Production and Active Trading of Child Sexual Exploitation Images Depicting Identified Victims

Full text

Production and Active Trading of Child Sexual
Exploitation Images Depicting Identied Victims
MARCH 2018
RESEARCH TEAM
Michael C. Seto, Royal Ottawa Health
Care Group
Cierra Buckman, Johns Hopkins University
R. Gregg Dwyer, Medical University
of South Carolina
Ethel Quayle, University of Edinburgh
IN COOPERATION WITH
National Center for Missing
& Exploited Children®
FUNDED BY
Thorn

NCMEC & Thorn Research Report
3
5
6
8
Table of Contents
Executive Summary
Project Aim
Background
Data Collection Process
NCMEC Datasets
Results | Historic Dataset
Results | Modern Dataset
Conclusions
References
Appendix
15
21
45
14 47
42

NCMEC & Thorn Research ReportNCMEC & Thorn Research Report
PAGE
3
Executive
Summary
The National Center for Missing & Exploited Children (NCMEC) has
access to unique data about child exploitation images, particularly
those involving identied victims and oenders and reported by
multiple law enforcement agencies.
Through the cooperation of NCMEC, and with
the nancial support of Thorn, we were able to
extract data from NCMEC databases to address
multiple research questions.
The primary objective in this project was to
develop knowledge to assist law enforcement
in identifying victims of child sexual abuse
material and intervening to prevent child sexual
exploitation and abuse.
In this study, the rst of its kind, we were able
to analyze data from two dierent datasets:
(1) a historical dataset that encompassed all
actively traded cases involving identied victims
from July 1, 2002, to June 30, 2014 (518 cases
involving 933 victims); (2) a modern dataset
encompassing all cases involving identied
victims from July 1, 2011, to June 30, 2014 (1,965
cases involving one oender and one victim, and
633 cases involving multiple oenders and/or
victims; only a small minority of these cases were
actively traded). The historical set allowed us to
examine trends over time, whereas the modern
dataset had more information due to a more
comprehensive law enforcement submission
form implemented in 2011.
DATASETS
1) HISTORICAL
• Actively traded cases
involving identied
victims: July 1, 2002
— June 30, 2014
• 518 cases involving
933 identied victims
2) MODERN
• All cases involving
identied victims:
July 1, 2011 — June
30, 2014
• 1,965 cases: one
oender and one victim
• 633 cases: multiple
oenders and/or victims

NCMEC & Thorn Research ReportNCMEC & Thorn Research Report
PAGE
4
Executive
Summary
These results have implications for law enforcement investigations regarding adult-created child
pornography cases through a better understanding of the relationships between child, oender,
and oense characteristics.


no obvious trends in terms of child victim age or gender.
1


egregious content in terms of sexual activity
particularly nuclear family members.
2


.
3
Report Highlights

NCMEC & Thorn Research Report
PAGE
5
Project
Aim
NCMEC & Thorn Research Report
The primary objective in this project was to develop knowledge to assist
law enforcement in identifying victims of child sexual abuse material
and intervening to prevent child sexual exploitation and abuse.
WE WERE ABLE TO EXAMINE THE FOLLOWING RESEARCH QUESTIONS:
1. From data about all identied, actively traded
cases (involving 5 or more reports to NCMEC)
from 2002 to 2013, are there longer-term
trends in the nature of the content analyzed
by NCMEC, in terms of the age, gender, or
sexual activity involving depicted children?
From data involving identied child victims
between July 1, 2011, and June 30, 2014, whether
actively traded or not, we examined the following
research questions, rst by focusing on data
from cases involving a single oender and a
single victim, and then including cases involving
multiple oenders and/or victims:
2. Was actively traded status (5 or more
reports to NCMEC) associated with victim
age or gender, oender age or gender,
sexual activity level, or relationship between
oender and victim?
3. Given some oenders were family members
of victims, was familial relationship
associated with victim age or gender,
oender gender, or sexual activity level?

Background
NCMEC & Thorn Research Report
PAGE
6
Online child sexual exploitation is an international
problem, because these production and
distribution technologies transcend national
borders. There is also wide variation in child
pornography laws around the globe, according
to a recent review by the International Centre for
Missing & Exploited Children (2016). There are
growing concerns about the sexual exploitation
and abuse of children as new technologies
create more opportunities for perpetrators (Seto,
2013). Although the total number of children
who have been sexually exploited or abused and
photographed is unknown, the number of arrests
for adult-produced child pornography in the U.S.
practically doubled between 2000 and 2009,
resulting in more than 1/3 of arrested producers
of child pornography in 2009 being adults who
created the images of the children themselves
(37%) (Wolak, Finkelhor, & Mitchell, 2012).
There is limited scientic understanding of
the characteristics of these children who are
victimized in child pornography images/videos
and their relationship with those who have
sexually abused them. It is not known how these
factors may change over time or vary across
sociocultural contexts such as ethnicity or
poverty. Existing research has provided some
insight about cohorts of identied children, or of
images seized from the computers of oenders,
but there are many unaddressed questions. More
is known about perpetrators than victims at this
time (e.g., Long et al., 2016; Quayle & Jones, 2011;
Seto, 2013; Seto & Eke, 2015, in press; Seto, Wood,
Babchishin & Flynn, 2012; Taylor & Quayle, 2003).
Knowledge gained from this research can lead
to a better understanding of online victimization
and oending, thereby supporting more eective
and ecient prevention and law enforcement
initiatives to protect children. The results of
this research could have international impact
given the professional networks the researchers
have in their respective countries and the
relationships NCMEC has with the international
law enforcement community. For example, there
are many questions about longer-term trends
in the production of child exploitation content,
and whether more actively traded content diers
from non-traded content in victim or oender
characteristics.

7
Background |
NCMEC & Thorn Research Report
Given younger children appear to be at greater
risk of sexual abuse by family members than from
non-relatives, reecting access and opportunity
(Snyder, 2000), is it also the case that exploitation
content depicting younger children are more
likely to involve familial oenders? Finding this
association could help guide law enforcement
investigations. As another example, evidence
that child characteristics, such as gender and
age, are related to distribution or other oending
characteristics would support the development
of computer algorithms to categorize large
collections of child exploitation images. Seto and
Eke’s (2015) predictive research has shown the
ratio of boy to girl content is associated with the
likelihood of future sexual oending, so nding
associations between child gender and other
study variables would extend this research.
THE TEAM
Principal Investigator: Michael Seto, PhD,
forensic research director at the Royal Ottawa
Health Care Group and an Associate Professor
in Psychiatry at the University of Toronto, with
cross-appointments to Ryerson University,
Carleton University, and the University of
Ottawa (Canada).
Co-Investigators: R. Gregg Dwyer, MD, EdD,
Associate Professor and Director of Community
and Public Safety Psychiatry, Director of the
Sexual Behaviors Clinic and Lab, Department
of Psychiatry and Behavioral Sciences, Medical
University of South Carolina (USA).
Ethel Quayle, PhD, Reader, School of Health
and Social Science, University of Edinburgh
(Scotland).
Research Coordinator: Cierra Buckman, MHS,
Senior Research Program Coordinator at the
Moore Center for the Prevention of Child Sexual
Abuse, Bloomberg School of Public Health,
Johns Hopkins University (USA).
The work was completed in collaboration with the
National Center for Missing & Exploited Children
(NCMEC) sta.
This project was funded by Thorn, a nonprot
organization dedicated to driving technology
innovation to combat child sexual exploitation.
Thorn partners with nonprots and academic
institutions to gather new insights into the role
technology plays in child sex tracking, the
creation and proliferation of child pornography,
and the normalization of child sexual exploitation.
Thorn then goes beyond insight to action to
develop the tools, systems, and approaches to
help address these issues (learn more at
www.wearethorn.org).

NCMEC & Thorn Research ReportNCMEC & Thorn Research Report
PAGE
8
Data Collection
Process
Database
NCMEC is a private, nonprot organization
established in 1984 (learn more at www.
missingkids.org). It was created to help nd
missing children, reduce child sexual exploitation,
and prevent child victimization. NCMEC serves as
the national clearinghouse for families, victims,
private industry, law enforcement, and other
professionals on issues related to missing and
sexually exploited children. NCMEC’s Exploited
Children Division operates the CyberTipline® and
Child Victim Identication Program® (CVIP®).
CVIP primarily helps to verify whether or not
child exploitation images appear to depict
children who have been previously identied
by law enforcement agencies as actual (rather
than virtual or computer-generated) children
and helps law enforcement identify new child
pornography victims. CVIP maintains a database
of information related to child sexual exploitation
images, containing both identied and
unidentied children.
When NCMEC introduced CVIP in 2002, the
record-keeping for identied children was
eective, but basic. As CVIP’s reputation and
recognition grew, so did their program. Law
enforcement began seeking their assistance on
hundreds and thousands of cases. At this point,
CVIP moved their records to a case management
system and formalized submissions with a law
enforcement submission guideline form. The
form’s rst edition was still rather simple and
asked for standard information, such as data
about the victims involved in the case, the
jurisdiction, a point of contact and such. [Please
note, NCMEC does not request nor record the
names of victims in any of its systems.] However,
the process quickly became more sophisticated
and they added new variables and categories
to each iteration of the guideline form. By 2014,
the submission guideline contained multiple
pages and additional case details were requested
and captured in the system. Data from each
submission was now entered into its respective
eld and images were coded by analysts based
on their content.

9
Data Collection Process |
NCMEC & Thorn Research Report
The CVIP database provides a unique opportunity
for research related to online sexual exploitation
and abuse of children because it is a central
repository for data that crosses geographical,
jurisdictional, and operational lines. CVIP
works in conjunction with several national
and international organizations to move cases
along as quickly as possible. They also work
closely with law enforcement agencies, internet
service providers, victim attorneys, and child
welfare organizations throughout the U.S. They
have processed millions of cases and helped
to identify thousands of child sexual abuse
victims. As a result, their database has access
to very large, broad, and unedited datasets,
including information about child pornography
collections, victim characteristics, and oender
characteristics.
Vocabulary
Given the evolution of the NCMEC database, the
information in the CVIP records was not originally
intended or designed for research purposes. As
such, historically they used in-house language
for variables. In an eort to fully capture the
nuances of their database, we have adopted their
language for certain variables and categories
as well. Below are a few key denitions to help
readers understand the data as we describe our
collection process and analytical methods.
Case/Series — A series is a group of images
focusing on a specic child(ren) and, when traded
or collected, is most often done so as a set. “Series”
and “case” are synonymous within this report.
Actively Traded — A term designated by NCMEC
referring to a series that has been seen in 5 or
more CyberTipline Reports and/or CVIP case
reviews.
Victim — Any child visible in the material who
is younger than 18. Please note, only identied
victim data have been included in this analysis.
Oender — The person who is proven or believed
to have produced and/or enticed or coerced the
images to be produced by a child.
Age Category — This is coded based on physical
development of the victim (limited to three
categories: infant/toddler, prepubescent, and
pubescent) based on the youngest appearance of
a child in a series of images or videos.
The database also includes other high-interest
variables, some which are coded on a series-level
and some which are coded on an individual-
level. Those coded on a series-level reect data
for the series overall regardless of number of
victims and/or oenders. Those coded on an
individual-level reect data for that specic child
victim or oender. Below is a list of some of these
variables, and how they were coded.

10
Data Collection Process |
NCMEC & Thorn Research Report
VARIABLE CODING LEVEL DESCRIPTION
Gender Individual Gender of child victim/oender
Ethnicity Individual Ethnicity of child victim/oender
Relationship of Abuse
to Child Individual Categorization of the relationship between each child
victim and each oender
Jurisdiction Series Specic U.S. state or “International” designation of
where the les were produced
Date NCMEC Received
the Submission Series Date NCMEC received the case submission by
law enforcement
Approximate Time
Frame of Production Series Date provided by law enforcement indicating time
frame of production of the series
Number of Images Series Approximate number of images and videos in the series
Sexual Activity Checklist Series Categorization of the sexual activity depicted in the
images and videos
Additional elds on both individual- and series-
levels were also reviewed during the study.
However, the denitions of these variables
are much more straightforward and align with
existing denitions in the research literature.
Inclusion and Exclusion Criteria
Data for our investigation was limited to cases
with an identied victim and one or more adult
oenders. Since access to the images and
videos is restricted, for the content variables, we
examined descriptors of series, counts of media,
and checklists of the sexual activity depicted.
Given the amount of missing information on
early-identied victims, we chose to have
separate datasets from their database. Since we
wanted to include some of the more historical
cases, in our rst dataset, we chose to only
include actively traded cases with an identied
victim. In our second dataset, we chose to
exclude cases before 2011.

11
Data Collection Process |
NCMEC & Thorn Research Report
Data Collection Method
The team’s research coordinator began working
onsite at NCMEC at the end of December 2014.
After a brief orientation, the lead analysts at
NCMEC presented Ms. Buckman with several
spreadsheets containing the raw variables for the
rst set of data. This rst dataset, the historical
dataset, contains all actively traded cases —
dened by NCMEC as having been reported
on ve or more times — from July 1, 2002, to
June 30, 2014. The second dataset, the modern
dataset, contains all cases involving identied
child victims from July 1, 2011, to June 30, 2014.
As discussed earlier, NCMEC receives a wide
range of information about a given case from
law enforcement, however, information is often
separated into dierent management systems.
For instance, one system tracks information
related to images and videos, another tracks
jurisdictional information and technical aspects
of a case, and a third stores information
concerning the series submission to NCMEC.
Given the method by which the variables were
queried, compiling the data into one database
would have greatly limited the analysis. Therefore,
the team opted for a more comprehensive
approach and asked Ms. Buckman to synthesize
the raw data into two dierent databases: cases
where there is only one identied victim-oender
relationship and cases with multiple identied
victim-oender relationships. Using this layout,
a closer examination of the relationship between
oender and victims is possible, while still
answering questions surrounding case-level
information.
While CVIP’s services are extremely helpful to
most law enforcement, many ocers fail to
update cases with important information or
fully complete the law enforcement submission
form. To compensate for the missing data, Ms.
Buckman coded case documents for each series
to ll in as much missing information as possible
and to capture additional variables that NCMEC
could not query from their data management
systems. The co-investigators determined that
variables needed to be at least 80% complete
to ensure reliable statistical calculations and
validity. At NCMEC’s suggestion, Ms. Buckman
developed a follow up survey for law enforcement
to collect the variables that still did not meet the
80% threshold.
A summary of the variables selected, scales for
sexual activity, and scale for oender-victim
relationship, is provided in the Appendix.

12
Data Collection Process |
NCMEC & Thorn Research Report
Sample Selection
It is important to note, while this dataset is
highly unique and oers a valuable insight into a
combination of perspectives (it combines oender,
victim, and content data), it also has limitations.
First, because NCMEC is entirely reliant on law
enforcement for their information, the dataset
excludes cases law enforcement did not pursue
as well as information remaining unknown to
law enforcement.
Furthermore, to ensure the goal of 80%
completion per variable was achieved as well as
enough information for each perspective to work
with, NCMEC and the research team decided to
focus their research eorts on cases involving at
least one identied child. This lter was applied
to both the historical dataset and the modern
dataset. As such, victim information is only
reective of the victims identied in the case, not
necessarily all victims present in a case. Likewise,
information related to oenders is limited to
those who have been reported to NCMEC by
law enforcement. Additionally, self-produced
cases were excluded in the analyses since their
relationships represented a unique type of case.
Moreover, since some cases involve multiple
victims and some cases involve multiple
oenders or both, the data was looked at from
two perspectives: cases involving one victim-
oender relationship and cases with multiple
victim-oender relationships. These dierent
perspectives allowed the use of variables that had
been coded at either the case level or individual
level. It is important to make the distinction as
to what dierent variables say in relation to one
another. For instance, in the historical dataset, a
rened sample (one victim-oender relationship
cases) was used to fully explain things such as
sexual activity and jurisdiction, both reported
at a case level. However, in order to maximize
SAMPLE SELECTION OF LAW ENFORCEMENT
SUBMISSIONS
Actively traded
cases reported
back to NCMEC 5
or more times
Cases identied
by NCMEC CVIP
Cases received
by NCMEC CVIP

13
Data Collection Process |
NCMEC & Thorn Research Report
the number of cases to work with, the multiple
relationship data was coded (i.e., if a case had all
girl victims the case was considered girl victim or
if it had all infant/toddler victims it was counted
as infant/toddler victim). For cases with mixed
samples (e.g., victims were both boys and girls),
a third “mixed” variable was created. This coding
strategy was applied to victim age and gender,
relationships of victims and oenders, and
oenders’ gender.
The raw NCMEC data was extremely rich with
detail. NCMEC precisely codes the relationship
between oenders and victims, marks checklists
for sexual activity present, and keeps a variety
of case information from distribution method to
information concerning how a case was initiated.
To make analyses more digestible, many of the
variables supplied to the team were grouped
and scaled to aid in dissemination and assist in
mapping ndings onto existing literature. These
scales and groupings are listed in the Appendix.
The nal sample criterion, only applied to the
historical dataset, was actively traded status
as dened by NCMEC as having been seen in
5 or more CyberTipline reports and/or case
submissions by law enforcement to CVIP. Due
to changes in the law enforcement submission
guidelines it was impossible for early, non-
actively traded cases to match the level of detail
of modern non-actively traded cases.

NCMEC & Thorn Research Report
PAGE
14
NCMEC
Datasets
The rst dataset was a historical, cross-
sectional slice encompassing all available actively
traded cases involving identied victims from
July 1, 2002, to June 30, 2014. This provided a
look at longer-term trends over time in the nature
of the production cases submitted to NCMEC.
For the analyses presented in this report, we
looked at 518 actively traded cases, which
involved 933 victims.
The second dataset was modern and
encompassed all cases involving identied child
victims from July 1, 2011, to June 30, 2014.
The dates for this cross-sectional slice were
chosen based on the implementation of a more
comprehensive law enforcement submission
form in 2011. While the historical dataset shows
interesting trends among actively traded cases,
some of the older cases (including their case
documents) were missing information that is
now included in the NCMEC database. Thus, the
modern dataset had the benet of being more
complete as well as larger than the historical
dataset. There were 1,965 cases involving one
victim and one oender, and approximately
7% (N=143) of those cases were actively traded.
There were 633 cases that involved multiple
relationships between victims and oenders,
and approximately 12% (N=75) were actively
traded. The larger amount of cases gave
increased condence in statistically signicant
dierences between subgroups and comparisons,
such as male versus female victims, male
versus female oenders, and familial versus
non-familial relationships.
DATASETS
1) HISTORICAL
• Actively traded cases
involving identied
victims: July 1, 2002
— June 30, 2014
• 518 cases involving
933 identied victims
2) MODERN
• All cases involving
identied victims:
July 1, 2011 — June
30, 2014
• 1,965 cases: one
oender and one victim
• 633 cases: multiple
oenders and/or victims

NCMEC & Thorn Research Report
Historic
Dataset
PAGE
15
Results

NCMEC & Thorn Research Report
16
Results | Historic Dataset
Results
The NCMEC historical and modern datasets are
unique and rich and could be used to address
a number of dierent questions. In this report,
we explore the interaction between victim
characteristics, oender characteristics, actively
traded status, and the content of the material,
with the ultimate goal of developing knowledge
to aid NCMEC and law enforcement in their work.
An overview of the project was presented
in August 2015 at the Dallas Crimes Against
Children Conference (http://www.cacconference.
org). Preliminary results were presented at
the annual meeting of the Association for the
Treatment of Sexual Abusers (www.atsa.com),
which took place in Montreal, Quebec, in
October 2015.
Historic Dataset
In this report, we have focused our analyses on
the modern dataset since it is larger and speaks
to current trends in child sexual abuse material,
but have presented a few timewise trends from
the historical dataset in the tables below.
Table 1 shows the number of actively traded
cases involving at least one identied victim by
year, using the year the case was rst recorded
at NCMEC.
Table 1 | Historic Dataset Distribution by Year
YEAR COUNT OF CASES
2002 and 2003 71
2004 and 2005 75
2006 and 2007 82
2008 and 2009 72
2010 and 2011 110
2012 and 2013 108

NCMEC & Thorn Research Report
17
Results | Historic Dataset
Figure 1 shows the sexual activity of each case across years. Of note, sexual activity is graded for the highest activity
depicted in a series of images. The association is explained by a greater prevalence of images at levels 3 or 4 in
later years.
Figure 1 | Year Distribution by Sexual Activity1
1
Percentages don’t always sum to 100% due to rounding. The sexual activities scale is shown on the following page and in the Appendix as Table 4.

NCMEC & Thorn Research Report
18
Results | Historic Dataset
Table 2 | 4 Point Sexual Activity Scale
Nudity or erotic posing with no sexual activity. (Level 1 on SAP Scale)
• Fully clothed erotica
• Erotica present
• Exposed genitals or anus
• Exposed breasts or chest
• Other sexual explicit content (i.e. fetishes)
• Full nudity
Non-penetrative sexual activity between children, adults and children, or masturbation.
(Level 2+3 on SAP Scale)
• Licking
• Kissing
• Manual stimulation
• Oral copulation
Penetrative sexual activity between adults and children. (Level 4 on SAP Scale)
• Anal or vaginal penetration
• Ejaculation seen
Sadism or Bestiality (Level 5 on SAP Scale)
• Drugged / Sleeping
• Bestiality
• Bondage
• Defecation
• Urination
1
3
4
2

NCMEC & Thorn Research Report
19
Results | Historic Dataset
Figure 2 shows the age category of all identied
victims across the year distribution. Of note,
some cases involve multiple victims, hence
why the number of victims is larger than the
number of actively traded cases. The association
is explained by a shift to relatively more

similar proportions in other years.
Figure 2 | Year by Victim Age
KEY INSIGHT
There is a
relative shift
for 2008-2009
with similar
proportions in
other years.

NCMEC & Thorn Research Report
20
Results | Historic Dataset
Figure 3 shows the gender of all identied victims
across the year distribution. Of note, some cases
involve multiple victims, hence why the number
of victims is larger than the number of actively
traded cases.
There was 

obvious trend because the percentage increased
from the rst period and then substantially
decreased in the last period.
Figure 3 | Year by Victim Gender
KEY

NCMEC & Thorn Research Report
PAGE
21
Results
Modern
Dataset

NCMEC & Thorn Research Report
22
Results | Modern Dataset
Modern Dataset
In the modern dataset, we subdivided the data
into cases that involved only one relationship (one
victim and one oender) and cases that involved
multiple relationships (either multiple victims or
oenders or both).
In the one relationship subgroup, victims were
predominantly white (85%), pubescent (61%)
females (76%) with non-familial relationships
(74%) to white (86%) male (98%) oenders. In
our second perspective, which looked at cases
with multiple victim-oender relationships,
victims were also predominantly pubescent (42%)
female (62%) with non-familial relationships
(59%) to male (82%) oenders. Most content in
the one-to-one series involved level 1 sexual
activity (40%), whereas those series with multiple
relationships involved more level 3 content (30%).
See Table 3 on the following pages.
We have not included oender ethnicity in our
general descriptive table or our analysis because
of the extent of the missing data; this variable
did not meet our 80% threshold. This is most
likely due to the fact that it is hard to judge the
ethnicity of depicted persons as a result of poor
photo quality or when only partial gures (i.e.,
arms, legs) were visible. NCMEC coding was
conservative and so entries were only made if
analysts were condent. The law enforcement
survey also had a low yield for this variable
as well.

NCMEC & Thorn Research Report
23
Results | Modern Dataset
 
RELATIONSHIP BREAKDOWN
Not Family (Closer in Proximity) 37% (728) 59% (374)
Not Family (Unknown To Child)237% (723) -- (--)
Family (Extended Family) 16% (305) 21% (134)
Family (Nuclear Family) 11% (209) -- (--)
Mixed -- (--) 20% (125)
SEXUAL ACTIVITY
140% (764) 28% (173)
220% (376) 21% (129)
326% (490) 30% (183)
414% (271) 20% (125)
64 cases were coded as unclear 23 cases were coded as unclear
VICTIM AGE
Infant/Toddler 6% (112) 3% (22)
Prepubescent 33% (644) 31% (196)
Pubescent 61% (1,209) 42% (264)
Mixed -- 24% (151)
2
Unknown to child includes those some refer to as “strangers,” sex trackers, and missing data (see Appendix - Table 5).
Table 3 | Modern Dataset Characteristics

NCMEC & Thorn Research Report
24
Results | Modern Dataset
 
VICTIM GENDER
Female 76% (1,486) 62% (393)
Male 24% (479) 22% (141)
Mixed -- (--) 16% (99)
OFFENDER GENDER
Female 2% (41) 3% (17)
Male 98% (1,726) 82% (494)
Mixed -- (--) 15% (87)
198 observations missing 35 observations missing
ACTIVELY TRADED STATUS
Not Traded 93% (1,822) 88% (558)
Traded 7% (143) 12% (75)
Table 3 | Modern Dataset Characteristics (continued)

NCMEC & Thorn Research Report
25
Results | Modern Dataset
Modern Dataset: One Relationship
As noted in the sample selection section,
NCMEC records information at both the case and
individual level. Since key variables are coded at
the case level, such as sexual activity, we chose
to analyze the subset of cases with only one
victim-oender relationship separately. These
cases allow us to speak directly to the variables
involved rather than providing grouped values or
generalizations about the case. The tables below
show the distribution of the data (N=1,965). If any
data is missing from the comparison, it is also
noted in the table. Statistically signicant odds
ratios are reported beneath the tables. If the odds
ratio is not presented, it can be assumed the
dierence was not statistically signicant.
Figure 4 | One Relationship - Victim Gender by Actively Traded Status
There was  in actively
traded status based on victim gender.
KEY

NCMEC & Thorn Research Report
26
Results | Modern Dataset
Figure 5 | One Relationship - Victim Age by Actively Traded Status
Cases with a  than either
infant/toddler or pubescent victims, suggesting this was the preferred age category.
Figure 6 | 
There was 
between male and female oenders.
KEY
KEY

NCMEC & Thorn Research Report
27
Results | Modern Dataset
Figure 7 | One Relationship - Sexual Activity Scale by Actively Traded Status
Each one point increase in the sexual activity scale
was associated with a greater likelihood of being
actively traded.
KEY

NCMEC & Thorn Research Report
28
Results | Modern Dataset
Figure 8 | One Relationship - Relationship by Actively Traded Status


non-familial relationship. Additional analysis
revealed the dierence was explained by cases
involving nuclear family members being the
most likely to be actively traded, and cases
involving a person who is unknown to the victim
or with whom the victim is unacquainted to be
the least likely. Relationship coding is listed in
Table 5 (Appendix).
3
Unknown to child includes those some refer to as “strangers,” sex trackers, and missing data (see Appendix - Table 5).



NCMEC & Thorn Research Report
29
Results | Modern Dataset
Figure 9 | 
Figure 10 | One Relationship – Victim Gender by Relationship
Though male oenders far outnumbered
female oenders, cases involving female

involve a familial relationship.
Cases involving female children

relationship with the oender.
KEY
KEY

NCMEC & Thorn Research Report
30
Results | Modern Dataset
Figure 11 | One Relationship – Victim Age by Relationship

less likely to involve a familial relationship
(14% compared to 59% for infants/toddlers and
43% for prepubescent victims).
KEY

NCMEC & Thorn Research Report
31
Results | Modern Dataset
Figure 12 | One Relationship – Sexual Activity Scale by Relationship
Cases involving the most egregious content
(level 4) were much more likely to involve a
familial relationship between oender
and victim.
KEY

NCMEC & Thorn Research Report
32
Results | Modern Dataset

The ndings presented below included cases
involving multiple oenders and/or multiple
victims, unlike the one-to-one cases just
described. To capture this, we added a “mixed”
category: For example, if a case involved only
female victims it would be marked “female only,”
if it involved only male victims it would be marked
“male only,” and if the case included both male
and female victims it would be marked “mixed.”
This has also been applied to victim age, oender
gender, and relationships. The gures below show
the distribution of the data (N=633). If any data
are missing from the comparison, it is also noted
in the gure.
Figure 13 | Multiple Relationships – Victim Gender by Actively Traded Status
Cases with both male and female victims
.
KEY

NCMEC & Thorn Research Report
33
Results | Modern Dataset
KEY INSIGHT
Infant/toddler
only content was
the most likely
to be actively
traded.
Unlike the one-to-one analysis, where cases
involving prepubescent victims were the most
likely to be actively traded, infant/toddler


and/or victims.
One possible explanation is that multiple
relationship cases in which images were actively
traded were more likely to involve a family
member (see gure 17) than one-to-one cases
and family members have more access to
infants or toddlers.
Figure 14 | Multiple Relationships — Victim Age by Actively Traded Status

NCMEC & Thorn Research Report
34
Results | Modern Dataset
Figure 15 | Multiple Relationships – Sexual Activity Scale by Actively
Traded Status

KEY

NCMEC & Thorn Research Report
35
Results | Modern Dataset
Figure 16 | 
Traded Status
Cases involving both male and female oenders were more likely to involve actively traded content.
Figure 17 | Multiple Relationships – Relationships by Actively Traded Status
Again, cases involving  were more likely to be actively traded.
KEY INSIGHT
Cases more
likely to be
actively traded:
• male and
female
oenders
• familial only
relationships

NCMEC & Thorn Research Report
36
Results | Modern Dataset
Figure 18 | 
Figure 19 | Multiple Relationships – Victim Gender by Relationship
KEY
KEY

NCMEC & Thorn Research Report
37
Results | Modern Dataset
KEY INSIGHT
Data shows
there is a relative
association
between
pubescent
victims and
non-familial
oenders.
Figure 20 | Multiple Relationships – Victim Age by Relationship
The most notable result here is the relative

, paralleling the nding
reported in Figure 11 (one relationship).

NCMEC & Thorn Research Report
38
Results | Modern Dataset
Figure 21 | Multiple Relationships – Sexual Activity by Relationship
There was  in the sexual activity scale when
comparing familial only to non-familial only, familial only to mixed, or non-familial only to mixed.
KEY

NCMEC & Thorn Research Report
39
Results | Modern Dataset
Figure 22 | 
Most victims in all age groups were victimized by male oenders.
However, cases involving infant/toddler or prepubescent victims

.
KEY

NCMEC & Thorn Research Report
40
Results | Modern Dataset
Figure 23 | 
There was no obvious trend in the relationship between oender and victim
gender. It was still the case that 
.
KEY

NCMEC & Thorn Research Report
41
Results | Modern Dataset
Figure 24 | 
There was no obvious trend in terms of sexual activity level relative to oender gender.
KEY

NCMEC & Thorn Research ReportNCMEC & Thorn Research Report
PAGE
42
Conclusions
In the following, we rst discuss the results from the historical dataset
and then from the modern dataset, because the data were organized
and examined dierently. We then conclude with implications for policy
and practice regarding law enforcement.
Historical Dataset
The historical dataset suggests there has
indeed been a shift toward more egregious

at levels 3 or 4 on the sexual activity scale in
later years. This is dierent from other analyses
of child images, such as those reported by Wolak
et al. (2011, 2012), but results are not directly
comparable because we focused our analysis
on cases involving adult producers and actively
traded content.
The NCMEC data indicated variation but no
obvious trend in the proportion of boy victims
over time. Wolak, Finkelhor, and Mitchell (2011)
reported a small decrease in boy victims between
2000 to 2006 (20% to 13%). With the INTERPOL
database analysis, gender of the children varied
over the years, with two-thirds (63%) involving
girls. The only exception was in 2013, when boys
were in the majority (Quayle, E., Jonsson, L.,
Cooper, K., Trayner, J. and Svedin, C-G., 2018).
The Internet Watch Foundation (2013) data
indicated 26% of identied images were boys
in 2011, going down to 11% over the following
two years.
Modern Dataset
Actively traded cases were associated with
having prepubescent victims. Actively traded

egregious content in terms of sexual activity,

particularly nuclear family members. A familial
KEY INSIGHT
Most notable
historical nding:
trend toward
more egregious
sexual content
over time.

NCMEC & Thorn Research Report
43
Conclusions |
oender-victim relationship was relevant in a
number of other ways besides being more likely
to be actively traded. Cases involving familial


content, and younger victims.
Male oenders were much more common than
female oenders in this dataset, similar to
previous research on online oending samples
(see Babchishin, Hanson, & VanZuylen, 2015).
Nonetheless, the involvement of female




related victims, younger victims, and to be
actively traded.
Integrating these dierent ndings, the
pattern of associations we observed indicates
male oenders are the most common, as
demonstrated in multiple prior studies. These
male oenders are more likely to target girls who
are unrelated to them, especially pubescent girls.
However, there were also cases involving both
male and female oenders. Dierent associations
suggest these cases involve mostly unrelated
male oenders co-oending with female
oenders who were more likely to be related
to victims, especially younger victims. These
co-oending cases, denoted by mixed gender
oenders, are more likely to have both boy
and girl victims.
Though we are aware of cases where unrelated
male oenders contact women with custody of
children in order to produce child pornography
content that may then be distributed to others,
this is largely an unexplored phenomenon in the
scientic literature. These cases suggest female
oenders are not explained by current models
of online oending developed using research
with male oenders. Case studies of female
producers of child pornography suggest their
criminal conduct is not related to pedophilia (Prat,
Bertsch, Chudzik & Réveillère, 2014). Prat et al.
hypothesized that producing images allowed
women perpetrators to meet the desires or needs
of their romantic partners, which was important
enough to the women to overcome any inhibitions
against exploiting children in their care.
This pattern of results can be interpreted in light
of how we understand access and opportunity
play a role in child sexual exploitation and abuse.
Through social media and other online channels,
men can have contact with pubescent children,
particularly girls (Whittle, Hamilton-Giachritsis,
Beech & Collings, 2013; Quayle, Allegro, Hutton,
Sheath & Lööf, 2014; Winters, Kaylor & Jeglic,
2017). Some men who are interested in younger
children, however, may contact and eventually
conspire with women who have contact with
younger children.
KEY INSIGHT
Cases involving
female oenders
were more likely
to also involve:
• male oenders,
• related victims,
• younger victims,
• and to be actively
traded

NCMEC & Thorn Research Report
44
Conclusions |

Given limited law enforcement resources relative
to the number of tips, reported contacts, and
responses to personas, decisions have to be
made about how to allocate time and eort.
Decision-making algorithms would be helpful
in this regard, and was the rationale for the
development of the Child Pornography Oender
Risk Tool (CPORT: Seto & Eke, 2015). However,
producers of child exploitation content were a
minority of the sample in the development of the
CPORT, and there may be important dierences
between producers and possessors of this content.
Knowing more about those engaging in
production of child exploitation images can serve
to improve the efficiency of law enforcement
operations. Knowing what type of images are most
likely to be produced can help law enforcement
plan their investigations accordingly. Using a
large dataset, this study has replicated and
extended previous research.
A signicant nding is that prepubescent children
are sought more than other age groups from
this study’s sample, and the nding that victim
cases involving young children are more likely
to involve at least one perpetrator related to the
child and both male and female perpetrators.

younger children and/or more egregious
content are more likely to involve familial
. This information could be useful to law
enforcement during victim identication eorts
and investigations, perhaps keeping in mind that
while looking for very young victims, the oender
is relatively likely a family member.
Another nding relevant for law enforcement is
not all images are traded with equal frequency.



be actively traded.
KEY INSIGHT
Images depicting
younger children
and/or more
egregious
content are
more likely to
involve familial
oenders and
were more
likely to be
actively traded.

NCMEC & Thorn Research Report
45
Conclusions |
References
Babchishin, K. M., Hanson, R. K., & VanZuylen, H.
(2015). Online child pornography oenders are
dierent: A meta-analysis of the characteristics
of online and oine sex oenders against
children. Archives of Sexual Behavior, 44, 45-66.
Burgess, A. W., Carretta, C. M., & Burgess, A. G.
(2012). Patterns of federal Internet oenders: A
pilot study. Journal of Forensic Nursing, 8, 112-121.
Burgess, A. W., Mahoney, M., Visk, J., &
Morgenbesser, L. I. (2008). Cyber child sexual
exploitation. Journal of Psychosocial Nursing &
Mental Health Services, 46, 38-45.
DeHart, D., Dwyer, G., Seto, M. C., Moran, R.,
Letourneau, E., & Schwarz-Watts, D. (2017).
Internet sexual solicitation of children: A
proposed typology of oenders based on their
chats, E-mails, and social network posts. Journal
of Sexual Aggression, 23, 77-89.
DeLong, R. L. (2012). Developing a typology for
understanding internet sexual oenders. Doctoral
dissertation, Walden University, Minneapolis, MN.
Dwyer, R. G., Seto, M. C., DeHart, D., Letourneau,
E., McKee, T., & Moran R. (2016). Protecting
children online: Using research-based
algorithms to prioritize law enforcement Internet
investigations (Research Report). Washington,
DC: U.S. Department of Justice.
International Center for Missing & Exploited
Children. (2016). Child Pornography: Model
Legislation & Global Review, 8th Edition.
Available at: http://www.icmec.org/wp-content/
uploads/2016/02/Child-Pornography-Model-
Law-8th-Ed-Final-linked.pdf
Internet Watch Foundation (2013). Annual Report.
Available online from https://www.iwf.org.uk/
sites/default/les/reports/2016-03/ar_nal_
web_low%20res.pdf.
Internet Watch Foundation (2016). Annual
Report. Available online from https://www.iwf.
org.uk/sites/default/les/reports/2017-04/iwf_
report_2016.pdf.
Long, M., Alison, L., Tejeiro, R., Hendricks, E., &
Giles, S. (2016). KIRAT. Psychology, Public Policy,
and Law, 22, 12-21.
Prat, S., Bertsch, I., Chudzik, L., & Réveillère, C.
(2014). Women convicted of a sexual oence,
including child pornography production: Two case
reports. Journal of Forensic and Legal Medicine,
23, 22.
Quayle, Allegro, Hutton, Sheath, & Lööf. (2014).
Rapid skill acquisition and online sexual grooming
of children. Computers in Human Behavior, 39,
368-375.

NCMEC & Thorn Research Report
46
Conclusions |
Quayle, E., & Jones, T. (2011). Sexualized images
of children on the Internet. Sexual Abuse: A
Journal of Research and Treatment, 23, 7-21.
Quayle, E., Jonsson, L., Cooper, K., Trayner, J.
and Svedin, C-G. (2018). Children identied in
sexual images - who are they? Self and non-self
taken images in the International Child Sexual
Exploitation Image Database 2006-2015. Child
Abuse Review.DOI:10.1002/car.2507.
Seto, M. C. (2013). Internet sex oenders.
Washington, DC: American Psychological
Association.
Seto, M.C., & Eke, A.W. (2015). Predicting
recidivism among adult male child pornography
oenders: Development of the Child Pornography
Oender Risk Tool (CPORT). Law and Human
Behavior, 39, 416-429.
Seto, M. C., & Eke, A. W. (in press). Correlates of
admitted sexual interest in children among child
pornography oenders. Law and Human Behavior.
Seto, M. C., Hanson, R. K., & Babchishin, K. M.
(2011). Contact sexual oending by men arrested
for child pornography oenses. Sexual Abuse: A
Journal of Research and Treatment, 23, 124-145.
Seto, M. C., Wood, J. M., Babchishin, K. M., &
Flynn, S. (2012). Online solicitation oenders are
dierent from child pornography oenders and
lower risk contact sexual oenders. Law and
Human Behavior, 36, 320-330.
Shelton, J., Eakin, J., Hoer, T., Muirhead,
Y., & Owens, J. (2016). Online child sexual
exploitation: An investigative analysis of
oender characteristics and oending behavior.
Aggression and Violent Behavior, 30, 15-23.
Snyder, H. N. (2000, July). Sexual assault of
young children as reported to law enforcement:
Victim, incident, and oender characteristics
(Report NCJ 182990). Bureau of Justice
Statistics, U. S. Department of Justice, Oce of
Justice Programs. Retrieved from https://www.
bjs.gov/content/pub/pdf/saycrle.pdf.
Taylor, M., & Quayle, E. (2003). Child pornography:
An Internet crime. New York: Brunner-Routledge.
Whittle, Hamilton-Giachritsis, Beech, & Collings.
(2013). A review of young people’s vulnerabilities
to online grooming. Aggression and Violent
Behavior, 18, 135-146.
Winters, G., Kaylor, L., & Jeglic, E. (2017). Sexual
oenders contacting children online: An
examination of transcripts of sexual grooming.
Journal of Sexual Aggression, 23, 62-76.
Wolak, J., Finkelhor, D., & Mitchell, K. J. (2012).
Trends in arrests for child pornography
production: The Third National Juvenile Online
Victimization Study (NJOV‐3). Retrieved from
https://scholars.unh.edu/ccrc/47/

NCMEC & Thorn Research Report
47
Conclusions |
Appendix
Table 4 | 4 Point Sexual Activity Scale
Nudity or erotic posing with no sexual activity. (Level 1 on SAP Scale)
• Fully clothed erotica
• Erotica present
• Exposed genitals or anus
• Exposed breasts or chest
• Other sexual explicit content (i.e. fetishes)
• Full nudity
Non-penetrative sexual activity between children, adults and children, or masturbation.
(Level 2+3 on SAP Scale)
• Licking
• Kissing
• Manual stimulation
• Oral copulation
Penetrative sexual activity between adults and children. (Level 4 on SAP Scale)
• Anal or vaginal penetration
• Ejaculation seen
Sadism or Bestiality (Level 5 on SAP Scale)
• Drugged / Sleeping
• Bestiality
• Bondage
• Defecation
• Urination
1
3
4
2

NCMEC & Thorn Research Report
48
Conclusions |
Table 5 | Relationship Scale
FAMILIAL Nuclear Family • Mother
• Father
• Brother
• Sister
• Half Sibling
Extended Family • Step-Father
• Step-Mother
• Aunt
• Uncle
• Grandfather
• Step-Grandparent
• Brother-in-Law
• Cousin
• Legal Guardian
• Other Relative
 Close Proximity • Babysitter/mentor/coach/teacher
• Boyfriend
• Guardian’s Partner
• Neighbor/Family Friend
Unknown to Victim • No Relationship
• Online Enticement/Self & Perp Produced
• Photographer
• Sex Tracker
• Stranger
• Unknown

Production and Active Trading of Child Sexual
Exploitation Images Depicting Identied Victims
MARCH 2018