Child pornography – how is the evidence obtained on the Internet?

Since the findings of the international operation “Luz na infância” (“Light in childhood”), led in Paraguay by the Public Ministry and the National Police for the prosecution of child pornography, it became clear that this type of abuse constitutes a problem with an international dimension. The scope has expanded with the irruption of new technologies and the private sector has become an important ally to cooperate in reducing this terrible problem.

The democratization of new technologies and the lack of information open up the possibility of access to illicit material, but it is important to point out that, in many cases, it is the relatives or people in their environment who are involved in the sexual or labor exploitation of minors. It must also be considered that these events are prior to the digital dissemination of the materials, according to the UN publication “Child Safety Online: Global challenges and strategies” and experts from the Internet Watch Foundation (IWF).

As stated in the Convention on the Rights of the Child, experts point out that poverty and underdevelopment are factors that favor minors being subjected to human trafficking, prostitution or pornography.

What is child pornography and how is this punishable act prosecuted in our country?

When we talk about child pornography, we are specifically referring to pornography involving people under the age of 18, being punishable in our country any person who produces, trades, distributes, disseminates, exhibits or intentionally acquires or stores it, by whatever means, as stipulated in article 140 (“Pornography related to children and adolescents”) of Law 4439/11 of the Paraguayan Criminal Code.

The institutions of the criminal justice system are responsible for carrying out the proceedings to prosecute this punishable act. Penalties range from 5 to 10 years in jail.

Moreover, on December 23, 2013, the Public Ministry signed an international cooperation agreement with the National Center for Missing and Exploited Children (NCMEC) based in Washington, United States. This agreement grants the Public Ministry remote access to Cyber Tipline, a software that allows the download of reports generated by NCMEC’s Exploited Child Division. In addition to this, it has the objective of optimizing investigations into illegal activities on computer networks related to the uploading and downloading of images of child pornography.

This institution works with content platforms based in the United States to collaborate in the prosecution of this type of abuse. A noteworthy fact is that, between 1988 and 2017, NCMEC received more than 27 million reports of suspected child sexual exploitation.

Since the signing of this agreement and its implementation in 2015, the most frequent criminal figure handled by the unit specialized in computer crimes of the Public Ministry is the “Pornography related to children and adolescents”, which accounts for 80% of the investigations.

On the same issue, in 2017 Paraguay ratified the Budapest Convention on Cybercrime, which is a legal instrument for international cooperation on the subject. It also has bilateral and strategic agreements (MLAT – international rogatory) with INTERPOL’s General Secretariat to ensure that there is a fluid, timely and effective communication between institutions of the criminal system and thus coordinate investigations against this criminal type.

How does the exchange of information between the content platforms and the NCMEC work?

The most widely used content companies worldwide have an agreement with NCMEC: in each one of their Terms and conditions (law enforcement) there is an exclusive section on this topic. Leading companies like Google, Facebook or Snapchat have a strong commitment in the fight against the exploitation of children on the Internet.

These content platforms have a software called “PhotoDNA”, developed by Microsoft, that analyzes the images, classifies them and reports them automatically. According to experts, the software analyzes the fingerprint of each image, which is unique. Through PhotoDNA algorithms, each of these fingerprints is expressed as a unique numeric code called hash. This hash is used to automatically identify an image with the same or similar characteristics, even if modifications are made to a file.

NCMEC has developed a large database of images of this type so that the companies that signed the agreement can automatically and routinely access the database and use it to check the images published on their platforms. This means that only the images that NCMEC is aware of can be detected, while other illicit images could eventually go unnoticed.

Can a criminal case be opened if I receive child pornography?

In the event that I receive this type of material without my consent, could a criminal case be opened? The answer is yes. Article 140 of Law 4439/11 is very clear in sanctioning the storage of this illegal material. Automatic and permanent checks are carried out by these content companies (WhatsApp, Microsoft, Google, Facebook) and, once they identify the hash, an alert is generated between the company and NCMEC. Subsequently, all the technical documentation (metadata) is sent to the Public Ministry of Paraguay, who starts the investigation to open a criminal case. It will be the suspected person who has to demonstrate that they are not responsible for the criminal act.

Do Internet providers monitor traffic?

Supposedly not, but there are ways for the Internet service provider (ISP) to find out which platform you are using. That is how they can identify when a person is using a “zero rating” service like “WhatsApp free”, so that it doesn’t get charged in their data plan, or when a customer connects via a VPN or a P2P network. In this sense, ISPs do control traffic and partly know about your access to these cloud services.

P2P networks feature a large amount of protocols and are currently very common ways to exchange this type of illegal material. In the case of the international operation “Light in childhood”, the details about the technical and intelligence efforts carried out to identify the IPs associated with the downloading and distribution of this material are unknown, due to serious configuration problems on the part of Internet providers in Paraguay.

Improving Internet infrastructure to collaborate in the fight against organized crime

To keep up with the great effort carried out to prosecute this punishable act, ISPs must improve network configurations in order to modernize Internet services and to achieve a unique identification of the devices and authors of a certain illegal act.

Currently, there are some IP address allocation problems: no unique assignments are made, which results in a serious user identification problem. When a client hires the Internet, some ISPs do not provide them with a public IP for their connection, but instead assign them a private IP, masked together with approximately 200 other customers behind a single public IP. In other words, the system of “one service = one public IP” that is the standard in the vast majority of countries, is not fulfilled in Paraguay. Therefore, when looking at the public IP “from the outside” and analyzing the traffic, it isn’t possible to identify a single person, having instead dozens of possible suspects. This problem was identified in the course of the international operation “Light in childhood“ and prevented more suspects from being identified.

In order to avoid a regulation on traffic data conservation that demands ISPs to store all metadata for 12 months (“Pyrawebs” law) it will be necessary to upgrade the network, thus avoiding massive and disproportionate mass surveillance in search of a small group of suspicious people.

A good alternative could be the implementation of IPV6 by all providers, for the entire infrastructure of the country, which would bring many benefits for all, such as the development of the “Internet of Things” (IoT). It would also help in the identification of suspects, without putting the privacy of innocent people at risk, while also alleviating the problems that arise from the extinction of IPv4 addresses.