Battling Child Exploitation with Digital Forensics
Written by Glenn Hickok   

According to estimates by the federal government, the number of child sexual exploitation cases is on the rise—with a 1,000-percent increase in child sexual trafficking cases reported since 2004. Moreover, the Center for Missing & Exploited Children reports that one in six runaways in 2014 were likely sex trafficking victims.

Thanks to efforts by Congress, law enforcement agencies, and prosecutors at the federal, state, and local level, the number of active child sexual exploitation investigations has increased by 2,062 percent over the past 15 years. This increase has significantly heightened the demand for expertise and forensic resources at every level of government, resulting in growing backlogs of cases that have yet to be fully investigated. In fact, according to recent testimony provided to Congress by the FBI, the processing of digital evidence in some cases can take more than nine months.

Investigating and prosecuting child exploitation cases can be especially daunting. The fact patterns often involve shadowy networks of perpetrators who are able to move seamlessly across virtual and physical borders around the world. But as technology continues to make our world a smaller place, these perpetrators are finding it harder to hide in the shadows. The current number of mobile devices in use around the world recently exceeded seven billion, and this number is expected to continue to increase exponentially. According to a survey conducted by the Pew Research Center’s Internet & American Life Project, 91 percent of adults have a cellphone today—a mobile device for almost every person. The National Consumers League states 56 percent of children between the ages of eight and 12 have a cellphone, with the average age of receiving a first phone being 10-11.

Congress is responding to the global human trafficking crisis. In the Senate, Senators Bob Corker (R-TN) and Robert Menendez (D-NJ) introduced a bill to address human trafficking and exploitation of minors. “Today more than 27 million people, many of them women and children, suffer under forced labor and sexual servitude in over 165 countries around the world, including our own,” said Sen. Bob Corker. “As I have seen firsthand, the stark reality of modern slavery is unconscionable, demanding the United States and civilized world make a commitment to end it for good. Despite the pervasive nature of this horrific practice, modern slavery is a crime of opportunity that thrives where enforcement is weak, so raising the risk of prosecution can achieve significant results.”

The U.S. Senate also recently passed a bill sponsored by Sen. John Cornyn, which would increase penalties for perpetrators of sex trafficking, provide greater support for victims, and strengthen law enforcement capacity to investigate child sexual exploitation. This bill, particularly the elements that support greater use of technology to investigate and convict perpetrators, represents a major step forward.

Mobile devices and apps create links between children and predators

The reality is that children are at increasing risk of exposure to sexual predators via mobile devices. Virtual relationships are often established between predators and children because of the mistaken perception by the child that it is “safe” to do so because of an apparent distance between the parties. To the predator, this mechanism is an easy means to the end. New and enticing applications available for download might seem to be benign tools but are actually calculated means of enticing vulnerable children by making them feel comfortable. Sadly, this can ultimately lead to their exploitation.

Predators often use the Internet and personal devices and applications in their attempts to lure children away from safety. In fact, according to a recent study, one in 25 children ages ten to 17 received an online sexual solicitation in which the solicitor tried to make offline contact. As the use of personal devices extends to an ever-growing group of children, the risk from exposure to this technology continues to rise. However, the use of personal devices in these cases also affords law enforcement the ability to rapidly arrest, investigate, and prosecute offenders through the use of digital forensics technologies.

Such was the case in Tehachapi, Calif. where a former Tehachapi official and city councilman received a ten-year sentence for sex crimes involving minors after engaging in sex acts with a 13-year-old boy he lured using the Grindr app. The conviction was due in large part to digital forensics tools that were used to decode and extract data present on the defendant’s personal device from Grindr, a networking app he used to contact his victims.

The Tehachapi case is telling for many reasons. The proliferation of smartphone devices around the world continues to explode. A new research report found that the purchase of smartphones will continue to outpace the purchase of non-smartphones, driving 102 billion app store downloads this year. As law enforcement continues to grapple with the challenges of the child exploitation investigation backlog, it is essential they have tools that enable them to extract data from apps, including the rapidly evolving number of chat apps available globally. Many of today’s popular apps offer secure messaging as well as picture and video sharing through which senders may have the option to establish view times of sent content followed by deletion of the communication after a specified amount of time.

Popular apps such as Kik Messenger allow users to send MMS-style messages with photo, video, and sketch attachments. The communication is sent over the data path, which means that message content is unrecorded in the carrier’s call detail records (CDR). TigerText and similar apps take it up a notch by allowing the sender to control when the message is deleted from the recipient’s phone with a “Delete on Read” option that can be set for as short as five minutes. Snapchat provides self-destructing messaging and gives senders the ability to set view times of the message content between one and ten seconds. Other apps, including Skout and Grindr, add proximity features that allow users to determine how close other users are and strike up conversations with those nearby via the app.

Recovering data from apps

This snapshot of messaging apps illustrates the need for investigators to have tools to not only forensically extract information from mobile devices, but also to properly decode what could be critical app data. As mobile technology evolves, so does the sophistication of apps and the associated databases locally stored on the mobile device. Apps such as WhatsApp and Wickr are not only encoded but also encrypted, thus adding another layer of complexity. Such encryption provides another means for child predators to hide their criminal activity. Countries such as Brazil have temporarily suspended WhatsApp for its failure to remove child abuse images from its servers. Additionally, apps such as Vaulty are designed to hide pictures and videos, which provides a haven for child pornography storage.

Fortunately, apps are associated with database files. Each time a message is sent, or a picture “securely” stored, a database on the device records all activity. Messages thought to be deleted by the user typically remain in the app database; data is merely marked for deletion and hidden from the user when the app is used. This data is still recoverable, and with the right tools, investigators can capture this key evidence.

The good news is that powerful tools exist to help law enforcement get behind most apps and tackle the backlog. The challenge is that tight budgets remain a significant barrier to effectively procuring those tools. In order to effectively operate in this fiscal and operational environment, it is essential that law enforcement have tools to maximize their time and effort. The ability to extract data from several phones at a time is also a critically important feature for investigators. Additionally, the ability to securely decode and store extracted cellular information for use now and for reevaluation later allows investigators to capture even more information that could become relevant in the future as more applications are decoded. This can be of paramount importance in securing a conviction. The content of a case file from six months ago may benefit greatly from new releases of technology—as long as it’s a clean and easy process.

Advanced tools also now allow for the establishment of “watch lists” comprised of known terms, file types, names, and other identifiers that can be flagged if identified on the device. This allows technology to act at the “first set of eyes” on the data and triage files that need a deeper analysis, saving countless hours by letting technology conduct the redundant processes and allowing for a more efficient use of the officer’s time in getting the predators off the street. These tools can be game changers, but they must be in the hands of the right people to make a difference. Unless and until the proper mobile forensic tools are deployed to investigators, predators will remain at large because agencies simply don’t have time to pursue them all.

Leveraging the Internet Crimes Against Children Program

A prominent federal law enforcement official recently noted the cellphone is the single most importance piece of evidence at most crime scenes. As such, investigators need effective tools to efficiently and securely capture and analyze the valuable data these devices hold. One program that has been instrumental in enabling state and local efforts achieving this is the Internet Crimes Against Children (ICAC) Task Force. Launched in 1998, the ICAC Program comprises a network of 61 coordinated task forces representing more than 3,000 federal, state, and local law enforcement and prosecutorial agencies. These agencies are engaged in a wide array of forensic investigations and criminal prosecutions.

One local law enforcement agency that has had significant success in working with ICAC and leveraging technology to reduce the backlog and increase successful prosecutions is the Memphis (Tenn.) Police Department’s Internet Crimes Against Children/Human Trafficking Unit. The Memphis ICAC/Human Trafficking Unit recently used a combination of ICAC grant funds and state resources to assemble a cutting-edge digital forensics platform that utilizes the latest tools. In doing so, this department has been able to extract and analyze data from multiple devices simultaneously at high speed in the field.

“We were close to being overwhelmed by the number of cases we were asked to investigate,” said the unit’s supervisor, Lt. Wilton Cleveland. “We now process over 1,200 pieces of digital evidence a year. Having the right tools and the right training to perform rapid examinations, on multiple devices anywhere, has been a game changer.”

According to Cleveland, the constantly expanding number and type of apps remains a challenge. “It’s unbelievable how many new apps hit the marketplace every day—and many of them can pose a significant threat to young children as they can serve as a portal for predators,” said Cleveland. “For this reason, it is critical to have tools that can rapidly get behind these new apps, and top-notch training that can enable you to do the workarounds that are sometimes necessary to conduct an effective investigation.”

In addition to ICAC grants and local funding, federal grant programs such as the Paul Coverdell Forensic Science Improvement Grants Program and the Edward Byrne Memorial Justice Assistance Program are funding sources law enforcement can tap to acquire mobile digital forensics technology—if they apply. “Despite the availability of these grants, the right tools have not been fielded widely enough nationwide to empower law enforcement to impact the backlog in a meaningful way,” said National Fusion Center Deputy Director Glenn Archer. “This may be due to a lack of awareness of the availability of these grants for digital forensics or may be due to the fact that there are too many competing concerns at the command level of each agency to make a concerted effort around acquisition of these important tools.”

Historically, policy makers have addressed high-priority, high-need areas by carving out specific categories within federal grant programs such as the Coverdell program. In the recent past, for example, a strategic need for increased capacity for forensic DNA testing was addressed by creating a specific category within the Coverdell grant portfolio. By creating a discreet category and dedicated funding, federal policymakers were able to significantly increase the capacity for DNA testing at the state and local level while raising the awareness level for applicants.

“Policymakers in Congress and at the Justice Department should act to create a specific category for digital forensics within the Coverdell grant program and other applicable programs such as the Bryne grants as they have done with DNA testing and body armor,” added Archer. “Doing so would help solve the backlog by ensuring that a greater number of law enforcement agencies get needed equipment and local and state agencies would become more aware that specific funding is available to help them.”

Though neither the Coverdell nor Byrne/JAG programs yet have specific digital forensics funding set aside, grants may still be awarded to eligible law enforcement agencies for this purpose. Interested agencies can get more information about Coverdell grants at, and more information about Byrne/JAG grants at The 2015 State solicitation for Byrne/JAG grants has been released, and submissions by the State Administrating Agencies (SAA) are due on June 16, 2015.

While the number of investigations, and amount of raw data, continues to grow, there are a number of important resources that law enforcement can turn to today in order to secure the right digital forensics tools. Should Congress place a greater emphasis on digital forensics within applicable grant programs, experts say an even greater impact can be made to permanently turn the tide on the child exploitation investigation backlog in the United States.

About the Author

Glenn Hickok is the President of MSAB Inc., a global leader in forensic technology in mobile device examination.

< Prev   Next >

Image Clarification Workflow

A FEW WEEKS AGO, I received a call from Ocean Systems asking if I would like to beta test their newest software—ClearID v2.0 Image Clarification Workflow. The new progam has filters that were designed for use with Adobe’s Photoshop graphics-editing program.