Technology has fast become a double-edged sword: the same advancements that allow for a more connected and more enjoyable life also put child safety at terrible risk. Child sexual abuse materials (CSAM) can nowadays be found in virtually any online realm, whether it’s social media, online gaming platforms, or email. That’s the disturbing reality we live in. And, in their mission to protect children from harm, this is the harrowing situation law enforcement encounter daily.
In child exploitation investigations, it is often crucial to quickly determine if a suspect’s phone contains CSAM. The process of manually locating and reviewing every image file on a phone can be so time-consuming and emotionally taxing that it’s not a realistic option during an investigation. One unique and powerful feature of MSAB XRY solution is the capability to quickly determine if a suspect’s device contains child sexual abuse imagery. The method, rapid hash matching, has several advantages for investigators.
In this article, we’ll shine a light on those advantages. We’ll trace a line from How did we get here? to How is MSAB responding to ensure we are on the right path to defend children? We’ll delve into XRY’s capability to perform rapid hash matching and the impact of this feature on CSAM investigations.
Let’s take a closer look.
The Current State of Fighting Child Exploitation
The spread of child sexual abuse material (CSAM) was one of the first major criminal activities that emerged on the internet. The ubiquity of the internet and proliferation of digital devices have made it easier than ever before for criminals to create, distribute, and access CSAM.
The rise of this problem has been exponential. While 2001, the National Center for Missing and Exploited Children (NCMEC) received just 421 reports of CSAM, by 2021, that number far exceeded 29 million reports of suspected child sexual exploitation. Those 29 million reports included 85 million files – images and videos of CSAM. And the problem isn’t going away anytime soon. Reporting of suspected online child sexual abuse increased by 35% in 2021 compared with 2020, representing a historical peak.
CSAM Impacts on Victims
Child sexual abuse materials are far more than just images and videos being seen and shared through computers, phones, or other devices. Each CSAM file is an actual crime committed against children.
The detrimental impact of CSAM on victims is wide and far reaching. It includes long lasting trauma, psychological harm, fear, and feelings of guilt, shame and betrayal. Moreover, the effects of the exploitation and abuse last long after the victim has been removed from physical harm. Every time the images are viewed, the child victims suffer re-victimization. A survey led by the Canadian Centre for Child Protection showed that almost 70% of CSAM survivors feel victimized even after the physical abuse ends because once online, distribution never ends, the images are permanent, and their trauma gets resurfaced with every viewing. Because CSAM can be circulated for years, a full recovery is difficult, if not impossible.
While the picture is still incredibly grim, there are numerous efforts to turn the narrative around. Law enforcement agencies’ dedication in fighting this crime has helped make a difference in protecting children from harm.
Hashing: Revolutionizing the Digital Forensic Workflow in CSAM Investigations
Detecting CSAM is done through hash matching technology. This technology makes it possible to assign images and videos a “hash”, that is, a unique digital signature. Then, that hash can be compared against a database of previously identified CSAM.
Whether in the lab or in the field, law enforcement officers can quickly triage devices to determine the presence of CSAM content and flag the illicit files via hash matching.
On-site triage using hashes makes it easier to prioritize which devices need to be further analyzed and sent to the forensic lab. Through this initial assessment at the scene, frontline officers can determine which devices contain CSAM and reduce the number of devices they need to seize. Subsequently, they’ll also ease the burden on Digital Forensic Units (DFUs), which ultimately leads to cases getting solved faster.
Discover more ways to free up time for DFUs and empower expert investigators to handle the more complex cases.
Intelligence Databases of CSAM and Law Enforcement Collaboration
Project VIC and CAID are two out of multiple important initiatives aimed at combating online child exploitation. Both initiatives organize databases of hashes – digital fingerprints – of child sexual abuse material that helps law enforcement agencies identify and track down perpetrators of online child sexual abuse.
Project VIC (Victim Identification Center) is a global alliance of law enforcement agencies, non-profit organizations, and private sector partners working together to develop and share innovative technologies and tactics to help identify and rescue child victims of online sexual abuse.
UK-based CAID (Child Abuse Image Database) is the UK’s national database used by law enforcement to help fight the growing problem. It brings together all the images that the Police and National Crimes Association (NCA) encounter and it’s used to help identify both victims and perpetrators of child exploitation.
These databases are global tools that allow law enforcement agencies to share information and collaborate across borders in their efforts to protect children from online sexual exploitation. In a world as interconnected as ours, CSAM knows no borders. Neither should collaboration to fight this plague.
Huge amounts of data have already been categorized, analyzed, and tagged by forensic analysts, and the databases have revolutionized the workflow for investigators worldwide. Law enforcement agencies can download the hashes, and since the databases do not contain any actual images there is no risk of CSAM leaking and contributing to further re-victimization of survivors.
How Does XRY Leverage These Databases?
XRY is unique in its ability to perform rapid hash matching against data downloaded from international databases of observed CSAM, such as Project VIC and CAID. With XRY, investigators can connect a suspect’s phone to the software and conduct hash matching while the phone’s extraction is ongoing. MSAB’s Tech Evangelist Adam Firman explains:
“You, the investigator, are doing the extraction, you have connected the phone to XRY and can see the files coming off; a lot of DCIM filenames scrolling in front of you. If any of those files has got a hit against one of the databases, it will immediately come up with an alert saying that there is child abuse material.”
The efficiency of this workflow is remarkable. Examiners will know that there is CSAM on the device even before the extraction is finished. The swift confirmation can save forensic personnel valuable time during an investigation, and quick action can be taken against the suspect.
The Psychological Benefits of Using Rapid Hash Matching in CSAM Investigations
The advantages of the rapid hash matching feature do not stop at efficiency and workflow optimization. It also brings the advantage that investigators will not have to actually view the images or videos, which otherwise can be very taxing psychologically.
“You have to remember that investigators doing these extractions might not normally deal with child abuse images in their line of work, they may not be trained to work with this kind of material”, Adam Firman says. “So having this technology really helps reduce the emotional burden on examiners, and that is very important.”
Moreover, the use of XRY and hashes instead of manual inspection of images ensures that the investigation is conducted in a respectful manner, without further exploitation of victims.
Mobile Forensics Training That Makes the Difference in CSAM Investigations and Beyond
XRY is a greatly efficient data recovery software, and with the latest update it is more powerful than ever. To take advantage of its full power, officers operating the tool should be equipped with the knowledge and skills befitting their job level. That’s why training makes all the difference. It will ensure that professionals can harness the power of XRY, including (but not limited to) rapid hash matching.
One MSAB user drew attention to what makes training paramount:
“I train frontline officers on how to use XRY. This way, they’ll know how to – in just a few steps – download a phone, unplug it, and hand it back. They’re not spending half a shift in the office processing devices instead of being on the road helping the community by doing other police-related duties. Plus, if we can lower the number of devices that we bring back with us to the lab, it works for everybody.”
If police officers want to expand their skillset after the initial training, they can pursue certification courses from MSAB and focus further on forensic data extraction using our XRY products.
Improve Your Investigations with XRY
In short, time is of the essence during all investigations, and that is one of the reasons why XRY is such a valuable tool for law enforcement agencies when CSAM is involved. The rapid hash matching feature of XRY helps investigators quickly identify illegal content. It also rids them of the mentally painful task of having to view the images themselves. This unique feature is only but one of the myriad reasons why MSAB’s XRY software is an excellent tool for investigators to have at the ready.
If you’re new to MSAB tools and solutions, you can experience the brilliance and power of XRY and observe first-hand the the benefits it can bring to your organization. Get a 30-day trial and see yourself how it can help you find evidence that matters fast, in a secure, efficient, and lawful manner. Get in touch with our Sales team today at sales@msab.com.
