SID2017 Advisory

CHILD WATCH - SID2017 ADVISORY

New technology and younger users engaging with online pornography increase risks for primary and second level girls impacted by online image misuse.
 
Synopsis
One of the greatest vulnerabilities for young girls online is the misuse of personal images. Such misuse is systemic among very many web site users that choose to acquire or copy such images and upload them to bulletin boards, image sharing or pornographic sites.
 
A perception that online image misuse is focused upon beautiful images of teenage girls in their party dress outfit is misplaced. Many such images feature children so young that they do not yet have a social media page or smartphone.
 
Key factors for these young people are safety and digital foot-printing. Uploaded images often attract dialogue, indecent commentary and attempts to identify victims and establish location. A young person unaware that they feature in these uploads are unprepared and vulnerable if skilfully approached online.
 
The removal of these images is not guaranteed even where the request is made through law enforcement, child protection or digital industry organisations. Heretofore the notion of safety in numbers was viable in that the volume of these images circulating is vast. This is being eroded by two factors that are continuing to evolve: an increasing trend among young male students getting involved in all aspects of the problem domain; and the onset of facial recognition technology as a search option in the online pornography space.
 
These factors are complete game changers that actively erode anonymity.
 
User Uploaded Content
Cameras are included on virtually every consumer digital device meaning that anyone can create images or video in an instant. Images already online are simple to copy, alter or further distribute. Connectivity to the world wide web and sites with like minded individuals means that groups of people can congregate online and share content by uploading it to a web site or sharing directly through messaging or various forms of file distribution.
 
A feature of the interaction between such site users is the trading of identities and the ability to physically locate persons through various online means including geo-located social media posts and images; disclosure of a school, club name or home address. There is clear evidence that some of those engaged in the publication of identities are fellow students often encouraged by other sites users whose true background is likely unknown to them. Others include people with close access to a child through family or physical proximity and they are particularly dangerous.
 
There is no boundary between people who on one hand have an interest in very young children, and on the other an interest in teenagers. These users upload and interact freely. They will move to another communications channel when they need to hide their chat or trade images and information.
 
Image Removal
Having the images removed presents a challenge from a legal standpoint since most involve no nudity and do not contravene international norms defining child abuse imagery. Irish law is strong in its definition of what constitutes an offence including the construction of erotic story lines involving children, and the defilement of an image of a child with male body fluid. An Irish person found creating or viewing such material would be breaking the law. However the sites hosting this material are not within our jurisdiction.
 
The only other avenues for removal are to have government or digital agencies make representations to the site involved; an affected victim/parent/guardian makes a personal plea to the site; or take a civil legal action. This is of course dependent upon the victim/parent/guardian having knowledge of the presence of the images to begin with. Most often this is not the case.
 
Timeline
The initial uploads of these personal images were made in 2008 and this activity accelerated greatly in the period 2012/13 and remains an issue to the present day. The numbers of images uploaded involving Irish girls over the years are measured in the tens of thousands and it is clear that the majority of those affected are ignorant to this exposure.
 
Media have reported the problem regularly since 2013, and in particular the RTE Investigations Unit documentary, “Online and Unprotected” airing in December 2014. More reporting occurred with the discovery of a cluster of Cork-based girls affected. Site users uploading this content that were named in the RTE documentary still have galleries of Irish children that are now in place for two to three years, some of whom were of primary school age when first appearing.
 
Traceability
The content of these images varies greatly and some practices make the identification of victims easily achievable. When this occurs and a social media page is found, the likelihood of discovering a physical location increases. If location services on digital devices are enabled for posts and images then physically locating anyone to places that they go including home, school, holiday etc is virtually assured.
 
For instance, some children were photographed in their school uniforms that combined with other images in the gallery make identification simple. Another group of children are holding a banner with the name of their dance school, that also has a web page listing the venues of its classes and a Facebook page with likes and comments from visitors including students.
 
One user named in “Online and Unprotected” has uploaded in excess of thirteen thousand photos in over three hundred galleries featuring young girls from both Ireland and the UK. They have collectively received over three and half million views and the most popular gallery of that extensive collection features a (then) Irish 13yr old that has received well in excess of half a million views in the three years that it has been hosted there.
 
Facial Recognition

A reverse image search for any online image is nothing new. The ability to trace a like for like image across web sites is one thing, but the introduction of facial recognition to seek out ANY other images featuring the same person makes the image misuse issue far more sensitive. One site in particular is increasingly advancing the accuracy of its solution though its reach (at time of writing) appears to be restricted to the confines of the site itself. That said it does host a huge amount of user uploaded content including legal party dress pose images of teenagers.
 
Another solution being offered as a browser plugin is less effective at this time though that will inevitably improve, and upon achieving that improvement it will have the functionality to scan any face highlighted in any image from any source online through the browser and search participating sites for equivalence. For example, it is possible to apply this search to any image on a social media profile effectively searching for any distributed images of the subject that may be on a participating pornographic site.
 
In our research for RTE we highlighted techniques for identifying teenagers online and locating many of them in the physical world. At that time we were aware of the identities of over 100 of the girls affected. Without any determined effort and using existing techniques and software we feel that we have extended that number closer to 400.
 
If we had the advantage of being able to use facial recognition technology in the form of a browser plugin to scan any face from any source (e.g. social media page) for its presence in online pornography, or a service within a pornography site to find any other related images within the site, then those numbers would not be even close to the amount of these unfortunate Irish girls that would be identified and we know this because we use similar technology in our work and understand its capability. While the plugin has not yet matured, the instance of facial recognition used within the site has improved significantly in recent times.
 
Conclusion
In nine years of touring primarily second level schools we have discovered that young people are very concerned at losing control of their images and have a real sense of fear of the ability to bridge identity and location from the virtual to the physical worlds and locate a school, home or some other place that they visit. Equally they are naive about the activities of persons that would be a threat and this is a key vulnerability for them. They do not have the experience and longevity of their parents who very often believe that their children know more about ‘technology’ than they do, and this is equally a key vulnerability for parents.
 
Since 2011 there has been a trend in Ireland to estimate the security posture of young people by conducting surveys of their online experience and usage of technology. There is a reason why security professionals are tasked to run audits and test for vulnerabilities in IT systems as opposed to making findings of risk based on a survey of the users of that system. Equally there are very specialised investigative practices required to research the online activities of people that are a threat to young people, and no survey of young people and their parents will yield the results required to make an estimation of risk.
 
A parent’s inability to confidently understand and adapt to the digital world of their children is a polar opposite to a young person’s lack of life experience to deal with online risks however they may occur. Whether that risk manifests itself in terms of actual safety or destruction of their digital footprint (or possibly both) is not the primary issue since that is a consequence of the risk; it is that with few exceptions neither parent nor young person understands the critical space where risk is manifested and are therefore not best placed to understand what is occurring in that space.
 
Irish parents and their children are not receiving the support that they require to keep them safe online. The surveys that found that Irish parents and children are the safest in the EU in terms of their internet use are misleading. A government report in 2014 found that we are well served by our internet safety systems that are robust and capable of dealing with online harms. Where is this internet safety system, how is it reachable and what in fact do they do?
 
We have consistently called for a Safer Internet Centre in Ireland with the technical and investigative capability required to fill the void between the polar opposites of parent and child online. Image misuse is just one pressing example of the what is causing pain. There are many challenges in keeping young people safe from online harms and the provision of such a centre that is publicly accessible is absolutely core to our needs. Facial recognition will be used by online researchers (e.g. recruiters) as much a porn site users and parents and their children are powerless to mitigate against this threat since their images on these sites are beyond their control.

 
Produced by ChildWatch.ie for SID2017