“Our Laws Have Not Caught up with the Technology”: Understanding Challenges and Facilitators in Investigating and Prosecuting Child Sexual Abuse Materials in the United States

Abstract

With technological advances, the creation and distribution of child sexual abuse material (CSAM) has become one of the fastest growing illicit online industries in the United States. Perpetrators are becoming increasingly sophisticated and exploit cutting-edge technology, making it difficult for law enforcement to investigate and prosecute these crimes. There is limited research on best practices for investigating cases of CSAM. The aim of this research was to understand challenges and facilitators for investigating and prosecuting cases of CSAM as a foundation to develop best practices in this area. To meet these objectives, qualitative interviews and focus groups were conducted with participants throughout the western United States. Two major themes arose from this research: Theme 1: Challenges to investigating and prosecuting CSAM; and Theme 2: Facilitators to investigating and prosecuting CSAM. Within Theme 1, subthemes included technology and internet service providers, laws, lack of resources, and service provider mental health and well-being. Within Theme 2, subthemes included multidisciplinary teams and training. This research is a first step in understanding the experiences of law enforcement and prosecutors in addressing CSAM. Findings from this study can be used to support the development of best practices for those in the justice system investigating and prosecuting CSAM.

1. Introduction

The investigation of child sexual abuse (CSA) has become increasingly complex with technological advances and the widespread use and availability of the internet. In the United States, the creation and trafficking of child sexual abuse material (CSAM) online is among the fastest growing illicit online industries (Binford et al. 2015). Prior to the digital age, CSAM was typically shared among perpetrators through the physical sharing of hard-copy images either by mail or face-to-face encounters. Unfortunately, the internet has facilitated offenders’ ability to exchange and distribute CSAM, as well as evade detection by law enforcement.

1.1. Definition of CSAM

U.S. federal law defines child pornography as “any visual depiction of sexually explicit conduct involving a minor (someone under 18 years of age)” (18 U.S.C. § 2256). To be considered sexually explicit, the image does not need to depict the child engaging in sexual activity; a sexually suggestive photo of a naked child may still meet the legal definition (18 U.S.C. § 2256). Possession, creation, reception, and distribution of child pornography is illegal under both federal and state law in all 50 states (United States Department of Justice, [US DOJ] 2017). Offenders may be prosecuted under federal law, state law, or both (US DOJ 2017). Differences in federal and state sentencing of CSAM-related offences can make it challenging to understand the potential inconsistencies or differing lengths of sentences. Under federal law, statutory minimums range from five to 20 years for first-time offenders who transport child pornography interstate or for foreign commerce to life imprisonment if the offender has prior convictions for child sexual exploitation, or if the images are violent and the child was sexually abused (US DOJ 2017). Child pornography is not protected under the First Amendment of the U.S. Constitution, but instead considered illegal contraband under federal law (US DOJ 2017). While all states criminalize child pornography, the investigations and prosecutions of cases can become complicated, as not all state laws are identical. States vary as to whether first possession offenses are considered felonies or misdemeanors. However, federal jurisdiction nearly always applies when a child pornography violation occurs using the internet (US DOJ 2017).

As mainstream cultural attitudes generally regard the production of adult pornography as consensual and at least legally acceptable, it is important to differentiate child pornography. Child pornography can be further qualified as visual depictions of CSA. In this paper, child pornography is referred to as CSAM to more accurately underscore that these images and video footage depicts sexual abuse and exploitation of children.

1.2. Prevalence of CSAM

The National Center for Missing and Exploited Children (NCMEC) manages the CyberTipline, a national service through which the public and internet service providers (ISPs) can report suspected child sexual exploitation. From its inception in 1998, the CyberTipline has received over 50 million reports and this number has grown exponentially in recent years (NCMEC 2019). The CyberTipline now receives over one million reports every month, with 18.4 million reports received in 2018 alone (NCMEC 2019). Research into actively trafficked images of identified victims depicts alarming trends including more egregious sexual content over time and increased trafficking of images of prepubescent victims (Seto et al. 2018). Similar trends have been noted in Canada. A study by Cybertip.ca, a tip line for reporting online sexual exploitation of minors, reports that 78% of CSAM on the internet depicts children under the age of 12 with the majority (63%) being under the age of eight (Canadian Centre for Child Protection [CCCP] 2016). As the age of the child decreases, these images are becoming increasingly violent and containing more explicit sexual acts (CCCP 2016). Once these images enter cyberspace, they become next to impossible to permanently destroy, contributing to the ongoing victimization of affected children that continues into adulthood (Binford 2015; Bursztein et al. 2019; Martin 2014).

Each time a child’s image is redistributed, collected, and viewed, the child’s abuse is perpetuated. The child victims in these images continue to endure the “forced recording of non-consensual sexual victimization and the subsequent and equally non-consensual circulation of those images world-wide” (Butt 2007, p. 7). This lack of control over the continued sharing and public access to their abuse images is one of the most challenging aspects of their abuse to overcome and many victims report the resurfacing of these images is worse than the hands-on abuse itself (Binford et al. 2015; CCCP 2017). Adults whose CSA was recorded and distributed online worry constantly about being recognized by someone who has seen images of their abuse even years after the abuse occurred (CCCP 2017).

1.3. Current Challenges to Investigating CSAM

1.3.1. Procedural Challenges to Investigating CSAM

Law enforcement professionals face numerous challenges in investigating and prosecuting cases of CSAM. The sheer number of CSAM reports to NCMEC’s CyberTipline, currently surpassing one million a month, far exceeds the capabilities of NCMEC and law enforcement to adequately respond (Bursztein et al. 2019; NCMEC 2019). While the number of reports is astounding, this likely accounts for only a fraction of the CSAM in existence. Although federal law mandates that ISPs report known or suspected cases of child victimization to NCMEC’s CyberTipline “as soon as reasonably possible,” ISPs are not required to actively look for CSAM on their internet platforms, and savvy perpetrators can easily evade detection (18 USCA Section 2258(A); Henzey 2011). As ISPs are for-profit entities, committing personnel and resources to monitoring servers for CSAM may not be a top priority (McCabe 2008). However, the drastic increase in ISP reports may indicate these companies are beginning to take the issue of CSAM on their networks more seriously (Keller and Dance 2019). Google, Microsoft, Facebook, and Twitter are utilizing technologies to block trafficking of CSAM and user accounts through technology that generates a digital fingerprint for known abuse imagery and then scans user-generated content for these digital fingerprints (Bursztein et al. 2019).

However, once a report is made, police records show that ISPs often take weeks or months to respond to inquiries from state and local law enforcement agencies regarding CSAM—if they respond at all (Keller and Dance 2019). When they do fully cooperate, encryption technology meant to safeguard user privacy facilitates perpetrator concealment of CSAM (Keller and Dance 2019). Frustrating law enforcement investigations further, users may be notified by ISPs that their accounts are being blocked or taken down, giving perpetrators a head start in hiding or destroying evidence. Additionally, federal law only requires ISPs to preserve user material pertaining to CSAM for 90 days (18 USCA Section 2257(A)).

Furthermore, offenders who traffic CSAM are often on the cutting edge of technology, utilizing virtual private networks (VPNs), encryption techniques in messaging apps, peer-to-peer sharing networks (P2P), and Tor (Dark Web) to conceal their online activity (Bursztein et al. 2019; Keller and Dance 2019). One research study into Tor hidden services found that 80% of total requests were for abuse sites, predominantly CSA (Owen and Savage 2016). The authors indicated that these abuse sites were “easily identifiable in the meta data, suggesting webmasters had confidence that Tor would provide robust anonymity” (Owen and Savage 2016, pp. 4–5).

1.3.2. Challenges of CSAM Disclosure to Investigators

In investigating hands-on abuse, law enforcement investigators cannot depend on victim disclosure of CSAM to determine whether the abuse was recorded by photo, video or both. It is estimated that 60–80% of victims of CSA do not disclose that their abuser took photos or videos until adulthood (Alaggia 2010; CCCP 2017; Hébert et al. 2009). Furthermore, most cases of CSA are not reported to law enforcement, and of the reported cases, even fewer appear before the courts (Martin 2013). The CCCP (2017) Survivors Survey found a multitude of reasons why CSA victims may not disclose that there is photo or video documentation of their abuse, including shame, fear of consequences if the footage is uncovered, and a belief that the existence of their CSAM somehow incriminates them as well. Most often, the existence of CSAM is ascertained when a victim discloses to their therapist (86%) and is rarely uncovered as part of a police investigation (12%) (CCCP 2017). Disclosure to law enforcement of CSAM at the time of hands-on abuse may increase the likelihood that police can confiscate and contain these images before they are trafficked on the internet.

Unfortunately, investigators unfamiliar with the complex nature of enduring CSA trauma may not consider victims to be “credible” when they disclose their abuse while it is ongoing, let alone months or years after the abuse has occurred (CCCP 2017). This skepticism toward victims’ testimonies not only compounds the victim’s trauma, but is also one of the principle reasons perpetrators are not identified, charged, and prosecuted (CCCP 2017). The disclosure of the existence of CSAM when hands-on abuse is disclosed could have significant implications for the success of CSA investigations, as CSAM is a visual depiction, and thus, irrefutable evidence that the abuse occurred (CCCP 2017).

1.3.3. Effects of CSAM Exposure on Investigators

Several studies have researched the effects of CSAM on the mental health and well-being of investigators. Repeated exposure to CSAM is reported as a significant stressor for law enforcement professionals (Powell et al. 2014a; Violanti and Aron 1995). As a result of regular exposure to this material, investigators are more likely to experience secondary traumatic stress and burnout (Bourke and Craun 2014; Burns et al. 2008). Powell et al. (2015) concluded investigators of CSAM experience “salient emotional, cognitive, social and behavioral” consequences due to viewing this material in both the short and long term (p. 103). CSAM investigators vary in their perceptions of their main work stressors: some report organizational stressors including heavy caseloads and insufficient resources to cause more stress than exposure to CSAM itself (Powell et al. 2014a, 2015).

Despite evidence of profound effects on mental health, several studies have concluded most CSAM investigators feel positively about their work and are able to successfully manage the majority of stressors in their profession (Brady 2016; Powell et al. 2015; Wolak and Mitchell 2009). However, this perceived sentiment may be due to the dominant work culture in law enforcement which deters expressing vulnerability and weakness, and could indicate persistent problems remain unrecognized (Powell et al. 2014a; Wolak and Mitchell 2009). Furthermore, even if CSAM investigators are coping well with work stressors overall, this does not mean that consistent exposure to CSAM does not inflict psychological harm (Powell et al. 2014a).

There also exists a mixed perception of debriefing strategies among many law enforcement professionals who work with CSAM. Several studies highlight the importance of close professional relationships and frequent informal opportunities to process the psychological effects of exposure to CSAM with other colleagues (Burns et al. 2008; Powell et al. 2014a). Research is mixed on the benefit of therapy on coping with the mental health effects of CSAM. While some studies report CSAM investigators highly value annual psychological assessments, others are hesitant to divulge their experiences to workplace psychologists due to concerns regarding confidentiality or skepticism regarding the benefits of therapy (Burns et al. 2008; Powell et al. 2014a). Investigators also report workplace psychologists and Employee Assistant Programs are generally perceived as incompetent at addressing the specialized nature of CSAM investigations and their effect on investigators (Powell et al. 2014b; Wolak and Mitchell 2009). This echoes the experiences of victims of CSAM, who also report that therapists were not adequately trained or prepared to address the impact of the CSAM on their lives (CCCP 2017).

1.4. Rationale

To date, we located only one study that explores the existing procedural challenges of CSAM investigations from the perspective of investigators. Powell et al. (2014b), utilized anonymous telephone surveys to interview investigators of CSAM across multiple jurisdictions in Australia. The study published findings on the operational stressors that investigators of CSAM face and discussed how these stressors affect investigators’ capacity to perform their role. Their study concluded the chief challenges investigators faced included the following: a lack of supportive work relationships and high staff turnover, poor work resources due to large case volume, inadequate staffing and insufficient training, and open-plan workspaces where CSAM investigations could only be conducted with minimal privacy. Previous research has focused on the content of CSAM and the trauma experienced by law enforcement and other personnel who review these images (Burns et al. 2008; Krause 2009; Powell et al. 2014a, 2015). However, there is limited research on best and emerging practices for investigating cases of CSAM, including methods to facilitate CSAM disclosure, identifying victims portrayed in CSAM, identifying offenders and employing methods to deter creation and distribution of CSAM. Extending beyond a primary focus on the impact of exposure to CSAM on investigators, the purpose of the current study seeks to understand factors influencing best practices and common challenges for investigating and prosecuting cases of CSAM.

2. Methods

2.1. Participants

This research study was approved by the Willamette University Institutional Review Board. Service providers from law enforcement agencies and legal representatives were invited to participate in this research study. Using snowball sampling, participants were recruited from various cities in Washington, Oregon, and California. Agencies dealing with CSAM were contacted by a member of the research team and asked to participate in this research study. In total, 65 participants from 21 different agencies and/or organizations participated in semi-structured qualitative interviews or focus groups. The majority of participants were from local, state and federal law enforcement agencies as well as various district attorneys’ offices. While we had a total of 65 participants, data used for this analysis were from interviews and focus groups with 50 participants, from 16 agencies and/or organizations. This included 33 participants from law enforcement, 11 participants from the legal profession, and six from community organizations. The exclusion of the remaining 15 participants from 6 agencies/organizations were due to technical difficulties in a few instances. In the other instances, participants asked for their interviews to be off the record, and as such, were not recorded or used in data analysis. While these interviews and focus groups were not utilized in data analysis, many participants who asked to remain anonymous work in federal positions and have invaluable knowledge of CSAM and the legal system. These individuals provided context and information to support the research team in focusing the interview questions and in understanding the background of the issue of CSAM in the United States, and in particular in Washington, Oregon, and California.

2.2. Data Collection

Data collection occurred from January to May 2018. Qualitative data were collected through the use of semi-structured interviews and focus groups. Focus groups were used to highlight differences and similarities across participant experiences (Marshall and Rossman 2014). Focus groups are also useful to be able to include multiple participants in a shorter time frame from the same organization (Marshall and Rossman 2014). As many professionals expressed concern about limited time and high caseloads, focus groups were utilized to enhance maximum participation within a shorter time. All interviews and focus groups were conducted in person by at least one senior member of the research team. A total of 10 focus groups (44 participants total) and 19 individual interviews were conducted. A comprehensive interview guide was created with input from academics, content experts in the field, and an individual with lived experience. Interview questions focused on protocols and procedures used when evaluating or responding to cases of CSAM, as well as challenges and possible opportunities to enhance practice in this area. Interviews and focus groups were recorded, transcribed verbatim, and reviewed for accuracy. Interviews ranged from 45 min to an hour and a half. Participants were informed that they could decline to answer any questions or withdraw from this study at any time; informed consent was gained prior to beginning the interview or focus group.

2.3. Data Analysis

The framework method, falling within thematic analysis (Gale et al. 2013), was utilized for data analysis in this research study. The framework method is particularly useful for multidisciplinary research teams (Gale et al. 2013), as was the case in this study. The framework method is also useful when researchers seek to compare and contrast data emerging from qualitative interviews and focus groups (Gale et al. 2013). Following the stages of analysis set forth in the framework method, the interview and focus group data were analyzed. After familiarizing ourselves with the data, the research team coded five initial interviews to develop the initial framework. The research team met to discuss the initial codes and agreed on a framework for subsequent transcripts. The data were analyzed by three independent coders. All coders kept notes of questions or impressions and all discrepancies were discussed at bi-weekly meetings. The analysis process was overseen by a senior member of the research team experienced in qualitative data analysis. Data collection was considered complete once thematic saturation occurred and the research team did not identify novel concepts through the interviews and focus groups.

3. Findings

In this findings section, we will describe the two major themes that arose out of this research. These themes are interrelated as there are many overlapping challenges to investigating and prosecuting CSAM, and challenges and facilitators both impact the way that service providers are able to work within the area of CSAM. The roles in which participants work are diverse and include representatives from law enforcement and district attorneys’ offices. Within these roles, participants varied in seniority and included managerial, frontline, and support staff. Further, jurisdiction and location of participants ranged from local to state to federal. Some participants had specialized training and/or worked specifically in the area of CSAM, while others had broader professional roles, though all had some experience working with CSAM. This diversity will be evident throughout this section, as there was not always consensus amongst participants. All quotes are identified using either FG (focus group) and a number to identify different participants in the focus groups, or II (individual interview). FG identifiers are followed by a number (e.g., FG1, 1) to indicate the FG and participant number within the FG.

3.1. Theme 1: Challenges to Investigating and Prosecuting CSAM

All participants identified some unique experiences and challenges that arose when investigating and prosecuting CSAM. The four sub-themes identified were technology and ISPs, laws, lack of resources, and service provider mental health and well-being.

3.1.1. Technology and Internet Service Providers (ISPs)

Participants frequently described difficulties maintaining their knowledge of technology because of its continuously changing nature. Participants from both law enforcement and the judicial system identified that they are often several technological steps behind perpetrators both producing and trafficking CSAM. The participants in this study identified challenges keeping up with and identifying new apps, software, and programs commonly used by perpetrators of CSAM. When talking about specific devices, such as cell phones, some participants further noted that the increases in storage capacity was another challenge, as was the inability to crack passwords on encrypted devices. The following quotes speak to the challenges with rapidly changing technology:

The technology is clearly the biggest thing. I mean there’s a new app, new program, new security, just about every day, let alone every month, or year. So as an organization … we’re always kind of playing catch up and trying to figure out what the next thing is. (FG4, 1)

I think law enforcement is really constantly trying to catch up. I feel like no matter what, we’re always going to be behind unless, as the companies develop it, they keep us in mind…And this is how we help law enforcement, but we’re always the afterthought. (II9)

In addition to technology changing rapidly, one participant also noted that the physical size of devices and hard drives that store CSAM are becoming smaller; as such, the ability to hide material is becoming easier and law enforcement has a harder time searching for and finding these devices. Further, participants noted that the almost universal access to technology such as cellphones, computers, and the internet has meant that it is easier than ever for perpetrators to produce and traffic CSAM. Participants identified that advances in technology have allowed perpetrators to more easily connect with one another around the globe and remain anonymous while easily trafficking materials, as well as exchanging strategies to evade law enforcement investigation and prosecution.

Some participants perceived perpetrators as continuously updating their efforts to access and traffic CSAM. For example, participants explained that perpetrators are using everything from easily accessible chat rooms and peer-to-peer networks to the Dark Web. One participant noted that some perpetrators continue to use peer-to-peer file sharing because it is easy to access and trade files, though at the same time, it is easier for law enforcement to monitor their activities on these types of networks. On the other hand, participants noted that many perpetrators have moved to using the Dark Web because it is more secure and encrypted, which aids in users’ anonymity, making it more challenging for law enforcement. In the following quotes, participants discuss the different ways CSAM perpetrators use technology:

There are different avenues for people to trade this imagery, through Bit Torrent and the Dark Web, you know we’re just beginning to get access to that stuff. The file sharing stuff has been active for 10 plus years and I’m still kind of astounded how many people use it because it’s open information that law enforcement monitors, but yet people continue because it’s the easiest way for them to access this data. (FG16, 3)

You see horrible things on both sides [Dark Web and traditional platforms]. It’s not necessarily a matter of what they’re trading, it’s just their knowledge in where and how to trade it…I think just the ones [perpetrators] who understand how to use communication on the dark side of the web, that’s where they’re going to go to just because they know it’s more secure and they’ve got a better chance of staying anonymous on that side. (FG4, 1)

Many participants noted the challenges in working with technology companies, particularly when companies must respond to warrants or provide investigators with information on user profiles. Generally, participants noted struggles with some technology companies that they perceived prioritized client privacy over prosecuting perpetrators and protecting children. In particular, one participant called it the “Snowden effect,” indicating that since Edward Snowden, it has become significantly more difficult to work with ISPs, who have become much more concerned with client privacy. Participants identified that some companies were more responsive to law enforcement warrants than others. This was particularly evident when warrants came from federal as opposed to local or county authorities. For participants who worked within federal jurisdictions, they generally indicated that technology companies were forthcoming and responsive if they, as investigators, had the appropriate warrants. However, one participant spoke to both state and federal interactions with technology companies and stated:

I don’t imagine that the state system would get much response. And so, on occasion I have weighed in from my federal phone or email and that has been more helpful. (FG13, 1)

With respect to technology company responsivity, other participants felt strongly that certain companies were not willing to work with law enforcement, were not responsive, or tried to actively work against law enforcement, even with signed warrants. Other participants noted that the protocols in place at technology companies make investigating and retrieving information difficult. For example, certain websites will notify the account holder when served with a warrant, or the companies will shut down user accounts, tipping the user to the fact that they may be under investigation. The following quotes portray participant frustration with technology companies:

I don’t have data from [Company X] because I don’t have cyber tips from [Company X]. I know we are either getting images straight off the phone or we’re not doing anything with [Company X] because [Company X] doesn’t play ball. (FG13, 2)

[Company Y] showed this video…about how they review every search warrant and they look for whatever they can to reject it so they don’t have to provide this information to law enforcement. (FG10, 1)

They [technology companies] shut the account down. They don’t tell them why, but if a person has half a brain, they’re thinking, ‘okay, I just uploaded three child porn images and lo and behold, within a day my computer got shut down.’ (FG10, 2)

3.1.2. Laws

Often, participants pointed out that the laws and legal framework that guide CSAM investigations and prosecutions are outdated and do not reflect the changing nature of technology. The following quotes exemplify what participants said about outdated laws:

Our laws have not caught up with our technology and the reality of our situation. (FG1, 2)

If you look at the statutes governing this area [CSAM], most of them were written in the seventies, some are written in the eighties. There was no way that they’d envision what we’re seeing today. (FG13, 3)

The previous participant also noted that current statutes of limitation are not long enough, and thus, rarely protect victims or account for images being stored online rather than just hard-copy formats. While some participants noted that laws are changing in some states, generally participants agreed this was not happening consistently or quickly enough.

Participants also talked about challenges in writing and obtaining warrants. Participants explained that difficulties with warrants are related to having to write warrants for specific devices or accounts, which may require more specific evidence and expertise. The next two quotes demonstrate these challenges:

I applied for the search warrant. We got the search warrant, did the search of the house and everything went fine. But that is in itself a problem because you know, the old way, you just write it, you go seize everything and analyze it. We can’t do that anymore. You have to specifically identify which device you want to search [and] explain your probable cause to search that device. And so it’s created a whole other set of challenges. (FG10, 1)

You have to develop the expertise over the years to be able to feel confident in your ability to write solid warrants for a variety of different internet platforms like Google Mail and Snapchat and Facebook. And so, he’s really been focused on that for the last several years. (FG8, 2)

Further, participants talked about challenges in obtaining appropriate sentencing, and creating effective probation conditions for CSAM-related offenses. In terms of sentencing, they specifically discussed inconsistencies across jurisdictions. For example, one participant noted that in some states child pornography offences were a misdemeanor whereas other states treat such offences as a felony. Another participant further noted that sentencing even differed by county where some offenders only received probation, yet in nearby counties, other offenders received more significant sentences. Additionally, participants in the current study felt that child pornography offenders often received substantially lesser prison sentences than hands-on child abuse offenders. Finally, participants shared that probation terms do not always reflect the need to limit offender access to the internet and technological devices.

While these challenges were frequently discussed, some participants indicated that having CSAM as evidence was helpful in the investigative process and aided in gaining both confessions and plea deals from perpetrators. This idea is highlighted in the next quote:

There is corroboration through an image. The likelihood that we would get a plea on that case, it would be very high, I would say above 90 percent…it’s [an image] a damning piece of evidence for the defense. (FG7, 1)

3.1.3. Lack of Resources

With participants identifying such high volumes of CSAM, some of the most common barriers identified by participants were high caseloads, not enough staff, and the lack of financial resources to be able to adequately investigate or address all cases. Some participants outlined that while their caseloads have been increasing, they have actually been losing staff, making the issue of resources even more of a barrier for them. Participants noted that because they have limited trained staff, they are not always able to triage cases as they would wish, but rather will pursue cases with clear evidence. Another participant noted that they are only ever able to address the most imminent threat cases, which can leave victims and families feeling unsupported. Further, one participant outlined that even if they had all the images and all the disclosures, they do not have enough staff to support these investigations, particularly the technological side of investigations. The following quotes describe these sentiments:

We don’t have enough people [to investigate] so we can really only get the low bearing fruit. (II9)

We regularly gripe amongst ourselves about how our caseload is different than those who are doing property crimes … it would be wonderful if there was an acknowledgement about the content we deal with. (FG7, 1)

Always [investigating] the ones that were the most imminent. Never get to triage it, but it was most imminent threat to offend. Those were your priorities, and it may make a lot of folks upset because it might take a while to get to their case, but there were cases coming in every day. (FG10, 3)

I am concerned that if we had access to all the images that were out there, had all the disclosures in the world, that we wouldn’t be able to tackle that [and] the system would become overwhelmed … we are fortunate that we have two people dedicated to this work. That’s unheard of in this area to have two people dedicated to child pornography investigations. And even these two find themselves constrained by forensic processing and the length of time that it takes. (FG16, 1)

Some participants talked about having to compete for resources with other departments or investigations. One participant spoke about competing for resources in terms of forensic examiners and people who are able to find information on seized devices, as both the technology and the expertise are very expensive. Another participant noted that big operations or high priority cases will get adequately resourced, but the day-to-day investigations need more resource allocation. It is important to note that not all participants described a lack of resources. Participants noted that smaller jurisdictions or departments are at more of a disadvantage as they have even fewer resources in general, and specifically to deal with in-depth CSAM investigations. The following quotes describe competing for resources and a discrepancy in resources between areas:

We’re competing with every single other law enforcement investigation because you better believe that every gang shooting, they need to know what those texts were on those cell phones … so we need more resources, more forensically trained examiners for these devices … Both the hardware and the expertise is incredibly expensive. (FG7, 1)

If we have a big operation, [we] will get resources. We can always pull people, but it’s the day-to-day investigations that build up … we need more investigators that are dedicated to this and allocated to this full-time. (FG12, 1)

These small departments … these really strapped departments, have no capacity to do any of this kind of in-depth stuff. (FG1, 1)

One participant summed up the challenges and the need for more resources and staff in saying:

not enough investigators, money for training, money for technology … The bad guys on the internet … are able to get this high level of technology that law enforcement can’t compete with because we’re not a multimillionaire business. So that makes it really, really challenging. (FG10, 4)

3.1.4. Service Provider Mental Health and Well-Being

Many participants shared that investigating and prosecuting CSAM can have a significant impact on service provider mental health and well-being. Participants employed in the justice system discussed the adverse impact that viewing CSAM had on their mental health and quality of life. Indeed, some participants shared that the exposure to CSAM was a traumatic experience for them. Participants said:

You don’t get these images out of your head. It doesn’t leave. So even though they [investigators] always say it doesn’t bother them, that it’s okay, I think it’s there. What does it do long-term? (II9)

You view these images and it’s traumatic. (FG14, 1)

Other participants highlighted the importance of focusing on staff mental health and encouraging staff to seek professional assistance to maintain mental health wellness:

I mean, honestly, folks who do anything to do with child sex abuse should be going to talk to someone on a regular basis just for their own mental health. (FG10, 3)

How are our staff getting that support to address the vicarious trauma? And to make sure that we’re at least identifying it and recognizing it when we train. We always include that piece and talking about how people can develop their resilience around that kind of stuff. (FG7, 2)

Participants in senior or leadership roles specifically delineated concerns for their staff’s well-being and noted the importance of establishing protocols to mitigate against the negative effects of CSAM. It was noted that people in leadership should check on their staff regularly and let them know they have support. Importantly, one participant shared:

I think the population we generally forget about, too, is we have secretaries. They are in the trenches with us … We don’t talk about their exposure to this stuff [CSAM]. We assume that we’re the only ones who have to go in and do all the hard work and the reality is just not true and it trickles all the way down to anybody who touches our file. (FGS7, 1)

When talking about the impact of CSAM on service providers, many identified that by the time investigators and prosecutors have expertise in this area, they may be burnt out or transferred out of these units due to high levels of exposure to CSAM content. By the time people are competent in these roles, they are transferred to a different department or promoted to another position. As one participant notes, regarding the turnover in staffing:

We’ve had a number of employees that have needed to get out, and once that happened it needed to happen pretty quick. (FG13, 2)

Another participant highlighted the problems with turnover and the challenges that brings in adequately training staff:

Every few weeks there’s people turning over in SVU [Special Victims Unit]. So as soon as someone gets capacity or training, then they move on. (II15)

The majority of participants indicated that addressing and seeking mental health support was essential for those working in the area of CSAM. However, some participants worried about the possible repercussions of utilizing available psychological support. For instance, law enforcement was especially concerned about seeking therapy and having it used against them in the future, such as during a review for promotion or if there was an internal investigation. As one participant said, this concern stops many officers from coming forward with mental health concerns:

It’s a tough business to be in because we need it [mental health support]. We need the help. We’re just a little worried about what will happen if it went against you. (FG9, 2)

Many participants noted that supportive management, peer support, and a work environment that encourages staff to address mental health and wellness, were factors that made this challenging work more manageable. For example, relating to their workplace, one participant noted:

They offer all the resources that I think someone could need, whether it be therapy, whether it be time off, or whether it be just someone to talk to. A majority of all that comes with the people you’re working with. That’s why this unit’s really tight knit. (FG14, 1)

Another participant stated that self-care was essential in this field:

The importance of self-care for frontline service providers and law enforcement is critical to being able to maintain just a personally healthy perspective within work that we’re doing because it’s really traumatic work to deal with. (FG13, 1)

3.2. Theme 2: Facilitators to Investigating and Prosecuting CSAM

Although numerous challenges were identified, participants also highlighted facilitating factors that aided their CSAM investigations and prosecutions, including multidisciplinary teams (MDT) and training. However, it is important to note that there was not consensus about all of these factors being utilized in CSAM investigations and prosecutions. This tension will be discussed throughout this section.

3.2.1. Multidisciplinary Teams (MDTs)

Some participants identified MDTs as a best practice in investigating and prosecuting CSAM and supporting victims and their families. Participants spoke about MDTs enabling these incredibly complex investigations to be more effective and thorough through streamlined communications and coordinated efforts, as well as making sure that all professionals involved kept the victims’ best interests at the center of their work. Some participants shared that at least one state legislates the use of MDTs for the same reasons, as the following quote illustrates:

So when we say MDT, we mean multidisciplinary team, and public policy in the state of [X] says that investigating allegations of child abuse or neglect is very complicated and so the major agencies involved should work together and the district attorney in every county in [state] shall convene a multidisciplinary child abuse team or MDT to assist in that investigation. On that team, you should have representatives of your district attorney’s office or law enforcement agencies, your local [state] Department of Human Services, child protective workers or CPS workers, schools, healthcare [or] hospital personnel. Who else is on there? Other advocacy groups and then your child advocacy center or [also known as] the child … intervention center. (FG6, 1)

Participants working within MDTs noted that the approach fostered a climate of collaboration and information sharing. Additionally, using MDTs aided in creating a child-centered and sensitive approach, in that it minimized the need for multiple interviews with victims, which is considered best practice by most professionals working in the areas of child abuse investigations. Participants also believed that MDTs aided in the most effective and efficient use of scarce resources through pooling and sharing the funding, technology, and the professionals needed to do the work.

3.2.2. Training

Another factor that participants perceived facilitated effective CSAM investigations and prosecutions is specific and focused training for professionals involved in these types of cases. Participants noted that the type and amount of training they have received varied between jurisdictions. For example, some participants said that they received training about CSAM in their professional education prior to entering the field, while many others shared that they needed to seek out local, regional, or national workshops and conferences, noting that the annual interdisciplinary Crimes Against Children Conference in Dallas, Texas, includes a particularly effective CSAM-focused stream. One issue raised by some participants about training is that it is not always effective. Both the importance of training and this drawback are included in this quote:

So many of these trainings I go to and they’re just not that helpful. You come away disappointed because you’re going away from your family, your organization, spending all this money, you had to travel all the way over there. And this one [Dallas Crimes Against Children Conference] is just spectacular. It’s done for any kind of crime involving children, not just sex abuse. It’s for physical abuse, strangulations, domestic stuff. And it’s not just prosecutors, it’s for law enforcement, it’s for social workers. I’m sure the pediatricians who do this kind of stuff as well, therapists, all of that. It’s a fantastic training. That is … where the light bulb started to really light up for me. (FG8, 3)

In terms of topics, participants identified various potential subjects, including how to navigate and access specific platforms or technology (including the Dark Web), how the needs of CSAM victims and their families differ from and are similar to victims of other crimes, how to build investigations and prosecutions that comply with legislation that applies to CSAM, self-care and peer support, and discipline-specific issues such as advanced suspect interviewing, advanced forensics, and how to write effective warrants in CSAM cases.

While most participants agreed with the need for formal training, some made the case that learning on the job is most effective, as illustrated in this quote:

I tell people it took me about a year and a half to really grasp this type of investigation and I kind of just learned by asking them questions and then just getting into it. Training’s been great, but [there is] nothing like real life, real world experience. (FG14, 1)

Overall, participants clearly stated that training is helpful and needs to be a focus of organizations and leaders in the field of CSAM.

As illustrated, there are many challenges to investigating and prosecuting CSAM, as well as barriers and facilitators impacting professionals in this field. The findings in this section demonstrate the complexities faced by service providers who investigate and prosecute CSAM related offenses. While discussed in the previous section as distinct categories, the findings are highly interrelated and influence one another.

4. Discussion

The present study sought to understand factors that influence best or emerging practices in investigating and prosecuting CSAM, as well as understanding what challenges arise for individuals working in this area. To date, the research team located only one study that explored existing procedural challenges of CSAM investigations from the perspective of investigators themselves (Powell et al. 2014b). Extending beyond a primary focus of the impact of exposure to CSAM on investigators, the current study looked at factors influencing best practices and common challenges.

4.1. Theme 1: Challenges to Investigating and Prosecuting CSAM

4.1.1. Technology and ISPs

Technology was consistently identified as a leading challenge for investigating and prosecuting CSAM. The rapidly changing nature of technology makes it particularly difficult to adequately prepare or train investigators, especially as it relates to specific types of technology or platforms (Seigfried-Spellar 2018). Participants highlighted the difficulties in keeping abreast of new technologies. The plethora of online platforms available for perpetrators to access and traffic CSAM makes it challenging for investigators to keep up, and it is thought that P2P networks are responsible for the large growth in availability of CSAM on the internet (Bissias et al. 2016; Henzey 2011). P2P networks are free and relatively simple to employ so many perpetrators are thought to be sharing CSAM on these platforms (Bissias et al. 2016). While law enforcement does monitor online platforms, the volume of CSAM and the ease with which perpetrators can traffic materials on the internet makes it challenging for investigators to fully address the problem. Further, as one platform or technology is discovered, perpetrators move to other technologies such as social networks, cellular messaging, and the Dark Web (Bissias et al. 2016). Technology companies and ISPs were also cited as a major challenge when investigating and prosecuting CSAM. Legally, in the United States, ISPs are required to report instances of child pornography on their platforms (McCabe 2008) and while ISPs are making these reports to law enforcement, challenges remain. Participants highlighted that ISPs often prioritize users’ rights and are not always willing to provide timely information to law enforcement even with warrants. Further, while it is a legal requirement for ISPs to report CSAM if found, they are not required to look for it. Creating laws which require ISPs to implement server monitoring to combat CSAM would be one approach to addressing the ever-increasing challenges of investigating and prosecuting perpetrators of CSAM. While some companies, such as Google, Microsoft, Facebook and Twitter, utilize technologies to search for and report CSAM, these companies, along with others (such as Amazon) have continued to be criticized for not doing enough to address this problem (Keller and Dance 2019). The International Centre for Missing and Exploited Children (ICMEC 2018) has recommended that there be legislative and policy language enacted which clearly outlines ISPs’ obligations to not report CSAM. Further, they recommend legislative considerations for clear, sufficient, and substantial penalties to incentivize companies to be “proactive and responsible” in their reporting of CSAM (ICMEC 2018, p. 11).

Given that law enforcement agencies already feel overwhelmed and unable to process the volume of CSAM, ISPs may pose additional challenges to investigators when they feel the priorities are not the same. While perpetrators are becoming increasingly proficient with advances in technology, there have also been technological developments that can be used to support law enforcement. These technologies can help in detecting and deleting CSAM more efficiently, potentially reducing the amount of times images or videos of children are shared online (Lee et al. 2020). In addition to speeding up the detection and deletion process, using automated technologies can help to limit the amount of CSAM that investigators must look at, and in turn the vicarious trauma experienced by those who manually search CSAM. Some of the primary technological tools that have been used to support investigators include digital fingerprints and image hash databases, which scans user-generated content on various platforms for known abuse images (Bursztein et al. 2019; Lee et al. 2020). Web crawlers, or search bots, are also important technologies being used to combat CSAM. Web crawlers use pre-defined criteria to automatically browse websites and download data (Lee et al. 2020). Web crawlers have been shown to be successful in identifying CSAM. Project Arachnid, a web crawler created by the Canadian Centre for Child Protection (CCCP) is one such example of a successful web crawler and is able to search the Dark Web as well as open web pages (Lee et al. 2020). When researchers have partnered with law enforcement to test algorithms which are used to detect CSAM, these have shown more accuracy and reliability in detecting such material (Lee et al. 2020). It is necessary for ISPs, technology companies, law enforcement, and other organizations to work in collaboration to ensure technologies are being implemented in ways that optimize their capabilities to detect and delete CSAM. This in turn will support more thorough investigations and prosecutable cases, while supporting victims and families in comprehensive ways.

4.1.2. Laws

The current study found that laws and legal frameworks guiding CSAM investigation and prosecution are limiting and unreflective of the changing nature of technology. Henzey (2011) states that “current laws and enforcement strategies are insufficient to suppress child pornography production and distribution” (p. 2), which is supported by the results of this research. A major challenge to investigating and prosecuting CSAM cited in the literature is the lack of legislation or varying legislation between and across jurisdictions, specifically as CSAM is often trafficked across local jurisdictions as well as across international borders (Hillman et al. 2014). This may hinder the ability of law enforcement to hold perpetrators accountable, can impact cooperation between law enforcement in various jurisdictions, and interfere with timely access to evidence when evidence is located in different jurisdictions (Hillman et al. 2014). Lee et al. (2020) note that when there is inconsistency in legal and policy frameworks, perpetrators are able to find loopholes or simply move the jurisdiction and server location where they house CSAM content. For instance, Steel (2015) found that perpetrators in the United States, where there are laws and deterrence strategies in place, began searching in other jurisdictions, such as Russia, to avoid US laws. Lack of consistency in criminal procedures and laws across jurisdictions may also complicate prosecution procedures (Hillman et al. 2014) as was poignantly noted by some participants. To successfully follow a digital trail often requires quick responses and coordination between law enforcement agencies, both nationally and internationally, which adds to the difficulties (Hillman et al. 2014). While participants in the current research study described many challenges pertaining to laws, participants also highlighted that having CSAM as evidence was helpful in obtaining confessions and plea deals. Supporting this, Henzey (2011) highlights that in the United States, federal and state prosecutors have been highly successful in prosecuting CSAM cases, though federal cases show more success. Similarly, Von Weiler et al. (2010) note that interviewees in their German study generally suggested that having images led to more convictions and higher sentencing. While having CSAM as evidence has generally been noted as helpful in prosecuting cases of CSA, it is often noted that sentencing continues to be inadequate. Participants in the current study highlighted inconsistencies across jurisdictions, with some jurisdictions considering CSAM offenses a misdemeanor and with perpetrators of CSAM often receiving lesser sentences than perpetrators of hands-on abuse. Federal statutory minimums for child pornography trafficking offences are 5 years if no prior sex convictions involving a child and 15 years with prior convictions, while the maximums are 20 and 40 years, respectively (Dillof 2016). These base sentences exclude enhancements such as trafficking in imagery that is violent, sadistic, abusive, etc. (Dillof 2016). However, Dillof (2016) notes that the median sentence for these offenses was 6.5 years with variance in charging practices across the country making sentencing predictions challenging. Importantly, this is data on trafficking of child pornography and does not account for production offenses. Statutory minimums for production offenses are 15 years with a 30-year maximum prison sentence for first-time offenders (US DOJ 2020). While participants in the current study noted many challenges and inconsistencies in sentencing, it is a challenge to make direct comparisons. Hands-on sexual abuse offenses are likely to be prosecuted using state law, while CSAM offenses can be prosecuted using federal law, state law, or both (US DOJ 2020). State laws differ significantly, as do prosecutorial practices and sentencing. To support enhancing legislation and consistency in legislation, ICMEC (2018) has outlined a model of legislation after undertaking a global review. Documents like this can be helpful in having a common framework for law enforcement professionals around the globe (ICMEC 2018).

4.1.3. Lack of Resources

Many participants in the current study discussed the lack of resources facing law enforcement. Participants highlighted that there is an insufficient number of investigators and that caseloads are too high to be able to investigate and prosecute any meaningful amount of CSAM. Similarly, Bissias et al. (2016) noted that while there may be a downward trend on some P2P networks due to successful law enforcement actions, the numbers are still so high that the population of CSAM traffickers overwhelms the number of law enforcement agents who can address these crimes. With limited resources and staff, law enforcement must decide how best to triage resources they have without clear information on the most effective strategy for combatting CSAM (Bissias et al. 2016). Further, institutional pressures to arrest and prosecute can lead law enforcement officials to seek “low-bearing fruit” (US9, 1), a sentiment heard both in the current study and other research literature (Bissias et al. 2016; Henzey 2011). This often leads law enforcement to identifying “inexperienced pedophiles” or those using unsophisticated technological methods (Henzey 2011, p. 53). Finally, a lack of resources adds to the difficulty in technological training for law enforcement officers (Seigfried-Spellar 2018). If law enforcement, ISPs, tech companies, and other organizations combatting CSAM worked collaboratively together, some of these resource (and technological) challenges could be better addressed. Certain industry or researcher created technologies, such as Microsoft’s PhotoDNA, are freely available to eligible customers and was donated to NCMEC, the organization that receives CSAM reports in the United States (Lee et al. 2020). The Internet Watch Foundation’s Hash List, or list of digital fingerprints to identify CSAM, is freely available to ISPs and is utilized by platforms such as Google and Facebook (Lee et al. 2020). With the lack of resources being highlighted by law enforcement, and the increase in reports of CSAM, Bursztein et al. (2019) highlight the potential for various technological tools to enhance the detection process and automatically detect actionable or priority cases. Enhancing the collaboration and utilization of technology could be an essential step in supporting under-resourced CSAM investigators.

4.1.4. Service Provider Mental Health and Well-Being

Participants in the current study spoke about the impact of CSAM on their mental health and well-being. This is aligned with previous research, which has identified that repeated exposure to CSAM is one of the top stressors for law enforcement (Powell et al. 2014b; Violanti and Aron 1995). Further, research has shown that repeatedly viewing CSAM can lead to secondary traumatic stress and burnout (Bourke and Craun 2014; Burns et al. 2008). This was confirmed in this study, where participants discussed the mental health toll of doing this work and the high turnover rates for CSAM investigators.

One issue consistently raised by participants in this study was that, even when mental health services are available, there is a stigma in accessing professional mental health support and that doing so could be used against them later. Additionally, participants in this study noted that mental health services are often inadequate at addressing mental health and coping issues that relate directly to an individual’s work in the field of CSAM. They stated that often psychologists or other mental health professionals do not have adequate training or knowledge to address CSAM. This has been echoed in previous research, with investigators of CSAM highlighting that workplace psychologists or employee assistance program service providers are not able to address the specialized nature of CSAM and the impact on those investigating such crimes (Powell et al. 2014a; Wolak and Mitchell 2009). This is an essential point and has been brought up not only by investigators, but also victims and survivors of CSAM as well as mental health providers trying to support CSAM-affected populations. The Canadian Centre for Child Protection (CCCP) Survivors Survey highlighted that many survivors believe mental health providers are not adequately trained (CCCP 2017). In their survey with mental health service providers, Von Weiler et al. (2010) showed that service providers themselves often felt ill-equipped to provide support for survivors of CSAM. This amplified the need for service providers in this area to have adequate and specialized training.

While it did not come up as often, participants in this study highlighted that when they had policies and procedures in place that made mental health and wellness mandatory, this increased staff well-being. Supporting the idea of mandatory wellness programming, the CCCP was mentioned as a promising approach. At the CCCP, staff who view images are required to attend weekly group therapy and individual sessions, have a limit set on the amount of time they process images, have one “wellness” day per month, and have other policies and procedures in place that support the well-being of staff—especially those who are exposed to images on a regular basis. Within the current study, the traumatic nature of viewing and investigating CSAM was highlighted. Thus, having wellness programming in place is essential and should be a priority within these settings.

4.2. Theme 2: Facilitators to Investigating and Prosecuting CSAM

4.2.1. Multidisciplinary Teams (MDTs)

Repeatedly throughout this research, participants highlighted the benefits of multidisciplinary teams, which entails a team of multiple professionals such as law enforcement, prosecutors, child protection workers, and counselors all working together. Multidisciplinary teams have shown to be helpful not just for professionals dealing with CSAM, but also for children and families (Slane et al. 2018). Multidisciplinary teams lead to better decision-making and use of resources, as well as a reduction in staff burnout and less trauma for children and families (Slane et al. 2018). Multidisciplinary teams are also shown to improve coordination of CSAM investigations (Slane et al. 2018).

In their research with counselors who worked with victims of CSAM, Von Weiler et al. (2010) noted that professionals believed strongly in the necessity of cooperation with other professions and institutions, namely social welfare services, prosecutors, and law enforcement. They noted that professionals believed cooperation and collaboration with members of the legal system would greatly improve if law enforcement agencies had access to knowledge about the adverse effects of CSAM on victims. Further, participants suggested it would be beneficial to work together so that law enforcement and counselors/therapists understood the others’ procedures and potential limitations of these various professions (Von Weiler et al. 2010). Participants in the current study also noted that other professionals would benefit from understanding the law and legal systems. Multidisciplinary teams are a way to ensure professionals are informed about one another’s roles as well as policies and procedures of different professions or organizations.

4.2.2. Training

Training was considered an important part of improving CSAM investigations and prosecutions by participants in this study. Some noted the need for specialized training in areas such as forensic interviewing, understanding technology usage, and how to draft successful warrants. Edinburgh et al. (2015) found a dearth of literature about what lines of questioning by interviewers yield useful information in cases of CSAM and other forms of child exploitation. While research highlights that forensic interview protocols improve the quality of interviews, not all questions may be equally relevant depending on the type of abuse/exploitation. Further, while obtaining information about technology may be highly relevant in CSAM cases, these questions are not always asked (Edinburgh et al. 2015). To address some of these challenges, participants in the current study highlighted specific training initiatives and best practices that they integrate into their work. These include trainings on conducting internet investigations, advanced forensics, and advanced interviewing. These were generally discussed as state or organization specific trainings. Participants identified the Dallas Crimes against Children Conference as one example of an effective and impactful national training opportunity. This conference was highlighted by participants as providing practical and interactive training across professionals working with child victims of crime. This training has been further highlighted by the Council of Europe (2019) as being beneficial for law enforcement and other professionals seeking training on CSAM. By understanding training opportunities like this as best practice for those working in the area of CSAM, professionals can become more equipped to successfully investigate and prosecute cases of CSAM and support victims and families. Expanding training initiatives and building on what is working locally, regionally, and nationally would help to support CSAM investigators and prosecutors, and ultimately victims and their families.

4.3. Strengths and Limitations

To our knowledge, this is the first study to empirically investigate what, if any, best practices exist for investigating and prosecuting CSAM. This may be one of the first studies to focus on law enforcement and prosecutors’ perspectives of the challenges and facilitators to investigating and prosecuting CSAM. A strength of this study is the interdisciplinary nature of our research team consisting of individuals including a member with lived experience of exploitation, legal experts, social workers, and a nurse. Interviews and focus groups were conducted by this interdisciplinary research team. Further, the data analysis was done by a research team with different academic and career backgrounds in order to bring different lenses to the analysis.

This study has several limitations. First, given the time and resource limitations, the geographic area for recruitment was limited to a few cities in a similar geographic region, though recruitment did occur across multiple states. This may have impacted results as law enforcement and prosecutors may have different experiences in other areas of the country governed by different legislation and policies and sociopolitical contexts. Another limitation of this study was that in a small number of focus groups, there were people in leadership roles as well as frontline participants. This power differential may have influenced what some participants shared within focus groups. Although this is not ideal for focus groups, it allowed for more members of law enforcement teams to be able to participate in the research in a shorter time period. A final limitation noted in this study was that our research team did not include individuals with expertise in law enforcement and technology.

5. Conclusions

The findings from this study demonstrate both challenges and facilitators to investigating and prosecuting CSAM. Many of the findings are interrelated and both challenges and facilitators can differentially impact how service providers work to combat CSAM. Participants in this study shared critical information, which can help to improve future practice and outcomes for victims and their families. This study demonstrates the complexities faced by service providers who investigate and prosecute CSAM-related offenses. This research is a first step in understanding the experiences of law enforcement and prosecutors in addressing CSAM and may be employed to launch a large-scale study to understand the perspectives of others in similar positions across the US.