Investigating Child Exploitation Online: Tools, Tech, and Tactics

Technology makes many crimes easier to commit, and opens up new avenues to commit crimes. But it can also be used to combat crime and find the perpetrators. Though the internet makes it easier for criminals to exploit children and share child sexual abuse material, it also enables better tracing and collaboration required for law enforcement to investigate child exploitation and bring the perpetrators to justice.

See Child Exploitation Cyber Investigations with Debbie Garner for a complete transcript of the Easy Prey podcast episode.

Debbie Garner spent most of her law enforcement career with the Georgia Bureau of Investigation. After learning she was too short to be an Air Force pilot like she wanted, she switched to criminal justice and was hired by the GBI right out of college. She spent some years in undercover narcotics, then worked in healthcare fraud and terrorism intelligence before being promoted to Special Agent in Charge of the GBI’s Child Exploitation and Computer Crimes Unit. It was by far her favorite assignment, and the only time in her career where she consistently felt like she was making a difference. She retired a few years ago, but kept her passion for helping with these investigations. Now she works in the private sector, advocating for tech tools and software solutions to help fight child exploitation.

Child Exploitation and the Internet

The law calls it child pornography, but Debbie prefers to call it child sexual abuse material (CSAM). Before the internet, it was traded by mail. Pedophiles mailed hard-copy photos, CDs, and similar media to each other. That’s why the Postal Inspection Service used to be the main law enforcement agency working on these investigations. They still do to some degree, but with the advent of the internet, most child exploitation has gone online.

There are a number of ways children can be victimized, not just online sexual exploitation.

Debbie Garner

The internet has also changed how child exploitation happens. Most children are victimized by someone they know, whether that’s someone in their family or in their community. And that is still true. But with the internet, children don’t necessarily have to know their abuser. There are plenty of predators online who can manipulate children and victimize them in a number of ways. Child exploitation is often shared online, but that’s not necessarily where it happens. There are a number of ways children can be victims, both online and through their family and community.

How Law Enforcement Investigates Child Exploitation

Investigating child exploitation is a very collaborative process. The FBI, Homeland Security, and the Secret Service all do work on child exploitation investigations. In the U.S., though, most CSAM investigations are done at the state and local level through divisions of the Internet Crimes Against Children Task Force, which is a federally-funded task force program. There are 61 ICAC Task Forces across the country, and the federal funding helps the state agencies put additional tools and manpower into these investigations.

Local, state, and federal agencies work together on these investigations. There is even international collaboration, because crimes don’t have a border. It’s one of the most collaborative law enforcement efforts in the world. Different countries have different priorities, of course, but many people and agencies tend to prioritize abuse of children because people feel it’s a horrific crime.

The internet is obviously global, therefore these [child exploitation] crimes are global.

Debbie Garner

Identifying and safeguarding victims is a priority. It’s not uncommon to have a suspect in one jurisdiction with a victim (or multiple victims) in others. Working across jurisdictions is pretty much a requirement in investigating child exploitation. In the U.S., law enforcement and the ICAC Task Force has agreed that whatever jurisdiction has the perpetrator or suspect is the main entity doing the investigation.

Where Investigations Start

Investigations can start from either the victim or the perpetrator. The way most ICAC Task Forces get cases is through the National Center for Missing and Exploited Children’s (NCMEC) cyber tips program. These tips can either be about a child who is victimized where the investigation needs to find the perpetrator, or someone who was found with CSAM and investigators are looking for victims. Federal law requires companies like Meta, Snap, Comcast, Microsoft, Google, ISPs, and apps to report instances of child exploitation on their platform to the NCMEC. They’re not required to look for it, only report it if they found it. But many do look for it, and are pretty good at finding it.

Once it’s reported, the NCMEC triages it, adds information they can find, and passes the tip to one of the task forces. When Debbie started in 2013, Georgia got about 2,400 cyber tips a year. Last year, they got over 30,000. If you visit the NCMEC website, you can see lots of statistics. The total cyber tips reported, mostly from ISPs, has increased drastically.

The problem is that funding do deal with these cases hasn’t increased at all. The ICAC program is funded at the same rate today as it was when it was funded. In Georgia, Debbie’s unit received additional funding each year from the state, but it didn’t keep up with the tip increases. Across the country, ICAC Task Forces don’t have enough resources. There are never enough people and tech to keep up with the influx of tips, and this is true across the country.

Investigating Child Exploitation Requires Funding

When Debbie retired, several other ICAC commanders retired around the same time. They joined with even more who had retired earlier but were still working in investigating and fighting child exploitation and formed Raven, a group to lobby congress for more funding for ICAC. They also help with legislation to make investigating child exploitation easier and the internet safer. Raven has been around about two years, and they’ve become a resource on Capitol Hill for lawmakers in that area. Many lawmakers had heard from NCMEC about the increase in tips, but hadn’t heard from law enforcement how those tips made their way to agencies and how there weren’t enough resources to work all these cases. The system is good, but there’s just not enough resources available at the law enforcement level.

Georgia got 30,000 tips last year, and they made 450 arrests. That’s a good number, but there’s much more work to be done. It’s not because they’re not trying, but because there isn’t enough time in the day to work every case. Not every tip is actionable. Some don’t have enough information for investigation, and some don’t rise to the level of a crime in Georgia. Even with that, there’s a large discrepancy. But that’s as much as they can do with the resources they have right now.

Technology and Child Exploitation Investigations

Technology can really help in investigating and fighting back against child exploitation. Debbie works with a lot of digital forensics companies. They do forensics on everything from mobile phones to cameras to cars, recovering deleted data, and looking at locations, photos, chats, and more. All of this information can be related to child exploitation investigations. Debbie is a huge champion of digital forensics.

AI and machine learning can also be helpful in this space, especially when it comes to image classification. When an examiner downloads a phone to look for CSAM, they used to have to scroll through every image and find things manually. Now AI can help categorize images and find these exploitative materials faster. Technology tools can also help with dark web investigations, and there are some great investigations going on there.

Collaboration is key. Law enforcement works with tech companies to explain their challenges, and tech companies can develop tools and train them to use them. The open source intelligence (OSINT) community is heavily involved, too. They are especially good at finding missing children, who are disproportionally victimized in trafficking. Investigating child exploitation requires a lot of skills, which is hard for any one law enforcement officer to have. Fighting this particular crime is collaborative by necessity.

This particular crime type [of investigating child exploitation] … is an incredibly collaborative community.

Debbie Garner

How to Report Child Exploitation

Investigating child exploitation starts with reports and tips. So if you run into actual exploitation or suspected attempts, report it! If it happens on a particular platform, like Instagram, you can report it to the platform. That should be your first step. The platform can then preserve it for law enforcement but also take it down so it’s not doing more harm.

You can report instances to NCMEC too. They have a cyber tip line on their website, which you can access on a computer or a mobile device. You can also report it to local law enforcement. Any time or situation where someone is a victim or you find illegal imagery, you should report it.

When you report it, include as many details as possible. Especially if you’re being victimized, details are important. Dates, times, time zones, places, account names, if they sent pictures, if they asked you to go to another platform, all of that information is helpful. Cease all contact with the person exploiting you, but save any accounts, images, chats, or other things. Law enforcement needs that to investigate the exploitation, identify the perpetrator, and make a case. Sometimes people don’t do that. They want it off their phone. Debbie understands the impulse, but for law enforcement to do their job, they need that information, especially on platforms where messages can be deleted.

Getting Your Images Removed

We used to tell everyone that once it’s on the internet, it’s there forever. But there are systems in place to have your images removed. If you’re underage and your images are on the internet, NCMEC can help you get them taken off with their Take It Down program at takeitdown.ncmec.org. If you’re an adult, the organization Stop Non-Consensual Intimate Image Abuse, stopncii.org, can help you get your images off the internet.

There is also legislation currently in Congress called the Take It Down Act that requires individual platforms to create processes to make it easier to get your images taken down. But right now, most platforms will still respond if you let them know that you were/are underage and need the image taken down. If they don’t, they can face penalties.

Talk To Your Kids

If you are a parent, the best thing you can do to prevent child exploitation is to talk to your kids. Talk about CSAM and prevention. Start early and have age-appropriate conversations. NCEMC has resources on their website that can give you talking points for a lot of things – not just CSAM, but personal information online, bullying, and other important topics.

If we’re talking about [child sexual abuse] and prevention of things like this happening, I would just encourage parents to talk to their kids.

Debbie Garner

The organization IWF in the UK has some good talking points, and so does Thorn. If you’re not sure how to start the conversation, there are lots of places online to get conversation starters, or age-appropriate videos you can show your kids to get started. Debbie highly encourages parents to talk to their kids. Investigating child exploitation is important, but preventing it in the first place is the best option.

You can find Debbie Garner on LinkedIn, which she uses fairly heavily. You can also email her at [email protected]. She encourages people to reach out. And if you work in the field and are struggling with the emotional toll, she is happy to direct you to resources that can help.