IWF Operational Trends 2012
The IWF uses a bespoke database to collect and interrogate our statistics in order to provide world-trusted information on the prevalence and trends relating to the online criminal content we tackle. The following information relates to the statistics and trends identified during 2012.
Reports
Our Analysts assess reports which are made through iwf.org.uk. The severity of the sexual abuse in reported images and videos is assessed, along with the age of the child victims and the location of the files which dictates the removal method. Criminally obscene adult content and non-photographic images of child sexual abuse are firstly traced to the host country and such files hosted in the UK are within our remit and can be removed.
39,211 reports were processed and9,702 of these (25%) were confirmed as containing potentially criminal content within our remit. Of 39,211 reports:
- 38,891 reports of content on webpages;
- 306 reports of newsgroups;
- 14 reports of other types of off-remit content;
- 82% of people reported anonymously through our secure and confidential reporting facility on our website.
A text description of this chart is available below.
|
|
2012 |
2011 |
|
% of reports made to the Hotline believed to contain child sexual abuse material |
91 |
90 |
|
% confirmed as potential child sexual abuse content by IWF Analysts |
27 |
35 |
Of 35,821 reports alleging child sexual abuse content, 9,696 were confirmed as such by IWF Analysts. This figure includes website and newsgroup content.
All child sexual abuse content
|
All child sexual abuse content analysed by IWF |
2012 |
2011 |
|
% of child victims appearing to be 10 years or under |
81 |
74 |
|
% of depicting sexual activity between adults and children including rape and sexual torture |
53 |
64 |
|
% of images where victims were girls |
75 |
65 |
|
% of images where victims were boys |
10 |
26 |
|
% with both genders |
11 |
8 |
Note: A small number of the victims were unidentifiable as male or female.
Figure 2 shows the number of domains abused for the hosting of child sexual abuse content since 2006. For example, for domain analysis purposes, the webpages of…
- www.iwf.org.uk,
- www.iwf.org.uk/report,
- www.mobile.iwf.org.uk/report, and
- www.iwf.org.uk/about-iwf/news
…would have been counted as one domain i.e., iwf.org.uk. In 2012, 9,550 webpages contained child sexual abuse and these were hosted on 1,561 domains worldwide. (This excludes newsgroup content).
A text description of this chart is available below.
The 9,550 webpages hosting child sexual abuse content were traced to 38 countries. Five top level domains (.com .ru .net .org .in) accounted for 87% of all webpages identified as containing child sexual abuse content. One click hosting websites, where the user is able to upload an entire folder with one click of the mouse, were most likely to be abused with 60% of child sexual abuse content found here. They are also known as weblockers or cyberlockers.
Child sexual abuse content: UK trends and removal
Notice and takedown
We believe the most effective way to eliminate child sexual abuse content is to remove it at its source.
Therefore, our notice and takedown service is central to this. When child sexual abuse images and videos are hosted on a UK network, we issue a notice to the hosting provider and the content is taken down quickly – typically within 60 minutes. We do this in partnership with police to ensure evidence is preserved.
In 2012 we took action regarding 9,550 instances of publicly available child sexual abuse content hosted on websites around the world. We issued 35 notices to remove content hosted in the UK on 73 webpages. This relatively low number continues to show how the online industry is dedicated to making the UK a hostile environment to host such criminal content.
Content removal in minutes
We work to ensure that criminal content hosted in the UK is removed as quickly as possible. We can only do this in partnership with the online industry. Due to the increasingly rapid responses to takedown notices, we are now measuring removal time in a matter of minutes, rather than weeks or days.
A text description of this chart is available below.
- 56% are removed in 60 minutes or less.
- 78% are removed in 120 minutes or less.
|
UK hosted child sexual abuse content |
2012 |
2011 |
|
% of child victims appearing to be 10 years old or under |
79 |
65 |
|
% showing sexual activity between adults and children including the rape and sexual torture of the children |
51 |
62 |
Members and non-members
Of the 73 child sexual abuse webpages hosted in the UK in 2012, 58 (79%) were hosted by companies which are not Members of IWF (green line).
We regret that a text description of this chart is unavailable.
Those same companies take longer to remove the criminal content.
Criminals distributing child sexual abuse content appear to gravitate towards companies which do not have IWF membership.
Child sexual abuse content: International trends and removal
INHOPE/law enforcement
After a report has been confirmed as child sexual abuse content and has been traced to a location outside the UK, the data is uploaded to the INHOPE database (where there is an INHOPE Hotline in the host country) or the country’s police are notified. This enables the removal process to begin internationally.
9,477 reports were assessed as webpages hosting child sexual abuse content outside of the UK.
93% of all content actioned in 2012 and 2011 was hosted in a country with an INHOPE Hotline. 26 URLs were hosted within hidden services. These are explained on page 17 of the 2012 Annual Report.
We use at least three methods to trace the location of child sexual abuse content to determine the geographical location of the server on which it is hosted at the time of assessment. This enables us to pass the details immediately to the relevant Hotline or law enforcement agency, or take action ourselves in collaboration with the company whose services are being abused.
A text description of this chart is available here.
|
Child sexual abuse content hosted outside UK |
2012 |
2011 |
|
% of the child victims appeared to be 10 years old or under |
81 |
74 |
|
% showed sexual activity between adults and children including the rape and sexual torture of the children |
53 |
67 |
Simultaneous alerts
These are designed to significantly reduce the length of time child sexual abuse content is hosted outside of the UK by providing an alert to companies hosting abroad. IWF can alert the hosting company to the presence of child sexual abuse content at the same time as notifying the country’s INHOPE Hotline. Alerts are available to IWF Members and non-members hosting content outside the UK.
UK and global webpage removal times
We work quickly in the UK to remove child sexual abuse webpages, as shown in Figure 7 where we can analyse the speed of industry reaction in minutes. Since 2010 we have challenged ourselves to speed up the removal of child sexual abuse webpages across the globe by chasing up the removal of content hosted abroad.
We regret a text description of this chart is not available.
The pink line tracks the time taken to remove all UK hosted child sexual abuse URLs and measures time from the point a notice and takedown is issued.
The blue line tracks the time taken to remove all non-UK hosted child sexual abuse URLs and measures time from the point that we have referred the content to either the INHOPE database (where it’s hosted in a country with an INHOPE Hotline) or referred direct to law enforcement in a country without a Hotline. This happens after we have made an assessment to determine if the content is potentially criminal.
Where the content is referred to the INHOPE database, it is reasonable to expect a day’s time lag to allow the relevant country to assess the content. It shows that just over 50% of the content hosted outside the UK is removed in 10 days compared to 100% in 4 days within the UK.
On-going police investigations outside the UK mean that not all URLs are able to be removed which is why 100% removal is not achieved.
We continue to work to speed up the removal of internationally-hosted child sexual abuse content by:
- Proactively monitoring and reminding our international colleagues of images and videos that remain available for long periods;
- Providing simultaneous alerts to companies;
- Forging relationships with police in countries without an INHOPE Hotline.
Other disruption tactics
Payment disruption
By its very nature, commercial child sexual abuse content requires a financial transaction. We work closely with our financial Members to disrupt these payment mechanisms and therefore disrupt the distribution of these images and videos.
Commercial child sexual abuse content
Since 2009 we have been tracking the different “brands” of child sexual abuse websites which provide public access to child sexual abuse content on a commercial basis.
Throughout the life of the project, we have identified 1,262 unique website brands.
From analysing the hosting patterns, payment arrangements, advertising systems and registration details we believe these are operated by a small core group of criminal entities. For example, of the top 30 most prolific brands active during 2012, 16 of these are apparently associated with a single “top level” distributor.
Of these website brands, 513 have been active during 2012, with 268 new brands created in this period. This trend is consistent with 2011 in that just over half (52%) of the commercial website brands during 2012 have not been previously observed.
- Of 9,550 child sexual abuse webpages confirmed by IWF Analysts in 2012, 2,587 (27%) appeared on commercial websites.
SMS payments
Paying for products and services via SMS (Short Message Service) can be a convenient and alternative way of making a purchase. However, this mechanism can be abused by commercial distributors of child sexual abuse material. When we assess commercial child sexual abuse websites, we record the payment methods offered.
We then work with payment providers to assist them in preventing the abuse of their services and also disrupt the activities of commercial distributors.
Case study
IWF works with PhonepayPlus, the UK regulator for phone-paid services including mobile shortcode numbers, to notify them of any instances where UK shortcodes are being presented as a payment mechanism for images and videos of children being sexually abused.
In 2012 we encountered a commercial website displaying a list of international SMS shortcodes as payment mechanisms for this content. Included was a shortcode for the UK. We notified PhonepayPlus, which then identified the aggregator – the organisation responsible for the administration of the shortcode - and made them aware that their service was being abused. Within days the commercial distributor of the criminal content had removed the UK shortcode from its website and has since ceased to offer any form of SMS payment.
PhonepayPlus continues to work with all premium rate providers to increase due diligence, risk management and control and prevent any further occurrence of the abuse of premium rate to offer criminal content.
Hidden services
Internet users offering child sexual abuse content online via proxy software to protect their identity present a challenge to the IWF. This is particularly the case with certain types of proxy software that can be used to anonymously host websites, known as hidden services, and which conceal the true location of the web server hosting the content. This makes removal of the content at source problematic.
Our experienced Analysts are aware, from making assessments of these websites, that hidden services are a channel for the first appearance of a large amount of new child sexual abuse images.
Therefore, there are opportunities for identifying the offenders behind the abuse as well as the victims.
As a result, we are working with the Child Exploitation and Online Protection (CEOP) Centre to notify them of the existence of any hidden services which we have assessed as containing child sexual abuse material. Providing this intelligence ensures that CEOP, in conjunction with national and international law enforcement agencies, is able to undertake investigations into the sites.
We assess this content in the same way we do any report. The difference is that it is sent to INHOPE for recording purposes, but does not get referred on as there is no traceable host country.
We encountered 26 URLs hosting child sexual abuse content on hidden services during 2012.
Newsgroups
Our Hotline team has a systematic process for monitoring the content of newsgroups and for issuing takedown notices for individual postings where child sexual abuse content has been identified.
Throughout 2012 the IWF monitored and reviewed newsgroups and issued takedown notices.
- 306 reports of content hosted in newsgroups were made to IWF.
- 146 takedown notices were issued for newsgroups hosting child sexual abuse content (193 in 2011).
- By monitoring newsgroups, we recommended IWF Members do not carry 303 newsgroups containing child sexual abuse content.
Keywords list
Each month we supply our Members with a list of keywords used by those seeking child sexual abuse images online. This is to improve the quality of search returns, reduce the abuse of networks and provide a safer online experience for internet users.
We supply this to Members to keep their services safer.
- In December 2012 this list contained 438 words associated with child sexual abuse content, plus 69 words associated with criminally obscene adult content.
- 43 organisations used this list.
‘Disguised’ websites
During 2011 we noticed child sexual abuse content being hosted on ‘disguised websites’. These are predominantly commercial child sexual abuse websites which can only be accessed via a predetermined digital path. If the site is accessed via a particular gateway (referrer) the site displays
criminal content. If it’s accessed via another route, it will display legal adult content. This is a distribution tactic which we continue to monitor into 2013.
Other criminal content
3,320 reports alleged criminally obscene adult content. However, they were not hosted within the UK and therefore not within the IWF’s remit. 6 URLs were assessed as hosting non-photographic child sexual abuse content. These were passed to CEOP for further action.
Charts – text version
Figure 1
Total reports processed
Child sexual abuse content: 35,821
Criminally obscene adult content: 3,320
Non-photographic images of child sexual abuse: 9
Other: 61
Reports found to be potentially criminal
Child sexual abuse content: 9,696
Criminally obscene adult content: 0
Non-photographic images of child sexual abuse: 6
Other: 0
Figure 2
2006: 3,077
2007: 2,755
2008: 1,536
2009: 1,361
2010: 1,351
2011: 1,595
2012: 1,561
Figure 3
One click hosting: 60%
Banner site: 21%
Websites: 8%
Forum: 5%
Social networking site: 3%
Figure 4
60 minutes or less: 56%
Between 61 and 120 minutes: 22%
More than 120 minutes: 22%
Figure 6
North America: 5,155 (54%)
Europe (inc Russia): 3,574 (37%)
Asia: 793 (8%)
South America: 1 (<1%)
Africa: 1 (<1%)
Please note: The IWF uses the term child sexual abuse content to accurately reflect the gravity of the images we deal with. Please note that child pornography, child porn and kiddie porn are not acceptable terms. The use of such language acts to legitimise images which are not pornography, rather, they are permanent records of children being sexually exploited and as such should be referred to as child sexual abuse images. If you see such content online please report it to the IWF.
