IWF Operational Trends 2011
The IWF uses a bespoke database to collect and
interrogate our statistics in order to provide world-trusted information on the
prevalence and trends relating to the online criminal content we tackle. The
following information relates to the statistics and trends identified during
2011.
Child sexual abuse images: UK trends and removal
Child sexual abuse images: international trends and removal
Reports
During 2011 our Hotline processed a total of 41,877 reports and 13,164 (31%) of these were assessed as containing criminal content.
Of all reports, 40,949 concerned content on webpages, 835 concerned newsgroups and 93 concerned reports of other types of off remit content.
Of all public reports, 56% of people chose to leave their details in order to receive feedback from our analysts. Reports can also be made anonymously; our website allows reports to be made in a secure and confidential manner.
Figure 1 shows the number of reports processed by category and the number in each category assessed as within remit and potentially criminal.
A text description of this chart is available here.
90% of all reports made to the Hotline were believed to contain child sexual abuse material and 35% were confirmed as such by our analysts - slightly up on 2010 at 89% and 34% respectively. As of April 2011, we ceased taking reports regarding incitement to racial hatred online content as this passed to True Vision.
Child sexual abuse content
The majority of our work concerns the assessment and removal of child sexual abuse images and videos. In 2011:
- 74% of the child victims appeared to be 10 years old and under.
- 64% of all the child sexual abuse URLs depicted sexual activity between adults and children including the rape and sexual torture of the children.
- 65% of the victims were girls.
- 26% were boys.
- 8% contain both genders. A small number of the victims were unidentifiable as male or female.
A total of 12,966 URLs contained child sexual abuse hosted on 1,595 domains worldwide. This figure does not include newsgroup content.
Figure 2 shows the number of abused domains since 2006.
A text description of this chart is available here.
Hosting trends have changed and the rising number of abused domains since 2009 shows how criminals are once again using more and varied domains to distribute this content. This may increase the likelihood of online users stumbling across this material. There is a 15% increase in the number of abused domains since 2010. However, figures are still around half of what they were in 2006.
The 12,966 webpages were traced to 39 countries. Five top level domains (.com, .ru, .ps, .net, .org) accounted for 86% of all webpages identified.
For the past two years we have seen an increasing number of legitimate websites being criminally exploited to host this content.
Figure 3 shows the top 10 types of websites to be exploited to host child sexual abuse content.
A text description of this chart is available here.
Image hosting sites are most likely to be abused with 45% of child sexual abuse content found here. These sites enable the upload of an image and have a unique URL for each image. They are also known as weblockers, cyberlockers or one-click hosting.
Newsgroups
The IWF is the only Hotline to issue takedown notices for newsgroups and is the only Hotline to monitor and review newsgroups. We issued 193 takedown notices for newsgroups hosting child sexual abuse content.
In 2011, as a result of monitoring newsgroups for child sexual abuse content, we recommended our members do not carry 304 newsgroups. We continue to monitor a further 11 newsgroups.
Keywords list
We supply our keywords list to 44 organisations. In December 2011, this list contained 437 words associated with child sexual abuse content and 69 words associated with criminally obscene adult content.
Child sexual abuse images: UK trends and removal
In 2011 we took action regarding 12,966 instances of publicly available child sexual abuse content hosted around the world. Of those, 66 notices (for 214 URLs) were issued to remove content hosted in the UK. This relatively low number is testament to the online industry’s work with the IWF to make the UK a hostile environment to host such criminal content. Typically these URLs are removed within 60 minutes.
Of the UK-hosted content assessed:
- 65% of the child victims appeared to be 10 years old or under.
- 62% showed sexual activity between adults and children including the rape and sexual torture of the children.
- Six instances concerned adverts linking directly to this content.
These percentages increase for content hosted outside of the UK.
Child sexual abuse images: International trends and removal
12,752 reports were assessed as hosting child sexual abuse content outside of the UK.
- 74% of the child victims appeared to be 10 years old or under.
- 67% showed sexual activity between adults and children including the rape and sexual torture of the children.
Figure 4 shows the number of confirmed child sexual abuse URLs according to the host location (continent).
A text description of this chart is available here.
93% of all content actioned in 2011 was hosted in a country with an INHOPE Hotline.
We trace child sexual abuse content to determine the geographical location of the server on which is it is hosted at the time of assessment. This enables us to pass the details immediately to the relevant Hotline or law enforcement agency, or to take action ourselves in collaboration with the company whose services are being abused.
Commercial content
A significant proportion of our work concerns publicly available child sexual abuse images and videos provided on a commercial basis. Essentially, criminals set up websites in order to profit from the sale of this content. Since 2009 we have been tracking these ‘brands’ of commercial website to understand how this content is made available and the scale and number of criminal operations involved.
Over this time period we have identified 998 unique sources of commercial child sexual abuse websites, each with a distinctive name and brand. Of these, 440 have been active during 2011. Within the top 30 brands, no new ‘top level’ brand has been identified.
Each of the websites is a gateway to hundreds or even thousands of individual images or videos of children being sexually abused. They may be supported by layers of payment mechanisms, content stores, membership systems and advertising. Payment systems may involve pre-pay cards, credit cards, ‘virtual money’ or e-payment systems and the ‘customers’ may be required to carry out the transaction across secure webpages, text messages, or email. We are able to provide relevant details to law enforcement.
Other criminal content
- Of 2,779 reports alleging obscene adult content, just 2 were confirmed as such. One notice was issued for the removal of this content, while the other URL was removed before the notice was issued. The other reports were for content not hosted in the UK and therefore not within our remit.
- No notices were issued regarding non-photographic depictions of child sexual abuse.
- Until 3 April 2011 we took reports regarding incitement to racial hatred content. No notices were issued regarding this content.
‘Disguised’ websites
Our Hotline analysts are experts at tracking and tracing child sexual abuse content. They have discovered that a cluster of commercial (and some non-commercial) sites can only be accessed via a predetermined ‘digital path’. These ‘disguised websites’ therefore present different content based on the route the user takes.
When the URL is loaded directly into a browser, the page that loads usually contains legal adult content. However, if the same website is accessed via a particular gateway (referrer), the site displays child sexual abuse images.
This is a legitimate web development technique, commonly used, for example, on shopping websites which remember who you are when you return. However, like any technology of its type it is open to abuse. There are several reasons why this method of ‘disguising’ the criminal content is used.
Firstly it masks the criminal website from those who have not followed the correct digital path. Secondly, it means that a commercial child sexual abuse business may be able to acquire legitimate business services, such as banking services, if the website appears to host legal content when directly accessed – essentially tricking companies into providing their services for what is actually a criminal enterprise. It also means that when the public report finding child sexual abuse content to a Hotline, to the analyst visiting the reported URL, it appears to show legal adult content.
However, our analysts have become adept at spotting these sites and have developed a technique to circumvent the digital footpath to gain access to them.
This is an emerging trend and as yet, these sites have not been encountered on UK servers. Our analysts noted the use of this technique on 579 occasions during 2011. We are now working with other Hotlines to enable them to access these sites to expedite their removal. We are also working with our members in order to effectively tackle this trend.
Speeding up global removal of URLs
We challenged ourselves to speed up the removal of child sexual abuse webpages across the globe. We know that removal of this content in the UK is very fast but concern remains about the length of time content is available outside of the UK. During 2010 we launched new tactics to speed up its removal.
Figure 5 shows the percentage of child sexual abuse URLs removed within a given time (in days). This is for URLs hosted outside of the UK.
We regret that a text description of this chart is not available.
The yellow line tracks the time taken to remove all child sexual abuse URLs. It shows that around half of the child sexual abuse URLs hosted abroad are removed within 10 days with around 70% removed in 20 days. The removal process includes IWF liaising with the host country Hotline and with law enforcement agencies.
The blue line shows the speed at which URLs hosted outside of the UK by our members are removed. These URLs are removed more than 40% quicker than when a non-member is hosting the content. This is because we are able to directly alert our member to the presence of the child sexual abuse content on their services. That explains why almost 85% of URLs are removed within 10 days and after 13 days, 95% are removed. The host country’s Hotline and relevant law enforcement agency are still notified of the child sexual abuse content.
The plateau, which is seen at around 35 days, is the effect of on-going law enforcement investigations which means that URLs are unable to be removed.
We speed up the removal of online child sexual abuse content by:
- Proactively monitoring and reminding our international colleagues of images and videos that remain available for long periods;
- Providing simultaneous alerts to companies hosting child sexual abuse content outside the UK, at the same time as the details are provided to the relevant Hotline;
- Forging relationships with law enforcement agencies in countries without an INHOPE Hotline.
Public and victim protection whilst removing content
About the IWF URL list
After we have notified the relevant host (where they are a Member), hotline and law enforcement agency and while child sexual abuse content hosted abroad is available, we provide the IWF URL List. This allows companies to block and filter access to these webpages while efforts take place to remove the content.
In the UK blocking is carried out on a voluntary basis. Despite there being no legislative imperative for companies in the online sector to do this, over 98.6% of residential broadband connections are protected by internet service providers deploying our webpage blocking list.
76 companies chose to receive our list during 2011. These are a mixture of internet service providers, search providers, mobile operators and filtering companies who want to take steps to prevent their customers and users from being exposed to child sexual abuse content, and want to help prevent those victims’ sexual abuse being watched by others.
The list is deployed across all seven continents.
Due to our work to speed up the removal of this content there is an increase in the ‘churn’ of URLs. ‘Churn’ describes the numbers of URLs removed from the list as the content is taken down, and new URLs added as content is found. Therefore, the list is as dynamic as ever and importantly, we update the list twice a day to reflect this day-to-day churn.
2011 list trends
A total of 11,176 unique URLs were included on the list at some point during 2011. On average, 45 new URLs were added each day and the list contained an average of 602 URLs per day over the 12 month period.
These figures compare to an average of 1,200 URLs a day in 2008.
The wider picture
Deploying the list is a valuable disruption tactic to the distribution and accidental access to online child sexual abuse content. However, it is not a complete solution; it cannot put an end to offenders abusing children, nor can it effectively deny determined criminals who are actively seeking such material. Only a combination of tactics, including content removal, blocking, rigorous application of terms of use criteria and the sustained investigation of supply and demand networks by international law enforcement agencies can eradicate this complex global criminality.
Charts - Text Versions
Figure 1
Total reports processed:
Child sexual abuse content: 37,742
Criminally obscene adult content: 2,779
Incitement to racial hatred content: 242
Off-remit: 1,114
Potentially criminal URLs
Child sexual abuse content: 13,161
Criminally obscene adult content: 2
Incitement to racial hatred content: 0
Other: 0
Click here to go back.
Figure 2
2006: 3,077
2007: 2,755
2008: 1,536
2009: 1,316
2010: 1,351
2011: 1,595
Click here to go back.
Figure 3
Image host: 45%
Banner site: 12%
Social networking site: 12%
Generic websites: 10%
File host: 6%
Image store: 5%
Image board: 4%
Forum: 3%
Web archive: 2%
Blog: 1%
Various: 1%
Click here to go back.
Figure 4
North America: 6,341 (49%)
Europe (inc Russia): 5,522 (43%)
Asia: 1,096 (8%)
South America: 5 (<1%)
Australasia: 1 (<1%)
Africa: 1 (<1%).
Click here to go back.