New Crypto Unit formed as experts use every tool at their disposal to stop the distribution and sale of child sexual abuse images online.
The number of websites found to be accepting cryptocurrency payments for sexual content of children has doubled almost every year since 2015, with a new specialist unit launching to tackle the “escalating problem”.
The Internet Watch Foundation (IWF) is warning that criminals are using cryptocurrencies to access or buy images and videos of children suffering sexual abuse and rape online.
Last year (2021), the IWF identified 250,000 websites containing child sexual abuse. Of these, 1,014 sites gave criminals the option of using virtual currencies to access or buy videos and images of children being sexually abused and raped.
This compares to 468 sites allowing these crypto payments which the IWF identified in 2020. In 2019, 221 were identified, and in 2018, only 81 were found.
The IWF has now launched a new “crypto unit” in response to the increasing numbers and is receiving daily requests for information from law enforcement around the world, from the New Zealand police to the Austrian Criminal Intelligence Service and the Internal Revenue Service’s Criminal Investigation branch in the United States, as well as the Metropolitan Police in the UK.
The UK-based IWF is Europe’s largest hotline dedicated to finding and removing images and videos of child sexual abuse material (CSAM) from the internet.
IWF Crypto Unit Analyst Andrew* is part of a team which searches pro-actively for CSAM, as well as following up on reports of child sexual abuse images sent in anonymously by the public to the Hotline.
He said: “As part of our daily activities we record all the information possible about the online sites containing child sexual abuse material so that we can get them removed as quickly as possible.
“If criminals are seeking to profit from selling these images, we note everything we see on a website or forum’s payment pages, such as the wording used, the virtual currency and the amount, whether it’s a daily, weekly or annual charge, and the cryptocurrency wallet address of the provider.”
This information is then included in a report with details about the CSAM, such as the category and type of sexual abuse, and where the servers hosting the content are located.
Thousands of reports are shared daily with hotlines in other countries and law enforcement agencies so that websites can be removed and distributors can be investigated.
Because of the increasing popularity of cryptocurrencies as a form of payment, the IWF is seeing more requests from law enforcement and other organisations for information to help in criminal cases and prevention, a catalyst for the creation of the Crypto Unit.
Andrew added: “At the moment we get daily requests from global law enforcement, from the UK Met Police to as far as the New Zealand police and the US Internal Revenue Service’s Criminal Investigation branch. They follow up on data that we have provided through virtual alerts, as well as send through separate queries about new crypto addresses that may be linked to illegal activity.
“We search our systems to see if that address is in our system and then give them any information that we are allowed to share so that they can potentially build up a case.”
Detective Inspector Darren Young, from the Online Child Sexual Abuse and Exploitation unit at the UK Metropolitan Police said: “The Metropolitan Police Service is committed to using all avenues possible to identify victims and perpetrators of online child sexual abuse and exploitation.
“We are seeing cryptocurrency being used to pay for the distribution of abusive images and the online sexual exploitation of children, with perpetrators believing they can hide behind the anonymity of these virtual currencies.
“The IWF has been a key partner to law enforcement for many years and the newly formed Crypto Unit provides greater opportunities to combat these horrendous crimes, rescue children from sexual abuse and arrest offenders.”
The payment information displayed on commercial CSAM websites is also shared with partners in the financial industry. This helps to prevent misuse of their services and disrupt further spread of the criminal imagery.
Crypto exchange service Coinbase recently conducted an exercise that used IWF data to identify more than 6,500 people believed to be misusing their platform for alleged criminal purposes. The information also helped the platform identify website operators thought to be selling and distributing child sexual abuse material and close merchants who were accepting payments for illegal services.
Coinbase Global Intelligence Investigator Charlie Hare said: “Coinbase is committed to rooting out illicit activity within our business and the sector. As a company we are fully aware of the real harm that CSAM and the offenders have on our society, that is why we have sought to work with the IWF.
“In the exercise mentioned we committed all of our team's resources to leverage IWF data to identify offenders, services and the flow of funds. We then passed this analysis to the authorities and removed those offenders from our platform. This exercise demonstrated the power of private sector collaboration, and we are keen to continue this model going forward.”