Cyber crime targeting children increased during pandemic

As the pandemic forced both children and adults to live an even more virtual lifestyle, online predators suddenly found themselves with a much larger pool of victims. A special national task force called Internet Crimes Against Children, or ICAC, exists to locate and investigate the perpetrators, as well as to support the victims.

Christopher Rideout is a detective with the Belknap County Sheriff’s Department and also a member of ICAC. He’s currently in the process of acquiring a Cellebrite universal forensic extraction device that would allow him to “crack” cell phones and computers seized from suspects, even without their passwords.  

“There's four different types of extractions, each one goes deeper into the phone but it also takes longer,” Rideout explained. “If I had to brute force without a password, I'd probably get less, but If I have a password I can do a full file system extraction and get deleted stuff as well. It's been such a help for me to dump phones. It's 2022, everyone's got a phone and has evidence on their phone.”

As of this interview, there were 14 ICAC cases being worked on by Rideout in Belknap County.

When scrolling through these seized devices, Rideout frequently encounters child pornography or other sexually illegal material. Finding the materials is only the first step.

“After you extract you need to analyze and parse the information,” Rideout said. “From there I spend hours scrolling through phones looking for child pornography. I learn a lot about people.”

Rideout explained that videos have “hash values” which can be identified by systems like Cellebrite's. A hash value acts as a sort of digital fingerprint for a specific file, or set of files that can be traced back to complaints filed through the National Center for Missing and Exploited Children, or NCMEC.

“Some of these companies like Snapchat, Google, Microsoft or Verizon, they have algorithms that flag stuff and auto report it to NCMEC,” Rideout said. “There's also hash values so they can automatically know. We're getting better at reporting it.” 

Individuals can also report illegal content and behavior to NCMEC. Once these reports are filed, law enforcement can use a variety of tools and techniques to locate the suspect. Once a suspect is located, officers like Rideout can request search warrants to obtain devices.

Even material that is just viewed, not downloaded onto a phone has the potential to be retrieved during investigation. 

“If you click on an image online on your computer or phone, it creates a thumbnail on your phone,” Rideout explained. These thumbnails aren’t normally visible or accessible to the average user, and are found deeper in the device. 

Once an investigator like Rideout has the images, it’s up to him to attempt to identify the victims. That means having to wade through pools of explicit sexual material involving children.

“We usually take the top 10 [hash values]. Otherwise I'll be spending weeks describing the images or videos,” Rideout said. “and that's not good for my mental health either.”

“The victim identification program is an important part of what we do,” said New Hampshire ICAC Task Force Commander Lt. Eric Kinsman. “We make every effort to ID the child victims in this material with hopes of rescuing them or getting them services they need to get their life back to a better place. When they're part of that program, one of the things that happens is if that same image is shared again after identification, they are entitled to notification when their image pops again. In certain circumstances they have a right to say how this person is prosecuted.”

Often times, the victims in the content are in foreign countries. Other times, it can be difficult to determine the age of the footage, making justice difficult to pursue.

“In these cases, sometimes I identify a victim, most of the time it's not around here, it's overseas or a couple domestic ones,” said Rideout. “There's no way of knowing how old some of this stuff is. Eastern Europe is a pretty bad place for it. Around here, I see a lot more of the chat rooms. Like Kik messenger was really bad for it. I have a bunch of conversations where they trade it. Some [users] even pretend to be children.”

To make his job easier, Rideout is currently seeking funding for the Cellebrite system through a nonprofit called the Underground Railroad.

“They do stuff with human trafficking with a focus on child trafficking,” Rideout said. “Because they receive donations, they try to help out agencies. That's how this whole thing started. I reached out to them and they asked what do you need, I told them mobile forensics, they said they’d send me some quotes.”

Until Rideout has a local set of equipment, he'll have to send laptops and cell phones out to the state police and wait weeks, or sometimes even longer to get them cracked. In the meantime, cases in New Hampshire have increased since the onset of the pandemic. 

“Here, I would say I'm pretty overwhelmed by the amount of ICAC cases, child exploitation cases just in general,” Rideout said. During the early portion of the COVID-19 pandemic, Americans, especially children, found themselves looking at screens more than ever. 

According to a recent study by JAMA Pediatrics, children’s screen time doubled during the pandemic, from four hours to eight hours per day. In addition to online learning, children relied more and more on the virtual world for social interaction. Apps like TikTok, Snapchat and Instagram saw an increase in young users, and games like Fortnite also experienced an increase in players.

Predators, however, use all of these media to target children, and NCMEC complaints across the country skyrocketed.

“Tips from NCMEC to ICAC from 2019-2020, it went 16.9 million to 21.7 [tips] nationally,” Rideout said, describing saying that the global nature of the internet provides an extra level of complication. “Tik Tok was one of the bigger drivers. The company is owned by a company in China, so how am I gonna serve paperwork or a subpoena in China?”

Fortunately for Rideout, there haven’t been any TikTok cases traced back to Belknap County, but the app remains a playground for pedophiles and others looking to exploit children. Just like the rest of the country, New Hampshire has seen a significant increase in internet crimes against children.

“As recently as 2018 we were averaging 35-50 cyber tips per month as a task force in the state of New Hampshire,” said Kinsman. “In 2020 it skyrocketed, we were averaging 150 cyber tips a month. We were executing or assisting in the execution of three to six search warrants a month to three to four search warrants a week.”

Kinsman said that for a while, the agency was blaming the increase on the pandemic, but as restrictions were lifted, the numbers didn’t go back down. From a data standpoint, it seems that this is the new normal. According to Kinsmen, last year, New Hampshire ICAC received 1,107 cyber tips. Just one year ago, they received 860.

“The number of reports TikTok has made to NCMEC has grown 258% since 2019,” Kinsman said. “Snapchat isn't far behind. We're not anti-Snap or anti-TikTok, or anti-internet for that matter, part of our mission is to educate and ensure that people using these platforms are acting with good intentions.”

As for the increase in reports, it isn’t clear if this is a result of an increase in pedophilloic appetites, an increase in reporting, or a combination of both.

“I don’t know if it's getting more popular, or if people are getting more aware of it, it's definitely blowing up. The numbers are pretty clear.”

It’s not just the viewing and distribution of child porn that threatens users. 

“We're seeing an alarming increase in sextortion or cyber bullying,” Kinsman said. “Victims will send material, nudes of themselves or other types of child sexual abuse materials over Snapchat or TikTok. The receiver will in turn extort them for money in exchange for not sending the pictures to the rest of their contact list. Sometimes they send the money which makes the problem worse.”

A lot of child porn material is often shared between minors, and can also get flagged by reporting algorithms. Some content posted by minors may not be explicitly pornographic, but also can be exploitative and sexualized on platforms like TikTok. This type of content can easily attract predators.

“There are times where it may not be material we would prosecute for in NH, but because we take our mission seriously, we take that as an opportunity as a teachable moment, we'll work hard to identify an actual physical address, we'll do knock and talks, knock on the door and have a good educational conversation with the juvenile and the parents, we're not gonna prosecute them about it, but talk about better internet safety.”

If you are a victim or a parent of a victim, or associated with a victim of cyber crime, file a tip at cybertipline.com, or call 800-843-5678.

Editor's note: This article has been updated to correct the spelling of Det. Christopher Rideout's name.