Analysis of topic popularity within a child sexual exploitation Tor hidden service

Highlights

• Quantifies offender consumption of child sexual abuse material – i.e., preferences and frequency of access – in absence of saved collections on electronic devices.

• More interest and activity was observed among threads with hardcore child sexual abuse material, and the overt action of giving “thanks” served to reinforce and perpetuate the amount of hardcore content on the site.

• Threads containing visual material were viewed most frequently among the members of this Tor hidden service community.

• Thread titles relating to soft core/non-nude material or modeling visual material decreased the frequency of viewing.

• More egregious (hardcore) child sexual abuse material is viewed, downloaded, and “thanked” most often within Darkweb child sexual exploitation communities; despite a copious variety of child sexual abuse material available and equally advertised.

Abstract

Knowledge about the online bulletin board communities dedicated to child sexual exploitation (CSE) located on the Darkweb (Tor) has generally been limited to those that investigate and prosecute individuals participating in those sites, as accessing them and viewing the abuse material is a crime. This leaves many of those in the CSE field without a scientifically validated foundation of the behaviors typically demonstrated by members of these CSE online communities. The following research empirically examines topic popularity of one Darkweb CSE Tor hidden service that was seized by a federal law enforcement agency. Analyses reveal that some topics tend to be viewed significantly more often, and descriptors about specific sexual acts and the ages of children portrayed in the thread titles correlate with the frequency of viewing, approving and downloading of that material. Implications of these findings for professionals working in the CSE field will be discussed.

Introduction

There is no doubt that technological advances, such as the expansion of the Internet and mobile devices, have contributed to the significant growth in child sexual exploitation (CSE)¹ material, making it easier to produce, access, store, and distribute files depicting the sexual abuse of minors. As a result, law enforcement response has also increased, with more concentrated investigative efforts in this area (Thorn, 2014). However, the overall prevalence and scope of the crime problem is still difficult to ascertain. Investigations, arrests and reporting are thought to likely only represent a fraction of offenders and the offenses they perpetrate against children (Adams & Flynn, 2017; Bourke et al., 2015; Hanson et al., 1999; U.S. Sentencing Commission, 2012). Law enforcement continues to gain better insight into CSE and the offenders who perpetrate it, and industry partners have become increasingly aware and more willing to report suspicious or illegal online behavior (National Center for Missing & Exploited Children, 2021). Although there is now a substantial amount of research providing general insight into online child sexual exploitation and the offenders who perpetrate it, more focused attention is needed to address behavior as it relates to the new technologies (Taylor & Quayle, 2003).

Technology presents ever-changing challenges as offenders adapt to new enhancements in security and data protections to engage in CSE-related activity. One emerging online CSE threat is that posed by the Darkweb (Aked, 2011; Bartlett, 2014; Smallbone & Wortley, 2017). The Darkweb refers to the collection of encrypted communication networks that exist at hidden levels outside of the observable internet. Perhaps the best known Darkweb is Tor. Tor's primary appeal is that it encrypts internet traffic and bounces it through a chain of computers, making it very difficult for anyone to track where it came from. After downloading the Tor browser software, a user is able to transmit encrypted data that cannot be intercepted or read by unauthorized third parties, allowing the user to remain anonymous and untraceable (Smallbone & Wortley, 2017).

Websites that are only accessible on the Tor network are referred to as Tor hidden services. Many Tor hidden services are dedicated to a broad spectrum of CSE material (with increasing levels of content volume and severity) and to various aspects of offending (WeProtect Global Alliance, 2018). Within a CSE Tor hidden service, the homepage typically provides a listing of multiple predicated forums and sub-forums, under which members can navigate to and submit messages or referrals to a multitude of sexually abusive material depicting children. These messages result in threads that can evolve into long-running discussions between countless members. Thread views are fundamental to understanding behavioral aspects such as sexual preferences and activities, as it is the first step that must be taken by a CSE Tor hidden service member in order to access or download the material. Threads within forums and sub-forums often contain hyperlinks to content of a certain sexual interest (i.e., age and/or gender of the depicted children, the severity of the material, or the type of sexual act) should be placed. Threads also often involve communication and negotiation about the exchange of the CSE material, and extensive discussions about members' sexual preferences, fantasies, and experiences. Additionally, popular forum and sub-forum threads provide locations where members can access information about the hidden service's rules and regulations, (technical) safety, and law enforcement operations and evasion techniques, which offer education and guidance among members.

Research examining CSE offender behavior within these online community environments compliments and adds to the broader understanding of CSE offenders and their sexual interests, motivations, and actions. However, due to the illegal nature of the material within these CSE Tor hidden services, little information exists outside of law enforcement that describes the scope of the problem and the behavior that makes up these communities on the Darkweb. Based on the authors' law enforcement experience, Darkweb CSE communities are likely to be an increasing focus of investigative attention. Knowledge of how CSE offenders operate in such communities in terms of how they search for, advertise, and share content with others can also provide greater insight into the detection, identification, and disruption of illegal content and those who traffic it. The goal of the current study is to inform both law enforcement and practitioners about Darkweb offender behavior and the type of material that is available and most popular within a CSE community on Tor. This study will aim to explore online behavioral patterns among CSE offenders on a Tor hidden service website and how those behaviors compare to previous research using data from different technology platforms. Specifically, this study examines what material CSE offenders most gravitate toward, and what they prefer to access, view, and download on a Tor hidden service website. Although research specific to CSE Darkweb communities is not yet available in the existing literature, previous studies examining other online CSE offender networks operating on the Clearnet (the publicly available internet), provides an adequate basis for comparison. The current study allows for comparisons to past work examining online CSE offender behavior studied via other online networks such as Peer-to-peer (P2P).

Many previous articles have examined the prevalence and volume of CSE material within online communities, such as chat rooms, forums, news groups, and P2P file sharing programs (Bissias et al., 2016; Hughes et al., 2006; Hurley et al., 2013; Latapy et al., 2013; Steel, 2009; Wolak et al., 2013). However, few have studied the specific behavioral characteristics among CSE offenders within these online networks.

In some of the earliest work examining CSE offender behavior in online environments, Durkin and Bryant (1999) analyzed an online “boy love” support forum and categorized the dialogue exchanged among members of that community. The study provided insight into the use of cognitive distortions, namely justifications, given by offenders with a sexual interest in young boys in order to account for their deviant sexual behavior. The authors concluded cognitive distortions are changed and refined within these online communities and receiving support from other like-minded offenders promoted pro-offending beliefs in socially isolated individuals (Durkin & Bryant, 1999). Ten years later, O'Halloran and Quayle (2010) replicated the study in an effort to reexamine findings from Durkin and Bryant's preliminary work accounting for advancements in technology. Results indicated that despite the passage of time and changes in technology, the behavior of offenders within online CSE support forums remained generally consistent (O'Halloran & Quayle, 2010). These online communities provide a safe space for CSE offenders to freely share interests, feelings, fantasies, and experiences abusing children with a sense of reassurance and normalization (Carr, 2012; Durkin, 1997; O'Halloran & Quayle, 2010; Taylor & Quayle, 2003; Thorn, 2019). Some offenders can end up prioritizing the social relationships formed within the CSE community over the images that exist there (Taylor & Quayle, 2003). Cumulatively, this research highlights that belonging to this type of community provides benefits far beyond obtaining and sharing images.

In the early 2000's, P2P networks emerged as a global internet phenomenon, accounting for almost 60 % of all internet traffic (Thorn, 2014). P2P networks allow users to download files directly from computers that belong to other individuals in a network. Available files are labeled with a string of key terms that would cause them to be found in searches. At that time, the majority of P2P activity was comprised of sharing and downloading music, movies, and other non-pornographic content. However, offenders quickly began to exploit these networks as platforms with which to view and distribute CSE material. Previously, research had suggested the majority of CSE offenders exercised very few precautions to avoid detection. Wolak et al. (2011) found that a small minority of convicted offenders used identity protection technologies such as encryption (3 %) and anonymization (1 %). However, these statistics may not adequately represent all online offender behavior and may be more reflective of the technology available at that time and data available from those apprehended by law enforcement. Offenders are often keenly adaptive and routinely seek new and improved ways to efficiently access CSE material and enhance anonymity protections online (U.S. Department of Justice, 2016). The appeal of P2P platforms among CSE offenders cultivated a new mechanism for obtaining CSE images and videos from a worldwide online network while offering lowered social risk, decreased inhibitions, and more perceived identity protection capabilities among its users (Taylor & Quayle, 2003; Wolak et al., 2011). By 2014, P2P network traffic had significantly declined among the general internet user base but remained a primary channel for individuals engaging in CSE activities online (Thorn, 2014).

One of the first to examine behavioral patterns and preferences within the context of specific P2P networks was research by Steel (2009), specifically as it relates to the supply-demand exchange of CSE material (those seeking and those advertising the material). Results indicated that although, images made up the largest proportion of files available within the P2P network studied, videos were the most common file type searched for. This suggests that CSE offenders have a preference for videos over images (Steel, 2009). Additionally, almost 50 % of the CSE queries used single words, with the most common single-word query being “pthc,” an abbreviation for “preteen hardcore.” Steel concluded that offenders searching for CSE material tend to use broad categories terms, and that non-explicit words such as “teen” or “young” appeared much less frequently in offender queries. This suggests that those searching for CSE material on P2P networks are knowledgeable of and use terminology more specific to the subculture (Steel, 2009; Westlake et al., 2012). In contrast, those distributing CSE material opted for an average of 14.5 words for CSE-related file names, suggesting offenders providing content to the network attempted to maximize the number of single word queries that would find or “hit” on their files (Steel, 2009).

Behavioral patterns and preferences were also noted among offenders' searches for CSE material related to age and gender of the victim. The majority (76 %) of age-specific search queries analyzed were for content depicting children ages 11–16 years old. While this did not necessarily reflect the actual age of the child depicted, it does represent the perceived ages sought by offenders within the community. Steel (2009) further noted the vast majority (95 %) of available CSE-related files included language pertaining to underage females, despite the fact that queries for material often did not designate a gender preference. In the small percentage of queries that did specify a gender preference, the requests were more commonly for underage females. Interestingly, these findings are inconsistent with a 2012 study that found boy-centered keywords were more commonly found on CSE websites than girl-centered keywords, although the difference was not statistically significant and the data analyzed was from a website rather than P2P network (Westlake et al., 2012).

A final notable finding by Steel (2009) was that individuals searching for CSE material tended to limit their searches specifically to CSE – <5 % of the queries associated with an IP address searching for CSE material had non-pornographic search terms in other queries (e.g., for popular movies and/or music) (Steel, 2009). These findings serve to debunk a common defensive argument that searches using non-explicit terms or “stumbling” upon CSE material while searching for other things suggests a lack of malicious intent. Instead, it appears that offender behavior can be characterized as more deliberate in their online searching and consumption of CSE material within the P2P environment. This research provided valuable insight into the nature of querying by CSE offenders as well as the content they are sharing within P2P environments. The question remains as to whether these same behavioral patterns remain consistent across other platforms or Darkweb CSE communities. Consistencies would suggest these behaviors are characteristic of CSE offenders generally, whereas changes in behavior patterns may be reflective of technological influences.

Recently, research has indicated online CSE offenders are transitioning away from file sharing programs and navigating to environments that allow for greater interaction with other offenders or potential child victims, including mobile phone applications, social networking sites, and Darkweb communities (Bissias et al., 2016). From 2012 to 2014 there was a decline in the number of unique IP addresses and GUIDs² seen throughout the P2P file sharing landscape (Bissias et al., 2016). Instead, Tor hidden services have emerged as a preferred platform for CSE offenders to facilitate their deviant sexual interests (Mordock, 2019; U.S. Department of Justice, 2016). Although heavily peer-moderated by users, the material and information on these sites are not censored by any outside authority such as internet service providers or law enforcement (O'Halloran & Quayle, 2010). CSE hidden services within Tor make up only approximately 1 % of the websites that exist within the Tor network (Intelliagg, 2016). Despite that seemingly insignificant number, traffic to those exploitation sites typically ranks higher than any other category of sites within the Tor network (Owen & Savage, 2015). Specifically, in their analysis of data from web crawling software that tracked packages of information being shared by Tor network users, Owen and Savage (2015) found that requests to child abuse sites represented >80 % of total requests observed, although they accounted for only 2 % of the total hidden services available during the study period. Many Tor hidden services have registered members in the tens or hundreds of thousands.

Law enforcement has reported Tor hidden services are the largest facilitators of CSE content seen in a single online location (U.S. Department of Justice, 2016; U.S. Department of Justice, 2019; Mordock, 2019). For example, the FBI's analysis of one particularly egregious site on Tor found that it hosted approximately 1.3 million images depicting children subjected to violent sexual abuse (U.S. Department of Justice, 2016). Darkweb communities, such as Tor hidden services, are appealing to CSE offenders because the technology allows CSE communities to become more stable; sites can exist in plain sight of law enforcement agencies over long periods of time, accumulating more content, more information and more members (WeProtect Global Alliance, 2018). Joining an online community of other CSE offenders is one of the easiest ways to quickly gain access to massive amounts of CSE material (Carr, 2012). The level of anonymity afforded by these sites may arguably be one of the most significant factors perpetuating online sexual abuse of children (Smallbone & Wortley, 2017). Without research into these new technical areas as they arise, law enforcement and legal professionals are left with an incomplete picture of the overall behavior of CSE offenders. Such gaps in understanding hinder the ability to apprehend and prosecute those who perpetrate sexual crimes against children, as well as protect children from future harm (Krone, 2004).

Child sexual exploitation is a multi-faceted and complex social problem that can only be effectively disrupted through cooperation between academic, clinical, and criminal justice professionals. Additionally, as platforms and online environments change, it is important to maintain awareness of similarities, as well as any adaptations, in how offenders' access and consume CSE material as a result of that technology. Steel (2009) sets up strong precedent to examine whether similar behavioral patterns and preferences observed within the P2P environment may also be true for CSE Tor hidden services on the Darkweb. The goal of this paper is to quantify the viewing and consumption preferences of users within a Darkweb CSE community through data from a CSE Tor hidden service, data that is not available to researchers outside of the law enforcement community. Utilizing that secondary data, the authors present a cross-sectional study that is both exploratory and descriptive in nature. Specifically, this paper examines the content categories maintained on the site in order to ascertain the types of material most often viewed and which keywords, if any, have an impact on these views, downloads and appreciative clicks of “thanks.” The following research questions will be examined: 1) What are the most popular threads within the forum and sub-forum environments of a CSE Tor hidden service? and 2) What descriptors in a thread's title predict how often that thread will be viewed, downloaded and “thanked” by site members?

Qualitative examples will be presented to support and provide context to the quantitative research findings. Implications of understanding the child pornography preferences of those within this online CSE community, the effects this knowledge will have on practitioners working with this offender population, as well as recommendations for law enforcement, are discussed.