OSINT in Sexual Abuse Investigations: From Data to Justice

The Internet has revolutionized accessibility in many ways, ranging from shopping and education to banking and more. Yet, this digital realm has also given birth to secondary online personas, where individuals can transform into entirely different characters. While many people harness these digital identities for creation and connection with others, some exploit them for murky purposes.

In this article, together with the Social Links Center of Excellence, we dive into the sensitive topic of sexual abuse and discuss how using open-source intelligence can help investigate such cases. Starting from a current situation, we move to proven OSINT techniques that help collect situation anamnesis quickly and deanonymize perpetrators.

So, let's get started.

• Current State of Online Sexual Abuse
• What Online Sexual Abuse Looks Like
• OSINT Techniques Against Online Sexual Abuse
• Quick Recap

Current State of Online Sexual Abuse

Following the COVID-19 pandemic, cybercrime saw a massive surge, and unfortunately, sexual abuse remains a significant concern with some disheartening statistics. According to Statista, a staggering 81% of women in the United States encountered harassment on social media. Interestingly, 68% of men have reported similar experiences.

Sadly, abusive situations continue to affect people of all ages. NSPCC reports that in the UK alone, in the period from 2018 to 2022, there has been an alarming 80% increase in online child grooming crimes. In the meantime, IWF detected a 1000% uptick in online sexual abuse cases involving primary school children since 2019. This surge has also seen a rise in what's known as 'Category A' materials, which include explicit content involving children as young as 7 to 10 years old.

Another example demonstrates that nearly one in six US young adults experienced at least one type of online sexual abuse. Unfortunately, such figures highlight that technological developments not only brought a breakthrough in communications but also allowed darker impulses to explode. With more people becoming victims of online sexual abuse, it's clear that the current safety measures are not enough. It’s vital to acknowledge the gravity of this issue and take necessary actions to address it effectively.

What Online Sexual Abuse Looks Like

Abusive behavior can manifest in many forms, making it tricky to notice red flags in time. As most methods involve a lot of manipulation, perpetrators disguise abusive behavior as casual conversation. So, with this in mind, let's look at some ways that offenders engage in sexual abuse online.

• Cyber Stalking. This form of harassment involves individuals experiencing persistent and unsettling contact with someone, creating feelings of unease. For instance, it could involve receiving numerous emails, messages from different social media accounts, and other forms of online interaction. Imagine sharing vacation pictures and someone commenting on the photos immediately after uploading. Naturally, this situation would create the sense of being followed closely, which can be distressing.
• Cyber Bullying. This centers on intimidating and pressuring individuals, sometimes accompanied by threats of physical harm. Perpetrators might seek to force victims into generating intimate content or complying with their demands. For example, an abuser contacts someone and tells them that unless they send private photos, something terrible will happen to their family. In such cases, people might consider sending what the criminal wants to prevent unwanted consequences.
• Revenge Porn. This type of abuse concerns the non-consensual sharing of personal photos, videos, or text. Such content may have been shared consensually in the past, especially in cases involving ex-partners. Alternatively, malicious actors might obtain intimate materials through intrusive methods, such as hidden cameras, voyeurism, hardware theft, or hacking. A famous example of this kind of abuse happened in 2014 when hackers leaked illegally obtained private photos of more than a hundred female celebrities.
• Sexual Extortion. In this case, perpetrators use the threat of distributing intimate media files as a means to manipulate and control individuals. The difference between this type of abuse and revenge porn is that in extortion, the criminal threatens the person to get what they want. If compromising images were shared online, that would be revenge porn. For instance, a malicious actor contacts their target to claim that they have compromising photos, and if the victim doesn’t send more, the criminal will release the pictures they have.
• Doxing. This type of sexual abuse involves the threat actor publicly sharing someone’s personal information, such as workplace, partners, family members, and home address. Perpetrators may exploit this information for blackmail or harassment purposes. Imagine an abuser threatening to reveal the address of the victim unless they send nude photos.
• Grooming. This one is about threat actors using manipulative tactics, often acting like a friend to the victim. Perpetrators create fake identities and profiles to establish trust with their prey. Regrettably, children are frequently the targets of this kind of abuse. For example, an adult might pretend to be a peer, building a fake friendship with a child to exploit their trust.
• IoT Hacking. In this form of harassment, abusers gain unauthorized access to a victim's IoT (Internet of Things) devices, such as cameras, speakers, or microphones. Criminals do this to obtain personal information and explicit content, invading the person's privacy. A notable case of IoT hacking happened between 2010-2012 when hackers could access live feeds of home security cameras manufactured by Trendnet. Such vulnerabilities can allow fraudsters to obtain materials for future abuse.

OSINT Techniques Against Online Sexual Abuse

Luckily, there’s a solution. Open-source intelligence provides a lot of techniques that come in handy when investigating predatory and problematic online behavior. While preventing abuse is the preferred goal, sadly, that’s not always possible. In such cases, authorities can turn to OSINT to increase investigation effectiveness.

So, let’s get to the practice part. For illustrative purposes, we're introducing a character, Brandon Smith, an OSINT investigator at a law enforcement agency (LEA). He's monitoring the Dark Web to track and combat criminal activities. In a routine check, he stumbles upon a new darknet marketplace that became a hub for illicit content, including revenge porn and child sexual abuse material (CSAM). Concerned by the gravity of the situation, he decides to take action and gathers evidence using various OSINT techniques. And here they are.

Dark Web Intelligence (DARKWEBINT)

Brandon's investigation starts with the Dark Web monitoring. To do this, he uses SL Professional and its Darknet Pack, created in collaboration with DarkOwl. First, the investigator begins scanning darknet marketplaces and forums, searching for any traces of illegal content and services associated with the criminals behind this platform. He manages to find a considerable amount of sexual abuse content (videos and photos) that the offenders are trying to sell.

As Social Links' extension provides a vast amount of darknet content, Brandon accesses a bulk of aliases relating to potential threat actors that he can analyze further.

Social Media Intelligence (SOCMINT)

Brandon decides to dig deeper using data he gathered from the darknet marketplace. He scrutinizes social media platforms such as Twitter for any matches with darknet aliases. After identifying several accounts, he starts looking into the keywords, hashtags, and geotags related to the users. This technique helps Brandon uncover discussions that may contain trigger words or acronyms.

Imagery Intelligence (IMINT)

Brandon then starts looking into the users' content on social media for any identifiers (tattoos, scars, faces, voices, etc.) that appeared in the sexual abuse materials he found previously. Matching such characteristics can help reveal the threat actors' identities.

When the needed data is found, it becomes obvious—manual analysis will take ages. Luckily, Brandon knows a way around this obstacle. He employs ML-powered methods, such as facial and voice recognition, to identify users. Moreover, some techniques extract geodata from pictures or videos based on background details and metadata.

Geospatial Intelligence (GEOINT)

With multimedia analysis yielding essential information, Brandon focuses on tracking locations. By scrutinizing content shared on social media, he gathers insights into the criminals' lifestyles and habits. The investigator knows that even when specific geolocation data is unavailable, users often tag or mention locations or share photos and videos that provide clues about their whereabouts.

User Identification and Deanonymization

To finalize his investigation, Brandon brings together all the puzzle pieces he found during the process. For such purposes, OSINT tools are time savers and helping hands, allowing analysts to summarize all the evidence properly and not miss any details.

Following the detailed inquiry, Brandon finally has a list of real names, emails, and IP addresses from metadata of the sexual abuse materials found at the beginning of the investigation. He forwards all of his findings to his colleagues from LEA, who will take the case into the real world and build a legal claim against the malicious actors.

Quick Recap

1. A routine Dark Web monitoring revealed darknet marketplace with sexual abuse materials;
2. Aliases revealed on the Dark Web helped expand future research on the Surface Web;
3. ML-powered OSINT features allowed the processing of all the evidence quickly and construct the suspects’ digital footprint;
4. Real identities obtained from metadata became a starting point for further case development aimed at bringing criminals to justice.

Sexual abuse is a very sensitive topic that requires in-time (or even preventive) actions. Modern OSINT solutions help in it. Want to learn how? Simply follow the button below, and we will arrange a personalized demo for you. During the call, we’ll discuss your case, answer burning questions, and show you how open-source intelligence can speed up investigations.