the perpetrators themselves, and will depict their own family members or children to whom they have access. However, others may be screenshots or downloaded images from live streamed child abuse which has been made to order.
To consumers and sharers of such content, having access to never before seen images is very useful. As investigative methods have improved over the years, so too have criminals’ methods of evading detection become increasingly sophisticated. Nowadays, in order to access some of the more hardcore and niche content in the child abuse sharing community, new members are often required to share an image that has not been previously seen by others in the space. The idea behind this is that law enforcement agents will understandably not want to promote or share images of child abuse, including (and perhaps especially) those that are not widely known, and therefore the likelihood of any new member being an undercover investigator decreases.
This does mean, however, that for those who have no direct access to children and who cannot create their own new images, live streaming is becoming an increasingly popular way to source content depicting new victims of abuse.
But how do law enforcement agents work out whether an image is an “unknown unknown”? After all, while police forces have reported seizures of up to two and a half million images in a single collection, not all investigators will have seen all the images. It is unrealistic to rely on human memory to work out whether an image has been seen before.
Image hashing is a common way of classifying depictions of child abuse, as well as categorising images of other crimes and of innocuous content. It is relatively straightforward for an investigative team to hash the images they collect and use these hash values to verify the content of files seized from new devices.
Devon Ackerman elaborates:
“Hashing identification systems within law enforcement circles have allowed investigators to more quickly identify where child exploitation material may be sequestered on a storage device and may even assist with initial legal processes. Rare, if not non-existent, are situations where entire cases are solved with image hashing lists, but the workloads are reduced with a properly used hash list.
If we recall from our college info. tech classes, hashing is simply a mathematical algorithm used in computer forensics for “digital fingerprinting” purposes, i.e., taking a variable length of digital information (data) and representing it with a fixed length value (e.g., hash). Any single-byte alteration to the original results in new fixed length value. With modern operating systems and Web 3.0 applications, the process of applying visual effects to images (adjusting brightness or contrast or adding a black square to obscure a face), resizing an image (1920×1028 -> 1024×768), and image or video compression techniques all result in a new underlying data structure and a new hash for arguably identical or near-identical content (as observed by the naked eye).
The separate highlighted problem of diverging hashes from techniques applied to data when creating copies of it is being addressed with image comparison, facial recognition, and skin tone detection technologies that the private sector and other groups are developing.”
Another challenge comes when crimes take place across different jurisdictions. Many criminal activities are not localised to a single territory, and the live streaming of child abuse is one such crime.
Operation Endeavour began in 2012 and to date has seen the arrests of individuals from twelve countries. The majority of the child abuse content was actually being created in, and streamed from, the Philippines, but most of the consumers of the content were based in the Western world. The operation required the joint efforts of the UK’s National Crime Agency, Australia’s Federal Police, and the US’ Immigration and Customs Enforcement teams.
Such large-scale projects require large-scale budgets and a huge amount of investigators’ time, but Ackerman holds out hope for increasing international investigations:
“We are presented with a couple of obstacles regarding cross-border matters stemming from differing laws between countries and governing structures as well as financial (cost of investigations) considerations. There are also the investigative priorities of Agencies involved and the strained ranks of smaller countries and their governments.
I have been in meetings with representatives from other countries discussing matters related to how my organization executes Digital Forensics processes and when I mention that we have hundreds of examiners across the whole of the enterprise, I am met with looks of amazement because their whole country’s worth of certified and trained expertise is sitting at the conference table with me! All of the aforementioned factors need to align for a mission to move forward in a timely manner, but in the end, a passion for the work and a passion to succeed are a must.”
In summary, then, the live streaming of child sexual abuse is a growing problem, and one that is not easily investigated. However, progress is being made; advances in “fuzzy hashing” algorithms, which allow investigators to compare different images and see what percentage of the content is similar, are one way in which the field is moving forward. International cooperation on child protection investigations is also allowing investigators to uncover more evidence than ever before, and it can only be expected that as time moves on, methods of solving large-scale child protection cases will continually be developed.
All opinions stated by individuals quoted in this article are their own and do not necessarily reflect those of their employers.