Improving child sexual exploitation material investigations: Recommendations based on a review of recent research findings

Abstract

Child sexual exploitation material (CSEM) investigations have emerged as an area of specialization that combines multiple skillsets. Recent research has reshaped how we view CSEM offenders – they have different offense-supportive cognitions from contact sex offenders, their use of technology is no longer based on anecdotal evidence, and approaches to investigative planning, interviewing and forensics have evolved. This paper summarizes select, relevant areas of recent research related to CSEM investigations, and makes evidence-based recommendations for evolving how we approach these efforts. Current trends from other domains, including contact tracing and mental health considerations in a remote-working environment are additionally addressed.

Keywords

Child pornography child sexual exploitation material suicidality interviewing telework

Introduction

Historically, child sexual exploitation material (CSEM) was distributed in the backrooms of less-than-reputable adult stores and through mail order catalogues. Just prior to the Internet explosion, organizations like the United States Postal Inspection Service and similar investigative agencies around the world had all but removed access to CSEM in any widespread fashion and largely curtailed its distribution. Since the growth of the Internet, CSEM distribution has likewise expanded, overshadowing the paper-based distribution mechanism previously favoured. In 2019, the Internet Watch Foundation (IWF) identified 132,676 websites containing CSEM, which includes child pornography, child erotica and virtual child pornography (IWF, 2019). Also in 2019, the National Center for Missing and Exploited Children (NCMEC) received 16.9 million reports of child sexual exploitation, primarily from electronic service providers, across technologies ranging from Twitter to Snapchat, with Facebook representing 15.9 million of the total complaints, principally using Facebook Messenger (National Center for Missing and Exploited Children, 2020). At the same time, the technological landscape has become increasingly complex, with offenders using platforms ranging from peer-to-peer networking to TOR-based darknet forums (B. G. Westlake, 2020). With rapid changes in technology and limited law enforcement resources to address this issue (Cullen et al., 2020), using a risk-based, innovative approach to CSEM investigations is a necessity.

In addition to changes in technologies, the COVID-19 pandemic has changed workplace dynamics. Increased telework (López-Igual and Rodríguez-Modroño, 2020) for both law enforcement and offenders increases the importance of the home environment. Offenders may have lower employer surveillance over their activities, but more surveillance by family members. Because the home is now either an exclusive or joint workspace for many individuals, offending behaviour using work-related devices may allow for home search warrants more readily. Additionally, both physical and virtual access to children have changed – virtual classrooms means children are on-line more hours, and may have greater at-home risks of abuse. Additionally, increases in stress, social isolation, and downtime may be facilitative of increases in CSEM offending (Seto, 2019). The impacts of COVID-19 on the prevalence and nature of CSEM offending and how that impacts investigative dynamics are still in flux. Europol has shown mixed initial data, with no increased reporting related to CSEM offending in some countries, but markers of increased activity in others (Europol, 2020). Other preliminary data has shown increases in forum activity related to offending, as well as help-seeking behaviour (Parks et al., 2020).

This paper reviews recent, empirical research work related to CSEM in an investigative context. The paper recommends best practices for investigative planning, interviewing, digital forensics, and post-interview management of CSEM offenders, and provides guidance on providing for the mental health of those involved in CSEM investigations in a rapidly changing technological environment based on current trends and research findings.

This review uses the term ‘child pornography’ when referencing other work that used the term, and the phrase ‘child sexual exploitation material’ when referring to the broader content definition, consistent with the Luxembourg guidelines (Terminology and Semantics Interagency Working Group on Sexual Exploitation of Children, 2016). Additionally, a substantial number of the studies cited utilized research participants based in the United States and this paper uses that as an example jurisdiction where appropriate, though the majority of the recommendations have global applicability.

Investigative planning

The traditional approach to CSEM investigations is to either identify sufficient evidence on a single offender (e.g. in most peer-to-peer investigations) or to identify the group of offenders using a particular resource (e.g. in most darknet forum takedowns) and divide and conquer by providing leads to other investigative agencies with the appropriate jurisdiction. These are then frequently treated as discrete investigations by that agency, focusing on an individual offender. While this is an approach supported by jurisdictional rules and the appropriate use of local or regional resources, the ultimate goal of child protection can be inadvertently superseded by the goal of obtaining a proximal conviction. A better approach can be applied based on the contact-tracing concept stemming from disease propagation research (Eames and Keeling, 2003). In contact tracing, the origination vector (including the time and method of contact) is identified, as are any potential additional propagation vectors. For CSEM offenses, this aligns with current United States laws in that identifying when and how the content was obtained is one of the most effective methods of proving receipt charges. Further, identifying any propagation of the content after it is received can be used for proving distribution. Additionally, by working backward and referring information as needed to other jurisdictions where the content originated, the original ‘patient zero’ may be identified which would directly support victim identification and rescue. While CSEM images traditionally involved direct, hands-on abuse by a producer, the dynamics are shifting. During the COVID-19 pandemic, the Internet Watch Foundation found that 44% of shared CSEM was self-produced (“Disturbing” Rise in Videos of Children Who Have Been Groomed into Filming Their Own Abuse, 2020). Some of these images and videos were voluntarily taken but were non-consensually shared, while others reflect a shift toward more online grooming and sextortion-based crimes where the offender coerces or extorts the victim remotely.

For peer-to-peer systems like RoundUp and the Gridcop Child Protection System (CPS) (Child Rescue Coalition, 2020; Liberatore et al., 2010), a contact-tracing approach may mean incorporating and mining for trends in ‘first appearance’ data of a particular image or video to identify the start of a chain of production or distribution. For web forum takedowns, it may mean explicitly identifying initial upload data and providing that as part of lead packages to kickstart the contact tracing.

In individual cases, contact tracing means identifying the technical means and timeframe in which the content was acquired, and the identification of the source of the content (either an account name or IP address). It additionally means identifying any outward sharing of the content using the same approach and sending targeting packages to the relevant investigative agencies associated with those receiving that content. While full and permanent removal of the content from the Internet is not likely, identification of previously undetected repositories (e.g., individuals who received and collected but have not shared) for future distribution can occur with this approach.

The technical profiles of CSEM users need to be accurate for appropriate investigative planning as well. Historically, CSEM offenders were thought to be technically sophisticated individuals who made extensive use of countermeasures such as encryption. While some offenders exhibit technical sophistication in their particular criminal domain (i.e., obtaining CSEM), overall their technical sophistication was not found to be statistically different from the general public, and they owned fewer digital devices than the average person (Steel, 2021). Additionally, their use of technically sophisticated countermeasures like encryption has been consistently low, with recent rates ranging from 7.7% (Krone et al., 2017) to 18% (Steel et al., 2022a), though this only includes intentionally employed encryption and not built-in encryption like that on the iPhone. From an attribution perspective, 22% of CSEM offenders used TOR and 15% used anonymizing VPNs to hide their activities (Steel et al., 2022a), which necessitates confirming any IP addresses identified with CSEM activity are not shared servers running VPNs at a hosting facility and not TOR exit nodes as identified by the TOR project (TOR Exit Node List, 2020) before applying for and executing search warrants to avoid misattribution.

Current CSEM offenders are also significantly more mobile in their viewing habits than they were a decade ago (Constine, 2018; Restar, 2019; Romero Hernández, 2017). In a recent study, 22% of offenders reported viewing CSEM at a hotel/motel, 9% from a vehicle, 9% at work and 99% at home. In particular, individuals that were identified as viewing CSEM at work were 100% likely to also have viewed it at home, providing the basis for obtaining a residential search warrant based on work-based viewing activity (Steel et al., 2022a). Additionally, 27% of offenders reported using mobile phones to view CSEM, making portable viewing an increasing trend, and necessitating planning for the presence of and the seizure of mobile phones as part of any enforcement action (Steel et al., 2022a).

The risk of recidivism and future contact offending by CSEM offenders is generally overestimated, with the general public rating the risk of a CSEM offender committing a contact offense or committing another CSEM offense multiple times higher than the actual risks (Steel et al., 2022b). In practice, the 5 year recidivism rates for CSEM-only offenders ranged from 1.6% (Faust et al., 2015) to 4.4% (Eke et al., 2011) based on arrest and 10% based on self-reporting (Steel, 2021), though these are lower bounds as there may be both longer term and undetected recidivists. The risk of committing an additional contact offense is also low, with Seto et al. (2011) identifying a 2% contact offense rate and Elliott et al. (2019) a 2.7% rate. Because of the low risk of recidivism, alternative policing strategies have been employed in some locations. As an example, the Sussex police in the United Kingdom’s Police Paedophile On-Line Investigation Team (POLIT) began performing non-arrest knock-and-talks and issuing warning letters in lieu of investigation to low risk, first time offenders (those identified as downloading a single image or small number of images). This allowed for limited police resources to be focused on higher-impact contact offenders and larger volume CSEM offenders. Under Lawless Space Theory (LST), the act of reinforcing capable guardianship is likely to be a strong psychological deterrent to re-offending (Steel et al., 2021b), providing a similar level of deterrence to actual arrest. While not specifically addressed in the POLIT initiative, this type of approach could be coupled with a voluntary abandonment agreement for offenders to turn over any computer equipment used to view or store CSEM. This increases the friction costs that the offender must overcome to re-engage with CSEM and reduces the risk of the offender later finding old CSEM which becomes a trigger to recidivate (Steel et al., 2021b).

While deterrence-based approaches may be extremely cost effective by allowing funds to be spent on higher risk offenders and are likely to halt CSEM viewing behaviour in the majority of low-risk offenders, the tradeoff is the possibility of having uncovered victims present. A subset of those deterred may have already committed a contact offense or may be in possession of images that would allow the identification of additional victims. As with most law enforcement efforts, there are trade-offs in both approaches, but the societal benefits and opportunity costs that would be lost through a full investigation make this a viable option in specific cases.

Digital forensics

As noted above, CSEM offenders are not expected to have more devices present than non-offenders and are not significantly more likely to use enhanced anti-forensics techniques. They are, however, likely to employ countermeasures that frustrate forensics efforts, with 68% admitting that they have deleted their web browsing history, 38% using In-Private browsing and 31% using wiping software on their hard drive (Steel et al., 2022a). Additionally, a small percentage (4%) of offenders admitted to only viewing but never downloading pornography (Steel et al., 2021a), and the majority of offenders, 74%, admitted they deleted their entire collection at least once (Steel et al., 2021a). This may pose potential limits on the amount of forensic artifacts that are recoverable in a particular case, but it also highlights the fact that the forensic findings are the lower bound of activity, and the actual amount and duration of viewing will be substantially higher in many cases. This is an important consideration because for risk purposes the number of images and videos viewed may be less important than the length of offending (i.e., the overall time since the first image ever viewed) (Seto and Eke, 2015, 2017).

The composition of collections and collecting behaviours demand additional focus as well. One recidivism risk factor for CSEM offenders used in the Child Pornography Offender Risk Tool (CPORT), the most relevant current instrument for assessing the risk of re-offending, is the ratio of boy/girl content present in CSEM (Eke et al., 2019; Seto and Eke, 2015; Soldino et al., 2020), with a higher ratio indicating additional risk. In addition to the boy/girl content ratio, the quantity and presence of forensic detail related to adult SEM viewing should be catalogued. While many CSEM offenders show paedophilic behaviour, a substantial percentage of offenders are not paedophiles (or hebephiles) or exclusive paedophiles (Seto et al., 2006). Forensically, this may be evident in the proportion of child SEM compared to adult SEM. In a study looking at the ages of content present, 74% of previously convicted child pornography offenders viewed more adult SEM than child SEM, and no offenders exclusively viewed CSEM (Steel et al., 2021a). Forensically identifying a high ratio of CSEM to adult SEM content may be of later interest in terms of risk based on whether or not an offender is predominantly interested in CSEM or if it is a secondary interest based on their overall viewing habits.

Complicating the forensic challenges is a shift from predominantly image-based content to video-based content (Bursztein et al., 2019; Krone et al., 2017; B. Westlake et al., 2017; Wolak et al., 2011). Video analysis imposes additional requirements on examination – tools are needed to incorporate thumbnail generation for videos into ‘gallery’ views, codecs are needed to view particular video files may not be present, and the immersion of reviewing video and audio content may have a more detrimental effect on examiners. Additionally, traditional automated detection using hash-based identification may need to incorporate more flexible hashing approaches including video-based implementations of PhotoDNA (Langston, 2018), as well as artificial-intelligence based approaches (Bursztein et al., 2019; Vitorino et al., 2018).

Building on the contact-tracing approach, most digital devices are now part of a forensic ecosystem. The CSEM content found on an iPhone, for example, is potentially on any computer that the phone was connected to and backed up to an iCloud account. Additionally, features like device backups and automated restore points may mean the same content is further propagated to removable media or other locations within the same media (Boucher and Le-Khac, 2018; Chung et al., 2017; Domingues et al., 2019). By treating each device as part of an ecosystem and identifying vectors for potential CSEM propagation within a user’s systems, further external distribution can be identified, and the investigators can ensure all relevant copies of content are seized to prevent the facilitation of future recidivating behaviour.

As a final note, any suspected but previously identified CSEM content, including non-offending content that depicts the same individual as offending content, should be submitted to a victim identification clearinghouse such as NCMEC. Ideally, using the contract tracing approach, the content can be submitted detailing where the images originated from (e.g., the IP address and technology from which they were obtained). This will facilitate global victim identification by providing additional detail on currently unidentified victims, even if local resources preclude further pursuing those investigative leads.

Interviewing

Interviewing and interrogation approaches vary based on the legal system in which they operate. The PEACE approach is growing in popularity and has been effective within the United Kingdom (Shawyer et al., 2013), and its collaborative approach fits well with the contact-tracing approach to CSEM investigations. A more traditional interview/interrogation model using Reid-like techniques (Inbau et al., 2011) is potentially useful as well if there is a broader focus placed on rapport building and understanding, if the themes used align with actual offense-supportive cognitions in CSEM offenders, and if any admissions are fully corroborated with forensics to avoid false confessions. Because most if not all of the elements necessary for prosecution may be obtained forensically in many cases (and may even be identified before the interview), the focus of the interview can be redirected away from initial admissions and toward understanding the scope and specifics of when and how the subject obtained (and distributed or produced) CSEM.

In a recent survey of CSEM offenders in the United States, the majority of participants noted that investigators showed a lack of compassion, fairness, and understanding in their interview (Steel et al., 2022c). In particular, showing compassion was correlated with more full admissions of their CSEM activities. Because the development of rapport is critical and interviews tend to be most successful when investigators stress a humanistic approach (Cleary and Bull, 2019), exhibiting a better understanding of the concerns of offenders and developing themes that are consistent with their own rationalizations and do not attack self-worth.

Before the interview itself, consideration should be given to the environment in which it takes place. Ideally, the interview will occur in a neutral setting, but a law enforcement setting may be preferable to a home or work environment. CSEM offenders reported high anxiety around friends, family, and co-workers finding out about their activities (Steel et al., 2022c), and a home or work environment may increase their stress and act as an impediment toward a successful understanding-based interview. Additionally, those environments may cause early disclosure of the offender’s activities to those same individuals, resulting in additional stressors on both the offender and their unwitting and uninvolved relations.

In using an understanding-based approach with the CSEM offender, traditional offense-supportive cognitions that may be used as themes with contact offenders that rely on a lack of victim empathy or the sexualization of children may not resonate well as they tend to exhibit lower overall endorsement of traditional sex offender cognitive distortions (Steel et al., 2020). Instead, strong support for other cognitions that may lead to more effective theme development have been shown to be present in CSEM offenders. There are four specific themes that are consistent with the latest research on the cognitions of CSEM offenders (Paquette and Cortoni, 2020):

1. Digital images and videos are separate from the underlying contact abuse. There are two cognitive distortions present in CSEM offenders related to this theme – that the Nature of Harm is different, and that Virtual is Not Real (Paquette and Cortoni, 2020). Highlighting that the offender’s actions were purely virtual (with a caveat related to contact offending noted below) can facilitate admissions based on this shared understanding within the offender’s pre-existing belief system. It can also facilitate a contact tracing–based discussion on the details of acquisition and distribution without focusing explicitly on the underlying victimization.

2. Novelty-seeking as opposed to paedophilia drives behaviour. Research has shown that CSEM offenders view a broader variety of adult SEM categories than the general public (Steel et al., 2021a), their own statements justify their actions as thrill seeking, and not all CSEM offenders are paedophiles (Seto et al., 2006). By focusing on the actions that led an offender to view CSEM, the focus is taken away from the victimization and placed on a particular lawless space and how that facilitated their behaviour. The concept of uncontrollability of actions and the concept of a slippery slope may resonate with the offender, and allow them to expand on specific behaviours that led them to CSEM consumption. This can be furthered by discussions of Internet addiction or general pornography addiction (Quayle and Taylor, 2004), of which CSEM behaviour is only a portion of the ‘whole person’, which will allow the offender to compartmentalize and contextualize their behaviour.

3. CSEM consumption was out of character behaviour due to stressors. A significant portion of CSEM offenders endorsed offense-supportive cognitions related to Uncontrollability – both of the Internet and of their own behaviours (Paquette and Cortoni, 2020). Many offenders identified using CSEM to cope with life stressors (Knack et al., 2020), and that the stressors caused them to take actions they otherwise would not have engaged in. They additionally reported routine deletions of their collections as part of a guilt/shame cycle (Steel et al., 2021a). Discussing this in the context of the CSEM viewing behaviour being an out of character action, and that their guilt/shame shows remorse and that they wanted to but were struggling to do the right thing, is consistent with their self-justifications.

4. Engagement in a lawless space facilitated offending. Lawless space theory posits that specific perceived lawless spaces facilitate offending (Steel et al., 2021b). By focusing on a particular lawless space, investigators can discuss the general activities that occur in that space outside of the context of the individual offender (e.g. discussing sharing of copyrighted music on peer-to-peer), and discuss the overall uncontrollability of that space (Paquette and Cortoni, 2020). This allows for a transition into the criminogenic nature of the space and the child exploitation-related activities that occur there. In discussing and contrasting the actions of the offender with others in that lawless space, it shows the investigator understands the incentives provided in that context, reducing perceived strain related to the investigator’s views of the offender, and it allows the offender to minimize their own behaviours in the interview context. This can lead to a discussion of where the particular offender draws their limits related to age or depicted activities or volume, and to get an accurate picture of the overall CSEM offending behaviour.

As a final consideration in interviewing, a substantial portion of CSEM offenders may have committed a prior contact offense. The most accurate current estimates are that approximately half of CSEM offenders who are arrested have committed at least one prior contact offense against a child, though that may be partially due to a selection bias in the sampled populations (Seto et al., 2011). Because the proportion is well above zero, all interviews should, at a minimum, attempt to ascertain any prior contact offenses to identify victims. If the offender admits to CSEM activities and immediate discussions of contact offending are not practical, the use of tools such as confirmation polygraphs as part of plea agreements can help reduce the risk of missing unidentified victims (Bourke et al., 2015).

Post-interview management

CSEM offenders have a high post-interview suicide risk (Key et al., 2021; Kothari et al., 2021). In a survey of previously convicted offenders, 73% had a high suicidal ideation, and 19% attempted suicide (Steel et al., 2022c), and these numbers do not include individuals who took their own lives. There is also evidence that a substantial number of CSEM offender suicides occur within the first 48 h after their initial interview (Hoffer and Shelton, 2013). The impact of CSEM offender suicide is not limited to the offender – law enforcement investigating the CSEM offense and those responding to the suicide, as well as relatives that already have a difficult time adjusting to the disclosures of the offense may have additional psychological strain as a result. Additionally, victims depicted may not be able to pursue financial compensation or get closure (Hoffer et al., 2010) following an offender’s suicide. Because of this, investigators should have a plan for reducing suicide risk in place for all CSEM investigations. Reduction in suicide risk starts with the interview – a compassionate approach to the offender as noted will begin the process on sound footing based on trust.

The most immediate post-interview intervention should be to engage the offender and assess and plan for any suicidality. From an investigator standpoint, a modified crisis response plan approach (M-CRP) can be used (Rudd et al., 2001). The M-CRP has three main components. First, an assessment of any immediate suicidal risk and associated mechanisms should be undertaken. Second, a contact plan should be put in place. Finally, the investigator should fully explain the next steps in the legal process that will occur.

To begin the process of assessing immediate suicide risk, the investigator should ask the offender what their next steps are – how they are doing overall, where they are planning to go and what they are planning to do immediately after the interview. Asking the subject if they are considering taking their own life as appropriate, and how they are considering doing so, can then occur. Under M-CRP, steps to remove implements that would facilitate suicide should be taken. This can consist of a voluntary surrender of firearms to law enforcement or to a trusted third party the subject designates. If suicidal ideation is suspected, the investigator should assist the subject in making contact with an appropriate counselling service, whether local or through a national suicide helpline. In cases where there is a suspected immediate risk of self-harm, a 72 h involuntary commitment can be considered.

Based on the subject’s responses to what their next steps are going to be (and many may not have any idea what their next steps are), the investigator can assist in planning a short term protection strategy, which leads to a basic contact plan. The investigative agency should have a previously prepared pamphlet for all subjects that provides contacts to mental health crisis intervention staff as well as to organizations such as StopItNow (StopItNow – About Us, 2020), which can assist subjects as well as family members. The investigator should elicit from the subject the names of individuals that they can personally discuss their situation with and encourage the subject to write them down as part of the M-CRP. This can include friends, family, clergy or colleagues that they trust.

Finally, the investigator should discuss the next steps in the legal process with the subject and provide estimated timeframes for each step. Because many CSEM-only offenders have no prior criminal record (Seto and Eke, 2005), they are likely to be unfamiliar with the steps in the criminal justice system. Questions about returning seized equipment, court appearances and notifications are common. If possible, prosecutors should avoid press releases at the time of arrest to allow subjects the time to notify their friends and family in their own manner and avoid putting in place an additional, immediate strain.

Mental health for investigation staff

Law enforcement, in general, is a stressful career field, with departmental issues and operational interactions causing increased risk for mental (and physical) health issues (Toch, 2002). Investigators and forensic staff working crimes against children cases face additional stressors, including social isolation from colleagues and secondary traumatization from viewing explicit depictions of abuse. In a study of Internet Crimes Against Children (ICAC) taskforces, 35% reported individuals experiencing negative life impacts including sexual dysfunction, personal and family difficulties, and job performance issues (Wolak and Mitchell, 2009). In particular, sworn law enforcement officers that also perform digital forensics examinations appear to be the highest risk for secondary traumatic stress issues (Seigfried-Spellar, 2018).

Current technological and environmental changes can exacerbate the problems facing CSEM investigative staff. The more sensory engagement in content, the higher the level of immersion, and therefore the greater potential for secondary traumatic stress. The shift to video (Bursztein et al., 2019; Krone et al., 2017; B. Westlake et al., 2017; Wolak et al., 2011) as the preferred medium over still images has increased immersion through the depth provided by moving images and the inclusion of audio sensory content as well as the increased time-on-target required to review the content. Virtual reality SEM has the potential for even greater immersion (Simon and Greitemeyer, 2019) and secondary traumatic stress. At the same time, telework is increasing (López-Igual and Rodríguez-Modroño, 2020), compounding potential social isolation issues (Pietrabissa and Simpson, 2020). There are several best practice considerations for departments related to the CSEM investigations policies and practices that are emerging:

1. Modification of work environments. Environmental design to reduce isolation for crimes against children staff moved working environments from closed-door units to digital labs with open floorplans, using monitor shields and headphones to limit exposure while reducing social isolation in recent years. The COVID-19 pandemic increased overall telework on a potential permanent basis (López-Igual and Rodríguez-Modroño, 2020), including for law enforcement and forensics personnel. To reduce contact exposure, many digital forensics labs have gone virtual, which has forced personnel to review offending content in a socially isolated ‘sandbox’ environment. In addition to well-practised strategies of taking frequent breaks and switching between tasks, new options are needed. One option being piloted by several departments is the issuance of dual monitors to staff, so that individuals can have an always-on video connection with colleagues on one screen while reviewing explicit material (with appropriate controls for the home environment) on the other, reducing social isolation without increasing exposure. More research and additional strategies will be needed as more labs utilize virtual reviews.

2. Continuous Suitability Evaluations. The United States Federal Bureau of Investigation (FBI) pioneered comprehensive suitability assessments for individuals joining their Innocent Images programme. Additionally, many departments require mandatory annual psychological assessments, which ensures that mental health assistance is destigmatized and removes barriers to help-seeking (Krause, 2009). Because the symptoms of problematic levels of job stress can be subtle and additive, however, formal annual check-ins should be augmented by more routine check-ins for continued suitability for CSEM investigative work. Changes in life situations (e.g. the birth of a child) or job stressors, coupled with cumulative secondary traumatic stress, can manifest in subtle ways at first and supervisory and mental health personnel should monitor for signs and symptoms and provide immediate intervention as needed. Voluntary transfer at any time, either temporarily or permanently, to non-CSEM assignments should be readily available and non-punitive.

3. Resilience training. Resilience training focuses on recognizing the signs of stress and implementing mechanisms such as mindfulness to reduce that stress. Law enforcement resilience training has been shown to be effective in positive changes in psychological and physiological measures (Christopher et al., 2018; McCraty and Atkinson, 2012; Weltman et al., 2014). Initial and recurring resilience training should be made available to all CSEM investigations staff. This training can be particularized toward CSEM work, focusing on CSEM-specific signs of stress such as hypervigilance with children, recollection of recurring and intrusive images, and impacts to social and sexual functioning. Stress reduction mechanisms can include incorporating routine breaks during examinations, peer support (from other CSEM investigations staff), and providing work hours for mental health activities (such as mindfulness) in addition to physical health (i.e. exercise).

4. Reduced immersion. With the shift to video (and eventually virtual reality), the risks for secondary traumatic stress on forensic examiners is increased. Technological steps can be taken to reduce immersion. These include flattening three dimensional content (and not viewing it in a VR environment), reviewing video with the audio turned off (and reviewing the audio separately), using thumbnail generation software to review videos, and viewing video and images in windows that are not full screen and at lower resolutions. For still images, de-duplication based on PhotoDNA hashes (Langston, 2018) not only reduces analysis time, but reduces the reinforcing impact of repeated viewing of the same image multiple times. Finally, investigative reporting workflows should be designed such that repeated viewing of the same content is not necessary.

Future research

This paper highlights several areas where there is limited empirical research available. A few of the high importance areas that would inform more effective policing of CSEM offenses are as follows:

1. CSEM propagation. There are technology-specific studies looking at individual areas such as CSEM persistence (Bissias et al., 2016), there have been no large-scale studies looking at the overall propagation of CSEM from production through extinction (or end state persistence). Understanding how content is distributed and how it crosses between different virtual lawless spaces may provide insights into deterrence and lead to more effective contact-tracing approaches.

2. Mental health for CSEM investigative staff. This work proposed several areas of consideration for CSEM investigative staff mental health based on work done elsewhere in law enforcement and the psychology of human computer interaction; however, the deployment and measurement of specific pieces of a programme are necessary. Differences in immersivity, impact of specific resilience efforts and experimental verification of work environment changes are areas for future research work.

3. Applicability of offense-supportive cognitions in building interview rapport. Current CSEM offenders reported low levels of investigator compassion and understanding (Steel et al., 2022c). More research on the effectiveness of the application of these cognitions as themes, and the impact on both confession rates and perceived investigation compassion, is needed.

Conclusion

This work presented a summary of current CSEM research that is directly applicable to policing, with best practice recommendations for rethinking the approach to CSEM investigations suggestions for evolving approaches to investigative activities based on current technological and work environments. As technology advances and our understanding of CSEM offenders and their behaviours deepens, investigative approaches will continue to improve from an ever-growing evidence-based, empirical foundation.

Footnotes

Declaration of conflicting interests

The author(s) declared no potential conflicts of interest with respect to the research, authorship, and/or publication of this article.

Funding

The author(s) received no financial support for the research, authorship, and/or publication of this article.

ORCID iD

Chad MS Steel

References

Bissias

Levine

Liberatore

, et al. (2016) Characterization of contact offenders and child exploitation material trafficking on five peer-to-peer networks. Child Abuse & Neglect 52: 185–199.

Boucher

Le-Khac

N-A

(2018) Forensic framework to identify local vs synced artefacts. Digital Investigation 24: S68–S75.

Bourke

Fragomeli

Detar

, et al. (2015) The use of tactical polygraph with sex offenders. Journal of Sexual Aggression 21(3): 354–367.

Bursztein

Clarke

DeLaune

, et al. (2019) Rethinking the detection of child sexual abuse imagery on the internet. In: The World Wide Web Conference, Burlingame, CA, USA, pp. 2601–2607.

Child Rescue Coalition (2020). https://childrescuecoalition.org/

Christopher

Hunsinger

Goerling

LRJ

, et al. (2018) Mindfulness-based resilience training to reduce health risk, stress reactivity, and aggression among law enforcement officers: A feasibility and preliminary efficacy trial. Psychiatry Research 264: 104–115.

Chung

Park

Lee

(2017) Digital forensic approaches for Amazon Alexa ecosystem. Digital Investigation 22: S15–S25.

Cleary

HMD

Bull

(2019) Jail inmates’ perspectives on police interrogation. Psychology, Crime & Law: PC & L 25: 157–170. https://www.tandfonline.com/doi/abs/10.1080/1068316X.2018.1503667

Constine

(2018) WhatsApp Has an Encrypted Child Porn Problem. TechCrunch. http://social.techcrunch.com/2018/12/20/whatsapp-pornography/

10.

Cullen

Zug Ernst

Dawes

, et al. (2020) Our laws have not caught up with the technology”: understanding challenges and facilitators in investigating and prosecuting child sexual abuse materials in the United States. Laws 9(4): 28.

11.

“Disturbing” rise in videos of children who have been groomed into filming their own abuse (2020). https://www.iwf.org.uk/news/%E2%80%98disturbing%E2%80%99-rise-videos-of-children-who-have-been-groomed-into-filming-their-own-abuse

12.

Domingues

Frade

Andrade

, et al. (2019) Digital forensic artifacts of the Your Phone application in Windows 10. Digital Investigation 30: 32–42.

13.

Eames

KTD

Keeling

(2003) Contact tracing and disease control. Proceedings. Biological Sciences/The Royal Society 270(1533): 2565–2571.

14.

Eke

Helmus

Seto

(2019) A Validation Study of the Child Pornography Offender Risk Tool (CPORT). Sexual Abuse: A Journal of Research and Treatment 31(4): 456–476.

15.

Eke

Seto

Williams

(2011) Examining the criminal history and future offending of child pornography offenders: an extended prospective follow-up study. Law and Human Behavior 35(6): 466–478.

16.

Elliott

Mandeville-Norden

Rakestrow-Dickens

, et al. (2019) Reoffending Rates in a UK Community Sample of Individuals with Convictions for Indecent Images of Children. Law and Human Behavior 43(4): 369–382. https://psycnet.apa.org/record/2019-20831-001

17.

Europol

(2020) Catching the Virus Cybercrime, Disinformation and the COVID-19 Pandemic. The Hague, Netherlands: Europol.

18.

Faust

Bickart

Renaud

, et al. (2015) Child pornography possessors and child contact sex offenders: a multilevel comparison of demographic characteristics and rates of recidivism. Sexual Abuse: A Journal of Research and Treatment 27(5): 460–478.

19.

Hoffer

Shelton

JLE

(2013) Suicide Among Child Sex Offenders. Berlin, Germany: Springer Science & Business Media.

20.

Hoffer

Shelton

JLE

Behnke

, et al. (2010) Exploring the impact of child sex offender suicide. Journal of Family Violence 25(8): 777–786.

21.

Inbau

Reid

Buckley

, et al. (2011) Criminal Interrogation and Confessions. Burlington, MA: Jones & Bartlett Publishers.

22.

IWF (2019) Internet Watch Foundation Annual Report - 2019. https://www.iwf.org.uk/sites/default/files/reports/2019-04/Onceuponayear-IWFAnnualReport2018.pdf.

23.

Key

Underwood

Farnham

, et al. (2021) Suicidal behavior in individuals accused or convicted of child sex abuse or indecent image offenses: Systematic review of prevalence and risk factors. Suicide & Life-Threatening Behavior 51(4): 715–728.

24.

Knack

Holmes

Fedoroff

(2020) Motivational pathways underlying the onset and maintenance of viewing child pornography on the Internet. Behavioral Sciences & the Law 38(2): 100–116.

25.

Kothari

Key

Lawrenson

, et al. (2021) Understanding Risk of Suicide among perpetrators who view child sexual abuse material (CSAM). Journal of Forensic and Legal Medicine 81: 102188.

26.

Krause

(2009) Identifying and managing stress in child pornography and child exploitation investigators. Journal of Police and Criminal Psychology 24(1): 22–29.

27.

Krone

Smith

Cartwright

, et al. (2017) Online child sexual exploitation offenders: A study of Australian law enforcement data. Criminology Research Grants 77. http://www.criminologyresearchcouncil.gov.au/reports/1617/58-1213-FinalReport.pdf

28.

Langston

(2018) How PhotoDNA for video is being used to fight online child exploitation. In: Combating Child Pornography: Steps are Needed to Ensure that Tips to Law Enforcement are Useful and Forensic Examinations are Cost Effective. Washington DC: DIANE Publishing.

29.

Liberatore

Erdely

Kerle

, et al. (2010) Forensic investigation of peer-to-peer file sharing networks. Digital Investigation 7: S95–S103.

30.

López-Igual

Rodríguez-Modroño

(2020) Who is Teleworking and Where from? Exploring the Main Determinants of Telework in Europe. Sustainability: Science Practice and Policy 12(21): 8797.

31.

McCraty

Atkinson

(2012) Resilience training program reduces physiological and psychological stress in police officers. Global Advances in Health and Medicine 1(5): 44–66.

32.

National Center for Missing and Exploited Children (2020) NCMEC - Key Facts. https://www.missingkids.org/footer/media/keyfacts

33.

Paquette

Cortoni

(2020) Offense-supportive cognitions expressed by men who use Internet to sexually exploit children: A thematic analysis. International Journal of Offender Therapy and Comparative Criminology 66: 306624X20905757.

34.

Parks

Sparre

Söderquist

, et al. (2020) Illegal online sexual behavior during the COVID-19 pandemic: a call for action based on experiences from the ongoing prevent it research study. Archives of Sexual Behavior 49(5): 1433–1435.

35.

Pietrabissa

Simpson

(2020) Psychological Consequences of Social Isolation During COVID-19 Outbreak. Frontiers in Psychology 11: 2201.

36.

Quayle

Taylor

(2004) Child Pornography: An Internet Crime. London, UK: Routledge.

37.

Restar

(2019) Encrypted Apps Are Used as Marketplace For Child Porn — Z6 Mag. Z6 Mag. https://z6mag.com/2019/02/21/encrypted-apps-are-used-as-marketplace-for-child-porn/

38.

Romero Hernández

(2017) Technology and child pornography in Colombia, 2013-2015: Interpretation from a victimology approach. Revista Criminalidad 59(1): 27–47.

39.

Rudd

Joiner

Hasan Rajab

(2001) Treating Suicidal Behavior: An Effective, Time-Limited Approach. New York, NY: Guilford Press.

40.

Seigfried-Spellar

(2018) Assessing the psychological well-being and coping mechanisms of law enforcement investigators vs. digital forensic examiners of child pornography investigations. Journal of Police and Criminal Psychology 33(3): 215–226.

41.

Seto

(2019) The motivation-facilitation model of sexual offending. Sexual Abuse: A Journal of Research and Treatment 31(1): 3–24.

42.

Seto

Cantor

Blanchard

(2006) Child pornography offenses are a valid diagnostic indicator of pedophilia. Journal of Abnormal Psychology 115(3): 610–615.

43.

Seto

Eke

(2005) The criminal histories and later offending of child pornography offenders. Sexual Abuse: A Journal of Research and Treatment 17(2): 201–210.

44.

Seto

Eke

(2015) Predicting recidivism among adult male child pornography offenders: development of the child pornography offender risk tool (CPORT). Law and Human Behavior 39(4): 416–429.

45.

Seto

Eke

(2017) Correlates of admitted sexual interest in children among individuals convicted of child pornography offenses. Law and Human Behavior 41(3): 305–313.

46.

Seto

Hanson

Babchishin

(2011) Contact sexual offending by men with online sexual offenses. Sexual Abuse: A Journal of Research and Treatment 23(1): 124–145.

47.

Shawyer

Milne

Bull

(2013) Investigative interviewing in the UK. In: International Developments in Investigative Interviewing. London, UK: Willan, pp. 50–64.

48.

Simon

Greitemeyer

(2019) The impact of immersion on the perception of pornography: A virtual reality study. Computers in Human Behavior 93: 141–148.

49.

Soldino

Carbonell-Vayá

Seigfried-Spellar

(2020) Spanish validation of the child pornography offender risk tool. Sexual Abuse: A Journal of Research and Treatment 33: 1079063220928958.

50.

Steel

CMS

(2021) Digital Behaviours and Cognitions of Individuals Convicted of Online Child Pornography Offences. The University of Edinburgh. DOI: 10.7488/ERA/1634.

51.

Steel

CMS

Newman

O’Rourke

, et al. (2020) A systematic review of cognitive distortions in online child sexual exploitation material offenders. Aggression and Violent Behavior 51: 101375.

52.

Steel

CMS

Newman

O’Rourke

, et al. (2021a) Collecting and viewing behaviors of child sexual exploitation material offenders. Child Abuse & Neglect 118: 105133.

53.

Steel

CMS

Newman

O’Rourke

, et al. (2021b) Lawless Space Theory for Online Child Sexual Exploitation Material Offending.psyarxiv.com/hnvb4

54.

Steel

CMS

Newman

O’Rourke

, et al. (2022a) Technical behaviours of child sexual exploitation material offenders. Journal of Digital Forensics, Security and Law 17(1): 2.

55.

Steel

CMS

Newman

O’Rourke

, et al. (2022b) Public perceptions of child pornography and child pornography consumers. Archives of Sexual Behavior 51: 1179–1185. DOI: 10.1007/s10508-021-02196-1.

56.

Steel

CMS

Newman

O’Rourke

, et al. (2022c) Suicidal ideation in offenders convicted of child sexual exploitation material offences. Behavioral Sciences & the Law 40: 365–378. DOI: 10.1002/bsl.2560.

57.

StopItNow - About Us (2020). https://www.stopitnow.org/about-us

58.

Terminology and Semantics Interagency Working Group on Sexual Exploitation of Children (2016) Terminology Guidelines for the Protection of Children From Sexual Exploitation and Sexual Abuse. ECPAT International.

59.

Toch

(2002) Stress in Policing. Washington, DC: American Psychological Association.

60.

TOR Exit Node List (2020). https://check.torproject.org/torbulkexitlist

61.

Vitorino

Avila

Perez

, et al. (2018) Leveraging deep neural networks to fight child pornography in the age of social media. Journal of Visual Communication and Image Representation 50: 303–313.

62.

Weltman

Lamon

Freedy

, et al. (2014) Police department personnel stress resilience training: an institutional case study. Global Advances in Health and Medicine 3(2): 72–79.

63.

Westlake

Bouchard

Frank

(2017) Assessing the validity of automated webcrawlers as data collection tools to investigate online child sexual exploitation. Sexual Abuse: A Journal of Research and Treatment 29(7): 685–708.

64.

Westlake

(2020) The past, present, and future of online child sexual exploitation: summarizing the evolution of production, distribution, and detection. In: Holt

Bossler

(eds), The Palgrave Handbook of International Cybercrime and Cyberdeviance. Berlin Germany: Springer International Publishing, pp. 1225–1253.

65.

Wolak

Finkelhor

Mitchell

, et al. (2011) Arrests for child pornography production: data at two time points from a national sample of US law enforcement agencies. Child Maltreatment 16(3): 184–195.

66.

Wolak

Mitchell

(2009) Work-Related Exposure to Child Pornography in ICAC Task Forces and Affiliated Agencies: Reactions and Responses to Possible Stresses. United States Department of Justice. https://www.researchgate.net/profile/Kimberly_Mitchell6/publication/267857165_Wor k-Related_Exposure_to_Child_Pornography_in_ICAC_Task_Forces_and_Affiliated_Agencies_Reactions_and_Responses_to_Possible_Stresses/links/553652d60cf20ea35f120a2d.pdf?inViewer=true&pdfJsDownload=true&disableCoverPage=true&origin=publication_detail