Europaudvalget 2019-20
EUU Alm.del Bilag 814
Offentligt
2220393_0001.png
EXPLOITING ISOLATION:
Offenders and victims
of online child sexual abuse
during the COVID-19 pandemic
19 June 2020
 EUU, Alm.del - 2019-20 - Bilag 814: Europol advarer om tiltagende seksuelt misbrug af børn under Covid-19-nedlukning
2220393_0002.png
FOREWORD
The COVID-19 crisis has resulted in a surge in online distribution
of child sexual abuse material (CSAM), which was already at high
levels prior to the pandemic. The harm resulting from being a
victim of this crime is severe, and every time a picture or video
is shared, this results in repeat victimisation. The impact of this
crime area can hardly be overstated and an effective response is of
utmost importance.
Europol’s role is to coordinate Member States’ investigations into
those who abuse children, encourage and enable that abuse, or
make abuse material available through online platforms. Europol
uses intelligence products to inform law enforcement partners
about suspects’ activities and behaviour, and to potentially
identify both offenders and victims. Europol works with partners
to organise prevention and awareness raising campaigns and will
contribute its expertise to the discussions around the upcoming EU
Strategy for a more effective fight against child sexual abuse.
CATHERINE DE BOLLE
Executive Director, Europol
2
 EUU, Alm.del - 2019-20 - Bilag 814: Europol advarer om tiltagende seksuelt misbrug af børn under Covid-19-nedlukning
2220393_0003.png
KEY FINDINGS
There have been significant increases in activity relating to child sexual abuse and
exploitation on both the surface web and dark web during the COVID-19 lockdown
period.
Travel restrictions and other measures during the pandemic have likely prevented
offenders from travelling and so have shifted their focus to the exchange of CSAM
online.
Increases in detection and reporting of CSAM on the surface web during lockdown
indicate the level of re-victimisation of children through the distribution of images
and videos depicting them.
Consistent levels of activity by offenders on the dark web during lockdown reflects
the ongoing organised business model that has evolved and the level of threat that
it poses to children.
An increase in the number of offenders exchanging CSAM online during lockdown
may have an impact on and stimulate demand for this type of material online
beyond the lockdown.
Society, including law enforcement, needs to focus on the self-generation of CSAM
to ensure that children are protected from this type of exposure to harm.
The increased circulation of CSAM during the COVID-19 pandemic will also
increase the need for law enforcement to identify the victims depicted in it.
We need to continue promoting preventive and educational initiatives in a
coordinated and structural manner across Europe.
3
 EUU, Alm.del - 2019-20 - Bilag 814: Europol advarer om tiltagende seksuelt misbrug af børn under Covid-19-nedlukning
2220393_0004.png
INTRODUCTION
Since the beginning of the COVID-19 pandemic, Europol has been monitoring
the impact of the virus on the serious and organised crime landscape. The
area of cybercrime is one of the crime areas most affected by the COVID-19
crisis. This includes online child sexual abuse
1
. As both children and offenders
have been forced to stay home and spend more time on the internet, the threat
stemming from online child sexual abuse has increased.
Online Child Sexual Abuse
2
refers to the
sexual abuse and exploitation of children
via the internet. Whereas the sexual abuse
or exploitation very much takes place in
the physical world, the subsequent sharing
of images and videos depicting this abuse
significantly aggravates the impact of this
crime on victims. The amount of CSAM
already online was staggering and it has
continued to increase during the pandemic
with statistics indicating that the amount
of material has rapidly increased in some
countries. While the number of young
children accessing the internet has grown
significantly over recent months, awareness
of the potential risks remains low and cases
of online sexual abuse and exploitation have
increased significantly.
During the COVID-19 pandemic, different
measures have been introduced to prevent
the spread of the coronavirus, including
social distancing, confinement, and working
and learning from home. Children have
experienced confinement in the home
bringing challenges for their safety online and
offline. Those challenges potentially include
social isolation, lack of peer and mentor
support, increased time online, anxiety, stress
and other mental health impacts.
This report examines activities involving the
sexual abuse and exploitation of children
online and related offline crimes with a
particular focus on how offenders have used
their time during confinement to increase
children’s vulnerability. The findings of this
report are mainly based on contributions
from Member States and Europol’s partner
countries and input from a number of
organisations
3
.
1 The
terms child sexual abuse and child sexual abuse material includes child sexual abuse material and material that may be produced through the exploita-
tion of a child in exchange for some material gain. It is used in this report in accordance with the Terminology guidelines for the protection of children from
sexual exploitation and sexual abuse, accessible at
http://luxembourgguidelines.org/
2 Europol
encourages the use of the term ‘child (sexual) abuse material’ and not ‘child pornography’. The use of the term ‘child pornography’ helps child sex
abusers as it indicates legitimacy and compliance on the part of the victim, and therefore legality on the part of the sex abuser. By using the phrase ‘child por-
nography’, it conjures up images of children posing in ‘provocative’ positions, rather than suffering horrific abuse. Every photograph or video captures an actual
situation where a child has been abused. This is not pornography.
3 National
Center for Missing and Exploited Children (NCMEC), Child Rescue Coalition, INHOPE, INSAFE and WebIQ.
4
 EUU, Alm.del - 2019-20 - Bilag 814: Europol advarer om tiltagende seksuelt misbrug af børn under Covid-19-nedlukning
2220393_0005.png
AN INCREASE IN ONLINE CHILD SEXUAL
EXPLOITATION: INDICATORS EXPLAINED
Since the beginning of the COVID-19 crisis, Europol has been monitoring various indicators to
assess the scope of online child sexual abuse and to determine whether there is an increase
in the production and/or distribution of CSAM. Although the data is still fragmented and
incomplete, there are strong indications there has been an increase in the number of cases of
child sexual abuse. Referrals from industry and third party countries have reached record highs
in recent months, particularly in relation to material accessed and distributed on the surface
web and in peer-to-peer (P2P) networks during the COVID-19 crisis. Activities on dark web
forums have also increased, including high levels of posts and responses. In many ways, these
discussions were ‘business as usual’.
Main CSAM indicators showing an increase:
•
•
•
•
•
referrals from National Center for Missing and
Exploited Children (NCMEC)
4
;
number of attempts to access online CSAM;
activity on P2P networks;
the number of reports from the public to law
enforcement or other institutions;
the volume of new posts on online forums
dedicated to child sexual abuse compared to
established baselines;
activity on dark web forums
•
4 Online
platforms providing social media and messaging services refer CSAM detected on their platforms to NCMEC.
5
 EUU, Alm.del - 2019-20 - Bilag 814: Europol advarer om tiltagende seksuelt misbrug af børn under Covid-19-nedlukning
2220393_0006.png
Referrals from the National Center for Missing and Exploited Children
The number of referrals from NCMEC to Europol is an indicator of the amount of CSAM distributed
on the surface web. This number began to rise at the beginning of March 2020, around the same
time the first EU Member States enforced their respective lockdowns. Referrals in April 2020 were still
considerably higher than usual; however, by May 2020 the situation seemed to have nearly returned to
that prior to the COVID-19 pandemic.
Total number of referrals submitted to Europol from NCMEC
Source: NCMEC, May 2020
1 000 000
600 000
200 000
ay
ne
ar
ch
Fe
br
ua
r
Fe
br
ua
r
Ap
to
b
Ap
ril
ar
ch
be
r
be
r
Ju
ly
be
r
us
t
ar
M
ar
nu
Ju
Au
g
ov
em
em
nu
m
M
te
Ja
Oc
Se
p
2019
2019
2020
N
De
c
Ja
2020
The number of referrals for Member States affected by the COVID-19 crisis shows a clear
increase in the period from March to May 2020 compared to the same period in 2019.
6
M
M
ay
y
ril
y
y
er
y
 EUU, Alm.del - 2019-20 - Bilag 814: Europol advarer om tiltagende seksuelt misbrug af børn under Covid-19-nedlukning
2220393_0007.png
Referrals to NCMEC,
Comparison April - May 2019/2020
Source: NCMEC
2019
2020
Austria
3000
Belgium
6000
2000
1000
4000
2000
March April
May
March April
May
Bulgaria
6000
Croatia
6000
Cyprus
1500
Czechia
3000
Denmark
1500
4000
2000
4000
2000
1000
500
2000
1000
1000
500
March April
May
March April
May
March April
May
March April
May
March April
May
Estonia
1500
Finland
1500
France
30000
Germany
30000
Greece
12000
1000
500
1000
500
20000
10000
20000
10000
8000
4000
March April
May
March April
May
March April
May
March April
May
March April
May
Hungary
6000
Ireland
3000
Italy
30000
Latvia
300
Lithuania
3000
4000
2000
2000
1000
20000
10000
200
100
2000
1000
March April
May
March April
May
March April
May
March April
May
March April
May
Luxembourg
600
Malta
600
Netherlands
6000
Poland
30000
Portugal
12000
400
200
400
200
4000
2000
20000
10000
8000
4000
March April
May
March April
May
March April
May
March April
May
March April
May
Romania
15000
Slovakia
1500
Slovenia
3000
Spain
39000
Sweden
6000
10000
5000
1000
500
2000
1000
26000
13000
4000
2000
March April
May
March April
May
March April
May
March April
May
March April
May
7
 EUU, Alm.del - 2019-20 - Bilag 814: Europol advarer om tiltagende seksuelt misbrug af børn under Covid-19-nedlukning
2220393_0008.png
Number of attempts to access online child sexual
abuse material
EU Member States have reported an increase
in the number of blocked attempts to access
websites featuring CSAM during their
lockdowns
5
. Such reports are in line with
figures from the Internet Watch Foundation
6
,
which reported almost 9 million blocked
attempts to access CSAM in April in the
United Kingdom alone
7
. In some countries,
this is matched by an increase in the number
of reported CSAM offences, such as online
solicitation and sextortion
8
.
Activity on peer-to-peer networks
P2P networks are among the most common
platforms for offenders to share CSAM with
each other
9
. Several EU Member States have
reported an increase in detected CSAM on
P2P networks especially in the second half of
March when lockdowns in EU Member States
started materialising. Figures from the Child
Rescue Coalition for detections of CSAM
on P2P networks in Italy and Spain – two
EU Member States which were particularly
affected by the COVID-19 pandemic – confirm
this picture, with both countries reporting a
considerable increase in March and April 2020.
CSAM Sharing on Peer to Peer networks during COVID-19 by country
Source: Child Rescue Coalition
Country
400
United States
Italy
China
Spain
350
300
250
200
150
100
50
0
November
December
January
February
March
April
May
29 May
2019
2020
5 Europol,
2020, Catching the virus: Cybercrime, disinformation and the COVID-19 pandemic, accessible at
https://www.europol.europa.eu/publications-docu-
ments/catching-virus-cybercrime-disinformation-and-covid-19-pandemic.
6 The
Internet Watch Foundation is a registered charity based in the United Kingdom. Its remit is “to minimise the availability of online sexual abuse content,
specifically child sexual abuse images and videos hosted anywhere in the world and non-photographic child sexual abuse images hosted in the UK.”
7 Internet
Watch Foundation, 2020, Millions of attempts to access child sexual abuse online during lockdown, accessible at
https://www.iwf.org.uk/news/mil-
lions-of-attempts-to-access-child-sexual-abuse-online-during-lockdown
The Guardian 2020, Watchdog reveals 8.8m attempts to access online child abuse in April , accessible at
https://www.theguardian.com/society/2020/may/20/
watchdog-reveals-88m-attempts-to-access-online-child-abuse-in-april
8 Contribution
from Member States.
9 Europol,
2019, IOCTA 2019, accessible at
https://www.europol.europa.eu/sites/default/files/documents/iocta_2019.pdf
8
 EUU, Alm.del - 2019-20 - Bilag 814: Europol advarer om tiltagende seksuelt misbrug af børn under Covid-19-nedlukning
2220393_0009.png
Number of reports from the public to law enforcement or other institutions
Data from INSAFE, a global network of hotlines against CSAM online, shows the contact made to
helplines in the first quarter of 2020 saw a sharp increase compared to previous periods, resulting in
the highest number of contacts in one quarter in the last four years.
Number of contacts received by EU Helplines January 2016 – March 2020
Source: INSAFE, March 2020
15 000
13 000
Number of posts per day
11 000
9 000
7 000
Q1
Q2
Q3
Q4
Q1
Q2
Q3
Q4
Q1
Q2
Q3
Q4
Q1
Q2
Q3
Q4
Q1
2016
2017
2018
2019
2020
Date in 2020
Contacts
Linear (Contacts)
Teenagers in particular contacted the
helplines more frequently and increasingly via
electronic means instead of phone calls. It
is important to note that contacts are about
a range of different issues, with child sexual
abuse-related matters being only one of them.
The increase in contacts may reflect the
figures referred to in previous Europol
10
and
other reports
11
on the increased vulnerability
and isolation of many children during this
period.
Volume of new posts in online forums dedicated to
child sexual exploitation compared to baselines
To assess this indicator, Web-IQ, a private-
sector company that monitors dark web and
other online activity, has provided Europol
with information. The data indicates that in
one particular dark web child sexual abuse
chat site there have been increasing levels of
activity, in particular since the beginning of
the COVID-19 crisis.
10 Europol,
2020, Catching the virus: Cybercrime, disinformation and the COVID-19 pandemic, accessible at
https://www.europol.europa.eu/publications-docu-
ments/catching-virus-cybercrime-disinformation-and-covid-19-pandemic
Europol, 2020, Beyond the pandemic: How COVID-19 will shape the serious and organised crime
landscape in the EU, accessible at
https://www.europol.europa.eu/publications-documents/beyond-pandemic-how-covid-19-will-shape-serious-and-organised-
crime-landscape-in-eu
11 ECPAT
International, 2020, WHY CHILDREN ARE AT RISK OF SEXUAL EXPLOITATION DURING COVID-19, accessible at
https://ecpat.exposure.co/covid19?utm_source=Website&utm_campaign=Hero;
UN Special Rapporteur on trafficking in persons, especially women and children, 2020, COVID-19 Position paper: The impact and consequences of the
COVID 19 pandemic on trafficked and exploited persons, accessible at
https://www.ohchr.org/Documents/Issues/Trafficking/COVID-19-Impact-trafficking.pdf
9
 EUU, Alm.del - 2019-20 - Bilag 814: Europol advarer om tiltagende seksuelt misbrug af børn under Covid-19-nedlukning
2220393_0010.png
Daily posts on the biggest English-speaking dark web chat thread on one site
Zero means the site was unavailable.
Source: WebIQ
800
700
600
500
400
300
200
100
0
10
17
24
9
16
23
30
13
20
27
February
March
April
May
One dark web site used for the distribution of
CSAM has shown increasing levels of activity,
including high levels of posting and responses
relating to the topics of sexual abuse of
male children and comments on particular
images and videos made available in posts.
It is important to note that activity across
dark web sites varies on an ongoing basis,
depending on their popularity, availability and
a range of other factors.
Monitoring of these sites by Europol verified
that there was an increase in activity from
March to May 2020 on the same dark web
site, particularly in relation to posts about
videos captured through webcam. These
videos range from children who are being
forced or coerced by an offender into
producing abuse material to other videos
of a sexual nature produced by children
for peers or for social media attention and
include videos being captured without their
knowledge. The categories the child abuse
material are listed under include ‘spycams’,
‘webcams’ and ‘live streams’. In another dark
web forum, a section specifically for those
capturing this live stream footage, known
as ‘cappers’, saw the numbers of messages
and threads more than triple from 500
messages from December 2019 to February
2020, to 1 500 from March to May 2020. This
reinforces concerns previously expressed by
Europol
12
and others
13
about the quantity of
material appearing to be self-produced by
children themselves. Some of this activity
may relate to annual ‘competitions’ organised
within forums to gather and promote video
captures of child sexual exploitation and
abuse material.
Overall, the total number of files made
available by offenders to one another across
several prominent dark web forums increased
significantly during the period March to May
2020. In one case, the number of files made
available increased by almost 50 % and in
another case, it almost doubled.
Activity on dark web forums
Criminal activities related to the production
and exchange of child abuse material started
to transform around 2012, when the dark web
started to be widely used for all kinds of illegal
activities. Law enforcement operations and
improvements in technological solutions have
further changed the conduct of individuals
involved in online child sexual abuse, forcing
them to change their behaviour to increase
their anonymity online. Many child sexual
abuse offenders have gradually moved
from the surface web to the dark web. The
Tor network in particular has been abused
12 Europol,
2019, IOCTA 2019, accessible at
https://www.europol.europa.eu/sites/default/files/documents/iocta_2019.pdf
13 Internet
Watch Foundation, 2018, Trends in Online Child Sexual Exploitation: Examining the Distribution of Captures of Live-streamed Child Sexual Abuse,
accessible at
https://www.iwf.org.uk/sites/default/files/inline-files/Distribution%20of%20Captures%20of%20Live-streamed%20Child%20Sexual%20Abuse%20
FINAL.pdf;
Netclean, 2019, Netclean Report 2019, accessible at
https://www.netclean.com/netclean-report-2019/insight-1/;
10
 EUU, Alm.del - 2019-20 - Bilag 814: Europol advarer om tiltagende seksuelt misbrug af børn under Covid-19-nedlukning
2220393_0011.png
through the creation of numerous forums and websites by anonymous individuals dedicated to the
production and exchange of CSAM, including tips and advice about online grooming and how to
safely travel to abuse children. Other online platforms and services, including messaging applications,
have also been abused by child sexual offenders to host and exchange CSAM.
14
In response to law enforcement operations targeting these dark web communities and due to the
need to select participants and ensure exchanges of information are strictly related to child sexual
abuse, some offenders have created new forums. These forums act as meeting places where
participation is structured similarly to criminal organisations, with affiliation rules, codes of conduct,
division of tasks and strict hierarchies. The purpose of the structure is to enforce rules and promote
individuals based on their contribution to the community, which they do by recording and posting their
abuse of children, encouraging others to abuse and providing like-minded, technical and practical
support to one another.
Commandments:
Rules that will be enforced.
- Do not reveal or request any kind of identifiable personal information. Prostitution included. This also talking about meeting in real life.
- Do not flame, attack or gratuitously offend other members or staff.
- Use English in the main forum.
- Do not post links to banned hosts and unsecure websites.
- Post your own links. Do not post links copied from other people without their permission.
- Posts with no previews will be removed.
- No adult content (over 18).
- No hurtcore (rape, torture, gore, snuff and blackmail). Medical content is not forbidden, but brutal medical procedures like autopsies,
circumcisions and others may be considered improper and removed. Necrophilia may also be considered improper.
- No trade offers outside of Public Market. Selling and buying included.
- Do not teach or ask for advice on how to drug children.
Recommendations:
Rules that may not be enforced.
- Do not post files with no password.
- Do not post files with explicit identifiable names. Use names that are unrelated, unsuspicious.
- Do not post .zip files. Use .rar or .7z.
- No thanks, re-up and wrong password spam.
* None of these rules is absolute. Occurrences will be judged on a case-by-casebasis.
* This topic may be updated without warning at any given time.
* You have the right to remove your account and posts at any time. You can do that
here.
Figure 1 Rules
for users of one online platform used to distributed child abuse material.
Source: Extracted by Europol, June 2020.
Strict observance of the rules is requested by the administrators to avoid being banned from the
forum. In addition, compliance with the rules and active participation can lead to a progressive
increase in rank.
Users regularly publish information and safety manuals aimed at avoiding detection by law
enforcement authorities. Some users are also attentive to law enforcement operations and regularly
publish news articles or even summary reports of the techniques used during successful operations.
Cross-posting across various boards and forums highlights a collective approach to improve
operational security for all.
14 Europol,
2017, Global action tackles distribution of child sexual exploitation images via WhatsApp: 39 arrested so far [Press release 18 April 2017], accessi-
ble at
https://www.europol.europa.eu/newsroom/news/global-action-tackles-distribution-of-child-sexual-exploitation-images-whatsapp-39-arrested-so-far;
Europol 2019, Operation Chemosh: How encrypted chat groups exchanged emoji ‘stickers’ of child sexual abuse [Press release 11 December 2019],
accessible at
https://www.europol.europa.eu/newsroom/news/operation-chemosh-how-encrypted-chat-groups-exchanged-emoji-%E2%80%98stick-
ers%E2%80%99-of-child-sexual-abuse
11
 EUU, Alm.del - 2019-20 - Bilag 814: Europol advarer om tiltagende seksuelt misbrug af børn under Covid-19-nedlukning
2220393_0012.png
Constant monitoring of these communities has indicated that activities of child sexual abuse
offenders on the dark web have been less affected by the lockdowns than those on the surface
web. As previously reported by Europol, there have been numerous discussions about COVID-19 on
dark web forums dedicated to child sexual exploitation, including enthusiastic messages about the
opportunities provided when children will be online more than before.
15
Topic: thank you covid19
is nobody seeing the bright side of this pandemic??
schools are closed so kids are at home bored….. that means way more livestreams and its very damn clear moderators arent working right now since
ive seen 3 hour streams go unbanned over the last few days where girls do whatever they fuck they want. what a time to be alive
Source: Extracted by Europol, June 2020.
However, most of the discussions have focussed on the problems caused by the lockdowns and
activities within these communities. Pre-existing restraints, such as limited access to children, are
discussed alongside more general discussions about the social impact of COVID-19.
Topic: Crisis affects
As we all know, the majority of the world is under quarantine at the moment due to this rampant disease, Covid-19. How is this situation currently
affecting you and this wonderful hobby? For me I’ve been given more time to allocate to other things, in this case this hobby. Unfortunately though I’m
not the only one who gained more free-time and don’t get much privacy, thus I cannot pleasure myself to this godly content, except late at night.
Source: Extracted by Europol, June 2020.
In many ways discussions and activities on online forums are very much ‘business as usual’. For
example, competitions for the best child sexual abuse videos shared within the community have been
organised, but as mentioned previously, this has been the case in previous years.
Monitoring of specific topics dedicated to the production of CSAM through grooming and sextortion
also showed no significant change in behaviour during the lockdown. Shared material and posts were
very similar to those for the same period one year ago.
15 
Europol, 2020, Catching the virus: Cybercrime, disinformation and the COVID-19 pandemic, accessible at
https://www.europol.europa.eu/publications-doc-
uments/catching-virus-cybercrime-disinformation-and-covid-19-pandemic
12
 EUU, Alm.del - 2019-20 - Bilag 814: Europol advarer om tiltagende seksuelt misbrug af børn under Covid-19-nedlukning
2220393_0013.png
INTERNATIONAL POLICE COOPERATION LEADS TO THE ARREST
OF A DARK WEB CHILD SEX ABUSER IN SPAIN
International cooperation was key to cracking a case of online CHILD SEXUAL EXPLOITATION - Europol
supported the Spanish National Police by analysing information received from Queensland Police in
Australia.
The COVID-19 crisis forced experts from the Central Cybercrime Unit to carry out their duties from
Madrid and coordinate officers on the ground in Barcelona remotely.
The operation to bring down a child sex abuser, who had made explicit videos of an underage boy,
owes its success to international cooperation. Information from Queensland Police – Australia’s
Taskforce Argos sent via Europol’s secure communication channel allowed Europol experts to carry out
operational analysis, which revealed that a video from 2015 found in Belgium and France may have been
filmed in Spain.
A crucial breakthrough on Social Media
The analysis of the images and video – which showed how the suspect abused a boy who was under five
years old at the time – led the Spanish National Police (Policía Nacional) to locate the suspect. When
looking into the message published with the video, officers noticed that the suspect used words and
phrases from Spain and not from a Latin American country.
Using operational analysis, open-source enquiries and cross-checking information, Europol experts
found that the suspect was registered on several websites and boards dedicated to child sexual abuse
and exploitation on the dark web. The investigation revealed that the suspect was also using a social
media network where he was in touch with a woman who shared the same surname as the one in the
title of the sexual abuse video.
COVID-19 Pandemic forces a change of tactics
Due to the lockdown in Spain, cybercrime experts from the Spanish National Police Central High-Tech
Crime Unit based in Barcelona were assisted remotely by other experts in Madrid. The material seized
showed how the arrested suspect was using several email addresses and dark web access points to
commit this horrific crime. The material seized is pending analysis, which is of special value as it could
provide important clues about other child sex abusers on the dark web.
16 
Europol, 2020, International police cooperation leads to the arrest of a dark web child sex abuser in Spain [Press release 21 April 2020], ac-
cessible at
https://www.europol.europa.eu/newsroom/news/international-police-cooperation-leads-to-arrest-of-dark-web-child-sex-abuser-in-
spain
13
 EUU, Alm.del - 2019-20 - Bilag 814: Europol advarer om tiltagende seksuelt misbrug af børn under Covid-19-nedlukning
2220393_0014.png
MODI OPERANDI
Surface web
The vast majority of online CSAM is detected
on image hosting websites that are accessible
from the surface web and on P2P networks.
17
Offenders keep using a number of ways
to disguise online CSAM, making it more
complicated for law enforcement authorities
to detect such images and videos. Although
the online distribution of CSAM continues
to take place via a variety of platforms,
P2P network sharing remains among the
most popular way among perpetrators to
share CSAM. One-to-one distribution and
sharing among larger groups routinely take
place on social networking platforms. This
harmful sharing and re-sharing of content
that victimises children has been repeatedly
detected at record levels during the COVID-19
pandemic within Europe
18
. NCMEC has stated
that there has been a 106% increase in such
activity across the globe
19
.
Such material is created through a range of
means. One of the most harmful is direct
contact sexual abuse of children by offenders.
However, the ability of offenders to trick,
coerce and sexually extort children into
producing child abuse material without ever
meeting them online has also prominently
featured in recent cases
20
. The effects noted
by victims in such cases are also extremely
damaging.
Dark web
Dedicated bulletin boards on the dark
web were popular among offenders as a
channel for the distribution of CSAM during
this period. This is especially the case for
offenders with niche interests, including
CSAM with infants and non-verbal children
and demeaning material depicting torture
and severe cruelty against children. In many
cases, offenders use encryption and install
software to cover their IP address and prevent
identification, such as virtual private networks
(VPNs) and Tor.
17 Europol,
2019, IOCTA 2019, accessible at
https://www.europol.europa.eu/sites/default/files/documents/iocta_2019.pdf
18 NCMEC
data for Europe 2020.
19 Forbes,
2020, Child Exploitation Complaints Rise 106% To Hit 2 Million In Just One Month: Is COVID-19 To Blame?, accessible at
https://www.forbes.com/
sites/thomasbrewster/2020/04/24/child-exploitation-complaints-rise-106-to-hit-2-million-in-just-one-month-is-covid-19-to-blame/#71cff86e4c9c
20 Independent,
2020, Matthew Falder: One of Britain’s most prolific paedophiles challenges 32-year prison sentence for ‘sadistic’ crimes, accessible at
https://
www.independent.co.uk/news/uk/crime/matthew-falder-paedophile-appeal-prison-sentence-blackmail-cambridge-a8585881.html
14
 EUU, Alm.del - 2019-20 - Bilag 814: Europol advarer om tiltagende seksuelt misbrug af børn under Covid-19-nedlukning
2220393_0015.png
During the pandemic and within ten days of the discovery of videos online, the Italian State
Police arrested a 30-year-old man following an international police investigation to track
down an individual producing CSAM.
The videos, which were released and offered for sale on the dark web, showed the suspect
violently sexually abusing a pre-school-aged girl. Analysis of these videos by the Italian
State Police identified the location of the abuse, which took place during the lockdown, in a
region of northern Italy.
Combining the information with open source information and intelligence from Europol,
the Italian State Police identified the home of the individual. Working together with the field
office of the State Postal and Communications Police, they carried out a thorough search
of the suspect’s home. Evidence, including items from the abuse videos, was found with
thousands of images and videos of sexual exploitation of minors. The victim was identified
and made safe and the suspect was arrested and awaits trial.
21
21 
Europol, 2020, International collaboration leads to arrest of child sexual abuser in Italy [Press release 27 May 2020], accessible at
https://www.europol.europa.eu/newsroom/news/international-collaboration-leads-to-arrest-of-child-sexual-abuser-in-italy
Social media applications and encrypted messaging
CSAM is increasingly distributed via social
media applications. The self-destruct
function of some of these applications makes
investigations particularly complicated.
In some cases, this is the result of self-
generated material being shared with peers,
after which it is further distributed via social
media and eventually ends up on CSAM
platforms. There are also instances where
fake social media accounts are created in
order to spread private pictures and videos of
underage victims together with their personal
information. Although such accounts
are often quickly deleted, it is easy for
perpetrators to simply create a new account.
Encrypted messaging can also be used by
those exchanging child abuse material, even
allowing them to form communities and
groups in order to do so.
22
22 
Europol, 2019, Operation Chemosh: How encrypted chat groups exchanged emoji ‘stickers’ of child sexual abuse [Press release 11 December 2019],
accessible at
https://www.europol.europa.eu/newsroom/news/operation-chemosh-how-encrypted-chat-groups-exchanged-emoji-%E2%80%98stick-
ers%E2%80%99-of-child-sexual-abuse
15
 EUU, Alm.del - 2019-20 - Bilag 814: Europol advarer om tiltagende seksuelt misbrug af børn under Covid-19-nedlukning
2220393_0016.png
CREATION OF CHILD SEXUAL ABUSE MATERIAL
Self-generated explicit material (SGEM) has
been a growing problem for several years as
more and more young children share explicit
material online. Growing access to high-
quality smartphones and other devices, in
combination with a relatively low awareness
of the risks of producing and sharing SGEM,
means this trend is likely to continue, especially
in a period when more and more children are
dependent on their smartphone or computer to
socialise online.
SGEM can be produced voluntarily, produced
under coercion or extortion by a child sex
offender. There was already a growing number
of minors voluntarily sharing sexual pictures
or videos with peers. Over recent months,
the quantity of voluntarily produced SGEM
has likely been further increasing due to
limited physical contact with peers. Children
and youngsters are thus making themselves
vulnerable to online solicitation by child sexual
offenders. There is a risk that the pictures or
videos may be spread further, first between
other peers, but eventually by online child
sex offenders. Such cases can subsequently
lead to the minors being subjected to sexual
coercion and extortion by online child sex
offenders for new SGEM or material involving
their siblings or other friends. We may expect
to see a further increase of this material being
spread and children being victimised in the
coming months.
Sexual coercion and extortion
Although sexual coercion and extortion of
minors can be a source of financial gain for
offenders, in the majority of cases their aim
is to obtain new CSAM. Offenders mostly use
existing explicit pictures or videos of a victim
and threaten to share this with the victim’s
network or on social media unless they receive
more material
23
. The increase in the level of
material being shared and the amount of
SGEM being produced may lead to an increase
in sexual coercion and extortion in the near
future.
Monetisation of child sexual abuse material
Although offenders are primarily driven by a
desire to access more CSAM than financial
gain, in some cases offenders do seek to profit
from online child sexual exploitation. Sexually
offending children by proxy against children
– where offenders watch other offenders live
stream abuse, known as ‘live streaming’ or
‘live distant child abuse’ – is frequently paid
for by offenders. It is a method of exploitation
that enables offenders affected by travel
restrictions, such as COVID-19, to continue
having children abused at their request.
Uploading CSAM to legitimate ‘pay-per-click’
advertisements on hosting services is another
method of monetising CSAM. The CSAM can
be initially disguised, thereby increasing the
platform’s click rate and the potential profits
per click. As there has been an increase in
sharing CSAM during the COVID-19 pandemic,
it is expected that offenders producing CSAM
for profit will seek to enlarge their market and
number of clients in the coming months.
First-hand child sexual abuse
Some offenders distributing CSAM online
are doing so by recording their own physical
sexual abuse of children. The demand for
such material perpetuates the ongoing abuse
of children by them and others. It is likely that
the increase in the circulation of online CSAM
in recent weeks will continue to feed the cycle
of physical sexual abuse of children and their
victimisation in real life and online.
23 Europol,
2017, Online sexual coercion and extortion as a form of crime affecting children: law enforcement perspective, accessible at
https://www.europol.
europa.eu/publications-documents/online-sexual-coercion-and-extortion-form-of-crime-affecting-children-law-enforcement-perspective
16
 EUU, Alm.del - 2019-20 - Bilag 814: Europol advarer om tiltagende seksuelt misbrug af børn under Covid-19-nedlukning
2220393_0017.png
CRIMINAL ACTORS AND FUTURE THREATS
It is difficult to assess whether the number
of offenders is increasing because of the
pandemic. However, the circumstances
around the pandemic have given existing
offenders access to a broader group of
potential victims.
The online offenders remain largely the same.
However, those previously travelling to certain
risk countries likely were increasingly active
online during this period. It will be important
to monitor if the online habits of online sexual
offenders changed.
The main threats related to online child sexual
exploitation have remained relatively stable
over the last years and throughout 2019.
The pandemic has shifted this assessment.
Contact and travel restrictions have led to a
surge in the exchange of online CSAM and the
consequences of this may have a long-term
impact on child sexual exploitation in general.
The proliferation of anonymisation tools and
the increase of material available may entail
higher risks of repeat victimisation of children.
Online child sexual abuse will remain a
significant threat as long as children spend
large amounts of time online unsupervised,
either during their spare time or while
receiving education via remote learning
arrangements.
The end of the current crisis and the lifting
of lockdown measures may result in an
increased number of reports of child sexual
exploitation, as abuse that occurred during
the COVID-19 pandemic may be reported to
law enforcement or other authorities after the
fact.
As Europol has previously shown
24
, a
relaxation of travel restrictions and opening
up of air travel will likely lead to an increase in
travelling offenders seeking out child sexual
exploitation in certain countries and regions.
If air travel remains limited for the foreseeable
future however, or becomes more expensive,
it is also possible we will see an increase in
virtual and proxy offending via live streaming.
Increased poverty stemming from the COVID-
19-related economic crisis could be another
driving factor for fewer opportunities to travel.
The connection between interest in child
sexual abuse and the use of paraphilic objects
such as childlike sex dolls has been the
subject of previous comments by the NCA.
25
The sale of adult sex dolls has increased
significantly since quarantine began to the
extent that one company anticipated needing
new staff to keep up with demand. The adult
sex doll company saw a 51.6 % increase
in orders from single men in February and
March 2020, with a 33.2 % year-on-year
growth in orders placed by couples in April.
26
It is possible that this level of demand will also
be true for those wishing to use childlike sex
dolls while they are confined as replacements
for the children they would usually travel to
abuse.
24 Europol,
2020, Beyond the pandemic: How COVID-19 will shape the serious and organised crime landscape in the EU, accessible at
https://www.europol.europa.eu/publications-documents/beyond-pandemic-how-covid-19-will-shape-serious-and-organised-crime-landscape-in-eu
25 The
Guardian, 2017, Child sex doll imports expose previously unknown offenders, accessible at
https://www.theguardian.com/society/2017/jul/31/
child-sex-doll-imports-expose-previously-unknown-offenders
26 Forbes,
2020, Sex Doll Sales Surge In Quarantine, But It’s Not Just About Loneliness, accessible at:
https://www.forbes.com/sites/frankicook-
ney/2020/05/21/sex-doll-sales-surge-in-quarantine-but-its-not-just-about-loneliness/#56bc7090170f
17
 EUU, Alm.del - 2019-20 - Bilag 814: Europol advarer om tiltagende seksuelt misbrug af børn under Covid-19-nedlukning
2220393_0018.png
EUROPOL’S RESPONSE
Since the beginning of the COVID-19 crisis,
Europol has not only been monitoring the
impact of the crisis on online child sexual
exploitation, but has also assured continuous
support to EU Member States and other law
enforcement partners to respond to these
threats. Europol has paid particular attention
to the Trace an Object initiative, which follows
up on leads submitted by the public and
processes new objects for this campaign.
Europol has been holding regular calls with
EU agencies and institutions to coordinate
strategic and operational responses to
online child sexual exploitation during the
pandemic and the European Cybercrime
Centre at Europol (EC3) has carried out
enhanced monitoring of open sources.
Despite challenges to operational work
during the lockdown period, Europol has
been able to ensure availability and business
continuity across all areas of support to
law enforcement in EU Member States
and beyond, including ensuring effective
information exchange, analysis and forensic
capabilities.
Providing the Member State law enforcement
authorities and partners with an up-to-date
situational picture is a key priority for Europol
during this crisis. To do this, and in response
to requests by several Member States that
the organisation take a coordinating role,
Europol commits resources to the continuous
monitoring of the situation and provides
immediate support to Member States.
In addition to providing operational support
to EU Member States and other partners
throughout the COVID-19 pandemic, Europol
also sought to increase ongoing prevention
and awareness campaigns that highlight the
risks to children’s safety online such as the
#Say No! campaign.
Other successful campaigns Europol
amplified in this period include:
•
•
•
COVID-19 global parental advice, by the
Australian e-Safety Commissioner;
#DontBeAnEasyCatch campaign, by
Saving Missing Children;
#ProtectChildrenTogether campaign, by
Suojellaan Lapsia ry/Skydda Barn rf/
Protect Children.
Since CSAM, particularly from live distant
child abuse, primarily originates from
developing countries, it is essential that EU
law enforcement authorities continue to
cooperate with and support the investigations
of law enforcement in these jurisdictions.
Fighting child sexual exploitation is a joint
effort between law enforcement, EU Member
States, non-governmental organisations,
international organisations and the private
sector and increased cooperation is
needed to coordinate efforts and prevent a
fragmented approach and duplicated efforts.
STOP
CHILD
ABUSE
TRACE
an
OBJECT
18
 EUU, Alm.del - 2019-20 - Bilag 814: Europol advarer om tiltagende seksuelt misbrug af børn under Covid-19-nedlukning
2220393_0019.png
E X PLO ITI N G I S O L ATI O N: O F F E N D E RS A N D V I C TI M S O F O N LI N E C H I L D S E X UA L
A B U S E D U R I N G T H E C OV I D -19 PA N D E M I C
© European Union Agency for Law Enforcement Cooperation 2020.
Reproduction is authorised provided the source is acknowledged. For any use or reproduction of
individual photos, permission must be sought directly from the copyright holders.
This publication and more information on Europol are available on the Internet.
www.europol.europa.eu