IWF Operational Trends 2009
The nature, number, and profitability of child sexual abuse images on the internet is the subject of much speculation. In fact this content represents an extremely small proportion of internet content but it still remains a very serious challenge. Since 1996 we have managed almost 300,000 reports and have over 13 years’ experience tracking and understanding the technologies, trends and movements behind the websites.
This is an extremely fast-moving environment. Tactics that had an impact two years ago are obsolete today. The technologies used to distribute criminal content are developing as are the methods used and so to predict the challenges of the future is difficult. National police agencies have finite resources to carry out long-term investigations into large-scale global activities which span multiple jurisdictions, borders, and continents so it is essential that everyone who has a desire to make the internet a safer place works together to tackle the problem.
The UK approach is grounded in partnership and self-regulation. The most effective way to combat criminal content on the internet is to work closely with the wider online industry and law enforcement agencies as well as with the support of government. It is also crucial to work beyond national borders with international partners.
There are a number of tactics which are already having an effect in minimising the availability of this content and which, if adopted on a global scale could help ensure the international internet community’s response to these crimes is more effective, faster and a better deterrent.
The 2009 trends include information on the following issues:
- Reports
- Content removal
- The UK situation in 2009
- Volume worldwide
- Location
- Case study: Commercial demand
- Commerciality
- Brands
- Hosts and hacked websites
- Spam
- Top level domains
- Severity and age
- Free hosting
- International partnership
- International removal
- Law enforcement
- National challenges
- Global challenges
During 2009 our Hotline team processed 38,173 reports, a 12% increase as compared to 2008. The vast majority of these complaints were from the public but also included leads developed by our analysts and information from our partners.
Figure 1 presents the breakdown of reports processed by category and the number in
each category that were assessed by our analysts to be within remit and likely to breach UK law. 23% of all reports concerned content which we assessed as criminal child sexual abuse material.
Almost all the content reported to us as allegedly criminally obscene adult content was either not hosted in the UK and therefore outside our remit, or was assessed by us not to contravene the Obscene Publications Act 1959 and 1964.
Any potentially criminal incitement to racial hatred content reported to us was found to be hosted abroad and therefore outside our remit or unlikely to contravene our laws.
As there is little international consensus regarding criminally obscene adult content or incitement to racial hatred content we have no international partnerships in place to further this aspect of our work. We can only take action when UK hosting services are being abused for the distribution of such content to help the internet industry prevent its services being used for criminal purposes.
Figure 1: Total reports processed and proportion considered potentially criminal, category
Content removal
As a result of the reports assessed, traced and considered by our analysts, 42 instances of online content on websites hosted in the UK were taken down during 2009 following notices from the IWF. All of the notices were complied with within a day:
As a result of the reports assessed, traced and considered by our analysts, 42 instances of online content on websites hosted in the UK were taken down during 2009 following notices from the IWF. All of the notices were complied with within a day:
- 40 child sexual abuse content notices were issued under the Protection of Children Act 1978
- 2 criminally obscene adult content notices were issued under the Obscene Publications Act 1959 and 1964
- 0 incitement to racial hatred notices were issued under the Public Order Act 1986
73% of the 40 notices were for images of children under 11 years old being sexually abused; 44% for images depicting the rape of a child. The IWF assesses child sexual abuse images according to levels set out by the Sentencing Guidelines Council.
The UK situation in 2009
Our work in partnership with the internet industry and the police in the UK continues to ensure UK networks are rarely exploited by those seeking to distribute criminal content within our remit and is a real example of an enduring success.
Our work in partnership with the internet industry and the police in the UK continues to ensure UK networks are rarely exploited by those seeking to distribute criminal content within our remit and is a real example of an enduring success.
The criminal content hosted in the UK varied from a collection of child sexual abuse images on a social networking website to non-commercial videos uploaded to a file hosting website and a commercial operation advertising child sexual abuse videos on a free hosting service.
Child sexual abuse images were hosted in the UK on 40 occasions during 2009. All of the hosting providers concerned were alerted by the IWF and the content was swiftly removed, with evidence preserved for investigation by the police.
Volume worldwide
During 2009, we took action to report 8,844 instances of child sexual abuse content around the world. Each of these actions regarded an individual web page or URL. The URLs were identified on 1,316 different domains. As shown in Figure 2 the number of URLs with child sexual abuse content known to us has remained fairly stable for the last three years however the overall number of domains on which this content is found has decreased by 57% since 2006 as the overall domains used for such purposes shift platforms and consolidate. This trend must be understood in the wider context of changes in the dynamic way in which such images are distributed, that is, often randomly generated, opportunistic and hosted on legitimate web services.
During 2009, we took action to report 8,844 instances of child sexual abuse content around the world. Each of these actions regarded an individual web page or URL. The URLs were identified on 1,316 different domains. As shown in Figure 2 the number of URLs with child sexual abuse content known to us has remained fairly stable for the last three years however the overall number of domains on which this content is found has decreased by 57% since 2006 as the overall domains used for such purposes shift platforms and consolidate. This trend must be understood in the wider context of changes in the dynamic way in which such images are distributed, that is, often randomly generated, opportunistic and hosted on legitimate web services.
Almost half the sexual abuse content URLs identified were located on 14 hosting providers with two providers each hosting 7% of the total 8,844.
Figure 2: 2006-2009 Child sexual abuse URLs and domains, worldwide
Location
There is general international consensus regarding the definition of child sexual abuse material and we work in partnership with INHOPE, the International Association of Internet Hotlines, and with 35 Hotlines around the world to combat the distribution of these images and videos. This means that details of child sexual abuse content hosted outside the UK can be passed immediately to the Hotline in the country whose hosting services appear to have been abused, so the website can be investigated by the relevant national authorities within their own judicial procedures. Where no authorised Hotline exists we pass details of child sexual abuse websites to the law enforcement agency in that country via our law enforcement partner agency the Child Exploitation and Online Protection (CEOP) Centre.
There is general international consensus regarding the definition of child sexual abuse material and we work in partnership with INHOPE, the International Association of Internet Hotlines, and with 35 Hotlines around the world to combat the distribution of these images and videos. This means that details of child sexual abuse content hosted outside the UK can be passed immediately to the Hotline in the country whose hosting services appear to have been abused, so the website can be investigated by the relevant national authorities within their own judicial procedures. Where no authorised Hotline exists we pass details of child sexual abuse websites to the law enforcement agency in that country via our law enforcement partner agency the Child Exploitation and Online Protection (CEOP) Centre.
Those countries whose internet services are exploited for the distribution of child sexual abuse content are often those with advanced technological infrastructures; whose internet services are of a high standard; and who offer a range of flexible hosting services. Figure 3 portrays the distribution of child sexual abuse URLs known to the IWF during 2009 around the continents of the world.
The dynamic nature of child sexual abuse content on the internet means some websites move hosting provider and hosting country regularly to avoid detection and removal. This produces a volatile geographical representation.
Figure 3: Confirmed child sexual abuse reports by location (continent) of hosting provider
Case study: Commercial demand
There remains a demand for access to child sexual abuse content via publically available commercial websites. These websites are often highly dynamic and have a persistent presence on the global internet. One such website was hosted briefly in the UK during 2009 before being removed. During the few days it was available on UK networks the website received requests from over 25,000 unique IP addresses worldwide, including requests from mobile internet accounts and gaming platforms. Appropriate action has been taken by the IWF and its partner agencies with regard to this activity.
There remains a demand for access to child sexual abuse content via publically available commercial websites. These websites are often highly dynamic and have a persistent presence on the global internet. One such website was hosted briefly in the UK during 2009 before being removed. During the few days it was available on UK networks the website received requests from over 25,000 unique IP addresses worldwide, including requests from mobile internet accounts and gaming platforms. Appropriate action has been taken by the IWF and its partner agencies with regard to this activity.
Commerciality
The commercial nature of online child sexual abuse content is complex. For example, we increasingly see images which supply commercial websites being hosted remotely from the main site and distinct from any payment mechanism. The increasing abuse of legitimate online services such as image sharing websites and free hosting platforms by commercial distributers means that established ‘brands’ known to us no longer retain all aspects of the purchase process within their main website. As a result commerciality may be less explicit at various points in the online journey than before.
The commercial nature of online child sexual abuse content is complex. For example, we increasingly see images which supply commercial websites being hosted remotely from the main site and distinct from any payment mechanism. The increasing abuse of legitimate online services such as image sharing websites and free hosting platforms by commercial distributers means that established ‘brands’ known to us no longer retain all aspects of the purchase process within their main website. As a result commerciality may be less explicit at various points in the online journey than before.
We are working closely with law enforcement officers to help them investigate the supply and demand for this
content.
content.
Brands
It has been apparent for a number of years that certain websites operate collectively; moving together across hosting providers in different countries. Many frequently change the URLs associated with their websites as well as their image stores and online payment mechanisms. Whilst this transient and apparent chaotic activity is intended to complicate the disruption of their operations, we have tracked the ‘brands’ and their movements.
It has been apparent for a number of years that certain websites operate collectively; moving together across hosting providers in different countries. Many frequently change the URLs associated with their websites as well as their image stores and online payment mechanisms. Whilst this transient and apparent chaotic activity is intended to complicate the disruption of their operations, we have tracked the ‘brands’ and their movements.
In analysing 2,828 commercial child sexual abuse reports we identified 461 unique brands. The ten most prolific brands alone accounted for 660 unique URLs, with the most prolific having 102 different URLs involved in the distribution of its brand of images over the year.
This sort of detailed analysis is helpful in judging the scale of the problem, that is, 38,173 total reports processed; 8,844 confirmed child sexual abuse URLs; 461 identifiable brands being run as businesses to profit from the sexual abuse of children.
Hosts and hacked websites
We often witness commercial operations using legitimate hosting providers or innocent websites which have been hacked for different parts of their ‘business’, for example, as image and video stores; as redirector advertising pages; and for their main website. The owner of a hacked website and the company providing the hosting services are likely to be unaware of the presence of such content.
We often witness commercial operations using legitimate hosting providers or innocent websites which have been hacked for different parts of their ‘business’, for example, as image and video stores; as redirector advertising pages; and for their main website. The owner of a hacked website and the company providing the hosting services are likely to be unaware of the presence of such content.
These hosting patterns are often transient and may be accompanied by a spam email campaign advertising the location of the images. Of course, innocent internet users will also receive unsolicited spam messages and this results in complaints to our Hotline.
We identified 286 instances of innocent websites being hacked to facilitate the distribution or sale of child sexual abuse images and were therefore unknowingly assisting criminal commercial operations.
We maintain an up-to-date spam list in the reporting section of our website to enable the public to check whether we are already aware of a particular spam email. This facility reassures the public that the appropriate action has been taken whilst minimising the duplication of our efforts. Nevertheless, during 2009, we dealt with 383 reports from the public regarding emails allegedly containing or linking to such content.
Top level domains
The top level domain (TLD) of a website is the end part of the domain name that follows the last full stop. For example www.iwf.org.uk uses ‘uk’ which is the UK country code TLD (ccTLD). Generic TLDs (gTLD) are not countryspecific i.e. ‘com’, ‘net’, ‘org’, and ‘biz’. All the gTLDs and ccTLDs which feature in Figure 4 are open to anyone to register domain names with.
The top level domain (TLD) of a website is the end part of the domain name that follows the last full stop. For example www.iwf.org.uk uses ‘uk’ which is the UK country code TLD (ccTLD). Generic TLDs (gTLD) are not countryspecific i.e. ‘com’, ‘net’, ‘org’, and ‘biz’. All the gTLDs and ccTLDs which feature in Figure 4 are open to anyone to register domain names with.
Companies providing domain names may permit registration without the verification of any personal details such as name and address therefore identifying those responsible for the distribution of child sexual abuse images is much more difficult for law enforcement agencies.
We work with the UK domain name registry, Nominet, to minimise the abuse of the ‘uk’ domains. Afilias is also a member of the IWF and operates the ‘info’ gTLD and they work in partnership with us to minimise the abuse of their registration services. We also work with some of our partner Hotlines in this area and those efforts have resulted in successes in the deregistration of domains by the registrars
involved.
involved.
As presented in Figure 4, over 60% of the 8,844 child sexual abuse URLs identified in 2009 are registered on two TLDs which are maintained and administered by two registries; and 80% by seven.
Figure 4: The top level domains most often used for distribution of child sexual abuse content in 2009
Severity and age
As we better understand the scope and scale of the problem by quantifying information and trends we are also very mindful of the fact that behind every statistic is a child that has been sexually exploited or abused.
As we better understand the scope and scale of the problem by quantifying information and trends we are also very mindful of the fact that behind every statistic is a child that has been sexually exploited or abused.
Our analysts concentrate their efforts on assessing, tracing, and sharing intelligence about images and videos depicting the real sexual abuse of real children. Any image depicting sexual activity involving a child is a criminal record of a sexual assault and the publication, distribution, downloading, or viewing of that content is an offence under UK law.
It remains the case that many of the children we see being sexually abused in images are young and are being subjected to severe levels of abuse.
72% of the child victims appear to be between the ages of 0 and 10; 23% six years old or under; and 3% two years or under.
44% of images depict the rape or torture of the child.
Free hosting
Our analysts have seen a trend in the abuse of free hosting services for the distribution of both commercial and non-commercial child sexual abuse content.
Our analysts have seen a trend in the abuse of free hosting services for the distribution of both commercial and non-commercial child sexual abuse content.
Free hosting services allow users to create their own websites and host them without charge; to share photos and videos with online communities; to upload and store large volumes of visual media; or to post images to interactive spaces such as blogs, forums, message boards, and profiles; as well as a range of other online tools.
As some mainstream free hosting providers limit the amount of content which can be uploaded, there has been a significant growth in free hosting services which are solely dedicated to image and video hosting and storage. Such companies provide a legitimate service to many internet users and are easy to use; often requiring little in the way of verifiable personal details or identification procedures. Images hosted or stored in these areas are used to supply known commercial child sexual abuse websites as well as for storage and sharing amongst online communities with a particular interest in such content. In order to share and sell this content those responsible will often promote the exact URL link to their images to their ‘community’ on bulletin boards or in discussions forums.
We carried out a detailed analysis of 300 websites most used for storing or distributing child sexual abuse images. 154 of these (51%) offered free website hosting or free image sharing services which were used for criminal purposes.
This sample analysis indicates that over half of the child sexual abuse content we identify is found on a range of legitimate free hosting services. Our sample also reveals the types of such services used for both commercial and non-commercial content: see Figure 5.
These online services can be vulnerable to exploitation for the storing, sharing, and sale of child sexual abuse images and videos on the internet and we work closely with our member companies who offer such services to help prevent the abuse of their networks and to support their development of new technologies in this area that are more hostile to such abuse.
Figure 5: Most abused free hosting services during 2009 for child sexual abuse images
International partnership
Our partnership with INHOPE Hotlines around the world is crucial in terms of information sharing and the ability to take swift action to combat child sexual abuse content. Every image or video we trace to a country outside the UK is immediately passed on for investigation by the relevant authorities in the hosting country.
Our partnership with INHOPE Hotlines around the world is crucial in terms of information sharing and the ability to take swift action to combat child sexual abuse content. Every image or video we trace to a country outside the UK is immediately passed on for investigation by the relevant authorities in the hosting country.
For example, we received a report from our Hotline partner in Canada, Cybertip.ca, about a one minute long video file depicting the sexual exploitation of a boy which they believed to be hosted in the UK. We confirmed the location of the video to be hosted in the UK at the time of assessment: a free hosting portal offering image, video, and audio sharing.
Within an hour of the report being processed, we had liaised with CEOP and the free hosting provider, the content had been removed and preserved as evidence for investigation, and cybertip.ca were advised that action had been taken to disable public access to the video.
International removal
We have operated a successful national ‘notice and takedown’ scheme to remove child sexual abuse content on UK networks since 1996 and have, for many years, advocated the benefits of such arrangements around the world. However, we still have concerns about the length of time some websites distributing images of children being sexually abused remain available around the world so we have been considering ways in which to speed up the removal of these images outside the UK, in collaboration with our international partners. We are very pleased to have been granted funding by the Nominet Trust to develop this work.
We have operated a successful national ‘notice and takedown’ scheme to remove child sexual abuse content on UK networks since 1996 and have, for many years, advocated the benefits of such arrangements around the world. However, we still have concerns about the length of time some websites distributing images of children being sexually abused remain available around the world so we have been considering ways in which to speed up the removal of these images outside the UK, in collaboration with our international partners. We are very pleased to have been granted funding by the Nominet Trust to develop this work.
We look forward to adopting a more direct approach towards the international removal at source of potentially criminal child sexual abuse content by fostering relationships with internet service providers and hosting providers outside the UK so that, in partnership with their relevant national authorities, we can alert them to the abuse of their own networks for the distribution of child sexual abuse images as quickly as possible.
Law enforcement
New partnerships between the IWF and police continue apace whilst we strengthen existing law enforcement relations. Our Hotline team meet on a regular basis with their police colleagues to share expertise and intelligence as well as for the reciprocal provision of specialist training and to consider opportunities for investigation.
New partnerships between the IWF and police continue apace whilst we strengthen existing law enforcement relations. Our Hotline team meet on a regular basis with their police colleagues to share expertise and intelligence as well as for the reciprocal provision of specialist training and to consider opportunities for investigation.
We supported police investigations with a total of 11 evidential statements in 2009. We provided specific intelligence to the police for investigation on 80 occasions and continue to refer a growing number of images and videos to CEOP when we establish the existence of specific detail from which their experts may be able to identify victims in the UK or abroad. We have liaised directly with 43 different police forces and national UK police agencies during the year in order to support potential or current investigations. In one noteworthy case which culminated in December 2009 a UK man was jailed for two years for distributing indecent images of children. A statement and intelligence from the IWF supported this investigation and helped lead to a successful prosecution.
As the majority of the content we deal with has no explicit UK link and is hosted overseas, we have strong intelligence sharing arrangements with Hotlines and police forces around the world. During the year we have assisted with ongoing investigations in many countries including the US, Egypt, and France.
2009 has seen the IWF join the European Financial Coalition (EFC) Law Enforcement Working Group. The EFC is a CEOP led, Europe-wide, multi-agency approach to the investigation and disruption of commercial websites selling child sexual abuse content and the criminals behind these networks. The working group consists of law enforcement representatives from amongst 27 EU member states alongside the IWF and we are committed to the provision of intelligence and analysis to facilitate the investigative activity of our EFC colleagues.
National challenges
To establish and support a Hotline which specialises in combating online child sexual abuse content using tactics which include:
To establish and support a Hotline which specialises in combating online child sexual abuse content using tactics which include:
- Operating a national ‘notice and takedown’ system to swiftly remove child sexual abuse content at source
- Operating a free and anonymous reporting mechanism for the public to report their exposure to potentially criminal child sexual
abuse content - Working in partnership with the national internet industry and with the support of government and law enforcement
- Working with national domain name registries and registrars to remove domain names persistently distributing child sexual
abuse images - Participating in international partnerships to share data, intelligence, and tactics in order to combat the cross-border nature of these crimes
- To support and inform the establishment of a global law enforcement body to work with international Hotlines and the internet industry which is solely dedicated to investigating child sexual abuse websites
- To support the development of international ‘notice and takedown’ systems to better enable the swift removal of criminal content at source
- To establish a universal procedure for swiftly deregistering domain names dedicated to selling child sexual abuse images
- The promotion of end-user filtering software to provide a safer internet
- To consider network level URL-specific blocking to prevent accidental access to child sexual abuse content whilst processes to remove it are in progress
- To support the harmonisation of national legislation to include serious penalties for the online distribution, downloading, and
possession of child sexual abuse images - To inform international debate and policymaking on how to prevent the abuse of new technologies for the sexual exploitation of children and to support initiatives designed to combat this abuse
