THE EXPERIENCE AND PERSPECTIVE
OF THE POLICE

Manipulated images and hidden images
– a challenge for investigators

In our previous reports we asked police officers about the main challenges they face in their investigations of child sexual abuse material. In the NetClean 2016 Report, we identified that the major challenges were: encryption; anonymisation technologies; live-streaming; and deleters (people who consume material and then delete it). In the NetClean 2017 Report, we saw encryption and anonymisation technologies as the main challenges, but also cloud based services and use of chatrooms.

In this year’s report, we have chosen to look more closely at the challenges police officers face when offenders hide or manipulate images in different ways. We asked questions relating to two different areas: how common is it that the content of an image is manipulated to make it difficult to identify people and/or places? And how common is it that offenders use obfuscation techniques to hide images or files on their computers or on the internet?

No clear-cut answer

The response to the question about hidden images does not present a clear picture. More than 45 percent of the surveyed police officers report that it is common or very common that offenders try to hide the files. However almost as many, nearly 40 percent, report that it is uncommon or very uncommon.

How common it is that offenders manipulate the content of images or films to make it difficult to identify people or places: 

The statistics are similar in relation to the question about the manipulation of image content. Just over 40 percent of the surveyed police officers report that it was common or very common for offenders to manipulate images, and almost as many responded that it is uncommon or very uncommon for this to happen.

How common it is that offenders manipulate the content of images or films to make it difficult to identify people or places:

In response to whether these techniques are becoming more common, almost half report that they are becoming more common, whereas the rest respond that they have not seen any changes to the trend.

The following quotes illustrate the varied thoughts on this issue:

“Although we talk about this it rarely happens. Remember a suspect lives in his own bubble. They are lazy and need access to their material quickly. They are not necessarily techy […]”

”In about 10% of my cases they try to hide the material.”

”Increased slightly but not insurmountable.”

”Greatly increased – there are so many new and secure applications that provide encrypted storage. Also the web related applications which do not store any data.”

Whether it has become more or less common for offenders to try to hide child sexual abuse material:

Three categories of challenges

The challenges that the surveyed police officers face from manipulation and obfuscation techniques can be divided into three categories. The first relates to the visual content in the pictures, the second to offenders trying to hide files, and the third relates to encryption.

Manipulation of images

The result of the survey shows that police officers encounter different types of manipulation of image content, often in an attempt to hide the background and identity of people depicted in the images. The most specific answer, from nearly a quarter (23 percent) of the surveyed police officers, was that the techniques are used to hide the victim’s and/or offender’s face. What they see most frequently is an attempt to erase the face, or the placement a black square or other type of image onto the face. Images can also be cropped to remove faces. The surveyed police officers also see images where a child’s face has been edited into adult pornography, or where the face of a different child to the victim has been edited into the child sexual abuse material.

In contrast to these methods, (and as a plausible explanation for the variation in responses as to how common it is to see the manipulation of images) Taskforce Argos highlighted in the NetClean Report 2017*, that images with hidden identities have a ‘lower value” than those rich in detail within forums where child sexual abuse material is swapped.

* The NetClean Report 2017. Comment on Insight 7: “We need to teach kids safe Internet behaviour.”

Whether it has become more or less common for offenders to manipulate the content of images or films: 

Obfuscation techniques

Another challenge is the work offenders put into hiding files. There are different methods such as filters in cloud-based services, hidden apps for images, using darknet/TOR, virtual machines or different anti-forensic approaches. Close to one fifth (18 percent) of police officers surveyed report that they often see attempts to hide that an image file is an image file. Roughly one out of ten police officers (13 percent) also mention attempts to hide material in complex file structures, and one out of ten (10 percent) report that they often see image files that have been placed in different types of files, such as a Word document or PDF.

Encryption

The most common challenge, which nearly a third (32 percent) of the police officers mention, is encryption. Where previous NetClean Reports have considered the challenges faced by the police officers in their investigations encryption has consistently featured)

Comment to insight 5:

“Project “Trace an Object” – details help
the police identify children”

Cathal Delaney
Head of Team, Analysis Project Twins,
EC3, Europol

Read comment here

Project “Trace an Object” – details help the police identify children

Encryption is becoming more widely used by the public at large, and this echoes the trend that we see in child sexual abuse investigations. It is more difficult to say something certain about the manipulation of images or obfuscation techniques. While these techniques are currently not used in the majority of investigations that we work on, this does not necessarily mean that the use of them is not increasing. What we can say is that the more technologically sophisticated offenders, who are also taking other security measures to hide their identity, are the ones that also use these technologies.

Images of specific objects

There is always a question as to how much information we should share about these techniques, as it highlights the importance of details in images in victim identification work. However, in the project “Trace an Object” we have opted to ask the public for help to identify objects or locations in images where we have exhausted all other ways of investigation, to help us find the children depicted in the images. At www.europol.europa.eu/stopchildabuse we share images of specific objects and specify what information we are seeking for that particular object or location.

People can, anonymously if they wish, send in information about the objects to the site. The tips are then dealt with by Europol’s victim identification team, who pass credible leads on to the country to which the object appears to refer to. There it becomes the responsibility of the police authorities to decide whether to develop an investigation or not.

Eight children have been identified

“Trace an Object” has been up for eighteen months now, and we have seen good results. We have asked for the public’s assistance with 145 different objects, and as a result one offender has been arrested and eight children have been rescued. These are eight children that we would not have found without this project and the assistance of the public.

We invest a lot of time and effort to ensure that the project and site are working as intended. We only use this possibility when we have already followed all other possible leads to identify a child in an image. Before posting an image on the site, we follow a structured process with internal procedures as well as permissions from the police authority in the country that is in charge of the investigation. We also notify other police authorities to give them a chance to solve the case before we post the image.

The public input is much appreciated

The response to this project has been very positive, and we are grateful for the traction that “Trace an Object” has had, as it has generated many qualitative tips. We intend to build on this success and hope to see more identified children as a result.

 


Europol och European Cybercrime Centre (EC3)

Europol assists the 28 EU Member States in their fight against serious international crime and terrorism. Europol set up the European Cybercrime Centre (EC3) in 2013 to strengthen the law enforcement response to cybercrime in the EU and help protect European citizens, businesses and governments from online crime.