New techniques are emerging to help forensic analysts build cases against Internet child pornographers.
Some crimes, like the rape and torture of infants and toddlers, are so unspeakable the reaction of most people is to turn away and hope the problem vanishes.
Forensic analysts, however, must face this dark reality in the pursuit of prosecutions. The scope of the problem is immense.
The Internet enables instant access to child pornography. The National Center for Missing and Exploited Children (NCMEC) reports it has reviewed 23 million child pornography images and videos—8.6 million just in 2008.
As the problem spreads, the victims seem to get younger and younger. According to the 2008 Internet Watch Foundation (IWF) Annual Report, 69% of child victims are under ten years old, and 24% are six years old or younger. Some are babies.
Both IWF and NCMEC are active in helping forensic scientists build cases against those who produce, distribute, and consume child pornography. Two new software tools, one developed at Oak Ridge National Laboratory and the other in Sweden, appeared this summer to help them and others involved in this pursuit. Both packages are designed to automate some of the grim forensic tasks of fighting child pornography.
The Swedish system, called NetClean Analyze, is an investigative tool for individual law enforcement agencies working with images and videos of child sexual abuse.
Developed for the Swedish National Police, NetClean Analyze uses unique image recognition techniques to speed up the process of analyzing and classifying images and videos. The system, which is currently in use throughout the European law enforcement community, can rapidly catalog the hundreds of thousands of images and videos that are typically found during an investigation of computers confiscated from suspected child pornography traffickers.
Before NetClean Analyze, forensic examiners had to manually view and catalog each image or video, which significantly slowed down the forensic process.
NetClean Analyze focuses on three key issues. It minimizes the time investigators have to spend looking at old or duplicate images and videos, it eases collaboration between police units, and it enables more efficient reporting with an engine that allows easy creation of either customized or standardized reports.
Aside from automatic categorization, NetClean isolates duplicate files, which saves time.
“It’s not unusual for duplicates to reduce the number of images in a case from perhaps 350,000 to 80,000, saving a tremendous amount of analytical time,” said Christian Sjöberg, CEO of NetClean Technologies, Göteborg, Sweden.
The system can also find images similar to an image in question.
“Since child abuse images usually come in series, if you select an image and ask the system to show similar images, the system will find the whole series related to the first image with one click,” Sjöberg said. “This is useful to investigators who may have an image they are uncertain of. They can ask the system to find similar photos, one that may be clearly child abuse.”
After all files have been analyzed and catalogued, the investigator can then produce a detailed report formatted for prosecutorial purposes, along with sample images.
Global Technology Solutions (Hollywood, Florida) holds the North American rights to NetClean and has made the system available to law enforcement agencies at no cost, per agreement with the Swedish developer.
The initial NetClean installation in the U.S. was in Florida, in September, at the Broward County Sheriff's Office, where it is currently being fine tuned for actual field work.
“We will then make it available to other law enforcement agencies,” said Chris Cavallo, president of Global Technology Solutions.
Any police department interested in obtaining a copy of the software can contact GTS headquarters in Hollywood, Florida, at 954-981-2600, or through the company website, www.gtsna.com.
One of the strengths of NetClean is the massive central database of child pornography material already known, making it possible, and quite simple, to match newly confiscated material against the database to identify new images or videos.
“The more agencies that have the system and use it, the more complete our image database will be, and that makes catching child pornographers and trying their cases easier,” Cavallo said.
Oak Ridge System
The Oak Ridge system also employs software to rapidly and thoroughly scan hard drives on confiscated computers, dramatically reducing the amount of time necessary to scan a computer, potentially reducing forensic analysis backlogs.
“We’re combining network text and image analysis tools to rapidly find the worst of the worst child pornography offenders,” said Tom Potok, of ORNL’s Computational and Engineering Science Division.
The worst of the worst in this case being the deviant predators that sexually rape, abuse, and torture children, many of whom are infants and toddlers.
Potok said with his system, as yet unnamed, there is a good chance that the number of prosecutions of these offenders could double.
Potok said the Oak Ridge system, which won a 2007 R&D 100 award, differs from NetClean in that his system works by analyzing both images, videos, and text, whereas NetClean analyzes images and videos only.
“Our work is also applicable to peer-to-peer file sharing networks, not just hard drives,” he said.
The idea is that by finding child pornography text and images on the same computer there is a higher likelihood of finding someone who is actually abusing a child and sharing the images or video, rather than perhaps being merely a consumer of the vile product.
A prototype of the Oak Ridge system was deployed in September for live beta testing at the Knoxville Internet Crimes Against Children Task Force. A second prototype has also been deployed at the same organization. The second one helps identify missing children by comparing faces in child pornography images to missing children databases.
When it comes to searching text or images, no one is more adept than Google, which last year announced a partnership with NCMEC to provide software designed to automate the technical assistance NCMEC provides to police child pornography investigations.
It’s the latest iteration of the NCMEC offensive of fighting fire with fire.
“Criminals are using cutting edge technology to commit their crimes of child sexual exploitation, and in fighting to solve those crimes and keep children safe, we must do the same,” said Ernie Allen, president and CEO of NCMEC.
Analysts with NCMEC’s Child Victim Identification Program have reviewed more than 15 million child pornography images and videos in an attempt to identify and rescue children. NCMEC analysts typically review something like 200,000 images a week.
Now, with the automated Google system, colloquially called the Bedspread Detector, NCMEC analysts will be able to more quickly and easily search NCMEC’s systems to sort and identify files that contain images of child pornography victims.
The system is named ‘Bedspread Detector’ because one NCMEC analyst noticed the same bedspread in several different images with different victims.
“She was able to tie together the abuse of two little girls, one blonde, the other brunette, because the perpetrator was abusing them on the same distinctive bedspread,” Allen said.
Google’s ‘Bedspread Detector’ system now enables analysts to identify unique features, such as a distinctive bedspread, background photo, tattoo, or potted plant, then search against a vast database of other images containing that particular feature.
“This will help us identify more victims and link victims to particular perpetrators because most of them offend against multiple children,” Allen said.
Google encourages its employees to devote 20% of their work time to worthwhile social projects. In this case, four Google software engineers spent a year developing this new tool.
Details of exactly how the system works are not being disclosed, nor is how it specifically helps rescue children. What NCMEC will say is that what Google is doing is not just aiding prosecution, it is helping identify and rescue children.
“While there won’t be miraculous changes overnight, the bottom line is, because of these tools, we’re making headway,” Allen said.
Allen has other tactics that are paying off in the anti-child pornography campaign. In 2006, NCMEC was instrumental in forming the Financial Coalition Against Child Pornography (FCACP), a groundbreaking alliance between private industry and the public sector in the child porn battle.
Consumers of child pornography were once able to use traditional payment tools, such as credit cards, as well as new, alternative payment schemes like PayPal, to purchase child pornography on the Internet. The mission of the FCACP is to follow the flow of funds and shut down the payments accounts used by these illicit enterprises.
The alliance is composed of leading banks, credit card companies, electronic payment networks, third party payments companies, and Internet services providers, representing nearly 90% of the domestic payment industry.
“We’ve been doing this three years, and we’ve virtually eliminated the use of the credit card to purchase access to child pornography sites,” he said. The operators of these sites are being forced to develop other payment methods. Allen said some are establishing their own payment mechanisms or are using third parties. Most no longer accept U.S.- or UK-issued bank cards.
Another sign of progress is the price points of this perverse content have increased dramatically. In some cases, what once cost $29.95 a month for access to a child pornography site now costs $800 to $1,000, according to Allen.
Law enforcement reports that the number of operators of these illegal sites has decreased substantially to no more than a handful, most of which are believed to be operated by Eastern European organized crime syndicates.
“We’ve made it more expensive for these people to do business,” Allen said. “We’ve increased the risk.We’ve limited the payment options and virtually stopped the use of mainstream credit card usage.”
But, he’s realistic. He knows people who make money from the sexual exploitation of children will adapt.
“They’ll come up with other ways to collect, so we follow the money,” he said. “As they develop new mechanisms, we’ll try to attack those.”
Douglas Page writes about forensic science and medicine from Pine Mountain, California. He can be reached at firstname.lastname@example.org.