Published: Tue 1 Nov 2022
The number of websites found to be accepting cryptocurrency payments for sexual content of children has doubled almost every year since 2015, with a new specialist unit launching to tackle the “escalating problem”.
The Internet Watch Foundation (IWF) is warning that criminals are using cryptocurrencies to access or buy images and videos of children suffering sexual abuse and rape online.
Last year (2021), the IWF identified 250,000 websites containing child sexual abuse. Of these, 1,014 sites gave criminals the option of using virtual currencies to access or buy videos and images of children being sexually abused and raped.
This compares to 468 sites allowing these crypto payments which the IWF identified in 2020. In 2019, 221 were identified, and in 2018, only 81 were found.
The IWF has now launched a new “crypto unit” in response to the increasing numbers and is receiving daily requests for information from law enforcement around the world, from the New Zealand police to the Austrian Criminal Intelligence Service and the Internal Revenue Service’s Criminal Investigation branch in the United States, as well as the Metropolitan Police in the UK.
The UK-based IWF is Europe’s largest hotline dedicated to finding and removing images and videos of child sexual abuse material (CSAM) from the internet.
IWF Crypto Unit Analyst Andrew* is part of a team which searches pro-actively for CSAM, as well as following up on reports of child sexual abuse images sent in anonymously by the public to the Hotline.
He said: “As part of our daily activities we record all the information possible about the online sites containing child sexual abuse material so that we can get them removed as quickly as possible.
“If criminals are seeking to profit from selling these images, we note everything we see on a website or forum’s payment pages, such as the wording used, the virtual currency and the amount, whether it’s a daily, weekly or annual charge, and the cryptocurrency wallet address of the provider.”
This information is then included in a report with details about the CSAM, such as the category and type of sexual abuse, and where the servers hosting the content are located.
Thousands of reports are shared daily with hotlines in other countries and law enforcement agencies so that websites can be removed and distributors can be investigated.
Because of the increasing popularity of cryptocurrencies as a form of payment, the IWF is seeing more requests from law enforcement and other organisations for information to help in criminal cases and prevention, a catalyst for the creation of the Crypto Unit.
Andrew added: “At the moment we get daily requests from global law enforcement, from the UK Met Police to as far as the New Zealand police and the US Internal Revenue Service’s Criminal Investigation branch. They follow up on data that we have provided through virtual alerts, as well as send through separate queries about new crypto addresses that may be linked to illegal activity.
“We search our systems to see if that address is in our system and then give them any information that we are allowed to share so that they can potentially build up a case.”
Detective Inspector Darren Young, from the Online Child Sexual Abuse and Exploitation unit at the UK Metropolitan Police said: “The Metropolitan Police Service is committed to using all avenues possible to identify victims and perpetrators of online child sexual abuse and exploitation.
“We are seeing cryptocurrency being used to pay for the distribution of abusive images and the online sexual exploitation of children, with perpetrators believing they can hide behind the anonymity of these virtual currencies.
“The IWF has been a key partner to law enforcement for many years and the newly formed Crypto Unit provides greater opportunities to combat these horrendous crimes, rescue children from sexual abuse and arrest offenders.”
The payment information displayed on commercial CSAM websites is also shared with partners in the financial industry. This helps to prevent misuse of their services and disrupt further spread of the criminal imagery.
Crypto exchange service Coinbase recently conducted an exercise that used IWF data to identify more than 6,500 people believed to be misusing their platform for alleged criminal purposes. The information also helped the platform identify website operators thought to be selling and distributing child sexual abuse material and close merchants who were accepting payments for illegal services.
Coinbase Global Intelligence Investigator Charlie Hare said: “Coinbase is committed to rooting out illicit activity within our business and the sector. As a company we are fully aware of the real harm that CSAM and the offenders have on our society, that is why we have sought to work with the IWF.
“In the exercise mentioned we committed all of our team's resources to leverage IWF data to identify offenders, services and the flow of funds. We then passed this analysis to the authorities and removed those offenders from our platform. This exercise demonstrated the power of private sector collaboration, and we are keen to continue this model going forward.”
“At the heart of this issue is the protection of children, wherever they are in the world,” said IWF Hotline Director, Chris Hughes. “We are doing everything we can to find and disrupt child sexual abuse material online and, in this case, to help law enforcement and other organisations track those making money off the back of children’s exploitation and abuse.
“The sale of child sexual abuse content online is an escalating problem, and the number of sites offering cryptocurrency as a form of payment has doubled almost every year since we first started recording the trend at the IWF. As a result, we have established the dedicated Crypto Unit.
“The IWF constantly evolves to improve our reporting systems and keep up to date with the latest tech needed to combat child sexual abuse. The Crypto Unit is a natural extension of this need and is rooted in the world-class expertise of our experienced analysts and supporting tech team.”
Supervisory Special Agent Garr Holland for the IRS-Criminal Investigation’s D.C. Cyber Crimes Unit (CCU) said: “The information we receive from the IWF and other organisations can be invaluable in helping us identify CSAM criminal cases. More specifically, these tips can help our special agents pick up the digital financial trail through crypto and other currency transactions that we then use to trace and identify criminals.
“DC CCU agents previously helped lead the takedown of the largest CSAM darknet marketplace, resulting in over 330 arrests around the world and 23 children who were actively being abused saved. We continue to work with our federal law enforcement partners, lending our financial investigation expertise while also continuing to expand relationships with local law enforcement to help ensure additional tips go to the right investigative agency.”
Detective Senior Sergeant Dave Bealing from the New Zealand Police Financial Intelligence Unit said: “New Zealand Police are committed to preventing harm in our communities, and we value the partnerships we have with organisations like IWF. IWF have the tools and expertise to suppress online CSAM which is invaluable in the work law enforcement agencies do to keep children safe. Rapid advances in technology can be challenging for law enforcement but working with trusted partners like IWF allows us to hold offenders to account.”
Petra Huber-Lintner, Head of Investigations, General Crime Unit at the Austrian Criminal Intelligence Service said: “Criminal networks and criminal networking are global issues, because they happen globally as well as internationally. Therefore, it is essential for investigative authorities to achieve, maintain and further interdisciplinary cooperation and networking between law enforcement, NGOs, the internet community and reporting hotlines and the organisations behind them. In the fight against online sexual child abuse proactive international and multiagency collaboration is key.”
More than 175 technology companies worldwide are Members of the IWF, giving them access to the charity’s unique range of services. Beyond payment information, this includes valuable data such as the IWF’s Image Hash List – a list of ‘digital fingerprints’ of known child sexual abuse imagery – which allows companies to stop CSAM from being uploaded or shared on company networks, platforms and apps.
As part of their responsibilities, the new IWF Crypto Unit provides data sets to Members for specific projects, monitors new payment sites and sends regular cryptocurrency updates via virtual alerts.
*Names have been changed to protect analysts’ identities.
Find out more about our Virtual Currency Alerts here.
The IWF and NSPCC say tech platforms must do more to protect children online as confirmed sextortion cases soar.
A major 18-month trial project has demonstrated a first-of-its-kind chatbot and warning message can reduce the number of online searches that may potentially be indicative of intent to find sexual images of children.
