Measurement and Analysis of Child Pornography Trafficking on P2P Networks, Final Technical Report

• NCJ Number: 248597
• Author(s): Ryan Hurley; Swagatika Prusty; Hamed Soroush; Robert J. Walls; Jeannie Albrecht; Emmanuel Cecchet; Brian N. Levine; Marc Liberatore; Brian Lynn; Janis Wolak
• Date Published: September 2014
• Length: 19 pages
• Grant Number(s): 2011-MC-CX-0001
• Agencies: OJJDP-Sponsored
• Publication Type: Test/Measurement; Report (Technical); Report (Study/Research); Report (Grant Sponsored)
• Award: RoundUp Predictive Tool (RPT) Project

Annotation

This is the report of a study that examined the criminal acquisition and distribution of child pornography (CP) on peer-to-peer (p2p) networks, through which users both download and upload CP, which constitutes the illegal possession and distribution of CP.

Abstract

The focus of the study was CP trafficking on the eMule and Gnutella networks. The data were collected by law enforcement officers using forensic tools developed by project researchers. The study characterizes a year's worth of network activity and assesses various strategies for prioritizing investigators' limited resources. The highest impact research in criminal forensics works within, and is evaluated under the constraints and goals of investigations. This principle was followed in this study. First, it focused on strategies for reducing the number of CP files available on the network by removing a minimal number of peers. A metric is presented for peer removal that is more effective than simply selecting peers with the largest CP libraries or the most days online. Second, the study characterized six aggressive peer subgroups, including peers using Tor, a software which prevents others from learning your location or web browsing habits; peers who bridge multiple p2p networks; and the top 10 percent of peers who contribute to file availability. These subgroups were found to be more active in their trafficking, having more known CP, and more uptime than the average p2p user. A third finding was that although Tor would appear to be a challenge to investigators, in practice offenders use Tor inconsistently; over 90 percent of regular Tor users send CP from a non-Tor IP at least once after first using Tor. 19 figures