Comparing paedophile activity in different P2P systems

Peer-to-peer (P2P) systems are widely used to exchange content over the Internet. Knowledge on paedophile activity in such networks remains limited while it has important social consequences. Moreover, though there are different P2P systems in use, previous academic works on this topic focused on one system at a time and their results are not directly comparable. We design a methodology for comparing \kad and \edonkey, two P2P systems among the most prominent ones and with different anonymity levels. We monitor two \edonkey servers and the \kad network during several days and record hundreds of thousands of keyword-based queries. We detect paedophile-related queries with a previously validated tool and we propose, for the first time, a large-scale comparison of paedophile activity in two different P2P systems. We conclude that there are significantly fewer paedophile queries in \kad than in \edonkey (approximately 0.09% \vs 0.25%).Comment: Submitte

An overview of NuDetective Forensic Tool and its usage to combat child pornography in Brazil

In many countries, the possession of files containing child and teen pornography is a heinous crime and is desirable for law enforcement be able to detect such files in a timely manner at crime scenes. However, mainly at crime scenes, it is impossible to manually examine all files that can be stored in digital storage devices. The NuDetective Forensic Tool was developed to assist forensic examiners to identify child pornography at crime scenes. NuDetective uses automatic nudity detection in images and videos, file name comparison and also uses hash values to reduce the files to be analyzed by forensic examiners. Despite the high detection rates achieved in past experiments, the authors did not get any formal feedback of NuDetective users about its performance in real forensic cases. So, this work presents a detailed review of the four main features of NuDetective Forensic Tool, including all techniques and methods implemented, and also the results of an unpublished survey conducted to evaluate the real effectiveness of NuDetective by its Brazilian users. The results obtained showed that NuDetective is helping to arrest pedophiles and to combat the child sexual exploitation in the digital era.Sociedad Argentina de Informática e Investigación Operativa (SADIO

A systematic survey of online data mining technology intended for law enforcement

As an increasing amount of crime takes on a digital aspect, law enforcement bodies must tackle an online environment generating huge volumes of data. With manual inspections becoming increasingly infeasible, law enforcement bodies are optimising online investigations through data-mining technologies. Such technologies must be well designed and rigorously grounded, yet no survey of the online data-mining literature exists which examines their techniques, applications and rigour. This article remedies this gap through a systematic mapping study describing online data-mining literature which visibly targets law enforcement applications, using evidence-based practices in survey making to produce a replicable analysis which can be methodologically examined for deficiencies

iCOP:live forensics to reveal previously unknown criminal media on P2P networks

The increasing levels of criminal media being shared in peer-to-peer (P2P) networks pose a significant challenge to law enforcement agencies. One of the main priorities for P2P investigators is to identify cases where a user is actively engaged in the production of child sexual abuse (CSA) media – they can be indicators of recent or on-going child abuse. Although a number of P2P monitoring tools exist to detect paedophile activity in such networks, they typically rely on hash value databases of known CSA media. As a result, these tools are not able to adequately triage the thousands of results they retrieve, nor can they identify new child abuse media that are being released on to a network. In this paper, we present a new intelligent forensics approach that incorporates the advantages of artificial intelligence and machine learning theory to automatically flag new/previously unseen CSA media to investigators. Additionally, the research was extensively discussed with law enforcement cybercrime specialists from different European countries and Interpol. The approach has been implemented into the iCOP toolkit, a software package that is designed to perform live forensic analysis on a P2P network environment. In addition, the system offers secondary features, such as showing on-line sharers of known CSA files and the ability to see other files shared by the same GUID or other IP addresses used by the same P2P client. Finally, our evaluation on real CSA case data shows high degrees of accuracy, while hands-on trials with law enforcement officers demonstrate the toolkit’s complementarity to extant investigative workflows

Investigating the Availability of Child Sexual Abuse Materials in Dark Web Markets: Evidence Gathered and Lessons Learned

Child sexual exploitation and abuse (CSEA) and the associated distribution of child sexual abuse material (CSAM) are serious offences online and offline. They are exacerbated by the increased popularity of dark web markets, in which vendors and buyers can exchange CSAM while hiding their identities. The aim of this paper is to improve our understanding of the CSEA landscape in dark web markets. We reviewed and collated four groups of keywords (a total of 198) for the detection/discovery of potential CSAM on the dark web market. This allowed us to conduct a systematic data collection (i.e., scraping) on dark web markets containing CSAM to create a new text-based dataset and perform further analysis. We found that CSAM is more public in the Chinese market, but not in the mainstream English market. To illustrate this point, we detected 724 CSAM items in the two Chinese dark web markets studied, but none in the eight English markets. While the prices of these CSAM remain low, we found that there were 3,449 sales over the 44-week observation period, implying that CSAM has been commercialised to some extent. We also noticed that mainstream cloud-based data storage services were used for the distribution and sharing of CSAM. We hope that the findings presented in this paper can help relevant stakeholders to understand the CSAM landscape in the dark web market better, which in turn may be used to devise more effective countermeasures to combat CSEA and CSAM

A critical study of ISP filtering of child pornography

Information and communication technologies (ICT) are today the most used technologies for child pornography. In an attempt to reduce access to child pornography, some Internet Service Providers (ISP), in the United Kingdom, Norway and Sweden have introduced filtering systems which block access to web sites containing child pornography. The aim of this paper is to critically analyse whether the ISP filtering techniques is an effective approach to the problem with child pornography and ICT. The paper will present initial empirical findings consisting of court records, criminal investigation records and interviews with convicted offenders. This material provides information about the type of ICT that has been used for child pornography. The paper has applied critical information systems research, since this perspective is well suited to critically examine the technology used. In light of the empirical material this paper argues that although the ISP initiative to block access to child pornography is a step in the right direction, filtering is not a truly effective approach to this problem. Some identified flaws with the filtering approach will be presented. The results of this study are of great importance to both the critical IS research and professional communities, since the findings enhance the understanding of ICT and its social effects

Finding the Key Players in Online Child Exploitation Networks

The growth of the Internet has been paralleled with a similar growth in online child exploitation. Since completely shutting down child exploitation websites is difficult (or arguably impossible), the goal must be to find the most efficient way of identifying the key targets and then to apprehend them. Traditionally, online investigations have been manual and centered on images. However, we argue that target prioritization needs to take more than just images into consideration, and that the investigating process needs to become more systematic. Drawing from a web crawler we specifically designed for extracting child exploitation website networks, this study 1) examines the structure of ten child exploitation networks and compares it to a control group of sports-related websites, and 2) provides a measure (network capital) that allows for identifying the most important targets for law enforcement purposes among our sample of websites. Results show that network capital — a combination between severity of content (images, videos, and text) and connectivity (links to other websites) — is a more reliable measure of target prioritization than more traditional measures of network centrality taken alone. Policy implications are discussed

An overview of NuDetective Forensic Tool and its usage to combat child pornography in Brazil

In many countries, the possession of files containing child and teen pornography is a heinous crime and is desirable for law enforcement be able to detect such files in a timely manner at crime scenes. However, mainly at crime scenes, it is impossible to manually examine all files that can be stored in digital storage devices. The NuDetective Forensic Tool was developed to assist forensic examiners to identify child pornography at crime scenes. NuDetective uses automatic nudity detection in images and videos, file name comparison and also uses hash values to reduce the files to be analyzed by forensic examiners. Despite the high detection rates achieved in past experiments, the authors did not get any formal feedback of NuDetective users about its performance in real forensic cases. So, this work presents a detailed review of the four main features of NuDetective Forensic Tool, including all techniques and methods implemented, and also the results of an unpublished survey conducted to evaluate the real effectiveness of NuDetective by its Brazilian users. The results obtained showed that NuDetective is helping to arrest pedophiles and to combat the child sexual exploitation in the digital era.Sociedad Argentina de Informática e Investigación Operativa (SADIO