The BKA and other law enforcement agencies do not yet systematically remove content from darknet forums where child abuse depictions are shared. Once in the net, always in the net, it is said by leading investigators:inside. More important to find the perpetrators, he says. Is this really mutually exclusive??
LKA employees at the launch of the tip line on sexual abuse of children and adolescents in NRW. – All rights reserved IMAGO / Future Image
In early December, journalists from the ARD political magazine Panorama and the NDR reportage format STRG_F (funk) joined forces with Der Spiegel to reveal that photos and videos showing serious sexual abuse of children often remain online for years, even though investigating authorities could have them deleted. Victim protection organizations and child and youth psychologists subsequently spoke of a "slap in the face for those affected," and a group of EU parliamentarians is now also trying to clarify the situation.
In their guest article, Robert Bongen and Daniel Mobbrucker, who were part of the research team, describe why a change in strategy in the fight against child abuse would not only be a tactical investigative question, but also a political one.
During one of his last appearances in November 2021, Horst Seehofer, the then caretaker federal interior minister, became unusually emotional. At the fall meeting of the Federal Criminal Police Office (BKA), Seehofer highlighted an area that he personally was very concerned about: the dissemination of depictions of sexual abuse of children. Their number is increasing enormously from year to year – and this trend must be stopped by all means. Because behind the representations stands almost always also a real abuse:
What immeasurable suffering the perpetrators inflict on the children! The image or video material must not be permanently accessible under any circumstances. Otherwise, the victims will become victims again and again, and that for the rest of their lives. The deletion of these images and videos is therefore indispensable.
There is nothing to add to this. And yet: The words surprised us in their vehemence. Because at this point we had already finished our research. And just a few days later, we reported that the Federal Criminal Police Office of all places – which, as the central agency in Germany, has special rights and duties in the fight against child abuse – has for years at best only partially complied with Seehofer’s demand.
Photos and videos are mostly stored at common storage services, the download links are shared in darknet forums. But the BKA does not systematically report these links to these storage services, even though this would remove illegal material documenting serious child abuse from the net.
How can it be that an authority that is subordinate to the Federal Ministry of the Interior fails to do exactly what the responsible minister publicly describes as "indispensable"??
(Almost) everything is allowed
The world in which the investigators of the BKA move is disturbing. Example: Anyone who registers with an online service on the Internet usually has to accept the "General Terms and Conditions". They are usually so long and complex that no one reads them.
On the world’s largest platform in the Darknet, where pedo-criminals meet, it is different. Here the terms and conditions consist of only one sentence: If you want to post in the forum, you should never post personal information about yourself. Otherwise, one suspects, everything is permitted here, which is meeting with ever greater approval: In this forum alone, around 3.7 million user accounts were registered at the end of 2021, under the dubious slogan: "For Child Lovers".
Investigative agencies let forums get big
This forum was the focus of our research. Never before in the history of the Internet has there been a larger platform of this kind. By way of comparison: the "Boystown" forum, which German authorities were able to shut down in April 2021, had "only" around 400 users at the end of the day.000 user:inside accounts. One should not equate these numbers with people, because many pedo-criminals open a new account with every login, which they never use again afterwards. Nevertheless, there is much to suggest that these darknet forums have managed to record enormous growth rates, especially in the past two to three years. At the time of our research, the users of the platform with the slogan "For Child Lovers" had clicked on the content there about 1.7 billion times, and the number was rising rapidly.
There are technical reasons for the rise of these forums, for example the Tor network behind them has become faster and faster in recent years. Above all – and this is the central finding of our research – investigative authorities from many countries, including the German Federal Criminal Police Office, are involuntarily making these platforms more and more attractive because there is more and more content available for download – without the investigators intervening.
Darknet takes on the role of mediator
According to our data journalistic analyses, the largest forum "For Child Lovers" alone had more than 20 terabytes in November – that’s more than 20.000 gigabytes – for download. And this amount could be deleted within a very short time.
This is due to the special architecture of these pedocriminal networks. The operators of the pedo platforms operate in the anonymous darknet in order to establish a digital meeting place for pedo-criminals. However, the amount of data from the illegal footage that can be shared there by anyone is too large to be stored on the darknet platforms themselves. Therefore, the pedocriminals choose storage services on the ordinary Internet, so-called one-click filehosters, instead.
They put their material into a folder, which they encrypt with a password as a so-called archive, and upload this archive to the file hoster. So, from the file hoster’s point of view, an encrypted mountain of data was uploaded. In the Darknet forum, the pedo-criminals then share the corresponding download link and the associated password. The filehosters are usually unaware of this, because possible upload filters are not effective due to password protection.
According to the law, they do not have to search for it themselves. What’s more, it would even be illegal for filehosters to search the Internet for photos and videos of child abuse. The filehosters are thus dependent on receiving a tip-off.
97 percent of the content is in the Clearweb
The Canadian Center for Child Protection (C3P) estimates that only about three percent of photos and videos documenting child abuse are hosted on the darknet itself. 97 percent of the content is on the Clearweb, i.e. the part of the Internet that can be accessed with normal browsers such as Firefox or Chrome.
The Canadian charity organization C3P maintains, among other things, a hotline where suspected cases of child abuse can be reported. In addition, the organization specifically searches for depictions of abuse and reports them to the relevant Internet companies.
By its own account, C3P is also active on the darknet, searching forums for linked archives that lead to Clearweb hosts. So, does the NGO take over the job so that law enforcement agencies can worry about identifying the perpetrators:inside?
German security authorities are well aware of their work, some investigators even speak of the "Canadian approach". How it is then possible that in the largest of these darknet forums, of all places, no one systematically reports the content, C3P answers evasively when asked. Generally it is said:
We agree with your statement that not enough is being done and this problem is largely ignored. As stated in your report, this inaction continues to put victims at risk and leads to ongoing trauma.
An NGO is supposed to clean up the Internet
In addition, C3P says it wants to decrypt all content first and check it carefully. Filter hosts should be able to trust that only illegal material is reported. But this costs time. "As a relatively small charity, we have limited resources to deal with the amount of media we find," C3P writes.
Indeed, it seems grotesque that over 30 years after the development of the World Wide Web, a single non-profit organization with a manageable team and budget should be tasked with cleansing the entire Internet of depictions of abuse. C3P, which operates independently but is about half dependent on mostly Canadian government funding, regularly calls on Internet companies to take more consistent action against content on their servers. So it’s a problem for the Internet industry?
Companies take over 13 terabytes off the net
Initially, we assumed that the responsibility for the masses of content linked in the darknet forums lies with the filehosters. However, when we randomly sent some links to the services and often received info after a few minutes that everything had been removed, the narrative of disreputable, anonymous one-click hosts began to crumble.
In the end, we automatically collected about 80 links in a concentrated action.000 working links that pedo-criminals had posted on a platform. Behind them were about 13.55 terabytes of data. That’s about as much as if a person watched a video of a child being abused for a year, day and night, in HD quality.
After we sent the links to the file hosters, they removed the material from their servers after 48 hours at the latest. Previously, the content had been on the net for an average of about a year and a half. The oldest link we found was online for over six years and led to a video of a boy being abused and raped.
We sent one German image hoster links to around 100.000 photos it retrieved from its servers within three hours. These photos also lay dormant on his servers for years, without him being informed by German authorities, according to his own statement.
Government statistics with an opaque data basis
These numbers are in enormous discrepancy to what the Federal Criminal Police Office annually retrieves content from the net. Since a decision by the Bundestag in 2011, the BKA has been required to have illegal content deleted from the Internet as comprehensively as possible. The "deleting instead of blocking" approach has since been regarded as an alternative to network blocking, which was hotly debated under the title "censorship" in the wake of the then Family Minister Ursula von der Leyen, because critics feared that it would lead to state censorship of the Internet.
According to the annual report, the BKA went through around 6.800 hints to links behind which child abuse footage was concealed. The majority of prosecutors succeeded in having the links deleted within a few days. In view of such figures, the "deletion instead of blocking" approach is also considered successful by politicians. The then Minister of Justice and Family Affairs, Christine Lambrecht, commented on the BKA’s annual report accordingly:
The high deletion rates and the comparatively short processing times prove that the concept of ‘deleting instead of blocking’ is effective overall.
However, the approx. 6.800 cases of the BKA that appear in the official statistics, only a fraction of the masses we found in the major darknet forums. So many links are apparently not reported by the BKA in the first place. Why not?
The fairy tale of the "server abroad
In the course of our research, we did not encounter a single hoster in the world who did not respond to our messages. The hosters who were most abused by the pedo-criminals are located in Germany, France, Sweden, Iceland or do not state their place of business at all – but they all cooperated.
Surprising – but also extremely irritatingly fast and simple. Why aren’t law enforcement agencies doing this? In conversations with investigators, we heard again and again that the "servers abroad" were a central problem. We cannot judge whether this applies to other areas of law such as copyright infringement or online fraud. However, in the case of the linked content circulating in the darknet forums for the exchange of child abuse material, the server location is definitely not an obstacle.
As early as 2009, the Bundestag’s Scientific Service noted that the BKA could send an "abuse e-mail" to foreign services to inform them of illegal content. If the BKA is unable or unwilling to inform the foreign hosters directly, they could ask foreign law enforcement agencies for assistance in case of doubt.
Catch perpetrators, leave photos?
So, although it would be technically easy and legally allowed (some lawyers even consider it mandatory), the Federal Criminal Police Office hardly ever reports the illegal content to the filehosters. By the way, not even to the few German memory services.
Particularly striking: even after the BKA, together with the Frankfurt General Prosecutor’s Office, shut down the "Boystown" forum in April 2021, it did not have the links shared there deleted. As a result, a few days after the takedown, pedo-criminals simply shared the still-functioning links on another forum, making much "Boystown" content available again.
For child and youth psychologists and the German Child Protection Agency this is incomprehensible. "Stunned" by the BKA’s apparent failure to systematically delete images from the web, they said in a joint statement in response to the research. This was a "slap in the face for those affected":
The fact that images of their horrific experiences continue to be available on the Internet is extremely stressful and makes it more difficult to come to terms with what they have experienced. Some victims speak of renewed abuse as soon as someone views the footage of their abuse.
Yet even the current federal government defends the actions of investigative authorities. In response to a written question from Konstantin von Notz, a member of the Green Party, Interior State Secretary Markus Richter replied in December: "Priority must be given to securing and evaluating the content that is needed for immediate measures to avert the threat and for criminal prosecution."
It is a typical argument that prosecutors use in the discussion: The priority is to catch the perpetrators and gather evidence for a conviction. In the best case, this could even save children whose abuse continues. In contrast, simply deleting photos and videos that can be uploaded elsewhere anyway actually seems less relevant.
But: Is it really this sad dilemma the authorities are facing??
Deletion does not hinder law enforcement, but supports it
On closer analysis, it becomes clear that there is nothing to be said against catching perpetrators and rescuing children as well as reporting content. This "either or" does not exist in this radical form. What’s more: it could probably even be prevented if deletions were more consistent.
Because with all the content, the forums have long since become a social space in which pedo-criminals are given the feeling that it is normal to perform sexual acts on children. Law enforcement officers investigating this area told us during the research themselves that they noticed a disinhibition on these platforms, so that more people might "want" to try things in real life as well. This was also confirmed by the child and youth psychologists and the German Child Protection Association in their statement.
That it is time-consuming to search for the links cannot really be said. It took us around six hours with an online crawler, a kind of "search dog for the net," to find the 80.000 links that led to over 13 terabytes of data. In fact, we were quite surprised how easy it was to collect the links, since the pedo-criminals at the time had no safeguards at all against automated downloads on the forum.
Does deletion really destroy evidence?
It is also possible to preserve evidence if it is deleted. There is nothing to be said against automatically clicking on the automatically loaded links and downloading the linked content once. Police officers could then view the photos and videos at a later date, but by reporting them to the file hoster, they could already stem the spread of the abuse.
The fact that legal content would be reported as "collateral damage" in this way (so-called "overblocking") is de facto ruled out: These forums are only there to distribute child abuse material, other content is not tolerated there.
But what’s the point of deleting the material if pedo-criminals still have it on their hard drives and can upload it again at any time?? We heard this argument again and again.
It’s not completely wrong, but according to our research it’s also not that one-sided: An upload takes significantly longer than collecting a link. The users mostly use the slower Tor network for uploading, in order not to reveal their true IP address to the Clearweb file hoster. This slows down the dynamics in the forums.
Furthermore, uploaders also lead normal lives and are not always on the forum every day to even notice that their links have been deleted.
Annoying users to death"
By the way, we got unexpected confirmation from the administrator of the currently largest forum himself: We had managed to get in touch with him. He wrote to us that consistent deletion can "annoy users to death": If you delete long enough, people might leave and the administrators might "shut the place down". This means: Uploaders are annoyed because their work is destroyed, and consumers are annoyed because many links lead nowhere.
If content were reported consistently and permanently, Internet companies could also block the material from being uploaded repeatedly. Some of the filehosters that are currently most abused by the pedo-criminals already have such upload filters in place. They produce a so-called hash value from the reported content and put it into a database.
If a user tries to upload a file again unchanged with the same hash value, the upload aborts immediately. This even works for the encrypted archive files of the pedo-criminals – but only if the filehosters get a hint from authorities which specific files with the corresponding hash values are illegal.
Failure to delete increases the number of offenders
Of course, users could upload their material again and again to new filehosters with different hash values. But how strong is this argument now, when not deleting undoubtedly also leads to more and more people being able to stash more and more material on their hard drives for redistribution?? So not deleting broadens the base of those who have the material on their hard drives and creates new potential uploaders.
The recent ever-increasing dimensions of these darknet forums make what might in principle be an understandable prioritization by the Federal Ministry of the Interior and law enforcement agencies seem increasingly absurd: How wisely are resources used when, as in the "Boystown" case, four people are arrested after months of investigation, but then the content is not secured and taken off the net? So that already a few days after the shutdown "Boystown" content is posted again elsewhere and thousands of users can help themselves to it until today?
There may have been a time when this was exactly the right strategy: shut down a forum in order to eliminate an entire infrastructure with a successful investigation. But today, these forums are teeming, all blithely linking to content hidden on the Clearweb.
Our research shows that often identical links to filehosters are shared in different darknet forums. This means in reverse that a deletion at a file hoster would remove the content for several darknet forums at once. In the end, an efficient approach to getting criminal content off the net.
Traffic light coalition wants to strengthen BKA
Horst Seehofer must simply not have known that the Federal Criminal Police Office apparently structurally fails to do exactly this when he so vehemently emphasized at the BKA’s autumn meeting that deleting the recordings was "indispensable". In the coalition agreement, the coalition government announced: "In the fight against child abuse, we will strengthen the Federal Criminal Police Office in terms of personnel."
It is now a political question how Seehofer’s successor Nancy Faeser (SPD) will distribute these funds in the BKA. If it takes "erasing depictions of abuse" seriously as an essential part of the fight against child abuse, it could do a lot here with relatively little money and personnel.
Robert Bongen works for Norddeutscher Rundfunk and is an editor for the ARD political magazine Panorama.
Daniel Mobbrucker works as a journalist on the topics of surveillance, data protection and Internet regulation. He is also a trainer for digital security and darknet research.