Abstract
Live streaming of child sexual abuse (CSA) involves the procurement and viewing of sexual abuse of children across the internet in real time, in exchange for money. These offenses leave little tangible evidence of the offense beyond a financial transaction, and metadata relating to the live-streaming session. This research analyzed the demographic, criminal history, and financial transaction characteristics of 209 individuals who live streamed child sexual abuse. A machine learning clustering technique was implemented to consider whether there were sub-groups present among these offenders, and in particular the prevalence of contact sexual offending among any detected sub-groups. Findings revealed that offenders tend to engage in live streaming around the same age, before making regular transactions with facilitators at brief intervals, with the majority of offenders featuring limited criminal history. This analysis identified a notable sub-group of live-streaming offenders that also engaged in contact sexual offending. This is the first study to empirically demonstrate an intersection between live streaming of CSA, and contact sexual offenses against children and adults. This research highlighted the importance of financial transactions data in detecting, and disrupting this crime type. Further, the identification of an intersection between live-streaming CSA offenders, and contact sexual offenders suggests that these individuals may pose a risk to both local and international communities.
Keywords
Introduction
Live streaming of child sexual abuse (CSA) is a unique and technologically enabled crime. First acknowledged in the mid-2000s (Huang et al., 2009), CSA live streaming features the procurement and viewing of sexual abuse of children across the internet in real time, in exchange for money (Açar, 2017; Europol, 2019). This crime type often involves a third-party who facilitates the offense (Ramiro et al., 2019; Terre Des Hommes, 2014). The nature of CSA live streaming results in barriers to monitoring by authorities, and prosecution, with little tangible evidence of the offense beyond a financial transaction (Açar, 2017). However, the harm to victims of technologically enabled abuse is substantial, and consistent with contact offenses (Puffer et al., 2014). Although some analytical evidence has emerged (Brown et al., 2020; Cubitt et al., 2021), the technologically and financially enabled nature of these offenses (Europol, 2019) mean data are difficult to obtain, and when available, samples are often small.
The evolving nature of mobile technology, and internet access, has created a difficult environment to police (WeProtect Global Alliance, 2019). Financial transactions made by individuals involved in CSA live streaming are difficult to identify, and as a result little is known about large-scale trends. While notable development has been made in understanding offense methodologies, including locations, drivers, and functional processes, comparatively little is known about the individuals that engage in these offenses (WeProtect Global Alliance, 2019). To enable a better understanding of this crime type, more must be known about offenders. The present research intends to expand the understanding of offenders that engage in CSA live streaming, by focusing on their demographics, criminal history, and the characteristics of the financial transactions used to procure live streaming of CSA. To do this, we employ an unsupervised machine learning technique to iteratively identify and compare latent sub-groups within a sample of CSA live-streaming offenders.
Literature Review
What We Know About the Live Streaming of Child Sexual Abuse
CSA live streaming is also known as “webcam child sex tourism/abuse” (Masri, 2015; Puffer et al, 2014; Terre des Hommes, 2014), “cybersex trafficking” (International Justice Mission, 2019) and “live distance child abuse” (AUSTRAC, 2019; EFC, 2015). Media articles reported live streaming of CSA occurring in the Philippines as early as 2008 (de Leon, 2013). Despite this, empirical research considering the characteristics of CSA live-streaming sessions, and offenders, is scarce. In one of the few studies considering these offenses, the Internet Watch Foundation (IWF) conducted an international analysis of over 2,000 image and video captures from live-streamed sexual abuse of children (IWF, 2018). The IWF found that 98% of victims in the sample were aged 13 years or younger, and 28% were aged 10 years or younger, with 40% classified as containing serious sexual abuse, including the rape and torture of children (IWF, 2018).
CSA live streaming is distinct from other child sexual abuse material shared on the internet largely due to the offense occurring in “real time.” Offenders often request the type of abuse either before or during the live-streaming session (Açar, 2017; ECPAT International, 2018; Europol, 2019; GACSAO, 2016; Napier et al., 2021). Research featuring interviews with Child sexual abuse material (CSAM) investigators noted the challenges for law enforcement investigations, as live streaming leaves no visual evidence of the abuse apart from session logs and data usage. As a result, police rely on money transfers, and call histories for evidence during investigation (ECPAT International, 2018). While the barriers to detection of CSA live-streaming offenses may be substantial when compared with the creation and sharing of CSAM material, it is possible that the difficulties detecting these offenses are similar to those of contact child sex offenses, including barriers to reporting by victims.
While this crime occurs in multiple countries (Europol, 2019), the Philippines has been identified as the “hub” from which CSA live streaming emanates (AUSTRAC, 2019; ECPAT International, 2018; EFC, 2015; Europol, 2019; Puffer et al. 2014). There appear to be several drivers of CSA live streaming emerging from the Philippines, including poverty, English language proficiency, well-established remittance services, and strong internet coverage (Batha, 2016; ECPAT International, 2018; Puffer et al., 2014). The high global demand for CSA live streaming (Terre des Hommes, 2014), coupled with the poverty experienced in vulnerable countries appears to be a key driver for this crime type. The exploitation of vulnerable populations, and considerable power imbalance between offenders and victims contributes to the sinister nature of this crime type. While the present research considers offenses emerging from facilitators of CSA live streaming in the Philippines, it bears note that there are a range of countries that meet the similar characteristics of those suggested as supporting this crime type. Although current research identifies the Philippines as a hub for these offenses, as further research emerges, it is possible that other locations, and cohorts may be identified relating to CSA live streaming.
The financial element makes CSA live streaming different from, for example, CSAM offenses, where images and videos are mostly shared freely on the internet or traded for other CSAM (Europol, 2019). It also differs from online sexual solicitation of children, where money is rarely exchanged. An analysis of chat logs from 179 offenders who solicited children online (DeHart et al., 2017) classified only a small sub-group as “buyers” of sex with children (13%, n = 23). Given that CSA live streaming is usually accompanied by a financial transaction (Europol, 2019), analyzing these transactions is a key method for both detecting and understanding the offending behavior.
Current research into online child sexual offenders has focused on CSAM and online solicitation offenders. Offenders who engage with CSAM and solicit children online have been categorized as younger, with limited employment and, consequently, limited access to finance compared with the general population (Babchishin et al., 2011). Babchishin et al. (2015) conducted a meta-analysis of 30 studies produced between 2003 and 2013 from the US, Canada, and the UK, finding that offenders that only accessed CSAM differed significantly from contact sexual offenders on a range of characteristics. Contact offenders were more likely to have access to children, score higher on antisocial personality measures, and more frequently commit minor offenses, than CSAM-only offenders. Additionally, Dowling et al. (2021) found that only a small proportion of CSAM-only offenders subsequently commit a contact child sexual offense.
Exploitation of children online appears to have increased over time, a trend that may have been aggravated by factors that emerged during the COVID-19 pandemic. While the drivers are unclear, there was a reportedly concurrent disruption to professionals that work to limit CSA live streaming (Salter & Wong, 2021). Additionally, reduction in victim support, and prevention initiatives resulting from pandemic disruptions, coincided with increased online and technologically enabled CSA activity (Salter & Wong, 2021). Given the current paucity of literature relating to CSA live-streaming offenders, we cannot be certain of the likelihood that these offenders, or a proportion of these offenders, may engage in contact sexual offending. It is pivotal to our understanding of these offenses, and the individuals that commit them, that some insight be gained into the relationship between CSA live streaming and contact sexual offending.
Characterizing Online Child Sexual Offenders
Previous research in adjacent fields considering contact sexual offending has adopted a range of approaches to explaining this phenomenon, including the motivation–facilitation model of sexual offending. This model suggests that paraphilia, high sex drive, and intense mating effort are each important motivations for online and offline sexual offenses (Seto, 2019). Alternate approaches include situational crime prevention, in which environmental or “situational” factors (e.g., access to children or CSAM) play a crucial role in an individual’s decision to sexually offend (Smallbone & Cale, 2016; Wortley & Smallbone, 2006).
Considering CSAM, and online solicitation offenders, qualitative analyses focusing on offending motivations, methodology, and use of language online, have suggested typologies, or sub-groupings of offenders (DeHart et al., 2017; Krone, 2004; Merdian et al., 2016; Powell et al., 2021). Based on an analysis of language use in online chats, Powell et al. (2021) identified three distinct “clusters” of online solicitation offenders based on the language they used with child victims. These clusters were identified as impetuous, opportunistic, and devious offenders, referring to those seeking immediate gratification, those who were content to wait for an opportunity to arise, and those that were comfortable being patient but were more likely to display aggression in solicitation efforts (Powell et al., 2021). Similarly, in other research, CSAM offenders that accrued more prior offenses, were identified as more likely to reoffend through either online CSAM, or contact sexual offenses (Seto & Eke, 2015).
The paucity of literature specifically considering CSA live streaming has resulted in limited understanding of offenders, or offending. Given the success of prior research in classifying small samples of online sex offenders into typologies, and sub-groups (DeHart et al., 2017; Krone, 2004; Merdian et al., 2016; Powell et al., 2021), the present research considered whether there are also distinct subgroups of CSA live-streaming offenders. In particular, we consider whether certain subgroups are more likely to engage in contact sexual offending than others. This approach was driven by the scarcity of research into the characteristics of CSA live-streaming offenders, and the role that an understanding of this offender population, and its subgroups, may play in investigation, disruption, and prevention.
The Present Research
Research Questions
While the body of research considering technologically enabled CSA is emerging, comparatively little is known about the characteristics of offenders. The intention of this research is to consider the characteristics of CSA live-streaming offenders; we therefore pose three research questions:
To what extent are the CSA live-streaming offenders, among this sample, a behaviorally homogenous group? In particular, do they onset of offending around the same age, and feature similar criminal histories?
If there are identifiable sub-groups within these data, what are the key differences between groups?
Are some subgroups more likely to engage in contact child sexual offending?
The data
To consider these questions, data were linked from two sources. The Australian Transaction Reports and Analysis Centre (AUSTRAC) collects and stores financial transaction data with the intention of detecting financial crime by individuals and businesses in Australia. Transaction data recorded by AUSTRAC may include amounts and dates, receiver details (including country), payment type, payment provider details, demographic data of the payer, and risk-related information on suspicious transactions. The Australian Criminal Intelligence Commission (ACIC) collects and stores comprehensive criminal history information on individuals in Australia via the National Police Reference System (NPRS). Information stored in the NPRS features charges and convictions for criminal offenses occurring in any jurisdiction in Australia, including the dates of offending, and demographic data on suspects and offenders (ACIC, 2019).
In 2018, the Philippine National Police and the Philippine National Bureau of Investigation provided the Australian Federal Police with a list of 118 individuals arrested in the Philippines for facilitating the sexual exploitation of children (facilitators). The AFP provided the identities of these facilitators to AUSTRAC, who, using their financial transaction data holdings, identified 299 Australia-based individuals that had sent funds to these 118 known facilitators of child sexual exploitation in the Philippines. Transactions data from AUSTRAC, and criminal history data from the ACIC were linked using demographic data, and a unique individual identifier. Low confidence matches, in which we could not be certain that the criminal history referred to the individual making the transactions, were excluded, resulting in a dataset of 256 de-identified individuals. Data were then aggregated into a unit-record dataset, with data for each available variable referring to a unique individual that had processed transactions with facilitators between January 2006 and February 2019. Where demographic characteristics of individuals were unavailable, they were excluded from analysis. A final dataset of 209 individuals that engaged in at least one transaction with known facilitators of CSA live streaming was available for analysis, featuring demographics, transaction characteristics, and criminal history. Given the sensitive nature of this research, the process of gathering and management of these data was developed in close consultation, with a Human Research Ethics Committee, with the cleaning and analysis of the data approved and overseen by the same committee.
Additional Variables
Several additional variables were generated for analysis. A prolific live-streaming variable was produced, as suggested by Cubitt et al. (2021). It was unusual for CSA live-streaming offenders to transact more than 20 times. A binary variable was therefore developed to identify whether an individual transacted in high volume (21 or more transactions) with a facilitator.
In addition to prior offense type variables, a variable was produced representing the harm resulting from prior offenses. Crime harm is emerging as a valuable measure of offending that accounts for the impact of offenses rather than the volume (Ashby, 2017). Specific to the Australian context, the Western Australian Crime Harm Index (WACHI) assigns a harm index weighted by court penalties (House & Neyroud, 2018). Prior research in Australia has operationalized this harm index to measure the extent of harm among criminal groups (Cubitt & Morgan, 2022; Morgan et al., 2020). Here, the WACHI was applied to the criminal history of each individual in these data, prior to their first live-streaming transaction, to provide two measures, the total harm produced by prior offenses for each individual, and the mean harm produced per prior offense. The full set of variables included in this analysis are described in Table 1 of the results.
Demographic and Transaction Characteristics of the Sample of CSA Live-Streaming Offenders.
Note. CSA = child sexual abuse; AUD = Australian dollars.
Data Limitations
While we can be certain that each transaction was to a facilitator of CSA live streaming, we cannot be sure that every transaction was for CSA live streaming. For example, it is possible that some transactions were for contact sexual offending against children (if offenders traveled to the Philippines) or for live adult webcam shows not involving children. However, in consultation with law enforcement subject-matter experts, it appeared unlikely the transactions were for contact sexual offending given such purchases are usually made with cash in the destination country (Brown et al., 2020). Therefore, it is unlikely that these Australia-based individuals were sending money to facilitators for reasons other than child exploitation, and at the very least we can be confident that the vast majority of transactions considered here reflect CSA live-streaming transactions. The transactions analyzed here relate to the outcomes from a large law-enforcement operation in the Philippines that identified a cohort of Australians sending money to known CSA live-streaming facilitators. The extent to which this group is representative of all individuals who purchase CSA live-streaming sessions, or whether they are specific to the facilitators considered here, is unclear.
Analytical Process
K-Means
K-means is a centroid-based clustering algorithm (Bora & Gupta, 2014), that is particularly useful in uncovering latent groups in complex data (Brennan & Oliver, 2013). K-means has been used to uncover latent behavioral groupings, and typologies, among a range of intimate partner violence, and interpersonal violence domains (Boudoukha, 2013; McKinney et al., 2016; Serie et al., 2017; Thijssen & de Ruiter, 2010). Importantly, k-means has demonstrated efficacy in identifying characteristic, and behavioral subgroups among perpetrators of crime that may be used in clustering and better understanding individuals that commit those offenses (Mach et al., 2017). The intention of this research was to consider whether there were previously unknown sub-groups within the larger group of CSA live-streaming offenders, a task for which k-means has demonstrated utility.
Given the number, and ensemble of sub-groups within these data were unknown, we implemented a cascading process for identifying clusters of CSA live-streaming offenders. First, the Hopkins statistic was implemented; this metric was employed to identify whether these data were or were not clusterable (Banerjee & Dave, 2004). The optimal number of clusters (k) must then be identified prior to implementation of the k-means algorithm. To do this, we employed the elbow method (Maheswari, 2019) to identify how many latent clusters were present in these data; we then confirmed this number using the gap statistic (Maheswari, 2019; Tibshirani et al., 2001). With the optimal number of clusters identified, we then employed k-means for analysis (Amer, 2020; Jain & Dubes, 1988).
To provide a visual representation of k-means clusters, we separately computed a Principal Component (PC) Analysis (PCA). PCA is used to condense several variables into, in this instance, two vectors, that best describe the extent to which individuals are similar or different. In the PCA cluster plot provided here, the first and second PCs are selected, and plotted on the x and y axes, titled Dim1 and Dim2 respectively. In brackets, on each axis, the proportion of variance accounted for by each PC is provided.
Metrics used to evaluate k-means
To assess the performance of k-means, the Silhouette coefficient was used. The silhouette coefficient measures how well clusters are separated, with the mean silhouette coefficient identifying the reliability of the clusters produced by k-means (Batool &Hennig, 2021). A silhouette coefficient is between −1 and 1 (Lleti et al., 2004). A negative score indicates that there is low confidence in the clustering of the associated data, while a positive score indicates that we can be confident in the accuracy of data attributed to that cluster.
The characteristics of each cluster of CSA live-streaming offenders were then compared, with a focus on considering the nature of, and any differences between, these latent groups. Analysis was performed using statistical analysis software, R, and the “dplyr,” “cluster,” “geosphere,” and “factoextra” packages.
Results
The Hopkins statistic was computed to test the tendency of these data to cluster; if the Hopkins statistic for these data was greater than 0.5, clustering would be considered a poor analytical methodology. Here, the Hopkins statistic returned 0.027, meaning there was high confidence that these data were clusterable, and k-means appears to be an appropriate methodology for analysis.
CSA live-streaming offenders appeared to exhibit onset of other criminal behaviors at a younger age than live streaming. Table 1 suggests, that among those that featured a criminal history, offending began prior to onset of transactions to facilitators of live streaming. The mean number of offenses by this group was relatively low, with most common offenses being relatively minor, including speeding, theft, and public order offenses, reflected in the low mean harm produced by offenses. However, after onset of live streaming, these offenders appeared to be persistent, with a mean of 12.23 transactions to live-streaming facilitators. These transactions were at brief intervals, with a median of less than a month between transactions, and for relatively low financial value, with a median of 65.41 Australian dollars per transaction.
Latent Cluster Quality and Content
Figure 1 suggested that clustering these data into three distinct groups was most appropriate, with a strong mean silhouette width of 0.79 for three clusters. Notably, the difference between two and three clusters was only a marginal improvement in cluster accuracy. The gap statistic presented in Figure 2 confirmed that three clusters was optimal, however, it also confirmed that the difference between two and three clusters was marginal. As noted later in these results, the third cluster featured only a small number of individuals.
The elbow method to identify the optimal number of clusters.
The gap statistic to confirm the optimal number of clusters
Silhouette coefficients for each individual cluster were computed, and provided visually as Figure 3. The first, and largest cluster consisted of n = 178 CSA live-streaming offenders (Silhouette coefficient = 0.92). Cluster 2 comprised of n = 28 (Silhouette coefficient = 0.48) again featuring strong confidence in the clustering. Finally, Cluster 3 was a difficult group to cluster (Silhouette coefficient = 0.20), and only featured three individuals (n = 3).
Silhouettes for clusters CSA live-streaming offenders (mean silhouette width = 0.79).
The small number of individuals in Cluster 3 appeared to feature similar characteristics to Cluster 1. The primary difference, and reason that these individuals were separated out into a different cluster was the value of financial transactions to facilitators. Individuals in Cluster 3 processed substantially higher value transactions per CSA live-streaming session, than those in either of the remaining clusters. However, outside of transactions, their characteristics were notably similar to individuals in Cluster 1, reflected by the PCA locating this small cluster as within the bounds of Cluster 1 (Figure 4).
Clusters of CSA live-streaming offenders.
The Characteristics of CSA Live-Streaming Offenders
The third cluster consisted of only three individuals, the primary difference being the median transaction value of these individuals was 2,733.4 Australian dollars (AUD). While this transaction value made them identifiable as a separate cluster, they were in no other way discernable from Cluster 1. As a result, these three individuals were separated from the remaining analysis, which focuses on the two primary clusters.
Table 2 provides demographic and transaction characteristics for clusters identified by k-means, Table 3 provides the mean number of offenses committed per individual in each cluster. Cluster 2 was a notable sub-group, featuring 13.4% of the sample. The age of onset of live streaming was similar; however, the onset of non-live streaming offending in Cluster 2 was earlier; these individuals also featured a larger number of criminal offenses on average. While Cluster 2 were more prolific in other crime types, on average they engaged in fewer live-streaming transactions. Despite this, the proportion of high-volume live streamers (21 transactions or greater) was similar in each group. While Cluster 2, on average, engaged in fewer live-streaming transactions, the time-intervals between these transactions were notably shorter than those of Cluster 1.
Demographic and Transaction Characteristics of Latent CSA Live-Streaming Clusters.
Note. CSA = child sexual abuse; AUD = Australian dollars.
Number of Offenses per Individual in Latent CSA Live-Streaming Clusters.
Note. CSA = child sexual abuse; AUD = Australian dollars.
Table 3 focuses on the comparative offense rates, prior to the first instance of CSA live streaming. Individuals in Cluster 2 were notably more prolific across all crime types, however particularly those that produced substantial harm, such as assault, break and enter, public order, theft, and drug offenses. Despite comprising the majority of these data, individuals in Cluster 1 did not feature in any recorded contact sexual offenses against either adults or children. Comparatively, individuals in Cluster 2, featured in notable rates of contact offending against both adults and children.
These findings suggested that there were two demonstrably different groups among these CSA live-streaming offenders. Cluster 1 made a larger number of transactions, and appeared to spend a higher median value per transaction; when they did offend outside of CSA live streaming, this group exclusively did not feature in recorded contact sexual offenses. Cluster 2, however, featured in a notable rate of contact sexual offenses, and were also responsible for a comparably high rate of non-sexual violent offenses. These findings suggest that, while the majority of CSA live-streaming offenders in this sample specialized in online victimization of children, there was an important sub-group, comprising 13.4% of the sample, that engaged in other crime-types, importantly a relatively high rate of contact sexual offending against both adults and children.
Discussion
Due to the noted difficulty detecting CSA live-streaming offenses, our understanding of these offenders, and their offense methodologies, is only emerging. As a result, there is little comparison available in the literature for the characteristics of offenders that engage in CSA live streaming. This research represents the first empirical evidence suggesting an intersection between CSA live-streaming offenders, and contact sexual offenders. However, it appears that, among this group, the majority of CSA live-streaming offenders specialized in online offending, and did not appear to commit other times of criminal offenses, contributing to the noted detection difficulties for this offender group.
In considering the neighboring field of CSAM engagement, Knack et al. (2020) suggested elements of habituation and compulsion. The time periods between offenses suggested that an element of compulsion may feature among the present sample; however, there was a notable difference between the two primary clusters. Cluster 1, featuring specialist CSA live-streaming offenders, transacted with facilitators roughly once per month, while individuals in Cluster 2, a group of more generalist offenders, transacted more than twice as frequently. The former group were more likely to be persistent, with a higher overall number of transactions than the latter group. Although it is likely that, by virtue of being more prolific violent and contact sexual offenders, the latter group may be detected before the specialist CSA live-streaming group. The brief time periods between live-streaming sessions among Cluster 2, and persistent nature of these offenses, suggests this sample may have features of compulsive behaviors as described by Knack et al. (2020).
Contact Offending Among CSA Live-Streaming Offenders
The majority of CSA live-streaming offenders in this sample had little to no history of criminal offending, and had no recorded contact sexual offenses against either adults or children. The offense types that were most often committed by these individuals produced limited harm, suggesting that they were largely a homogenous offending group, that almost exclusively engaged in the online sexual abuse of children. However, findings suggested that there was a notable sub-group within this sample of CSA live-streaming offenders, featuring offline offending behaviors that differentiated them from the rest of the sample. Compared to Cluster 1, Cluster 2 were more prolific among every offense type, and onset of offending behaviors notably earlier. Pivotally, this sub group committed a significant rate of contact sexual offenses alongside CSA live streaming.
Among CSAM offenders, research suggests that the rate of recorded sexual offenses may be substantially lower than the rate of self-reported contact offending (Seto, Hanson and Babchishin, 2011). While the sample here is marginally different to CSAM offenders, it is possible that the actual rate of offending, particularly sexual offending, is higher than the rate that is detected, and recorded. However, based on recorded criminal offenses available to this analysis, Cluster 1 and Cluster 2 appear to be two distinct groups of offenders. The identification of a specialist CSA live-streaming cluster, and a separate cluster that committed violent and contact sexual offenses, aligns with previous research into CSAM offending. Henshaw et al. (2018) found that mixed offenders who commit both CSAM offenses and contact sexual offenses feature a higher degree of antisociality, while Babchishin, Hanson and VanZuylen (2015) note that they also tend to engage in a higher rate of violent offenses than CSAM-only offenders. Although it may be a relatively intuitive finding, research in this field has, to date, lacked empirical evidence that CSA live-streaming offenders may also engage in contact sexual offending. While we rely on recorded offenses for this analysis, it appears that there is an intersection between CSA live-streaming offenders, and violent and contact sexual offenders.
Implications of the Use of Financial Transactions in Offenses
Monitoring of financial transactions is a central aspect of detecting these offenses. In Australia, AUSTRAC monitors certain classes of transactions, for example, any international fund transfers regardless of the value are subject to monitoring and reporting requirements (Anti-Money Laundering and Counter Terrorism Financing Act 2006 (Cth)). However, these reporting requirements are unique to Australia. In 2006, the United States Department of Treasury produced a discussion paper on the feasibility of a cross-border electronic funds transfer reporting system (U.S. Department of Treasury, 2006), concluding that a federal monitoring framework may improve detection of crimes involving international financial transfers. However, to date, there remains no central monitoring of international funds transfers in the United States. The United Kingdom are subject to similar reporting limitations. In 2021, G20 countries agreed to improve the ease of cross-border financial transactions; however the implementation of centralized monitoring approaches was delayed (Financial Stability Board, 2021), leaving UK regulatory agencies with limited visibility of international funds transfers.
It is an important implication for detection of these offenses that monitoring frameworks such as those that facilitated this research do not exist in the United States, or United Kingdom. While it would significantly benefit detection methodologies if these frameworks were implemented, until such regulations are imposed, opportunities for improving detection of this crime type principally relate to multi-agency partnerships. Financial institutions (banks, credit-card companies, and money service businesses) hold and consistently analyze data on financial transactions (FFIEC, 2020); these likely include transactions made by CSA live-streaming offenders. In the United States, the Fedwire, and the Clearing House Interbank Payment System (CHIPS) are the two primary payment systems for money transfer (FFIEC, 2021). The information held by these services presents an opportunity for partnership with law enforcement, that may help in the detection of CSA live-streaming offenses (Batha 2016; ECPAT International 2018; Puffer et al. 2014).
Implications of these Findings
The volume of cross-border transactions suggests that manual detection of CSA live-streaming transfers is impractical; for this reason machine learning techniques are increasingly applied to financial transactions data for the identification of potential criminal offenses. For example, fraud (OECD, 2021; Nandi et al, 2022), tax avoidance (Korsell, 2015), money laundering, and terrorism financing (Canhoto, 2020) are common applications. However, to detect these offense types, the characteristics of transactions, and offenders, must first be known. Findings in the present study demonstrate that where data are available, machine learning analytics may discern coherent groupings of CSA live-streaming offenders. These types of modeling offer an opportunity for identification of transactions among linked data from financial services, and law enforcement, that adhere to the characteristics of CSA live-streaming transactions. For example, considering financial data, transaction intervals, transaction value, and transfer locations offer opportunity for refining risk indicators. When linked with offending data, recorded criminal history may considerably refine risk indicators. Not only is flagging suspicious transactions that appear similar to CSA live-streaming transactions a reasonable prospect, given the noted differences in financial and offending characteristics between the clusters identified, it appears that stratifying suspicious transfers by risk may also be feasible.
These findings suggest that typologies developed among smaller samples of CSAM offenders may have similarities to CSA live-streaming offenders, at least to the extent that they both feature a subgroup more likely to engage in contact sexual offending (Krone, 2004; Merdian et al., 2016). However, when considered in conjunction with the frequency of transactions among Cluster 2, there may be an element of compulsion, and persistence among these offenders not previously identified. This notion, described by Knack et al. (2020) centers on the frequency of CSA live streaming, and in particular, the intersection of compulsive behavior and the likelihood of engaging in contact sex offenses in addition to CSA live streaming. While further research is required to confirm this effect, there are potentially significant implications for management and judicial decision making, relating to these offenders.
The present research is the first to empirically identify an intersection between CSA live-streaming offenders, and contact sex offenders. While this is a niche group of offenders, as the research base grows, it appears that this crime type is increasingly prevalent (Salter & Wong, 2021). Findings from the present research hold important implications for the monitoring of international financial transactions, multi-agency collaboration, and the implementation of machine learning analytics in support of detection of these offenses.
This research was limited in its ability to consider the diversity of the population studied, as there was no demographic information regarding cultural background, and these offenders were exclusively male. However, we were able to focus on the diversity of offending in relation to age. There are a few crime types that have an onset as late in age as that for live streaming of CSA; however, the findings here suggested that regardless of cluster and offending frequency, onset of CSA live streaming most commonly occurred after the age of 50. While this is a limitation of the offender sample, we focus on the underrepresentation of victims of this offense type among literature. This research employed data in which victims were exclusively children in the Philippines. The live streaming of CSA is facilitated by factors including poverty, well-established remittance services, and strong internet coverage (Batha, 2016; ECPAT International, 2018; Puffer et al. 2014), and have the greatest impact on a population with little ability to report, or prosecute offenders. The substantial power imbalance between offender and victims of these offenses serves to underscore the importance of research into offense methodologies, offenders, and possible disruption approaches, to limit the ability of offenders to exploit this vulnerable population.
Limitations
While the limitations relating to these data are set out previously, it is notable that we cannot be certain whether the 118 facilitators from which these data emerge, are comprehensive. It is likely that this is a sub-sample of active CSA live-streaming facilitators and ultimately, while this research establishes valuable steps in understanding these offenders, findings should be considered as relating to Australia-based offenders, and relating to the group of detected facilitators. It is possible that, as further data emerges from different locations or offender cohorts, research may find greater variation in the characteristics of these offenders and their offense methodologies. Further, while we use the metric of transactions to indicate live-streaming events, it is possible that each transaction does not relate to a single live-streaming event. Given the differing financial value of these transactions, it is possible that individuals in these data were processing payments in fragments to avoid detection. Alternatively, larger financial transactions may have been intended to procure more than one CSA live-streaming event.
Given the paucity of research in this field, we have chosen to situate these findings among the literature considering online child sex offending, including the production and sharing of CSAM, and online solicitation of children. However, as research continues to become available, it may be important to compare the characteristics of CSA live-streaming offenders to those of sex trafficking offenders, and sex tourism offenders. Although access to data on offenders in these fields is also limited, it is possible that the characteristics of these offenders may bear similarity to CSA live-streaming offenders.
Limitations of k-means
K-means implicitly assumes that all clusters have the same radius; when this assumption is violated, the resulting clusters may behave in an unusual way (see Raykov et al., 2016 for examples). To ensure this analysis did not violate the clustering assumptions of k-means, we produced the PCA plot alongside cluster findings. While there were some outliers, these were reasonable outliers when compared with the data. Additionally, k-means assumes that the number of clusters in the data is known prior to analysis (Raykov et al., 2016). Given this research sought to identify latent sub groups through clustering, this was not the case here. To address this limitation, the number of clusters was determined by using the elbow method, and validated using the gap statistic, to minimize within-cluster outliers. As a result, the clusters produced here were robust, with the silhouette coefficient suggesting high confidence in the clustering decisions of k-means. However, it bears note that future research employing a supervised learning methodology may improve understanding of model accuracy, if the dataset supports this approach.
Conclusion
Live streaming of child sexual abuse is a technologically, and financially enabled crime type, that is difficult to both detect and disrupt. While evidence is emerging regarding offending methodologies, it is pivotal to better understand the characteristics of these offenders. This research suggests that CSA live-streaming offenders may predominately be specialists; however, there was a notable sub-group that also engaged in contact offending against both adults and children. These appear to be prolific and persistent live-streaming offenders, and while their criminal histories may vary, they tended to onset of live-streaming offending around the same age, before making regular transactions with facilitators at brief intervals. These offenses attract limited attention due to their transnational nature, minimal visibility, and there being little forensic evidence of each occurrence. Despite this, it is an insidious and exploitative crime type, that produces significant trauma among victims. This research offers insight into the offending behavior, and criminal histories of those that engage in CSA live-streaming offenses. This is an area requiring a greater research focus, including increased empirical analysis of offender characteristics and offense methodologies to inform disruption strategies.
Footnotes
Declaration of Conflicting Interests
The author(s) declared no potential conflicts of interests with respect to the authorship and/or publication of this article.
Funding
The author(s) received no financial support for the research and/or authorship of this article.
