Content Warning: Mentions of Child Abuse
In an attempt to commit crimes and evade law enforcement, online child predators often use IP spoofing techniques to keep themselves anonymous. It is critical for investigators and law enforcement officers to understand the details behind the prevalence of these methods to support investigations into the trading of child sexual abuse material (CSAM) online.
Child Rescue Coalition (CRC) is a nonprofit organization that rescues children from sexual abuse by building technology to support law enforcement agencies. To advance research on these crimes, CRC worked with GeoComply Solutions Inc. (GeoComply) to analyze IP addresses collected during one month of interactions over chat and peer-to-peer (P2P) networks. Before this project, no publicly available research into VPN usage among CSAM offenders existed.
Solution
GeoComply and the Child Rescue Coalition have collaborated since January 2020. Beyond donating its IP spoofing solution, GeoGuard, GeoComply works collaboratively with the small but busy CRC team on projects like this to advance the knowledge base around these crimes and develop technical solutions.
GeoGuard is an award-winning IP spoofing solution that helps organizations detect disguised IP addresses. By comparing IP addresses collected by CRC and those in the GeoGuard database, GeoComply could interpret the proportion of CRC-monitored offenders that were using a VPN, Proxy, or other location spoofing technique.
With GeoGuard, CRC and GeoComply identified:
As many as 1 in 6 CSAM offenders monitored by CRC are using IP anonymizers
Approximately 1 of 3 IP addresses were attributed to a single VPN provider where a VPN service name could be attributed
Approximately 8% of P2P IP addresses and approximately 16% of chat IP addresses were connected to fraudulent activity
By calculating the percentage of offenders using VPNs to anonymize themselves, child protection stakeholders across public, private, and third sectors can take appropriate measures to identify anonymizers, flag high-risk activity, and provide law enforcement with the critical insights needed to investigate CSAM offenders.
