Improving child sexual exploitation material investigations: Recommendations based on a review of recent research findings

Introduction

Historically, child sexual exploitation material (CSEM) was distributed in the backrooms of less-than-reputable adult stores and through mail order catalogues. Just prior to the Internet explosion, organizations like the United States Postal Inspection Service and similar investigative agencies around the world had all but removed access to CSEM in any widespread fashion and largely curtailed its distribution. Since the growth of the Internet, CSEM distribution has likewise expanded, overshadowing the paper-based distribution mechanism previously favoured. In 2019, the Internet Watch Foundation (IWF) identified 132,676 websites containing CSEM, which includes child pornography, child erotica and virtual child pornography (IWF, 2019). Also in 2019, the National Center for Missing and Exploited Children (NCMEC) received 16.9 million reports of child sexual exploitation, primarily from electronic service providers, across technologies ranging from Twitter to Snapchat, with Facebook representing 15.9 million of the total complaints, principally using Facebook Messenger (National Center for Missing and Exploited Children, 2020). At the same time, the technological landscape has become increasingly complex, with offenders using platforms ranging from peer-to-peer networking to TOR-based darknet forums (B. G. Westlake, 2020). With rapid changes in technology and limited law enforcement resources to address this issue (Cullen et al., 2020), using a risk-based, innovative approach to CSEM investigations is a necessity.

In addition to changes in technologies, the COVID-19 pandemic has changed workplace dynamics. Increased telework (López-Igual and Rodríguez-Modroño, 2020) for both law enforcement and offenders increases the importance of the home environment. Offenders may have lower employer surveillance over their activities, but more surveillance by family members. Because the home is now either an exclusive or joint workspace for many individuals, offending behaviour using work-related devices may allow for home search warrants more readily. Additionally, both physical and virtual access to children have changed – virtual classrooms means children are on-line more hours, and may have greater at-home risks of abuse. Additionally, increases in stress, social isolation, and downtime may be facilitative of increases in CSEM offending (Seto, 2019). The impacts of COVID-19 on the prevalence and nature of CSEM offending and how that impacts investigative dynamics are still in flux. Europol has shown mixed initial data, with no increased reporting related to CSEM offending in some countries, but markers of increased activity in others (Europol, 2020). Other preliminary data has shown increases in forum activity related to offending, as well as help-seeking behaviour (Parks et al., 2020).

This paper reviews recent, empirical research work related to CSEM in an investigative context. The paper recommends best practices for investigative planning, interviewing, digital forensics, and post-interview management of CSEM offenders, and provides guidance on providing for the mental health of those involved in CSEM investigations in a rapidly changing technological environment based on current trends and research findings.

This review uses the term ‘child pornography’ when referencing other work that used the term, and the phrase ‘child sexual exploitation material’ when referring to the broader content definition, consistent with the Luxembourg guidelines (Terminology and Semantics Interagency Working Group on Sexual Exploitation of Children, 2016). Additionally, a substantial number of the studies cited utilized research participants based in the United States and this paper uses that as an example jurisdiction where appropriate, though the majority of the recommendations have global applicability.

Investigative planning

The traditional approach to CSEM investigations is to either identify sufficient evidence on a single offender (e.g. in most peer-to-peer investigations) or to identify the group of offenders using a particular resource (e.g. in most darknet forum takedowns) and divide and conquer by providing leads to other investigative agencies with the appropriate jurisdiction. These are then frequently treated as discrete investigations by that agency, focusing on an individual offender. While this is an approach supported by jurisdictional rules and the appropriate use of local or regional resources, the ultimate goal of child protection can be inadvertently superseded by the goal of obtaining a proximal conviction. A better approach can be applied based on the contact-tracing concept stemming from disease propagation research (Eames and Keeling, 2003). In contact tracing, the origination vector (including the time and method of contact) is identified, as are any potential additional propagation vectors. For CSEM offenses, this aligns with current United States laws in that identifying when and how the content was obtained is one of the most effective methods of proving receipt charges. Further, identifying any propagation of the content after it is received can be used for proving distribution. Additionally, by working backward and referring information as needed to other jurisdictions where the content originated, the original ‘patient zero’ may be identified which would directly support victim identification and rescue. While CSEM images traditionally involved direct, hands-on abuse by a producer, the dynamics are shifting. During the COVID-19 pandemic, the Internet Watch Foundation found that 44% of shared CSEM was self-produced (“Disturbing” Rise in Videos of Children Who Have Been Groomed into Filming Their Own Abuse, 2020). Some of these images and videos were voluntarily taken but were non-consensually shared, while others reflect a shift toward more online grooming and sextortion-based crimes where the offender coerces or extorts the victim remotely.

For peer-to-peer systems like RoundUp and the Gridcop Child Protection System (CPS) (Child Rescue Coalition, 2020; Liberatore et al., 2010), a contact-tracing approach may mean incorporating and mining for trends in ‘first appearance’ data of a particular image or video to identify the start of a chain of production or distribution. For web forum takedowns, it may mean explicitly identifying initial upload data and providing that as part of lead packages to kickstart the contact tracing.

In individual cases, contact tracing means identifying the technical means and timeframe in which the content was acquired, and the identification of the source of the content (either an account name or IP address). It additionally means identifying any outward sharing of the content using the same approach and sending targeting packages to the relevant investigative agencies associated with those receiving that content. While full and permanent removal of the content from the Internet is not likely, identification of previously undetected repositories (e.g., individuals who received and collected but have not shared) for future distribution can occur with this approach.

The technical profiles of CSEM users need to be accurate for appropriate investigative planning as well. Historically, CSEM offenders were thought to be technically sophisticated individuals who made extensive use of countermeasures such as encryption. While some offenders exhibit technical sophistication in their particular criminal domain (i.e., obtaining CSEM), overall their technical sophistication was not found to be statistically different from the general public, and they owned fewer digital devices than the average person (Steel, 2021). Additionally, their use of technically sophisticated countermeasures like encryption has been consistently low, with recent rates ranging from 7.7% (Krone et al., 2017) to 18% (Steel et al., 2022a), though this only includes intentionally employed encryption and not built-in encryption like that on the iPhone. From an attribution perspective, 22% of CSEM offenders used TOR and 15% used anonymizing VPNs to hide their activities (Steel et al., 2022a), which necessitates confirming any IP addresses identified with CSEM activity are not shared servers running VPNs at a hosting facility and not TOR exit nodes as identified by the TOR project (TOR Exit Node List, 2020) before applying for and executing search warrants to avoid misattribution.

Current CSEM offenders are also significantly more mobile in their viewing habits than they were a decade ago (Constine, 2018; Restar, 2019; Romero Hernández, 2017). In a recent study, 22% of offenders reported viewing CSEM at a hotel/motel, 9% from a vehicle, 9% at work and 99% at home. In particular, individuals that were identified as viewing CSEM at work were 100% likely to also have viewed it at home, providing the basis for obtaining a residential search warrant based on work-based viewing activity (Steel et al., 2022a). Additionally, 27% of offenders reported using mobile phones to view CSEM, making portable viewing an increasing trend, and necessitating planning for the presence of and the seizure of mobile phones as part of any enforcement action (Steel et al., 2022a).

The risk of recidivism and future contact offending by CSEM offenders is generally overestimated, with the general public rating the risk of a CSEM offender committing a contact offense or committing another CSEM offense multiple times higher than the actual risks (Steel et al., 2022b). In practice, the 5 year recidivism rates for CSEM-only offenders ranged from 1.6% (Faust et al., 2015) to 4.4% (Eke et al., 2011) based on arrest and 10% based on self-reporting (Steel, 2021), though these are lower bounds as there may be both longer term and undetected recidivists. The risk of committing an additional contact offense is also low, with Seto et al. (2011) identifying a 2% contact offense rate and Elliott et al. (2019) a 2.7% rate. Because of the low risk of recidivism, alternative policing strategies have been employed in some locations. As an example, the Sussex police in the United Kingdom’s Police Paedophile On-Line Investigation Team (POLIT) began performing non-arrest knock-and-talks and issuing warning letters in lieu of investigation to low risk, first time offenders (those identified as downloading a single image or small number of images). This allowed for limited police resources to be focused on higher-impact contact offenders and larger volume CSEM offenders. Under Lawless Space Theory (LST), the act of reinforcing capable guardianship is likely to be a strong psychological deterrent to re-offending (Steel et al., 2021b), providing a similar level of deterrence to actual arrest. While not specifically addressed in the POLIT initiative, this type of approach could be coupled with a voluntary abandonment agreement for offenders to turn over any computer equipment used to view or store CSEM. This increases the friction costs that the offender must overcome to re-engage with CSEM and reduces the risk of the offender later finding old CSEM which becomes a trigger to recidivate (Steel et al., 2021b).

While deterrence-based approaches may be extremely cost effective by allowing funds to be spent on higher risk offenders and are likely to halt CSEM viewing behaviour in the majority of low-risk offenders, the tradeoff is the possibility of having uncovered victims present. A subset of those deterred may have already committed a contact offense or may be in possession of images that would allow the identification of additional victims. As with most law enforcement efforts, there are trade-offs in both approaches, but the societal benefits and opportunity costs that would be lost through a full investigation make this a viable option in specific cases.

Digital forensics

As noted above, CSEM offenders are not expected to have more devices present than non-offenders and are not significantly more likely to use enhanced anti-forensics techniques. They are, however, likely to employ countermeasures that frustrate forensics efforts, with 68% admitting that they have deleted their web browsing history, 38% using In-Private browsing and 31% using wiping software on their hard drive (Steel et al., 2022a). Additionally, a small percentage (4%) of offenders admitted to only viewing but never downloading pornography (Steel et al., 2021a), and the majority of offenders, 74%, admitted they deleted their entire collection at least once (Steel et al., 2021a). This may pose potential limits on the amount of forensic artifacts that are recoverable in a particular case, but it also highlights the fact that the forensic findings are the lower bound of activity, and the actual amount and duration of viewing will be substantially higher in many cases. This is an important consideration because for risk purposes the number of images and videos viewed may be less important than the length of offending (i.e., the overall time since the first image ever viewed) (Seto and Eke, 2015, 2017).

The composition of collections and collecting behaviours demand additional focus as well. One recidivism risk factor for CSEM offenders used in the Child Pornography Offender Risk Tool (CPORT), the most relevant current instrument for assessing the risk of re-offending, is the ratio of boy/girl content present in CSEM (Eke et al., 2019; Seto and Eke, 2015; Soldino et al., 2020), with a higher ratio indicating additional risk. In addition to the boy/girl content ratio, the quantity and presence of forensic detail related to adult SEM viewing should be catalogued. While many CSEM offenders show paedophilic behaviour, a substantial percentage of offenders are not paedophiles (or hebephiles) or exclusive paedophiles (Seto et al., 2006). Forensically, this may be evident in the proportion of child SEM compared to adult SEM. In a study looking at the ages of content present, 74% of previously convicted child pornography offenders viewed more adult SEM than child SEM, and no offenders exclusively viewed CSEM (Steel et al., 2021a). Forensically identifying a high ratio of CSEM to adult SEM content may be of later interest in terms of risk based on whether or not an offender is predominantly interested in CSEM or if it is a secondary interest based on their overall viewing habits.

Complicating the forensic challenges is a shift from predominantly image-based content to video-based content (Bursztein et al., 2019; Krone et al., 2017; B. Westlake et al., 2017; Wolak et al., 2011). Video analysis imposes additional requirements on examination – tools are needed to incorporate thumbnail generation for videos into ‘gallery’ views, codecs are needed to view particular video files may not be present, and the immersion of reviewing video and audio content may have a more detrimental effect on examiners. Additionally, traditional automated detection using hash-based identification may need to incorporate more flexible hashing approaches including video-based implementations of PhotoDNA (Langston, 2018), as well as artificial-intelligence based approaches (Bursztein et al., 2019; Vitorino et al., 2018).

Building on the contact-tracing approach, most digital devices are now part of a forensic ecosystem. The CSEM content found on an iPhone, for example, is potentially on any computer that the phone was connected to and backed up to an iCloud account. Additionally, features like device backups and automated restore points may mean the same content is further propagated to removable media or other locations within the same media (Boucher and Le-Khac, 2018; Chung et al., 2017; Domingues et al., 2019). By treating each device as part of an ecosystem and identifying vectors for potential CSEM propagation within a user’s systems, further external distribution can be identified, and the investigators can ensure all relevant copies of content are seized to prevent the facilitation of future recidivating behaviour.

As a final note, any suspected but previously identified CSEM content, including non-offending content that depicts the same individual as offending content, should be submitted to a victim identification clearinghouse such as NCMEC. Ideally, using the contract tracing approach, the content can be submitted detailing where the images originated from (e.g., the IP address and technology from which they were obtained). This will facilitate global victim identification by providing additional detail on currently unidentified victims, even if local resources preclude further pursuing those investigative leads.

Interviewing

Interviewing and interrogation approaches vary based on the legal system in which they operate. The PEACE approach is growing in popularity and has been effective within the United Kingdom (Shawyer et al., 2013), and its collaborative approach fits well with the contact-tracing approach to CSEM investigations. A more traditional interview/interrogation model using Reid-like techniques (Inbau et al., 2011) is potentially useful as well if there is a broader focus placed on rapport building and understanding, if the themes used align with actual offense-supportive cognitions in CSEM offenders, and if any admissions are fully corroborated with forensics to avoid false confessions. Because most if not all of the elements necessary for prosecution may be obtained forensically in many cases (and may even be identified before the interview), the focus of the interview can be redirected away from initial admissions and toward understanding the scope and specifics of when and how the subject obtained (and distributed or produced) CSEM.

In a recent survey of CSEM offenders in the United States, the majority of participants noted that investigators showed a lack of compassion, fairness, and understanding in their interview (Steel et al., 2022c). In particular, showing compassion was correlated with more full admissions of their CSEM activities. Because the development of rapport is critical and interviews tend to be most successful when investigators stress a humanistic approach (Cleary and Bull, 2019), exhibiting a better understanding of the concerns of offenders and developing themes that are consistent with their own rationalizations and do not attack self-worth.

Before the interview itself, consideration should be given to the environment in which it takes place. Ideally, the interview will occur in a neutral setting, but a law enforcement setting may be preferable to a home or work environment. CSEM offenders reported high anxiety around friends, family, and co-workers finding out about their activities (Steel et al., 2022c), and a home or work environment may increase their stress and act as an impediment toward a successful understanding-based interview. Additionally, those environments may cause early disclosure of the offender’s activities to those same individuals, resulting in additional stressors on both the offender and their unwitting and uninvolved relations.

In using an understanding-based approach with the CSEM offender, traditional offense-supportive cognitions that may be used as themes with contact offenders that rely on a lack of victim empathy or the sexualization of children may not resonate well as they tend to exhibit lower overall endorsement of traditional sex offender cognitive distortions (Steel et al., 2020). Instead, strong support for other cognitions that may lead to more effective theme development have been shown to be present in CSEM offenders. There are four specific themes that are consistent with the latest research on the cognitions of CSEM offenders (Paquette and Cortoni, 2020):

1. Digital images and videos are separate from the underlying contact abuse. There are two cognitive distortions present in CSEM offenders related to this theme – that the Nature of Harm is different, and that Virtual is Not Real (Paquette and Cortoni, 2020). Highlighting that the offender’s actions were purely virtual (with a caveat related to contact offending noted below) can facilitate admissions based on this shared understanding within the offender’s pre-existing belief system. It can also facilitate a contact tracing–based discussion on the details of acquisition and distribution without focusing explicitly on the underlying victimization.

As a final consideration in interviewing, a substantial portion of CSEM offenders may have committed a prior contact offense. The most accurate current estimates are that approximately half of CSEM offenders who are arrested have committed at least one prior contact offense against a child, though that may be partially due to a selection bias in the sampled populations (Seto et al., 2011). Because the proportion is well above zero, all interviews should, at a minimum, attempt to ascertain any prior contact offenses to identify victims. If the offender admits to CSEM activities and immediate discussions of contact offending are not practical, the use of tools such as confirmation polygraphs as part of plea agreements can help reduce the risk of missing unidentified victims (Bourke et al., 2015).

Post-interview management

CSEM offenders have a high post-interview suicide risk (Key et al., 2021; Kothari et al., 2021). In a survey of previously convicted offenders, 73% had a high suicidal ideation, and 19% attempted suicide (Steel et al., 2022c), and these numbers do not include individuals who took their own lives. There is also evidence that a substantial number of CSEM offender suicides occur within the first 48 h after their initial interview (Hoffer and Shelton, 2013). The impact of CSEM offender suicide is not limited to the offender – law enforcement investigating the CSEM offense and those responding to the suicide, as well as relatives that already have a difficult time adjusting to the disclosures of the offense may have additional psychological strain as a result. Additionally, victims depicted may not be able to pursue financial compensation or get closure (Hoffer et al., 2010) following an offender’s suicide. Because of this, investigators should have a plan for reducing suicide risk in place for all CSEM investigations. Reduction in suicide risk starts with the interview – a compassionate approach to the offender as noted will begin the process on sound footing based on trust.

The most immediate post-interview intervention should be to engage the offender and assess and plan for any suicidality. From an investigator standpoint, a modified crisis response plan approach (M-CRP) can be used (Rudd et al., 2001). The M-CRP has three main components. First, an assessment of any immediate suicidal risk and associated mechanisms should be undertaken. Second, a contact plan should be put in place. Finally, the investigator should fully explain the next steps in the legal process that will occur.

To begin the process of assessing immediate suicide risk, the investigator should ask the offender what their next steps are – how they are doing overall, where they are planning to go and what they are planning to do immediately after the interview. Asking the subject if they are considering taking their own life as appropriate, and how they are considering doing so, can then occur. Under M-CRP, steps to remove implements that would facilitate suicide should be taken. This can consist of a voluntary surrender of firearms to law enforcement or to a trusted third party the subject designates. If suicidal ideation is suspected, the investigator should assist the subject in making contact with an appropriate counselling service, whether local or through a national suicide helpline. In cases where there is a suspected immediate risk of self-harm, a 72 h involuntary commitment can be considered.

Based on the subject’s responses to what their next steps are going to be (and many may not have any idea what their next steps are), the investigator can assist in planning a short term protection strategy, which leads to a basic contact plan. The investigative agency should have a previously prepared pamphlet for all subjects that provides contacts to mental health crisis intervention staff as well as to organizations such as StopItNow (StopItNow – About Us, 2020), which can assist subjects as well as family members. The investigator should elicit from the subject the names of individuals that they can personally discuss their situation with and encourage the subject to write them down as part of the M-CRP. This can include friends, family, clergy or colleagues that they trust.

Finally, the investigator should discuss the next steps in the legal process with the subject and provide estimated timeframes for each step. Because many CSEM-only offenders have no prior criminal record (Seto and Eke, 2005), they are likely to be unfamiliar with the steps in the criminal justice system. Questions about returning seized equipment, court appearances and notifications are common. If possible, prosecutors should avoid press releases at the time of arrest to allow subjects the time to notify their friends and family in their own manner and avoid putting in place an additional, immediate strain.

Mental health for investigation staff

Law enforcement, in general, is a stressful career field, with departmental issues and operational interactions causing increased risk for mental (and physical) health issues (Toch, 2002). Investigators and forensic staff working crimes against children cases face additional stressors, including social isolation from colleagues and secondary traumatization from viewing explicit depictions of abuse. In a study of Internet Crimes Against Children (ICAC) taskforces, 35% reported individuals experiencing negative life impacts including sexual dysfunction, personal and family difficulties, and job performance issues (Wolak and Mitchell, 2009). In particular, sworn law enforcement officers that also perform digital forensics examinations appear to be the highest risk for secondary traumatic stress issues (Seigfried-Spellar, 2018).

Current technological and environmental changes can exacerbate the problems facing CSEM investigative staff. The more sensory engagement in content, the higher the level of immersion, and therefore the greater potential for secondary traumatic stress. The shift to video (Bursztein et al., 2019; Krone et al., 2017; B. Westlake et al., 2017; Wolak et al., 2011) as the preferred medium over still images has increased immersion through the depth provided by moving images and the inclusion of audio sensory content as well as the increased time-on-target required to review the content. Virtual reality SEM has the potential for even greater immersion (Simon and Greitemeyer, 2019) and secondary traumatic stress. At the same time, telework is increasing (López-Igual and Rodríguez-Modroño, 2020), compounding potential social isolation issues (Pietrabissa and Simpson, 2020). There are several best practice considerations for departments related to the CSEM investigations policies and practices that are emerging:

1. Modification of work environments. Environmental design to reduce isolation for crimes against children staff moved working environments from closed-door units to digital labs with open floorplans, using monitor shields and headphones to limit exposure while reducing social isolation in recent years. The COVID-19 pandemic increased overall telework on a potential permanent basis (López-Igual and Rodríguez-Modroño, 2020), including for law enforcement and forensics personnel. To reduce contact exposure, many digital forensics labs have gone virtual, which has forced personnel to review offending content in a socially isolated ‘sandbox’ environment. In addition to well-practised strategies of taking frequent breaks and switching between tasks, new options are needed. One option being piloted by several departments is the issuance of dual monitors to staff, so that individuals can have an always-on video connection with colleagues on one screen while reviewing explicit material (with appropriate controls for the home environment) on the other, reducing social isolation without increasing exposure. More research and additional strategies will be needed as more labs utilize virtual reviews.

Future research

This paper highlights several areas where there is limited empirical research available. A few of the high importance areas that would inform more effective policing of CSEM offenses are as follows:

1. CSEM propagation. There are technology-specific studies looking at individual areas such as CSEM persistence (Bissias et al., 2016), there have been no large-scale studies looking at the overall propagation of CSEM from production through extinction (or end state persistence). Understanding how content is distributed and how it crosses between different virtual lawless spaces may provide insights into deterrence and lead to more effective contact-tracing approaches.

Conclusion

This work presented a summary of current CSEM research that is directly applicable to policing, with best practice recommendations for rethinking the approach to CSEM investigations suggestions for evolving approaches to investigative activities based on current technological and work environments. As technology advances and our understanding of CSEM offenders and their behaviours deepens, investigative approaches will continue to improve from an ever-growing evidence-based, empirical foundation.