How CSAM Distributors Exist on the Dark Web


The dark web is a network that specializes in user’s online identity protection.

While many internet browsers have employed this cloak for good, it has attracted an unsavory group.

Child sexual abuse material (CSAM) distributors are increasingly adopting the dark web as a means of dissemination.

In 2021, the 10 most harmful CSAM sites on the marketplace had over 3,000,000 registered accounts. [1]

Because most authorities lack the knowledge or physical resources to combat online crime, an encrypted web store page is often the safest place for illicit transactions.

Even if legal inquiry upends such a page, extended investigations may give perpetrators time to sell, then move to a new site.

The dark web contains child abuse sites that perpetuate the online exploitation of minors.

This article presents how CSAM distributors exist on the dark web and resulting identification complications.

How the Dark Web Works

Dark web child abuse sites range from discussion forums to image boards.

Forums rank members based on their community contributions, typically filling a moderation, administrative, or user role.

Some participants are moderators across multiple platforms, facilitating wider CSAM distribution.

To gain access to these communities, an initiate must produce new CSAM.

This requirement ensures applicants are legitimate minor abusers and gives participants legal leverage over potential informants.

Sellers use single images as bait, often attaching them to a direct message.

In cases where a distributor wishes to share larger quantities, they may link to videos and image archives, with a password.

Cyberlocker sites help protect and monetize CSAM by charging for initial access and subsequent downloads.

Migration to the Dark Web 


Public networks still host the majority of CSAM distribution.

However, improving online efforts by law enforcement coupled with an increasingly security-conscious user base has driven many exploiters toward the dark web’s security.

Despite recent crackdowns on illicit dark web activities, involved criminals can simply migrate to new marketplaces.

This flexibility is a great boon to users wishing to escape from busts without identity leaks.

From Nonsalable to Commercial

In 2021, the Internet Watch Foundation (IWF) determined that 661 of 931 newly-discovered hidden CSAM distribution services were commercial. [2]

This finding shows a sharp increase from a 2015 European law enforcement study that found only 7-10% of online CSAM is commercial. [3]

Part of this discrepancy may be due to the European study’s broader data set, which included the World Wide Web, not just hidden services.

CSAM-involved parties traditionally fall into one of two categories:

1. Profit-driven individuals with limited sexual interest in children.

2. Individuals sexually interested in children who rarely participated commercially.

Dark web users are helping change this distinction.

The network’s anonymity protection and widespread cryptocurrency acceptance make it an ideal place to build a market.

And with rising demand for new CSAM, established participants are well-positioned to earn major profits by selling.

Novelty is a key factor in determining CSAM’s value.

Unfortunately, this factor requires more production, inevitably leading to child abuse.

Scale of Producers

IWF analysts found that eight of the top 10 prolific CSAM sellers were associated with one top-level distributor. [4]

Of surface web commercial content, these eight produced 15%.

This trend paints a picture that the large number of CSAM URLs available are mainly the product of a few, highly prolific top-level distributors.

However, this level of centralization pales in comparison to its dark net counterpart.

A 2022 Justice Department investigation found that a single dark web market accounted for 80% of cryptocurrency transactions in 2021. [5]

While this monopolization attracts significant law enforcement attention, it is also attractive to buyers.

Dark web markets enable ratings from transaction participants.

Because cheated buyers cannot go to the police regarding illicit goods, they must rely on this built-in ecosystem.

Sellers that have hundreds of good reviews are far more trustworthy

In conjunction with CSAM’s increasing commerciality, larger producers are an inevitable trend.

Investigators should expect to deal with seasoned professionals, not sexually-invested amateurs.

Peer-to-Peer Distribution

Peers share CSAM through anonymous networks.

Because of the banned content’s relative rarity, some people will accept it as a form of currency.

Doing so enables participants to skirt even crypto’s weak tracking system.

Dark web networks also enable advice distribution regarding ways to best sexually exploit minors.

This advice often takes the form of locating and reporting children in vulnerable situations across borders, facilitating a class of anonymous, traveling abusers.

Currency Preferences

Because of its unmatched liquidity, price stability, and proliferation, Bitcoin is the most popular dark web currency.

Its next closest competitor, Litecoin, has historically averaged about 5% of Bitcoin’s market capitalization.

However, dark web services are always seeking improved anonymity-preservation methods.

Resulting crypto-currencies include Anoncoin, which pioneered support for Tor and I2P privacy networks, hiding users’ network identities from peers.

Darkcoin has sustained considerable community support by doubling down on privacy compared to Bitcoin.

Developers claim Darkcoins protects against unwarranted government snooping, corporate overreach, and criminals seeking payment information.

However, they acknowledge the currency’s possible uses on the black market.

Device Preferences


Smartphones are online child exploiters' preferred tool thanks to their transportability, cloak ability, and versatility.

A user may record minor abuse, store it on their device, and upload it to a server, all while on the move.

Users can keep the device on their person at all times, securing against fixed assets seizures.

And specialized smartphones encrypt information, without requiring third-party services.

Such flexibility also benefits CSAM consumers who can watch live streamed or stored CSAM while constantly monitoring the offending device.

How the Dark Web Stumps Law Enforcement

Traditional law enforcement tools are inadequate at combating the dark web.

Near-ubiquitous encryption and anonymous networks frustrate tracking and identification efforts.

Globalized CSAM transmissions further complicate matters by confusing jurisdictional clarity.

Shared international standards regarding online minor abuse are rare, and coordination between agencies is even rarer.

Tech-savvy criminals work hard to further officer confusion by constantly evolving the dark web’s sites.

Experienced offenders share information with upcoming community members, ensuring an unbroken chain of knowledge transfer.

Top-level domain hopping is a tactic CSAM merchants use to evade pin-downs.

Developers will name their site something like darksite.io.

When they wish to move market location, they will change the top-level domain (io) while preserving the second-level domain (darksite).

This trick allows emergency mobility without sacrificing brand recognition.

Law Enforcement Dark Web Counters

Despite the dark web’s imposing challenges, law enforcement employs a few techniques that threaten users’ security.

Here are some common methods:

Undercover Operations: Officers may impersonate buyers or sellers in a CSAM community.

This sting helps identify offenders.

Blockchain Analysis: Experts can trace cryptocurrency transactions back to involved parties using blockchain analysis tools.

Dark web CSAM markets are vulnerable to this method due to their reliance on digital currency.

Forensic Analysis: Devices or servers housing CSAM may contain digital files containing the identification of other offenders.

Performing forensic analysis on such devices can reveal these names.

Artificial Intelligence: Image-matching artificial intelligence can scan through the dark web, highlighting known CSAM images.

Tip Lines and Reporting: Law enforcement increasingly encourages public involvement in reporting CSAM.

In 2021, the National Center for Missing and Exploited Children (NCMEC) received a 106% increase in reports of suspected child exploitation. [6]

Consistent employment of these tactics ensures no dark web CSAM user can feel totally protected by the network’s anonymity features.

Future Online Exploitation Challenges

Trends indicate development of Dark Web CSAM markets will continue.

Fully peer-to-peer marketplaces pose unique challenges for investigators.

And new currency options will only increase their attempts at boosting anonymity.

Perhaps the most difficult trend is the increasing ease with which distributors can access fresh CSAM.

Modern culture increasingly normalizes sharing sexualized content online.

As the most susceptible group to peer pressure, children participate in this fad at alarming rates.

Much of the CSAM law enforcement encounters is self-made.

And since technology proliferation is only increasing, observers should expect such content to increase.

Adults need to be aware of their children’s digital society membership.

Certain sites allow public access to images that minors may believe are private.

And sharing sexually explicit pictures with internet strangers should be heavily discouraged.

Policy Change Recommendations


The international legal community must close policy gaps that provide bad actors with strategic loopholes.

Cyberspace’s borderless nature requires a global response.

Here are several steps that would notably improve the world’s anti-CSAM/ child sexual exploitation material (CSEM) efforts:

1. Regulations must establish cross-border coordination between internet companies, the NCMEC (or an international equivalent), and law enforcement.

2. Nations must criminalize all forms of online child exploitation. 

Relying on narrow terms like child porn leaves too much room for abuse like extortion and grooming.

3. Governments must clearly articulate electronic service providers’ role in fighting dark web CSAM. 

Law enforcement should teach these platforms how to contact them regarding illicit distribution.

By adopting these steps, countries save children from the whims of self-regulation, a path that has failed to consistently protect minors from abuse.

At the same time, over-eager regulation risks infringing on internet users’ privacy.

Lawmakers must consult with experts to determine how to enact changes with minimum censorship and spying. 

What Is Human Trafficking Front Doing?

Human Trafficking Front is actively engaged in raising awareness about the presence and activities of CSAM distributors on the dark web.

Our organization aims to shed light on the challenges faced by law enforcement in combating online child exploitation, especially on the dark web.

We advocate for policy changes at the international level to close gaps in regulations, criminalize all forms of online child exploitation, and establish clear standards for electronic service providers.

Therefore, Human Trafficking Front is actively engaged in advocacy, education, and awareness raising to address the challenges posed by CSAM distributors on the dark web, with a focus on policy changes, improving international collaboration, and protecting vulnerable populations such as children.

Conclusion

The dark web is a marketplace that satisfies CSAM distributor’s need for privacy, without sacrificing buyer visibility.

As trends drive these participants from surface web interactions, cloaked commercial networks are the most viable alternative.

Savvy CSAM producers have learned to trick or pay minors into giving them explicit or sexually suggestive content.

Adults and children must stay aware of the dangers disseminating technology provides.

Countering dark web CSAM requires a network of cross-national information sharing and clear, consistent standards regarding minor abuse.

Domestic laws must create similar standards while coordinating with electronic service providers to ensure cooperation. 

Key Takeaways

1. Public distribution often leads with bait photos that advertise paywalled content.

2. Security-conscious distributors are migrating to the dark web from public spaces.

3. An increasing number of sexually invested amateurs are selling CSAM.

4. Most CSAM originates from a top-level distributor.

5. Peer-to-peer distribution enables CSAM as a currency exchange, protecting privacy.

6. Developers are producing anonymization-specialized crypto-currencies to compete with Bitcoin.

7. Smartphones offer CSAM users and producers maximized mobility and versatility.

8. Officers must coordinate with global agencies to fill enforcement gaps.

9. Technology dissemination threatens to increase CSAM availability. 

Act Now. For more tools and information, check out our Resources page.  

Additional Details

This best practices prevention guide and publication is part of the Human Trafficking Front's program: Putting an End to the Online Sexual Exploitation of Children: Preventing Victimization and Strengthening Child Protection Systems.

Recommended Citation

Human Trafficking Front. (2023, December 23). How CSAM Distributors Exist on the Dark Web. https://humantraffickingfront.org/csam-distributors-dark-web/

References

[1] WeProtect. Global Threat Assessment 2021, at 4, https://www.weprotect.org/wp-content/uploads/Global-Threat-Assessment-2021.pdf 

[2] Internet Watch Foundation. Annual Report 2021https://annualreport2021.iwf.org.uk/

[3] ECPAT Belgium. In the Shadows of the Internet - Child Sexual Abuse Material in the Darknets, at 3, https://ecpat.be/wp-content/uploads/2017/12/Analyse-6-CSAM-in-the-Darknets.pdf

[4] Europol and European Financial Coalition against Commercial Sexual Exploitation of Children Online. Strategic Assessment 2014,  at 3, https://www.europol.europa.eu/cms/sites/default/files/documents/efc_strategic_assessment_2014.pdf

[5] U.S. Department of Justice. Justice Department Investigation Leads to Shutdown of Largest Online Darknet Marketplace. https://www.justice.gov/opa/pr/justice-department-investigation-leads-shutdown-largest-online-darknet-marketplace

[6] WeProtect. Global Threat Assessment 2021, at 23, https://www.weprotect.org/wp-content/uploads/Global-Threat-Assessment-2021.pdf 

Human Trafficking Front
 

Dr. Beatriz Susana Uitts is a human rights specialist, Internet child safety advocate, and founder of Human Trafficking Front, a research and advocacy organization for the prevention of human trafficking. Dr. Uitts holds a J.S.D. and LL.M. in Intercultural Human Rights from St. Thomas University College of Law in Miami Gardens, FL, and is the author of the book Sex Trafficking of Children Online: Modern Slavery in Cyberspace regarding the growing problem of online child sexual exploitation. In this book, she proposes solutions to prevent its spread and promote a safer Internet for children and adolescents worldwide.