Introduction to Undercover Operations

MISSING AND EXPLOITED
CHILDREN
TRAINING & TECHNICAL
ASSISTANCE PROGRAM
An Overview of Technology Used in
Child Exploitation Cases
Steve Del Negro, Ret. MA State Police and ICAC Task Force Commander
Webinar Information
This webinar is supported by grant 2014-MC-FX-K046,
provided by the Office of Juvenile Justice and Delinquency
Prevention (OJJDP), and is brought to you by the ICAC
Training & Technical Assistance Program. Points of view or
opinions in this document are those of the author and do not
necessarily represent the official position or policies of the
U.S. Department of Justice or Fox Valley Technical College.
ICAC Training & Technical Assistance is a program of the Fox
Valley Technical College-National Criminal Justice Training
Center (NCJTC).
During the Webinar
• All attendees will be muted.
• If you desire to ask a question, please use the
questions section of the GoToWebinar dialogue
box, typically on the right side of your screen.
• Please do not raise your hand for questions, we
can not unmute you.
• Questions will either be answered directly by a
panelist or asked to the presenter who will
answer.
Poll Questions
• Poll questions may be asked during the
webinar. They are asked so we can better
understand the audience and provide the
most useful information to you.
• As they will only be open a short period of
time, please respond promptly.
Post Webinar Information
•
At the conclusion of the webinar, a short survey will appear. We
ask that you complete the survey in an effort to gather
information to better serve the community in preparation for
future webinars. Please complete it before signing off.
•
You will receive a link to access our law enforcement only webinar
library where you can view the recording and access related
webinar material. Due to the sensitivity of some of the material
you must be a registered law enforcement member of the
NCJTC.org or ICACTaskforce.org websites. If you are not
currently a member, you will need to register for access at
www.ncjtc.org.
An Overview of
Technology
Used in Child
Exploitation Cases
Learning Objectives
• Child Pornography & Child Sexual Assault
• Victims/Offenders characteristics
• Important technologies and concepts
Learning Objectives
• Types of Technology used

Cloud Computing
P2P
Social Networks
Cell Phones
Chat
Ad Services
Technology Facilitated Crimes
Against Children Offenses
• Manufacture, Dist., & Possession of c.p
• Online enticement of children by
sexual predators
• Trafficking of children for sexual
purposes, i.e., prostitution
• Sex tourism
What is Child Pornography?
• Common misconceptions
• Babies and bathtub photos
• 18+ posing as younger children
• In reality
• Evidence of a crime (CSA)
• Type of Child Sexual Exploitation (CSE)
• Child Abuse Images/Videos
Child Sexual Abuse (CSA)
• Most victims do not disclose CSA in
childhood
• Often disclosure is unconvincing, changes
or at risk of recantation
• Often little or no physical evidence of CSA
– depending on nature and timing of
disclosure
Offender Characteristics
Child Pornography Offenses Are a Valid
Diagnostic Indicator of Pedophilia
• “As a group, child pornography offenders showed greater
sexual arousal to children than to adults and differed
from groups of sex offenders against children, sex
offenders against adults, and general sexology patients.
The results suggest child pornography offending is a
stronger diagnostic indicator of pedophilia than is
sexually offending against child victims”
Seto, Cantor and Blanchard in their article in the Journal of Adolescent Psychology -2006
Suggested Reading
Victim Control Through
Technology
• Mobile phone GPS
• Constant texting
• Text message review
• Sexting
• Blackmail
Use of Pornography
•
Adult Pornography
Child Pornography
– Sexual arousal
Sexual arousal
– Sexual contact
Sexual contact
Child Pornography Collectors
Hernandez-Bourke – 2001
# of Victims
Ave. 26.4 VPO
54 Inmates
Child Pornography Collectors
Hernandez-Bourke – 2008 155 Inmates
Victimization
Key Implications for Law Enforcement
Post Hernandez Study
• Child pornographers, with and w/o criminal
records, do molest children
• Child pornography investigations should be
conducted with the goal of identifying and
locating any and all victims
• Suspect interrogations, and other investigative
methods should be utilized to identify victims
What Does That Mean?
• Is he a contact offender?
• High probability he chats online –has multiple
accounts
• High probability he has numerous social
networking sites
• High probability he has been doing this for a
very long time
Computers Appeal to Offenders
•A tool that facilitates their interest in
children
•The sex offender is the target of the
investigation, not the computer
•The investigation must identify the
person who used the computer for
the crime (SODDI Defense)
Technology Appeal to Offenders
• Provides the offender:
✴Unsupervised environment
✴Instant gratification
✴Easy accessibility (storage)
✴Security/Privacy/Speed
✴Enhanced distribution via P2P file sharing
✴“Perceived” Anonymity
Technology Appeal to Offenders
•
Medium for real time communication
✴E-mail
✴Chat Rooms
✴Instant Messages (IM)
✴Social Networking (ie; Facebook)
✴Don’t forget:
★ Mobile phones (text messaging, camera phones)
★ Online games (xbox 360, etc)
★ Virtual Reality (Second Life, WOW)
Technology Appeal to Offenders
• Provides mutual support for their adult-child sex
philosophies
• Allows for rationalization of their behavior
•Gary Hewitt, Psychotherapist
• “The support group sites give pedophiles a real
sense of power and the impetus to go out and
molest someone.”
Why Investigate Child
Pornography?
WHAT’S THE WORRY?
IT’S JUST PICTURES
Victims
Victim Impact Statement – Amy
(MISTY SERIES)
• I am a 19 year old girl and I am a victim of
child sex abuse and child pornography. I am
still discovering all the ways that the abuse and
exploitation I suffer has hurt me, has set my
life on the wrong course, and destroyed the
normal childhood, teenage years, and early
adulthood that everyone deserves.
Victim Impact Statement – Amy
(MISTY SERIES)
• “My uncle started to abuse me when I was only 4
years old.”
• “At first he showed me pornographic movies and
then he started doing things to me.”
• “And I remember the pictures.”
• “There is a lot I don't remember, but now I can't
forget because the disgusting images of what he
did to me are still out there on the internet.”
Victim Impact Statement – Amy
(MISTY SERIES)
• “Every day of my life I live in constant fear that
someone will see my pictures and recognize me
and that I will be humiliated all over again.”
• “I did not choose to be there, but now I am there
forever in pictures that people are using to do
sick things.”
• “It's like I am being abused over and over and
over again.”
Victim Impact Statement – Amy
(MISTY SERIES)
• “I want it all erased.”
•
“I want it all stopped.”
• “But I am powerless to stop it just like I was
powerless to stop my uncle.”
• “thinking and knowing that the pictures of all
this are still out there just makes it worse.”
• “It's like I can't escape from the abuse, now
or ever.”
Victim Impact Statement – Amy
(MISTY SERIES)
• “The truth is, I am being exploited and used
every day and every night…..”
• “How can I ever get over this when the crime
that is happening to me will never end?”
• “How can I get over this when the shameful
abuse I suffered is out there forever and being
enjoyed by sick people?”
• “I am horrified by the thought that other children
will probably be abused because of my pictures.”
Important Technology and
Concept
Cloud Computing
Defining the Cloud
NIST - Cloud computing is a model for enabling
convenient, on-demand network access to a
shared pool of configurable computing resources
(e.g., networks, servers, storage, applications,
and services) that can be rapidly provisioned and
released with minimal management effort or
service provider interaction.
The Cloud in Layman’s Terms
• Everything we currently do:
✴Email
✴Online Storage
✴Social Networking
✴Peer-Peer File Sharing
✴Chat
Email
Social Networks
P2P
Chat
A Cloud Crime Scene
A Cloud Crime Scene
Cloud vs. Traditional Scenes
• Law enforcement already investigates cloud based
activities like social networks, email, photo posting sites,
web sites, chats, distributing and receiving child
pornography, child enticement and a host of other crimes
against children. These crimes are investigated and
tracked to a suspect using a home computer or mobile
device. These would be the traditional scenes.
• Cloud storage providers are now scanning and reporting
child pornography stored on their servers.
• Search warrants are served on the cloud storage provider
initially.
PhotoDNA
• Microsoft uses NCMEC’s photo hash values as a part of
their hash library.
• Scans and locates images on Onedrive based on PDNA
standard hash values and fuzzy hashes.
• Generates a report to the Cyber TipLine resulting in a
Cybertip to Law Enforcement.
• LE investigates and compares seized evidence to NCMEC
using the fuzzy hash to the original hash. Will not
match up, but the photo does.
Investigative Cloud Concerns
• Questions to ask yourself:
✴How does this effect our investigations?
✴How can we best use them?
✴Would a sex offender use cloud
computing?
✴What are the legal challenges to
investigators?
Emerging Technology
The Good and Bad of Technology
• The good about technology - there is always
evidence
• The bad of technology - it is always changing
• Started with email, chat rooms, instant
messaging
• Now - social networking, mobile devices, Peer to
Peer, cloud computing
Computers
Computers
Cell Phones
Gaming Systems
GPS
Digital Storage Devices
Secure USB Devices
Makes drives invisible on your
PC/Notebook, only seen with SG-key and
password. Lock away your precious files so
NO ONE knows IT exists on your computer.”
iTouch - iPad – Kindle eReaders
Computer Servers
Wireless Multi-Media Devices
Pogoplug
Anonymizing your web surfing
Truly Mobile Devices
iStick
Securedrive
iPotty ?
The Technology
• P2P
• Social Networking
• Chat
• Ad Services
• Cell Phones
Peer to Peer (P2P)
P2P Networks
Some Popular P2P Clients
Packet
I have
it
Packet
Sender
24.21.23.215
Recipient
68.15.23.25
Peer
Packet
I have it
Packet
Peer
Peer
Packet
YOU
Peer
Packet
Search Term
Ultrapeer
I have
it
Packet
Peer
Peer
Packet
I have it
Packet
Peer
Peer
Packet
I have it
Peer
Packet
Packet
72
Scope of the problem P2P 2014
2014 Usage Report
Five P2P Networks
IP’s located sharing files of interest on 03/19/15 @ 1430hrs EDT
Social Networking
Social Networks
Updated 03/01/2015 | eBizMBA
Countless Networks and New ones
Daily
Types of Social Networking Sites
•
General (MySpace, Facebook)
•
Cell Phones (Mocospace)
•
Blogging (livejournal, xanga)
•
Microblogging (Twitter, Jaiku)
•
Students (classmates.com, graduates.com)
•
Religious (holypal, fusion 101, koolanoo,
naseeb)
•
Travel (TravBuddy, WAYN)
•
Cultural (MiGente.com LunarStorm grono.net)
FACEBOOK
Facebook
• 1.3 Billion Worldwide monthly users
• 152 Million daily users in US & Canada
• 54% of the US population
• Type of content?
Facebook Stats
As of 12/14
Facebook Addiction Disorder
(FAD)
In the News
Facebook Uses PDNA
• In 2011, Facebook became the first social
network to partner with Microsoft to use PDNA
to identify and remove images that exploit
children.
Facebook Security
• Facebook allows it’s users to download a copy of their
profile to a zip file that Facebook stores.
• This information can be provided to Law Enforcement in
the event an incident occurs involving a Facebook Profile.
• Parents with access to their child's profile can download
this information and provide a copy to LEA for their
investigation.
• This includes photos, videos, posts, messages, friends lists,
and other content shared with others.
Facebook Archive
Facebook Archive
Demo
Deactivate Account
Technology & Child Sex
Trafficking
• Social Media
• Online escort sites
• Online “dating” sites
“Backpage”
“Adultfriendfinder”
• Mobile device connections
✴Texting + images
Cell Phone Applications
Real-time
• Immediate status
updates
• Broadcast to
followers
and/or the public
• Worldwide
Google+
• Facebook
killer?
• Circles
• Tighter control of
privacy
Twitter
• < 140 characters
• Public by default
• #hashtags
• @mentions
• geolocation
A hashtag allows grouping of similarly
tagged messages, and also allows an
electronic search to return all messages that
contain it.
EX: #WhatToDo
A mention is any Twitter update that
contains "@username" anywhere in the
body of the Tweet. (Yes, this means that
@replies are also considered mentions.)
reference or link to a users profile. EX:
@winston
Geocode
• Twitter Advanced Search
http://twitter.com/search-advanced
geocode:43.2308015,-71.5626055,.5mi
geocode:42.3133734,-71.057157,.5mi
Instagram
• Popular photo sharing
• “Artistic filters”
• Public by default
• Instant uploads
• #hashtags & geolocation
• Bought by Facebook
YikYak
• Location-based
messaging app
• Messages are
anonymous
• Messages expire
• Threats,
cyberbullying,
harassment
• Schools blocked*
WhatsApp
• Instant messaging app
• Groups
• Attachments
Snapchat
• Messaging App
• Text, photos, videos, drawings
• “Snaps” set to expire 1-10 seconds
• Do they really??
• 3rd party apps
Skype
• IM , VOIP, video chat
• Share files
• Web & mobile
Facetime
• iOS popularity
• VIOP, video chat
Viber
• IM & VOIP
• Exchange images, audio, video
• Desktop & mobile apps
Tumblr
• Micro-blogging platform
• Short-form content
• Private or public
• Mobile apps
Pinterest
• Online “pin-board”
• Web & mobile
• Discover, collect, share, store
• Visual bookmark
AirDrop
•No Username needed
•No Phone number needed
•Can share any type of file not just photos
Chat
Chats and more…
• Okcupid
• Teenspot.com
Kidschat.com
• Motherless.com
Chatavenue.com
• KIK Messenger
• Grindr
• Smutvibes.com
Urban Chat
Chatroulette
Omegle
Chathour.com
• Tagged.com
• MOCO
• Adultfriendfinder
IRC
Datehookup.com
Facebook / Instagram
Paltalk
• Chat client very
similar to Yahoo
Messenger
• Offers chat rooms,
instant messages, file
transfers, voice and
video chat
• Free to use basic
features
• Advanced features
require subscription
Kidschat.Net
Mocospace
Ad Services
Craigslist.org
Backpage.com
How Craigslist Works
• www.craigslist.org
OR
www.craigslist.com
• Online classified
ads forum
– Allows you to
search and post ads
in nearly every
major U.S. city
– Canada, Europe,
Asia, Middle East
Posting to Craigslist
• Free to post
– Brokered apartments, job listings, therapeutic services
• An email address is required to post an ad
– CL is often requiring a verified phone number with
certain types of posting
– CL has begun to accept VOIP phone numbers
• No limit on number of postings
– CL has begun to target spammers
• Every post can contain up to 24 photos
• Poster can choose to list additional contact information
within the post
Posting to Craigslist
•Majority of postings expire after 45 days
• In many cities, the post expire after 7 days
• Boston, Los Angeles, New York, Portland,
Sacramento, San Diego, Seattle, San
Francisco, Washington DC
Backpage
• Suspect’s post ads to meet teens
• Escort and prostitution stings
• Victim and suspect rich environment
• Juvenile Prostitution
Backpage.com
Backpage.com
Websites like Backpage.com are ideal for pimps and sex
traffickers because as private companies, they aren’t
required to disclose the advertisement owners’ names. -
Thorn’s National Survey
• Of the domestic minor sex trafficking survivors
participating in Thorn’s national survey:
– 63% were sold via the internet at some point
in their trafficking situation.
– 62% had access to a cell phone while they
were being trafficked.
– 42% had access to the internet while they
were being trafficked.
Motherless.com
Motherless.com
• There is a free area, but must pay to play
in serious abuse section
• Has search function to seek Offenders
Skype Used in Ad
Questions ?
Available Resources