CIRCAMP

In the fall of 2006 the ECPTF (European Police Chief Task Force) accepted the Action Plan for CIRCAMP (COSPOL Internet Related Child Abuse Material Project). CIRCAMP is one of several COSPOL groups on various crime areas, and had worked on other Action Plans since its initiation in 2004. COSPOL is an abbreviation for Comprehensive Operational Strategic Planning for the Police.

CIRCAMP is a law enforcement only thematic network with the following members:

Driver: Norway

Co-driver: UK

Forerunner countries:

Denmark, Belgium, France, Finland, Ireland, Italy, Malta, Poland, Sweden, the Netherlands, Spain, Germany

Supporting units:

Europol and Interpol

CIRCAMP works towards raising the level of cooperation between law enforcement agencies in child sexual exploitation cases by expanding the sharing of information, reducing the duplication of work, increasing the quality and saving police man hours. Within the UK this role is performed by the Internet Watch Foundation.

Primary goals of CIRCAMP

·         To detect, disrupt and dismantle networks, organizations or structures used for the production and/or distribution of child abusive files and to detect offenders, identify children and stop abuse.

·         Through cooperation create a common understanding towards global policing of the Internet.

·         Reduce harm on society by attacking the distribution of child abuse material on a European level, and disrupt the methods used by organized crime groups responsible for the illegal pay per view sites.

Current Action Plan

- Phase I: Introduce blocking technology aimed at stopping the distribution of child abusive images and material. The system is called CSAADF (Child Sexual Abuse Anti Distribution Filter).

- Phase II: Analysis of sites and identify legal elements in the business solution and destroy their possibility of making a profit.

- Phase III: Investigating the people that financially benefit for the commercial distribution of child abuse material.

At present, several forerunner countries, in addition to various other countries, are working on the first two phases. CIRCAMP will cooperate with the police any country in the world willing to participate in the access blocking, will share information and make personnel available. The rest of this overview will focus mostly on the blocking of child abusive domains on the Internet.

By blocking access to domains distributing child sexual abusive material, several effects are achieved:

• Prevent the re-victimization of children.
• Prevent the illegal distribution of files.
• Prevent the illegal display of abuse material and reduce the harm to the general population while informing the public of the extent of the problem.
• Prevent access to child abuse material and thus limiting the “market”, reducing the need for new production.

Basic functionality and methodology

The police are responsible for confirming the illegality of the domain and to provide the addresses containing child abuse material. The Internet Service Providers (ISP) implements the access blocking in their networks, utilizing existing technology, personnel and equipment. All domains are downloaded by the police, seized, traced, looked up, saved and rechecked at predetermined intervals. Only police officers handle illegal material, as it is considered evidence of a crime, and shared between the participating law enforcement agencies.

The CSAADF focuses on blocking on domain level. We believe that this places the responsibility for the content of any domain or sub domain in the hands of the domain owner or administrator. If a domain owner places, accidental or willingly, child abuse material on his/her domain, and it is blocked by the police, the blocking will not be lifted until the material is removed. We believe that this will motivate content providers on the Internet to actively make an effort to avoid files with child sexual abuse on their systems/services. CIRCAMP believes that the police should not function as a moderator of Internet services, removing or blocking out parts of the available content, like an image. One image of a child in a sexual exploitive situation on a domain can/will result in the whole domain becoming unavailable in participating countries until removed. It is our experience that some domain owners/administrators are indifferent to the content they are providing access to, and there is a need for them to make informed decisions as to what content they are distributing and making available on the Internet.

In cases where a hosting company has been taken advantage of, like free photo hosting companies – CIRCAMP members will inform the owner/administrator of that domain that they are hosting child sexual abuse material. In most cases this will result in the removal of the files very quickly. Such services are not blocked as the implications for legal users and services would be substantial. If the domain containing child abuse material appears to be a legal domain or home page/company page of some sort, and is hosting this material without the knowledge of the responsible owner, the contact person of the domain is contacted and made aware of the hacking or abuse they have been victims of. The domain will normally be blocked until the contact person of that domain answers or contacts us, informing that the child abuse content has been removed. Our experience is that old domains that are no longer being updated and/or maintained are abused, due to the fact that the software or methods used to produce them are old and insecure, making it possible to hack and abuse them into hosting illegal material.

One trend when distributing child sexual abuse material is to host content on multiple services in different countries, while the complete content is compiled in the user’s browser when accessing the domain. The reason for this might be that a pure text (html, php etc) page will not attract Law Enforcement interest, as the norm is going after the content, making it possible to keep a domain name over time. The illegal files are then spread to various free or cheap hosting companies and the links are updated as they get deleted. By blocking the content, the Internet user will not have access to the domain and subsequently neither the illegal files.

Complaints for domain owners

CIRCAMP is in the process, in collaboration with Europol, to put in place a complaint system for domain owners/administrators related to the access blocking. If a domain owner/administrator experiences that his domain is blocked, a request via Europol will result in the reevaluation of the blocking in the participating countries, and as a result remove or continue the blocking based on the current content of the domain and the national legislation. The European legislation differs on various points when it comes to child exploitation, and a service that is totally legal in one EU country, is illegal to distribute in another. This is yet another reason why national legislation must apply and why national police must evaluate the legality of such services and initiate investigations if applicable.

Experiencing blocking

When an Internet user types in an address in his/her browser or clicks a link to a domain that has been found to contain child exploitation material, the ISP redirects the browser to a specific page instead of the desired address – the so called “stop page”. This contains information about what kind of content the users browser tried to access, links to national legislation, contact information to complain about the blocking and to the police. The content differs somewhat between the countries participating, but the basic message to the Internet user is the same.

An important part of the access blocking is the display of the “stop page” rather than a 404-error (page not found). The “stop page” will inform the Internet user that the police have evaluated the site in question and found that it contains material that is illegal to distribute in the country where the Internet user is accessing the network. The display of the “stop page” has a preventive and informative effect on the Internet user, will make some users reevaluate the material they are looking for and is raising awareness of the problem in general. The police are aware of the fact that many Internet users involuntarily or unwillingly are redirected to domains containing child exploitation material. The access blocking will prevent such involuntary exposure and might also motivate such users to remove any malware that are redirecting their browser.

In some countries, sites that provide payment services to the distributors of child abuse material are blocked. In spite of popular belief, the payment for illegal material is usually NOT done through serious payment companies, but rather through insecure scripts and programs placed on the same domain as the child abuse content or another domain that the distributors of this content controls. There are examples of serious companies being lured into providing payment services for illegal child sexual abusive files, by pretending to be adult pornography or other legal content. In cases where legal companies are abused and provide payment for illegal material, the domains are not blocked and the legal company informed. In our experience any legal company providing payments for illegal material will terminate these accounts immediately.

Information sharing

The countries that have access blocking in place will share all information on illegal sites between them and check the content according to national legislation. If the site is found to be illegal in said country, it will be added to the national list. Even though all information about the illegal sites is shared between the participants, the list generated by the police in each country differs according to legislation.

Both Internet users that actively seek out child abuse material in order to download or pay for access and those subjected to such material involuntarily are affected by the access blocking. The access blocking is purely preventive, no investigations against persons are initiated as a result of an Internet user being blocked and the “stop page” displayed. Internet users that are accessing, distributing, sharing, trading or possessing child abuse material will be dealt with using traditional police investigative methods outside of the preventive blocking.

In most participating countries the ISPs grant the police access to web logs that are generated when the “stop page” is displayed. The IP-address of the Internet users has been removed from the logs, so they contain no identifying information. These logs are used for statistic purposes and will provide information about new sites that are unknown to the police. The statistics from these logs will also provide an overview of the Internet usage related to child sexual abusive material in addition to information about search words, type of operating system, browser, time of day that most Internet users are redirected to the “stop page” etc. This will provide the police with the opportunity to have a qualified opinion about what their population look and search for, where on the Internet they originate, what time of day is most active and what kind of equipment they use. This, in turn, can direct the police towards areas that need more attention and personnel.

Using access blocking as part of the policing philosophy on the Internet is not something that is done instead of ordinary police work and investigations on the Internet, it is something that is done in addition to these methods. The nature of the Internet makes circumvention of the any blocking system possible for technically skilled people, but this does not undermine the importance of such blocking. Internet users that choose to access child sexual abusive material by bypassing access blocking must be approached and identified through usual police investigative methods.

CIRCAMP can assist and have assisted in presentations of the project on a multitude of levels, be it legislative, educational, for Internet content or access providers or politicians. One vital part of the work of CIRCAMP is transparency and heightening the awareness of the crime area and its impact on the victims and society in general. CIRCAMP members have attended conferences and educational gatherings all over the world to help spread the ideas of prevention and policing on the Internet, and will continue to do so in the future.

The number of hits

The number of hits in any given country varies greatly by size of population and legislation. One "hit" is here defined to being one display of the "stop page" rather than the illegal content. In countries with strict legislation, where for instance computer generated child abusive images are illegal, the numbers are somewhere in the area of 1 hit per 300 capita per day. This number varies, as the legal definition of a child differs, as do the objective criteria to define an image or movie illegal.

Cooperation with others

CIRCAMP has a law enforcement only policy when it comes to the sharing of documented child sexual abuse information, but receives information about child sexual abuse dissemination on the Web from a wide variety of sources, including NGOs running national hotlines. On non law enforcement sensitive information, CIRCAMP will cooperate with NGOs or other organizations on child rights, child protection, awareness raising and other topics related to this. The sexual abuse of children and documentation thereof is not a problem that can be solved by Law Enforcement alone, it is something that needs to be handled on a multitude of levels, and CIRCAMP will do its upmost to help.