Regularly used terms and acronyms
Bad actors: In the context of the IWF work, any individual or group that engages in harmful, unethical, or malicious behaviour by the production, distribution and or consumption of CSAM.
Banner site: A website or webpage made up of adverts for other websites with text links or images that take you to third-party websites when you click on them.
Blog: A blog is a discussion or information site made up of separate entries, or posts. Most are interactive, and visitors can leave comments and even message each other on the blog. The interactivity is what makes them different from other static websites.
CAID: The Child Abuse Image Database (CAID) is a project led by the Home Office which enables UK law enforcement to assess, categorise and generate unique hashes for tens of millions of child abuse images and videos found during their investigations.
Category A, B and C: We assess child sexual abuse material according to the levels detailed in the Sentencing Council's Sexual Offences Definitive Guideline. The Indecent Photographs of Children section (Page 34) outlines the different categories of child sexual abuse material.
Child sexual abuse images/videos/ imagery/content/material: Images or videos that show the sexual abuse of children. We use the term ‘child sexual abuse’ images to reflect the gravity of the images we deal with.
Clear web: The clear web is the internet that we use for everyday activities — like browsing, searching, online shopping and social media
Collage/Grid images: A single image made up of multiple sub-images. Commonly arranged in a grid pattern they are sometimes referred to as ‘grids’ although they can adopt other layouts.
Cookies: A small piece of data sent to the web browser by the server. This data is recorded in the Cookie field in the HTTP request. Just like with referrers, the server can check this data and show you a different result depending on the cookies you have acquired.
Cryptographic hash: A cryptographic hash is a digital fingerprint of any form of digital data. Cryptographic algorithms can hash a single word, an mp3, a zip file – anything digital. Cryptographic hashes can be used to identify exact matches of that digital data.
Cyberlockers: File hosting services, cloud storage services or online file storage providers. They are internet hosting services specifically designed to host users’ files.
Dark web: The dark web, also known as the dark net, is the hidden part of the internet accessed using Tor or a similar dark web-compatible browser. Tor is anonymity software that makes it difficult to trace users’ online activity.
Disguised websites: Websites which, when loaded directly into a browser, show legal content—but when accessed through a particular pathway (or referrer website) show illegal content, for example child sexual abuse images.
Domain alerts: Details of domain names that are known to be hosting child sexual abuse content.
Domain Name System (DNS): A system that translates human-readable domain names (such as www.example.com) into machine-readable IP addresses (such as 192.0.2.1). It allows users to access websites using easy-to-remember names instead of numeric IP addresses. DNS operates through a network of servers that resolve domain names into corresponding IP addresses, enabling web browsers and other internet services to connect to the correct servers.
Forum: Also known as a ‘message board’, a forum is an online chat site where people talk or upload files in the form of posts. A forum can hold sub-forums, and each of these could have several topics. Within a topic, each new discussion started is called a thread, and any forum user can reply to this thread.
Gateway sites: A webpage that provides direct access to child sexual abuse material but does not itself contain it.
GPUs (Graphics Processing Units): sometimes called “graphics cards” are designed to do lots of simultaneous calculations independently. Typically, they’re used in gaming but they can also be used to solve more general purpose computational problems on large scale data.
Grid Images: A single image made up of multiple sub-images. Commonly arranged in a grid pattern they are sometimes referred to as ‘grids’ although they can adopt other layouts.
Hash/hashes: A ‘hash’ is a unique code, or string of text and numbers generated from the binary data of a picture. Hashes can automatically identify known child sexual abuse images without needing to examine each image individually. This can help to prevent online distribution of this content.
Hash List: The IWF Hash List contains a special catalogue of codes, or hashes which is updated daily and manually verified by our expert analysts. Each hash is completely unique. It’s a type of digital fingerprint, or label that identifies a picture of confirmed child sexual abuse. Each criminal image has its own individual hash.
Once an image has been hashed, it can be recognised quickly. Better still, our list of hashes can block thousands of criminal pictures from ever being uploaded to the internet in the first place.
By using our Hash List, tech companies can stop criminals from uploading, downloading, viewing, sharing or hosting known images and videos showing child sexual abuse.
Hidden services: Websites that are hosted within a proxy network, so their location can’t be traced.
Hosting: The provision of internet infrastructure and services that allow websites or online content to be stored or distributed and made accessible to users over the internet.
Image board: An image board is a type of internet forum that operates mostly through posting images. They’re used for discussions on a variety of topics, and are similar to bulletin board systems, but with a focus on images.
Image host/image hosting site: An image hosting service lets users upload images which are then available through a unique URL. This URL can be used to make online links, or be embedded in other websites, forums and social networking sites.
Image and video analysis: The data in this section is based on an analysis of images and videos.
Invite Child Abuse Pyramid or ICAP: Custom-built websites using viral marketing techniques, similar to that of a pyramid scheme, where people are incentivised to share links to child sexual abuse sites far and wide in a ‘scattergun’ approach and with the aim of recruiting as many buyers as possible.
Inchoate sites: Websites which encourage or assist in accessing child sexual abuse material using formats of distribution such as innocent looking videos which include links and instructions in the comments section about how to view and download content elsewhere, with some videos even hiding passwords that unlock illegal content on secondary sites.
IntelliGrade: A powerful software tool that enables our analysts to accurately grade child sexual abuse images and videos, while automatically generating unique hashes (digital fingerprints) which are used to identify and eliminate these images wherever they appear.
IWF Reporting Portal: A world-class reporting solution for child sexual abuse content, for countries which don’t have an existing Hotline.
Keywords: A list of terms associated with child sexual abuse material searches.
Multichild: Nominet’s Countering Online Harms fund has funded work to enable us to record the age and sex of all children seen within singular images for the first time. This Multichild format became effective from 1 January 2024.
Newsgroups: Internet discussion groups dedicated to a variety of subjects. Users make posts to a newsgroup and others can see them and comment. Sometimes called ‘Usenet’, newsgroups were the original online forums and a precursor to the World Wide Web.
Non-photographic imagery (NPI): Images and videos of child sexual abuse which aren’t photographs, for example computer-generated images.
Notice and Takedown (NTD): Also known as Takedown Notices, are alerts sent to hosting companies when analysts at the IWF find any child sexual abuse images, videos or non-photographic imagery (NPI) hosted in the UK, that breaks UK law.
.onion: .onion domains enable anonymous hosting and cannot be attributed to any specific hosting country or individual. These allow people to browse and publish anonymously. These sites are only accessible through the Tor network.
Paedophile manuals: Manuals containing advice and guidance on how to commit sexual offences against a child, including creating child sexual abuse material or creating and fine-tuning AI models of this illegal imagery.
Perceptual hash: A perceptual hash is a digital fingerprint of an image which has been created using an algorithm. Perceptual hashes enable near-duplicates of that image to be identified.
Proactive/proactively searching/ proactively seeking: We can actively search for child sexual abuse content, and create reports for action by our analysts. We call this ‘proactive searching’, and it accounts for a large proportion of our work.
Proxy network: These are systems that enable online anonymity, accelerate service requests, encryption, security and lots of other features. Some proxy software, such as Tor, attempts to conceal the true location of services.
Red Watch List: Will comprise of websites that are known to contain regular discoverable volumes of CSAM*, but which cannot be classified as dedicated commercial sites. Examples of site types that would fall into this category would include prolific Image Host and Cyberlocker sites. * Volume and frequency levels to be decided.
Redirector: A technique used by websites to make a web page available under more than one URL address. When a web browser attempts to open a URL that has been redirected, a page with a different URL is opened.
Referrer: An optional field in the HTTP request which identifies the page making the request. This allows the server to see what web page you’re coming from. When your browser sends a request to see a web page, the server can check an optional HTTP referrer field stored by your browser. This allows the web developer to program which version of the site you will see depending on what’s in your referrer field.
Reporting Portals: A world-class reporting solution provided by the IWF for child sexual abuse content, for countries which don’t have an existing Hotline
Revictimisation: Revictimisation, or repeat victimisation is what happens to a victim when their image is shared online. A single image of a victim can be shared hundreds or thousands of times.
Service Provider/Internet Service Provider: An internet service provider (ISP) is a company or organisation that provides access to the internet, internet connectivity and other related services, like hosting websites.
Self-generated child sexual abuse imagery: The descriptor ‘self-generated’ is used when our analysts determine that a child has produced images or videos of themselves. In some cases, children are groomed, deceived or coerced into producing and sharing a sexual image or video of themselves by someone who is not physically present in the room with them. Sometimes children are completely unaware they are being recorded and that an image or video of them is then being watched and shared by abusers.
Some children may generate intimate images or videos of themselves without coercion from an abuser but may later find their content has been shared or distributed without their consent.
(We regard the term ‘self-generated’ child sexual abuse as an inadequate and potentially misleading term which does not fully encompass the full range of factors often present within this imagery, and which appears to place the blame with the victim themselves. Children are not responsible for their own sexual abuse. Until a better term is found, however, we will continue to use the term ‘self-generated’ as, within the online safety and law enforcement sectors, this is well recognised).
Social networking site: A social networking service is a platform to build social relations. It usually has a representation of each user (often a profile), their social links and a variety of other services. Popular examples include Facebook and X.
‘To assess’: When our Analysts ‘assess’ a report, this means they have checked it for child sexual abuse imagery.
‘To action’: When our Analysts ‘action’ a report, this means they have checked it for child sexual abuse imagery, made an assessment against UK law and found imagery to be criminal.
Top-level domain (TLD): Domains at the top of the domain name hierarchy. For example .com, .org and .info are all examples of generic top-level domains (gTLDs). The term also covers country code top-level domains (ccTLDs) like .uk for UK or .us for US and sponsored top- level domains (sTLDs) like .mobi or .xxx
URL: An acronym for Uniform Resource Locator. A URL is the specific location where a file is saved online. For example, the URL of the IWF logo which appears on the webpage www.iwf.org.uk is www.iwf.org.uk/themes/iwf/images/theme-images/logo.png.
URL analysis: The data in this section is based on an analysis of URLs which may contain one, but often many individual images and videos.
URL List: Our dynamic URL List provides a comprehensive list of webpages where we’ve confirmed images and videos of child sexual abuse. Since each URL is a unique webpage address, we can be precise about the exact location of the criminal imagery to ensure we never over-block a legitimate website.
All IWF Members can use this List, under licence, so that they can block access to these criminal webpages. While access to the images and videos is blocked, we work to have the actual picture or video removed from the internet.
The addresses included on our List are at URL (webpage) or image level, rather than domain level. And we update it twice a day, adding new URLs as our analysts find them and removing URLs that no longer contain the criminal content. This means that our dynamic List is precise and networks aren’t over-blocked. The only images included are criminal and they’ve been individually assessed by one of our world class analysts. Only if an entire website is dedicated to confirmed child sexual abuse will we block at domain level.
Webpage: A document which can be seen using a web browser. A single webpage can hold lots of images, text, videos or hyperlinks and many websites will have lots of webpages. www.iwf.org.uk/about-iwf and www.iwf.org.uk/Hotline are both examples of webpages.
Website: A website is a set of related webpages typically served from a single web domain. Most websites have several webpages.
