Facing 36 million CyberTips and counting, ICAC Task Forces need OSINT to keep up.
The National Center for Missing & Exploited Children (NCMEC) publishes its CyberTipline® data yearly. In 2023, they reported the following. Online enticement reports had risen by more than 300% since 2021, and urgent reports had increased by 140% - wildly out of proportion with general growth. Overall, NCMEC received over 36.2 million reports of suspected child sexual exploitation, a 12% increase from just the year before. This data comprised 54.8 million images and 49.5 million videos, or more than 105.6 million individual pieces of potential Child Sexual Abuse Material (CSAM).
These numbers paint a dark picture: reports are more numerous, but also more severe.
This shouldn’t pose an overwhelming challenge to those ‘on-the-ground’ fighting child exploitation. However, the Internet Crimes Against Children (ICAC) Task Forces that handle state and local investigations have to factor in a federal funding crisis. As a result, all 61 ICAC Task Forces in the United States face significant fiscal and public awareness challenges. Last year, $40.8 million in funds were authorized for ICAC’s vital work. Interpolating with NCMEC, this leaves only $1 available to investigate each tip. The proportion of appropriations that manifests in reality is often smaller; at $29m, the 2021 appropriation demonstrates funding can sink even lower.
‘Funding for investigative technology has not kept pace with device and data growth, leading to a significant resource gap…’ - John Pizzuro, CEO of resourcing non-profit Raven [Source: OFTA/Cellebrite]
Fiscal hurdles like these mean ICAC forces are left with little room for innovation to combat their workload. Still, with little or no cost to law enforcement, OSINT solutions like OSINT Industries can make a massive difference to both ICAC Task Forces nationwide, and the children they protect. When it comes to bringing predators to justice, the right tools in an investigator’s toolbox can change everything.
ICAC and SEARCH: A Chapter in OSINT History
Celebrating 55 years of history, The National Consortium for Justice and Statistics’ SEARCH (or System for the Electronic Analysis and Retrieval of Criminal Histories) program has been key in American law enforcement’s OSINT journey. Founded in 1969, SEARCH aimed to provide methods for all 50 states to share criminal histories, digital forensics and public safety information in an electronic format - and they’ve been rising to new challenges ever since.
SEARCH began with the task of automating criminal history records, a groundbreaking meld of law enforcement and the nascent concept of computerization. Soon, SEARCH was pioneering techniques in evidence-sharing, beaming criminal fingerprint facsimiles from the Los Angeles County Sheriff’s Office, via California, to the Florida Department of Law Enforcement through an ‘experimental satellite system’.
As one of the earliest investigative organizations in the electronic space, SEARCH quickly became the go-to for digital and computer forensics; when tasked in 1986 with accessing a personal computer used for fraud, SEARCH’s digital forensic training program began. Teaching officers the fundamentals of electronic evidence gathering, this program could be considered among the forefathers of modern OSINT Training programs in the United States.
By 1998, the popularization of the Internet had raised perhaps SEARCH’s darkest challenge: online child exploitation. Squaring up to a Web of 36,739,000 connected computers in 242 countries and territories, ICAC task forces immediately reached out to America’s premier digital forensics organization. The result: SEARCH’s hosting of the first ICAC Conference, designed to bring the United States together to decide the best course of action to combat this new cyberthreat to America’s children. This partnership has been ongoing ever since.
Today, SEARCH has expanded their original digital forensics focus to include other online crime-solving methods - including OSINT. SEARCH still participates in the National ICAC Conference, as well as several smaller regional ICAC Conferences, and bi- or tri-annual ICAC Commanders’ Meetings, at which all 61 ICAC Commanders have the opportunity to come together with SEARCH and other ICAC training providers by their side. Here, they’ll discuss cases, diagnose knowledge gaps, and discuss which upcoming challenges they’ll rise to next.
Meet Lauren, Program Manager of Cybercrime and Digital Forensics at SEARCH.
Lauren reached out to us as a committed OSINT Industries user and trainer. Lauren works with ICAC to provide assistance, organization and training at Conferences and beyond. As she summarizes: ‘I teach OSINT’.
Lauren has her own story of making OSINT history. She joined SEARCH as an intern in 2005, while gaining her Masters degree in Computer Forensics. As the youngest member of her part of the organization, Lauren quickly became a knowledge source on what was then the most popular social media site among America’s young people: MySpace.
As Facebook was then still restricted to ‘.edu’ addresses, Lauren identified MySpace as the ideal social platform to reach and protect victims under 18. Even before Lauren recognized ‘OSINT’ as a term, she was quickly enlisted to develop and deliver one-day ICAC training on MySpace predators, and even developed an OSINT initiative. Titled ‘My Number One Friend Is A Cop’, the initiative encouraged ICAC Commanders to create law enforcement-identified pages on MySpace, featuring their agency badge as a profile photo. Officers would then engage directly with young people, encouraging potential victims to ‘add’ their local police department as their ‘number one friend’. When an agency badge was visible in an account’s ‘top 8’, predators would be deterred from engaging with that young person. This proactive, OSINT-powered approach was the first of its kind.
Twenty years after her first single-site suite of OSINT Training, Lauren is one of six - and one of the first - providers assigned to help officers get to grips with online investigation, Lauren’s proud to supply answers about what OSINT can do to aid investigations, and to teach OSINT Industries’ tool in-session.
Today, Lauren teaches 12-15 Social Media Intelligence (SOCMINT) classes for ICAC Task Forces a year, alongside other organizational and training commitments. At ICAC Conferences, Lauren can teach as many as 100 top law enforcement officers at a time how to get the most out of OSINT Industries; in her in-depth 3-place classes, she provides free law enforcement accounts for all her students. By the second day of her training, officers are using OSINT Industries to investigate live cybertips, making a real-world impact with OSINT before the program is even complete.
Inside ICAC: How Investigators Use OSINT to Tackle Cybertips
‘Issue your legal process, OSINT while you wait…’ - Lauren W., Program Manager of Cybercrime and Digital Forensics, SEARCH [Source: OSINT Industries]
Lauren was able to give us insight into the specific role OSINT Industries can play in an ICAC cybertip investigation.
Cybertips are mostly company-generated, through a hash value detection system. Hash values are unique codes identifying a file, created using a cryptographic hash function or similar technology. ‘Hashing’ converts data a human can understand (i.e. an image, video, or text post) into a fixed-length string of characters that can be understood by a computer. If even one part of the original data changes - for example, if the image is modified or the video is edited - the hash value changes for the new file. Modern ‘hashing’ systems can detect tiny changes, like resizing or touch-ups, in what appear to the eye as two identical images.
A hash value is a digital fingerprint. CSAM files are easy to trace and identify via, as Lauren describes, their ‘bad fingerprints’. Most social media platforms or service providers keep a database of ‘known bad fingerprints’, and automated systems to automatically generate a cybertip when they’re posted or shared. A trigger generates cybertip, this tip goes to NCMEC, and on to ICAC analysts. The majority of ICAC’s cybertips are generated this way; a great example of how automation and computerization have come a long way to protect Americans since SEARCH’s beginnings.
From here, ICAC needs to find their predator. The first step of many cybertip investigation is issuing legal process to the platform on which a ‘bad fingerprint’ is found or hosted. If one image, video or other piece of CSAM is found, the likelihood of its distributor having shared more content is extremely high. However, successful legal process relies on several prerequisites.
The cybertip generated will have been forwarded to the area in which analysts believe the predator to be located: if predator ‘John Smith’ is thought to be in Chicago, then an ICAC investigator will be assigned from Cook County. Proving concrete details like these, however, has historically been tricky. Images will often have been passed down a string of perpetrators via multiple accounts, from ‘John Smith’ to ‘John Thomas’ to ‘John Brown’. Often predators won’t distribute CSAM using ‘real’ information. Dummy accounts, sock puppets and alibis are common – a tool is needed to draw the line back to a real person, to verify their true identity. This tool is OSINT Industries.
All this means the legal process takes time. Lauren teaches this time as not a hurdle, but an opportunity. With OSINT on their side, waiting for a legal process return needn’t mean a stoppage in an ICAC investigator’s hunt. Lauren encourages her trainees to ‘OSINT while you wait’: to leverage the time warrant processing takes to strengthen their case with OSINT.
Most cybertip cases include a username, a phone number or an email address associated with an account. A tool like OSINT Industries opens these details up for evidence-gathering. An ICAC investigator can find more ‘bad fingerprints’, more associated accounts, and more concrete detail to make an identification. Gathering intelligence can make it possible to reply with new data if a warrant is refused by a platform. For Lauren, ‘OSINT while you wait’ is ‘not a new idea’ – ICAC investigators have been ‘Google searching for 19 years’. Now OSINT Industries can supercharge this search, without sapping scarce resources, in a fraction of the time. At the legal process stage, this addition to ICAC’s toolbox can be the difference between a successful and unsuccessful pursuit on a predator.
A Vital Tool: Why OSINT Industries?
‘I thought, “I’m gonna teach your tool, whether you allow me to teach it or not”…’ - Lauren W., Program Manager of Cybercrime and Digital Forensics, SEARCH [Source: OSINT Industries]
Lauren described the moment she realised that OSINT Industries is an indispensable tool for ICAC investigators. At an ICAC Meeting, she delivered a presentation to 61 Task Force Commanders that included a demonstration of our tool. After the demonstration, so many Commanders were enthusiastic to access our tool that Lauren remembers, ‘I had to say, “OK, I can only induct you one at a time”…’
Lauren first taught OSINT Industries in August 2023, to 26 ICAC investigators in an extremely rural New Hampshire location, three hours away from the nearest airport. She had heard about our tool before, and had taught raw Python scripts from our team - like OSINT Industries Founder megadose’s holehe - for three years as part of her ‘Other People’s Python’ course. Lauren realised immediately how valuable it could be for ICAC and SEARCH, to the extent that she began teaching without an account. She was determined to teach our tool to those who need it.
Luckily, our team share her passion for OSINT in law enforcement. We were happy to provide her with an account, and accounts for those she trains. Now, Lauren can better educate officers about OSINT Industries’ tool. She has trained 440 ICAC investigators, analysts, and prosecutors in our tool, and continues to train SEARCH-affiliated officers throughout the United States – over 70 Utah affiliates received Lauren’s OSINT Industries training, with upcoming training initiatives in Idaho and beyond.
What’s more, Lauren highlighted to us the unique capabilities of our tool. Before OSINT Industries’ tool, juvenile offenders presented a problem. Other people-seeking and aggregation tools - those not effectively utilising OSINT - are ‘based on houses and bills’, ignoring the vast network online footprints that young people often leave behind. The ability to utilise selectors like emails, phone numbers and even usernames gives ICAC investigators a better chance of finding victims, and intercepting harm.
Yet overall, Lauren thinks the indispensability of OSINT Industries for investigators lies in the way a powerful tool can make routine jobs easier. ICAC Commanders in charge of the largest metropolitan areas, like Chicago, New York or Los Angeles, are facing thousands upon thousands of NCMEC cybertips a month. When working with the phenomenal amounts of data involved in response, OSINT Industries can help protect children by streamlining an overwhelming workload.
To find out more about ICAC and SEARCH’s work, visit:
https://www.icactaskforce.org/
Reveal what's behind any contact, instantly.
We want to hear your story!
Inspire Others
Educate about what OSINT can do.
Positive Publicity
Share your success with the world.
Support #OSINT4Good
Be part of the OSINT story.
