Forums

In addition, analysts often visit forums to proactively search for child sexual abuse material.

Arguably forums provide the biggest source of all proactive work given the volume of images found on each page. Forums are massive; there will be multiple topics within a forum and each topic contains many threads and each thread can contain many pages all full of images and links to potential child sexual abuse material (CSAM). Unless both sexes are involved in sexual activity in an image, content of boys and girls tend to remain in separate places within a forum. Often a proportion of the forum will contain legal content, which makes it difficult to remove the whole forum seeing as the whole forum is not actually illegal. Therefore, analysts tend to “action” (perform a set of tasks which lead to the removal of the images/videos) at thread level opposed to the domain level.

Forums that are dedicated to hosting child sexual abuse material predominately contain self-generated content. This is where the abuser is not physically present with their victim but is often directing or coercing the child into performing sexual acts via webcam. Occasionally chats can be seen between the child and person at the other end of the camera.

Very often, a person abusing a forum for child sexual abuse material will upload images that are hosted elsewhere on a different domain, such as an image hosting site. In addition, beneath each image, a link is posted which appears to contain the whole video to the image that the viewer has been presented with. This link is hosted on a different domain too and it often requires payment to download the video.

When IWF analysts take steps to remove the illegal images and videos hosted within a forum, they need to trace where in the world the content is hosted. If the country where the content is hosted has a hotline, the information is sent to that hotline in the first instance. If the country does not have a hotline, the analyst passes this information onto law enforcement. In both instances if the content remains live, and the IWF has not been informed of an ongoing police investigation, the analyst will send a notice to the company that is hosting the content on its servers requesting for the content to be removed.

Forum choice:
Three forums that are known to host child sexual abuse material were examined during the study:

• Forum 1 is predominantly known for hosting images of boys. The sexual abuse imagery on this forum was removed on day two of the study (this could have been as a result of IWF action – this is explained further down in the study) and before enough data had been collected.
• Forum 2 is predominantly known for hosting images of girls. This sexual abuse imagery on this forum was also removed on day two of the study, but a large quantity of data had already been captured.

In both instances the forums remained live, however all the images were taken down/removed from the page. The links to the videos posted under each image remained on the page. However, access to these videos requires payment and the IWF does not go beyond payment barriers, therefore the links were not accessible to download. This did not pose a problem in the data collection given that there are so many forums dedicated to hosting child sexual abuse material. Hence, one more forum was chosen to continue with the data collection as enough data had already been collected of girls.

• Forum 3 was added on day three of the study, which housed sexual abuse imagery of boys and this was substituted for forum 1 to enable enough data to be captured.

Time spent on forum examination:
One hour per day, at roughly the same time each day, was spent examining the pages of the chosen forums. This took place over a four-day period. However, please note that this was just three days for the boy forums due to the content becoming unavailable and there being less content to find. We recorded a variety of information to highlight what goes on in forums and show how they operate. This information includes:

• Date and time checked;
• Thread date and time;
• Forum URL;
• Sex of child;
• Age categories;
• Self-generated or not;
• Website of the images being pulled into the forum;
• Website that the video link comes from;
• If a premium is required to download the video;
• Payment mechanisms to download videos;
• How many children seen in the images;
• If the offender is present in the image;
• The room in the house where the abuse took place;
• Hosting country of the forum;
• Username of the user posting content;
• If the images have been seen before by the Quality Assurance (QA) Officer;
• Anything of note that stood out in the images.

The IWF staff member who led the study has worked at the IWF for 14 years. She was an Internet Content Analyst for 13 years before becoming a Quality Assurance Officer. Both roles require the assessment and checking of large volumes of child sexual abuse material on a daily basis. During that time, she has seen many victims of child sexual abuse.

Analysis of content showing boys:

• 53 images of boys were recorded, 58% of the images of boys were of a self-generated nature.
• More boys were seen engaging in sexual activity, in a self-generated setting, while other children were present.
• In boys, the most frequent age seen was 11-13 years.
• Boys often appear to be under-represented in the data in terms of volume, however they are more likely to be assessed as Category A and Category B (more severe categories).
• 42% of boys had not been seen before by the Quality Assurance Officer who collected the data.

Analysis of content showing girls:

• 80 images of girls were recorded, 100% of the images of girls were of a self-generated nature.
• Girls are more likely to engage in self-generated content with no other children present.
• Girls aged 7-10 were the most frequently seen.
• 84% of the girls had not been seen before by the Quality Assurance Officer who collected the data. 

The term self-generated indicates that the abuser is not physically present with the child and the child has been groomed, coerced or encouraged into creating the content themselves. It is vital to remember that children are being groomed online and instructed to engage in this behaviour.

53 images of boys were recorded (51 images were confirmed as criminal).

• 58% of the images appeared to be self-generated content.
• 25% of the images contained the abuser.
• 13% of the images did not contain the abuser, however, did not appear to be self-generated content either (abuser presumed present however, outside of the image).
• 4% of the images were Adult?

Out of 80 images of girls recorded (62 images were confirmed as criminal) none of the images contained an abuser and all of the images appeared to be self-generated content.

• 100% of the images of girls were self-generated.

This is not surprising as most self-generated content that we see is of girls.

Three forums were used for data collection (two for imagery of boys and one for imagery of girls). Generally, the posts were uploaded by the same user on each of the forums checked.

Forums, threads, pages checked:

Forum 1 (boys): One thread checked over 4 pages. 40 images were found in total before the forum went offline.

Forum two (girls): Three threads checked over 10 pages. 73 images were found on one thread, 4 images on the second thread and 3 images on the third thread before the forum went offline.

Forum 3 (boys): One thread checked over two pages. 13 images were found in total.

The above demonstrates how many images can be found within a thread and how pages within a thread can vary in volume. Across the three forums, five threads were checked and returned 133 images.

Third Party Hosts:

Forum 1 (boys): Two third party hosts were identified. 100% of the images found on the page were hosted on an external site known as an image hosting site. This means the images were being pulled in from a different website. A link underneath each image was found. These types of sites are known as cyberlocker sites. Every single image had a link to a cyberlocker site, which undoubtedly contained the full video of the content, however payment was required and therefore this could not be accessed or verified. The cyberlocker site was the same one throughout the threads checked.

Forum 2 (girls): Two third party hosts were identified. Once again 100% of the images were hosted on an external site known as an image hosting site and therefore were being pulled in from elsewhere. A link underneath every image was found going to a cyberlocker site. Once again, gaining access to the videos required payment and as the IWF does not breach payment barriers we therefore could not access them. The cyberlocker site was the same one throughout the threads checked.

Forum 3 (boys):  Forum 3 was different in that none of the images were being pulled in from an external site. On this occasion 100% of the images on the pages were hosted on the same domain as the forum itself, which generally speaking, is not common. However, two third party hosts were identified. Like the other two forums, every image had a link underneath it going to a cyberlocker site appearing to contain the full video of the content. This time 2 different cyberlocker sites were identified.

(Please note the image hosting sites and cyberlocker sites were different in all three forums).

Apart from a few video links which were offline, all videos required payment to download. Each forum offered multiple payment methods. The payment options remained the same for every video link within that forum, however, varied across the three forums. The below chart shows how many payment methods were offered for each forum.

All the forums examined were hosted in either Hong Kong or Malaysia. Content does not usually come down easily or quickly in either of these countries, given that neither country has a hotline. In these instances, the IWF analyst who identifies child sexual abuse material which is hosted in these countries notifies the UK’s National Crime Agency (NCA).

Analysts in our hotline are allocated countries to look after and if the content continues to stay available for a period of time after notifying the NCA, the analyst then informs the host company directly with the intention that the host will take the content down. With all of these forums, we had informed the host. Therefore, it is possible that the images on Forum 1 which had been removed during this study was as a result of our analyst’s work in notifying the host.

Forums hosting child sexual abuse material will often appear to be removed from the internet but analysts know that these are not truly taken down,  often just from the message that is received when loading the URL. We see time and time again how, after just a few days, the forum will be live again but this time with a new host and perhaps a new hosting country. Every country has its own set of laws and regulations, and some hotlines have a better rapport with law enforcement than others. All of these factors influence how quickly a site hosting child sexual abuse material goes offline.

Forum 1 (boys’ imagery): This was hosted in Hong Kong. An IWF analyst notified the host and requested that the content be removed in early September 2022 and the images were no longer available on the page a week later. The links were still live on the page, however a premium account was required to access the content, meaning the content was being sold.

Forum 2 (girls’ imagery): This was hosted in Hong Kong. An IWF analyst notified the host to request that the content be removed in early September 2022 and the images were no longer available two weeks’ later.

Forum 3 (boys’ imagery): This was hosted in Hong Kong. An IWF analyst notified the host in mid-September 2022. On the same day the hosting moved to Malaysia and our analyst created a new report, it was then passed on to law enforcement, however before the new host could be notified, the forum moved hosting back to Hong Kong the very next day. This highlights how wily operators of forums can be and how difficult it can be to get the forum offline. This particular forum has been around for some time and first actioned by the IWF in December 2019. It has changed hosting many times and has been actioned by the IWF in many different locations all around the world, most recently in the UK. The site became offline quickly due to the analysts’ persistence in chasing up our law enforcement partners.

Forum 1 (imagery of boys): This forum had posts dating back a month (at the time of data collection).

Forum 2 (imagery of girls): All posts containing child sexual abuse material were posted in April/May of 2022 and therefore were a few months old at the time of data collection. Images of girls are much more voluminous. It appears that newer content is much more readily available.

Forum 3 (imagery of boys): The second forum featuring boys was different. Half of the posts recorded were two months old and the other half were two years old. Generally speaking across IWF’s work, we see fewer images of boys that we are confident in determining are under the age of 18 years, which means that the same images of boys are more likely to be re-posted time and time again. Indeed, in Forum 3 a couple of images had dates stamped on them; one dated back almost 30 years to 1994 and the other one to 1998.

Often images are reposted, duplicated and edited leading to multiple copies of images being posted online. Consequently, we often see images of the same children over and over again.

The Quality Assurance officer who collected the data for this study was interested to record whether she had seen the child victims before (see the section above about the experience of this person). Based on this member of staff’s knowledge, she recognised just 16% of the girls that were recorded compared with 58% of the boys seen.

This difference is not surprising, given that there are many more images of girls seen in this type of abuse (self-generated). As mentioned before, fewer images of boys means that the same imagery is more likely to be re-posted time and time.

This case study was carried out to capture the complexity of removing child sexual abuse imagery on forums. It has also provided an insight into the nature of child sexual abuse material found within just three forums.

Forums generate a large amount of work for IWF analysts. The removal of forums is difficult as they often host legal content as well as illegal, hence it is often the thread/page which is actioned rather than the whole forum at domain level.

In addition, they move host regularly, making permanent removal very difficult.

As forums pull in a vast number of images/videos from other types of websites it means that forums are a main culprit for the wide and global distribution of child sexual abuse images and videos and play a key role in the content’s monetisation.