Child porn arrests: Investigators must track moving targets

Police in Halifax have announced the results of a months-long investigation into child pornography, Operation Snapshot 3. The RCMP say the operation, the third of its kind in as many years, led to the rescue of five children from sexual exploitation and 150 people being charged or under investigation.

At any given moment, police say hundreds of Canadians are looking at child pornography.

In 2012 alone, the RCMP's National Child Exploitation Co-ordination Centre identified more than 45,000 unique internet addresses where people viewed and shared images of children being sexually abused.

• FAQ: Child porn arrests, in the officers' own words
• RCMP give details on massive cross-country child porn bust

Toronto police Det. Const. Chris Purchas, on secondment to the RCMP, recently illustrated the scope of the problem to CBC News by projecting a live, real-time map of Canada onto a screen at the NCECC.Red dots started to pop up immediately.

Next week on CBC's The National

CBC News was given unprecedented access to an online child exploitation investigation in Moncton, N.B. You can see Alison Crawford's in-depth report on The National on Monday, June 23.

"Each dot on the map represents a hub of activity within a specific region.There's at least one computer in every single province that has been identified within the past 30 seconds possessing or distributing child pornography," Purchas explained.

Within an hour, Purchas said, the map would be covered in hundreds of dots.

"Every one of these computers represents a person that has a sexual interest in kids, which is a potential risk to a child in that area," he said.

The source of all those red dots is free and public file-sharing websites.Many Canadians use these services to download movies and TV shows.Others, though, come for images of children being sexually exploited and abused.

"So I've typed in 'PTHC,' which is an acronym for 'pre-teen hard core.' I start to get hundreds of results of computers that are currently in possession of files matching that search term," said Purchas.

The titles associated with those files describe scenes of incest, rape and specific sex acts with children of every age, from infants to teenagers.Attached to each file is a digital address and flag indicating where the image is located.

Purchas clicked on one of the many IP addresses next to a maple leaf, performed a few searches and within minutes had reasonable grounds to believe a crime had just been committed. "So we were able to download a file from an IP address in the Ottawa area and I viewed that file and confirmed it to be child pornography," he said. The image was of two young girls performing a sexual act.

'We're always playing catch-up'

Confirming that child pornography has been distributed from a specific IP address is the relatively easy part.What follows in a child exploitation investigation is getting more complicated all the time.

"Well things change very quickly and we're always playing catch-up," said Saskatoon police Det. Sgt. Darren Parisien, another expert on secondment to the RCMP's NCECC.

In the past, officers could focus on a single computer a PC or a Mac running a handful programs to connect to the internet.Now, Parisien said, new apps are being designed every day.Hundreds of devices such as cellphones have different operating systems.There's also the storage problem.

I have no doubt every single person who looks at child pornography is going to be a hands-on offender if given the opportunity-Det. Sgt. DarrenParisien, Saskatoon police

"Certainly things even like cloud storage is going to change the way we do things.You can just connect to your own cloud and the application lives up there.So where is the cloud? How do I seize the cloud?How do I investigate the cloud? Is it in Canada?Do I go to the server that's on the other side of the world?" asks Parisien.

But even traditional storage devices are a problem for police because small external hard drives can be easily hidden.

Determining what is child porn

RCMP Const. Tonia Williams recently led an investigation that resulted in the arrest of a man in Moncton, N.B., who pleaded guilty to, among other things, possessing, distributing and making child pornography.The tip came fromPurchas in Toronto, and officers recovered several computers, external hard drives, USB keys and DVDs.

Williams said it's common for officers to recover 3-terabyte external storage devices. "The searches today are a lot more in-depth and more demanding on the technological side of things in regards to examining the evidence and also time-consuming because of the amount of data that is being found."

• Cyberbullyingbill won't be split in 2, PeterMacKaysays
• Cyberbullying bill surveillance powers alarm Ontario privacy watchdog

RCMP Const. David Skead is the lead investigator on a separate child pornography case in New Brunswick, where police retrieved more than five million pictures and videos.

"We have to verify every image is it child pornography or is it not," Skead said.

Each confirmed image of child abuse has to be examined.It is, after all, evidence of a crime scene.Skead concedes the task can be tedious and often upsetting.

"We can now do on a real good day, five of us, about 100,000 images. That's on a good day," he said.

Wireless internet a challenge

Another technological challenge for police is wireless internet.

"There are wireless networks everywhere, so individuals can steal internet connectivity making it even harder for us to identify individuals," Purchas said.

Parisien adds officers are also running into far more encryption on devices such as phones, tablets and laptops.

"The use of encryption by people has certainly changed the way we do investigations, not to necessarily say we are stonewalled or locked out of certain things, but we changed the way we look at investigations now.If we suspect that somebody might be hiding their location or evidence, we take extra steps or measures when we execute a search warrant."

Parisien said he can't explain what those measures might be, but said police have technological advances of their own that help them track and identify pedophiles.

Officers do their best

But even then, he said it's always hard to choose what IP addresses to investigate.

"Our job is to catch those people before they turn into the ones where the interest of looking at what they're seeing turns into them actively assaulting children.That's the magic we're trying to figure out here," Parisien said.

It is not an exact science. Police evaluate factors such as how many images a suspect has, the depravity of those pictures and videos and whether that person has access to children.

Parisien said officers do their best to make that calculation quickly.

"I have no doubt every single person who looks at child pornography is going to be a hands-on offender if given the opportunity," he said.