Paedophiles Are Using Ad Industry Tricks to Spread Child Sexual Abuse

By James Temperton
Wired
April 17, 2018

http://www.wired.co.uk/article/child-sexual-abuse-iwf-2017-figures-paedophiles-internet-watch-foundation

Paedophiles have a powerful and worrying new tool to help them find images and videos of child sexual abuse: the humble website redirect. And it’s causing a major headache for those leading the global fight against abuse.

“It works in same way as advertising referrers work,” says Fred Langford, deputy CEO of the Internet Watch Foundation, a UK-based charity that last year found and removed 78,589 images or videos of child sexual abuse. For Langford and his small team, the so-called “disguised website” technique is the latest salvo in the evade and detection arms race.

Here’s how it works: when a paedophile visits a bulletin board or online forum to find images and videos of sexual abuse, they click on a link. When they do, they enter a convoluted redirection system. As they pass from redirect to redirect, they are handed session cookies that confirm the route they’ve taken. Without going down this elaborate path, the site at the end of the redirect displays legal content. But with the right session cookie, that exact same URL displays child sexual abuse content.

For paedophiles, it means images and videos stay online for longer. For law enforcement, it makes finding and removing such content significantly more difficult. “If you did a Google search and clicked on it you'd just get the legal content,” says Langford. “If you came from a bulletin board that is used by paedophiles then this system just seamlessly passes people through. It's exactly the same page.” The IWF was the to first detect the disguised website technique and saw an 86 per cent year-on-year increase in its use in 2017. In total, the IWF found 2,909 disguised websites last year. And many more likely still evade detection. “It's getting worse and worse,” says Langford.

The shift to a more sophisticated method of hiding child sexual abuse content is part of a trend of professionalisation by the criminal networks feeding the demand. Providers want the content to remain live for longer as it suits their business models. “With this technique, the potential is that they can build consumer confidence in their brand much more,” Langford says. “Which is a worrying sign because it brings more traffic to the sorts of sites that aren't getting removed as quickly.”

The increase in disguised websites forms part of the IWF’s annual report that tracks the number of images and videos of child sexual abuse being shared and removed online. Overall, the charity saw a 37 per cent increase in the total number of child sexual abuse URLs – 78,589, up from 57,335 in 2016. More worrying still, the severity of this content is also increasing. Of the URLs the IWF found and removed, 33 per cent were Category A – the most extreme type of abuse – an increase of five per cent year-on-year. Images and videos in this category involve penetrative sexual activity and often include elements of bestiality or sadism. Langford believes this increase is the result of paedophiles being able to easily access more and more extreme content. “New material, that's like Class A drugs to someone. People seek it out,” he explains.

The IWF’s team of 17 people, a mix of technical and content removal specialists, is now able to assess a web page every four minutes. "We can take action and get a page or image removed every seven minutes,” Langford says. The aim is to keep bringing that number down. But it’s a daunting task. The charity receives no government funding and relies heavily on support from its 136 industry members – including Google, Facebook, Microsoft, Amazon and Apple – who provide technical assistance and contribute to the IWF’s vast list of known images and videos of child sexual abuse.

To help with its work, the team uses a suite of crawlers, open-source software and Firefox plug-ins to search the web and detect new and historic child sexual abuse content. In recent years, the team has seen a sharp increase in website ‘brands’ hosting child sexual abuse images and videos. In 2017 alone, the IWF reported a 112 per cent increase in content that it believes is part of a coordinated network of distributors.

“We started seeing these patterns going back seven or eight years now,” Langford explains. While the images and videos would be different, the fonts and graphics would be similar. “We started trying to work out if someone was stealing these templates off a free web template site. And we didn't find that. What we found is that they're very specific to child sexual abuse sites.” The IWF has now recognised a definite pattern in these brands, though it’s still some way from unpicking how everything is connected. “They're not just a huge number of disparate commercial sites. They're actually being controlled by a limited number of entities,” Langford says. “And it could end up being just one entity but with different strands.”

The IWF’s annual report also found that European hosting companies now account for 65 per cent of all child sexual abuse imagery it sees, up from 60 per cent in 2016. And, with 36 per cent of the global total, the Netherlands continues to be the country of choice for hosting child sexual abuse content. This is down to a combination of three major factors: its geographic location, the cheap cost of hosting and the amount of resource being put into tackling the problem by law enforcement. Langford says this means the country has now achieved something of a reputation. “Once it's been successful for a number of people hosting this sort of material they start sharing that information amongst likeminded people. Over the last few years it's grown exponentially.”

As the volume of content being detected increases – both a result of the IWF getting better at finding it and more paedophiles coming online and seeking it out – Langford says the IWF is increasingly reliant on its industry partners to help it tackle the problem. “The thing with child sexual abuse is that it's globally accepted as abhorrent. And the standards are very similar globally about what is considered illegal. So organisations like Facebook are quite comfortable taking action with something as long as somebody has said, 'This is illegal'. Which is what we've done,” Langford says. “We use the mantra, 'The polluter should pay'. We're a self-regulatory body, we're not funded by the government or the police, we're funded by industry.” With 136 members already signed-up, the IWF is calling on all partners to get more involved – and for more companies to join. “The most urgent thing is getting more industry members engaged,” Langford says.