IWF Annual Report 2016

People report to us at iwf.org.uk, or through one of the 16 portals around the world. All reports come to our headquarters in the UK. If we identify child sexual abuse, we assess the severity of the abuse, the age of the child/children and the location of the files.

Public report vs active searching – what’s the difference?

We actively search the open internet for child sexual abuse images and videos using a combination of our expert analysts’ skills and bespoke webcrawlers. We also take reports from the public. We like to show which reports we actively searched vs received through our website or portals.

Total numbers of reports processed

105,420 reports were processed by IWF analysts in 2016, down 7% from 2015. The vast majority were from webpages. 56% contained criminal content covering all three areas of our wider remit.

Please be aware that not all reports processed are found to contain criminal imagery with our remit.

57,335 URLs were confirmed as containing child sexual abuse imagery, having links to the imagery, or advertising it.

Child sexual abuse imagery on newsgroups

455 newsgroups were confirmed as containing child sexual abuse imagery.

Wider remit work

• In 2016, 4,031 reports of alleged criminally obscene adult content were made to us. Almost all were not hosted in the UK, so they weren’t in our remit.

• 1 URL depicted criminally obscene adult content hosted in the UK received from a public source.

• 1 URL depicted non-photographic child sexual abuse imagery hosted in the UK received from a public source.

Public report accuracy

55,738 public reports were taken by our Hotline, where the person thought they were reporting child sexual abuse imagery. This includes public reports from all external sources, which includes law enforcement, Members, professionals and the public. 28% of these reports correctly identified child sexual abuse images. This figure includes newsgroups and duplicate reports, where several reports have correctly identified the same child sexual abuse website.

53% of children were assessed as aged 10 or under. This is consistent with the trend identified in 2015 which indicated a decrease in younger children being depicted in child sexual abuse imagery assessed by our analysts.

In 2016 we saw a further overall drop in the percentage of children we assessed as being aged 10 or younger. In 2013 and 2014, this figure was fairly consistent at around 80%. In 2015, the figure was 69%. We’ve also seen an increase in reports of children we’ve assessed as 11 to 15.

We think there are two reasons why we’ve seen more images of 11 to 15 year olds, than children aged 10 and under.

1. We increasingly see what’s termed “self-produced” content created using webcams and then shared online. This can have serious repercussions for young people and we take this trend very seriously. We’ve looked into this before, and will be launching a new report focusing on online child sexual abuse imagery captured from webcams later in 2017.

2. By analysing our data further, we know that the public are more likely to report images of children aged 10 and younger, and whose abuse is of a more severe level. However, our actively searched-for images total a larger number than public reports. With more analysts and the ability to actively search for content (since 2014), if we encounter a forum with thousands of images of child sexual abuse, we will not only work to remove that forum, but also now capture the URLs of every image on there (which might be pulled from another site) and follow up to remove each and every image hosted on other sites as well. This technique appears to mean we more commonly encounter more images of 11 to 15 year olds.

For domain analysis purposes, the webpages of www.iwf.org.uk, www.iwf.org.uk/report, www.iwf.org.uk/what-we-do and www.iwf.org.uk/become-a-member/join-us are counted as one domain: iwf.org.uk.

In 2016, 57,335 URLs contained child sexual abuse imagery and these were hosted on 2,416 domains worldwide. This is a 21% increase from 1,991 in 2015.

The 57,335 URLs hosting child sexual abuse content were traced to 50 countries, which is an increase from 48 in 2015. Five top level domains (.com .net .se .io .cc) accounted for 80 per cent of all webpages identified as containing child sexual abuse images and videos.

Abuse of generic top level domains

Our Domain Alerts help our Members in the domain registration sector prevent abuse of their services by criminals attempting to create domains dedicated to distribution of child sexual abuse imagery. Several well-established domains including .com and .biz are known as “Generic Top Level Domains” (gTLDs). Since 2014, many more gTLDs have been released to meet a growing demand for domain names relevant to the web content shown. In 2015, we first saw new gTLDs being used to share child sexual abuse imagery. Many of these new gTLDs were dedicated to illegal imagery and had apparently been registered specifically for this purpose.

The number of websites using a new gTLD, and dedicated to the distribution of child Sexual abuse imagery, continues to be a rising in trend in 2016.

• In 2015, we took action against 436 URLs on 117 websites using new gTLDs.

• In 2016, we took action against 1,559 URLs on 272 websites using new gTLDs – an increase of 258% (153 of these were disguised websites).
Of these 272 websites, 226 were websites dedicated to distributing child sexual abuse content.

Image hosting sites and cyberlockers were abused significantly more than other services.

Social networks are among the least abused site types.

In 2016, 54,025 URLs (94%) were hosted on a free-to-use service where no payment was required to create an account or upload the content. In the remaining 6% of cases, the content was hosted on a paid-for service, or it wasn’t possible to tell whether the hosting was free or paid for.

Image Hosts

Image hosts are most consistently abused for distributing child sexual abuse imagery.

Offenders distributing child sexual abuse imagery commonly use image hosts to host the images which appear on their dedicated websites, which can often display many thousands of abusive images. Where our analysts see this technique, they ensure that the website is taken down and each of the embedded images is removed from the image hosting service. By taking this two-step action, the image is removed at its source and from all other websites into which it was embedded even if those websites haven’t yet been found by our analysts.

The award-winning IWF Image Hash List, launched in 2016, can help image hosts to tackle this abuse.

In 2016 the majority of child sexual abuse webpages were hosted in Europe which is a shift from North America. 60% of child sexual abuse content was hosted in Europe, an increase of 19 percentage points. 37% was hosted in North America, a decrease of 20 percentage points. Images and videos hosted in Australasia, South America and in hidden services totalled less than 1% of all confirmed child sexual abuse content in 2016.

Top five countries

92% of all child sexual abuse URLs we identified globally in 2016 were hosted in these five countries.

Hidden services are websites hosted within proxy networks – sometimes also called the "dark web". These websites are challenging as the location of the hosting server can’t be traced in the normal way. We work with the National Crime Agency (NCA) Child Exploitation and Online Protection (CEOP) Command to provide intelligence on any new hidden services which are displaying child sexual abuse imagery. With this intelligence, NCA-CEOP can work with national and international law enforcement agencies to investigate the criminals using these websites.

• Between 2012 and 2015, we saw a year-on-year rise in new hidden services dedicated to child sexual abuse imagery.

• The number of newly identified hidden services declined from 79 in 2015 to 41 in 2016. It is possible this could be the result of increased awareness by law enforcement internationally about hidden services distributing child sexual abuse imagery.

Hidden services commonly contain hundreds or even thousands of links to child sexual abuse imagery that’s hosted on image hosts and cyberlockers on the open web. We take action to remove the child sexual abuse imagery on the open web. Monitoring trends in the way offenders use hidden services to distribute child sexual abuse imagery also helps us when we’re searching for this imagery online.

The UK hosts a small volume of online child sexual abuse content – in 2016 this figure was just 0.1% of the global total, down from 0.2% in 2015. When we started in 1996, that figure was 18%.

In partnership with the online industry, we work quickly to push for the removal of child sexual abuse content hosted in the UK. The ‘take down’ time clock ticks from the moment we issue a takedown notice to the hosting company to the time the content is removed.

• 60 minutes or less: 52%

• 120 minutes or less: 65%

• More than 120 minutes: 35%

• All UK-hosted content was removed within two days.

We saw an increase in the number of takedown notices which were responded to in two hours or less during 2016. Although the URL numbers are relatively small compared to the global problem, it’s important that the UK remains a hostile place for criminals to host this content.

16 companies’ services in the UK were abused to host child sexual abuse images or videos during 2016. We issued takedown notices to these companies, whether they’re our Members or not.

• 13 companies who were abused weren’t IWF Members.

• 3 companies were IWF Members.

We know that internet companies who’ve joined us as Members are less likely to have their services abused and are quicker at removing child sexual abuse imagery, when needed. We sent 3 takedown notices to IWF Members in 2016 and in each case the content was removed within 120 minutes of the notification. In one case it took just six minutes.

We provide a list of webpage addresses with child sexual abuse images and videos hosted abroad to companies who want to block or filter them for their users’ protection, and to prevent repeat victimisation. We update the list twice a day, removing and adding URLs.

During 2016:

• The list was sent across all seven continents.

• A total of 53,552 unique URLs were included on the list in 2016.

• On average, 211 new URLs were added each day.

• The list contained an average of 1,951 URLs per day.

Each image can be given a unique code, known as a hash. A hash can be created from any image and it’s like a digital fingerprint. In this case it’s a hash of a child sexual abuse image and it acts as a unique identifier. The list of these hashes can be used to find duplicate images so we can remove these images at source, protect our staff from seeing several of the same image, and protect our Members’ services. For the children in the images, it offers real hope of eliminating the images for good. The Image Hash List could stop the sharing, storage and even the upload of child sexual abuse content.

In 2015, we announced the trial of our Image Hash List which was rolled out to five Member companies providing internet services. During this time (June to October 2015) nearly 19,000 category 'A' child sexual abuse images were added to the list.

In 2016, we made our Image Hash List service available to all our Members. We also worked with Microsoft on a cloud deployment solution, meaning Members get instant access to the service without costly changes to their own networks.

In order to ensure that the Image Hash List contains only child sexual abuse images, it takes real people – our analysts – to review hundreds of thousands of individual images which may, or may not, show children being sexually abused.

During 2016, we assessed 293,818 individual images, of which, we:

• added 122,972 hashes to our Image Hash List.
Of these hashes, 60,821 relate to the worst forms of abuse – images of rape or sexual torture of children.

This means our analysts reviewed 26,711 images each, alongside reviewing public reports, and actively searching for child sexual abuse images and videos.

Did you know that paedophiles create their own language – codes – for finding and hiding child sexual abuse images online?

Each month we give our Members a list of keywords that are used by people looking for child sexual abuse images online. This is to improve the quality of search returns, reduce the abuse of their networks and provide a safer online experience for internet users.

• In December 2016 the keywords list held 442 words associated with child sexual abuse images and videos. It also held 68 words associated with criminally obscene adult content.

A Newsgroup is an internet discussion group dedicated to a specific subject. Users make posts to a newsgroup and others can see them and comment. Also sometimes called ‘Usenet’, newsgroups were the original online forums and a precursor to the World Wide Web.

Our Hotline team monitors the content of newsgroups and issues takedown notices for individual postings of child sexual abuse imagery. We also provide a Newsgroup Alert to Members, which is a notification of child sexual abuse content hosted on newsgroup services so they can be removed.

We are one of only a handful of hotlines in the world that processes reports on newsgroups.

We actively search for child sexual abuse images in newsgroups.

Throughout 2016, we monitored and reviewed newsgroups and issued takedown notices.

• 629 reports of child sexual abuse images hosted within newsgroups were made to us.

• 2,213 takedown notices were issued for newsgroups containing child sexual abuse images (408 in 2015). That is an increase of 442%. One takedown notice can contain details of several newsgroup postings.

• 60,466 posts were removed from public access. 193% increase on 2015 figure of 20,604.

• After monitoring newsgroups, we recommended our Members don’t carry 305 newsgroups containing child sexual abuse images and videos.

Since 2011, we’ve been monitoring commercial child sexual abuse websites which only display child sexual abuse imagery when accessed by a “digital pathway” of links from other websites. When the pathway is not followed or the website is accessed directly through a browser, legal content is displayed. This means it’s more difficult to find and investigate the illegal imagery.

When we first identified this technique, we developed a way of revealing the illegal imagery, meaning we could remove it, and the websites could be investigated. But the criminals continually change how they hide the illegal imagery, so we adapt in response.

• In 2016, we’ve uncovered 1,572 websites using this method to hide child sexual abuse imagery, an increase of 112% on the 743 disguised websites identified in 2015.

Disguised websites are a significant and increasing problem. By sharing our expertise in uncovering these websites with our sister hotlines and law enforcement worldwide, we help disrupt the operation of commercial child sexual abuse websites.

See how we helped our colleagues in the Cayman Islands when they discovered disguised websites.

We define commercial child sexual abuse imagery as imagery which was apparently produced or is being used for the purposes of financial gain by the distributor.

Of the 57,335 webpages we confirmed as containing child sexual abuse imagery in 2016, 5,452 (10%) were commercial in nature. This compares to 14,708 (21%) in 2015. That’s a decrease of 62%.

We believe this decrease is due to changes in methods used by commercial distributors to try and prevent being found, particularly by using disguised websites. In 2015, 10,078 of the commercial URLs we actioned were images which were being displayed on separate commercial websites. This year we’ve identified a commercial distribution group that has started to encode their images to prevent us identifying the source host. We took action to have these websites removed and to add these images to our Image Hash List, ensuring our Members can detect these images if they appear anywhere in their networks.

Our Virtual Currency Alerts are sent to Members where we identify Bitcoin wallets associated with child sexual abuse imagery, enabling them to take action to disrupt this activity.

In 2014, we saw Bitcoin being accepted by commercial distributors of child sexual abuse imagery on the open web. This has gradually increased.

• In 2015, we identified 4 websites accepting Bitcoin.

• In 2016, we’ve taken action against 42 websites accepting Bitcoin.

While the number of websites is still low, we are working with Members within the Bitcoin economy to try and keep it that way.

Our Website Brands Project started in 2009. Since then, we’ve been tracking the different “brands” of dedicated child sexual abuse websites. These dedicated commercial websites are constantly moving their location to evade detection and our analysts see the same websites appearing on many different URLs over time. Since the project began we’ve identified 2,771 unique website brands.

We analyse:

• hosting patterns,

• registration details, and

• payment information.

We believe the majority of commercial child sexual abuse websites are operated by a small number of criminal groups.

In 2016, the most prolific group accounted for 27% of our total commercial child sexual abuse content reports.

Since 2014, we’ve seen an increase in the number of active "brands" selling child sexual abuse imagery.

• 664 brands seen in 2015.

• 766 active brands in 2016.

We’ve also seen a rise in the number of previously unseen brands:

• In 2015, 427 brands were previously unknown to us.

• In 2016, we saw 573 previously unknown brands, 226 of which were disguised websites.

We monitor trends and work with our financial industry Members to disrupt the commercial distribution of child sexual abuse imagery.