Organised offenders –
groups consisting of thousands of people

In the NetClean 2017 Report, we looked at: whether there is such a thing as a typical consumer of child sexual abuse material; the correlation between consuming child sexual abuse material and physically abusing children; and how offenders come into contact with children. In this year’s report, we focus on: how offenders organise themselves in internet forums and groups; and whether the level of organisation has changed over time.

A majority of police officers have encountered organised groups

The majority of surveyed police officers (85%) report that they have encountered organised forums and groups of offenders in their investigations. Amongst those who have not come across this sort of activity, they refer to the fact that they do not work on cases that lead them to investigate this type of online criminal activity.

”In my specifics there is no monitoring of forums and groups.”

A large majority of police officers report that they have worked on investigations where they have seen one to ten organised forums over a period of three years. However, a larger majority report that they mainly come across individual offenders in their cases.

“We’ve mostly encountered single perpetrators who have had contact with individual, single perpetrators rather than organizing themselves in any kind of forums.”

A fifth of the surveyed police officers report that they have worked on investigations where they have encountered up to fifty organised groups over the past three years. A small segment have seen 100-500 organised groups.

Whether the degree of organisation within forums and groups of offenders has changed and if so, how:

Estimated number of forums encountered by police officers over the past three years:

A handful have seen more than one thousand, or several thousand, forums. They explain (analogously to the police officers above who do not work in this area), that they have seen so many forums and organised groups because they work specifically on these types of cases.

“We have identified hundreds of forums and groups connected to different organizations, however we find the same individuals in different forums with the same alias.”

“Impossible to estimate. I mostly only investigate organized forums or groups of offenders, it’s always networks”

Indications that the number of groups is increasing

Just under half of the surveyed police officers report that the number of organisations has increased. A third of the police officers report that they have neither increased nor decreased. There has been no clear trend concerning the increase of forums and groups used by offenders over the past three years.

Whether the number of organised forums and groups of offenders has increased or decreased over the past three years: 

Groups operate on darknet and the open internet

According to the surveyed police officers, the forums exist in equal numbers on the open internet and the darknet/TOR. The police officers report that offenders use social media apps, or messaging apps, to communicate via direct message. The applications most commonly mentioned by the police officers are KIK, WhatsApp, Telegram, Facebook and Skype, and in addition links are shared through tools such as Dropbox*.

(* You can find more information and analysis about the social media platforms and applications that are most prevalent in police investigations in the NetClean Report 2016 and 2017).

“Put it this way, the vast majority of material is on the open web. They make contact with people of similar interest and trade indecent images of children.”

“Telegram groups disseminating images/videos and links to cloud storage”

“Any platform that facilitates group communication e.g. Facebook, Messenger Apps, certainly darknet groups.”

“The dark web still plays a very significant part in organised crime groups involving child sexual exploitation and indecent images of children offenders.”

The locations of online organised forums and groups of offenders:

Varied size of groups

When answering a question about the size of the groups of offenders, the surveyed police officers’ answers vary from 2 people to 5,000-6,000 individuals. According to the report the biggest forums consist of 100 000 – 200 000 individuals, and one police officer reported that they worked with a forum that consisted of one million individuals.

Offenders are getting more organised

More than half of the surveyed police officers report that how offenders organise themselves and the level of organisation within the forums is changing. According to almost half the surveyed police officers, groups are becoming increasingly organised, while one in ten reports that the offenders are becoming more careful. Only five percent report that the groups have become less organised.

“They are becoming more organized and creative in ways to hide their activity and identities.”

“The organized are more organized, and focus on crypto and anonymity, groups on Skype, for example, are more open, using their own IP addresses.”

“It is remaining constant … organised groups, with hierarchies and security etc, have existed for a long time.”

“Less organized as they frequently create new groups.”

Comment to insight 3:

“Offender groups are becoming more organised
and businesslike in their set-up”

Cathal Delaney
Head of Team, Analysis Project Twins,
EC3, Europol

Read comment here

Offender groups are becoming more organised and businesslike in their set-up

In Europol’s recent report Internet Organised Crime Threat Assessment (IOCTA) 2018, we looked, amongst other things, at the level of organisation among online offender forums and groups. We have growing intelligence pointing to increased organisation among particular users, especially on the darknet. The information to support these conclusions is contributed by Europol member states, which affords us a good overview of the situation and allows us to draw conclusions with a reasonable degree of accuracy.

Detailed and consistent advice

The conversations in different forums highlight that key individuals are increasingly sharing advice on things like anonymisation techniques and encryption on a more detailed, widespread and consistent level than before. This sort of advice on how to take precautions to hide online activity is not new, but there is now more structure around these conversations. It is the extent of advice and consistency in the messages that is new.

The forums themselves are also becoming more organised and businesslike in structure. In many cases individuals perform specific roles to ensure the efficiency of the forum. This points to the fact that the forums are developing.

A change in how individuals communicate

We have also seen a development in how people who belong to these online groups communicate. To start with groups who used different direct messaging services were formed through invitations on the darknet. Now they do not necessarily coexist in the same space, and do not move from one technology to the next as frequently as before. The individual choice of technology is most frequently based on what they are most comfortable using, and which technology they perceive to be the most secure; i.e. while one person chooses an app for direct messaging because it is perceived as the most secure technology, somebody else might be using the darknet for the same reason.

Groups and sub-groups

We don’t know the exact number of online offender groups or forums. Larger forums typically consist of many smaller sub groups, and it is a pointless exercise to count them all. The groups may be divided on the basis of: shared language; shared country of origin; a proclivity for the same type of child sexual abuse material; or the same age range of children featured in the material. The variations of these groups are endless. Hence, we do not need to know exactly how many groups there are; it is enough for us to know that they pose a risk to children.


Europol and European Cybercrime Centre (EC3)

Europol assists the 28 EU Member States in their fight against serious international crime and terrorism. Europol set up the European Cybercrime Centre (EC3) in 2013 to strengthen the law enforcement response to cybercrime in the EU and help protect European citizens, businesses and governments from online crime.