Child pornography represents various forms of visual depictions of explicit sexual conduct involving children. It has devastating effects on its victims and represents a serious social security issue, considering the advanced networking technologies in existence today. With the advent of the darknet, access to child pornography has become extremely anonymous and secure, which has resulted in a rapidly growing number of users. As such, it has never been more urgent to formulate the ideal techniques and methods that can help law enforcement agencies identify and bust key players in child pornography.
A recently published paper studied data related to child pornography obtained from online forums on the darknet. Offenders usually use these forums to distribute and create online discussions about various forms of child pornographic materials. Such darknet forums are often moderated professionally and serve thousands of users. To coordinate law enforcement activities in an efficient manner, it is pivotal to identify key players who are indispensable to the existence of these platforms, such as technical moderators, administrators, and abusers. The paper explored this data as a network and attempted to automatically identify the aforementioned key players and their various roles using different network science techniques and methods.
Network data used in the study:
The study relied on two sets of network data, referred to in an anonymous manner as data set A and data set B because they represent sensitive law enforcement data. The data was obtained from two child pornography darknet forums that had been taken down by law enforcement before the study was performed.
Data set A included 14,659 users and involved a 4-year period between 2010 and 2014. To be able to access this forum, a user had to upload child pornographic material that had to be verified by the forum’s admin. The forum featured a special tiered system, i.e. users were granted access to special topics only if they posted self produced or unique content. This enabled users to gain prestige in the forum via active contribution.
Data set B included 21,257 users and involved a 2-year period between 2015 and 2017. This forum featured a standard approach for user registration, granting all users access to almost all content topics, apart from a small number of protected topics for administrators and producers.
Membership roles and PIM ranking on child pornography forums:
The researchers then utilized a special technique developed by the Dutch National Police, known as the Program Identifying Main Targets (PIM) analysis, to determine users’ roles and the ranking of key players on the forums.
The researchers divided users into 4 groups and predicted the percentage of occurrence of each role in data set A and data set B. These roles are:
– Managers (0.49% of users in data set A and 3.52% of users in data set B). Their responsibilities include enforcing the rules, organizing the forum, and welcoming new members.
– Abusers (0.59% of users in data set A and 4.1% of users in data set B). These users communicate excessively about child abuse and post topics discussing their experiences and fantasies. Abusers encourage other users to commit child abuse and may also produce child pornography material themselves.
– Technical users (0.4% of users in data set A and 3.14% of users in data set B). These users are mainly concerned with developing anonymity software and offering technical support to other forum users.
– Embedded users (98.3% of users in data set A and 89.24% of users in data set B). These are users that cannot fall under any of the aforementioned three groups.
User roles and key players in child pornography forums:
The study utilized user role identification to define network driven characteristics that can aid in understanding the position of various groups of forum users. The study proved that PageRank represented the highest rank order correlation within data set B and the second highest rank order correlation within data set A. The below figure illustrates the differences between various user roles within data set A and data set B based on PageRank.
Figure (1): Distribution of the values of PageRank with weighted projection for child pornography forum user roles
The study showed that forum users with a special role (i.e. managers (MA), technical users (TE), and abusers (AB)) had a more central position when compared to regular, or embedded, users. Moreover, managers and abusers had roles that were more central than those of technical users, which can be explained by the fact that these user roles (key players) are more individualistic and are more concerned with developing applications, namely communicating with their peers. Managers must interact with all user roles, and thus, have a more central role.
Conclusion:
The paper studied two distinct network data sets from darknet child pornography forums in which users communicate by commenting on various threads related to child abuse. Via analysis of the degree distribution of these networks, the researchers showed that longer threads are usually commented on by less active users, namely because these threads are relatively more easily to be found and discuss easily accessible topics. On the other hand, threads with few replies were commented on by more active users, denoting the existence of an elite group of forum users who engage in more sophisticated discussions, including key players with more important forum roles.
Final thoughts:
The paper presented useful information regarding the different user roles of darknet child pornography forums. In future work, authors of the paper plan to investigate if they can formulate a classification model to accurately identify the role of a user, building upon the conclusions of the analysis and characterization of forum user roles via centrality. Moreover, they plan to delve into the private messages exchanged between users on child pornography forums in attempt to study the extent to which visible social interaction in the forums captures invisible social interaction.
by: Tamer Sameeh
