Hotline Actions
Report Processing And Access
Once a report is logged in the Hotline.ie database, an Analyst will try to access the content that the reporter suspects to be illegal. If it can be accessed the Analyst will then try to find and assess the content reported. Unfortunately this is often less than easy due to a combination of factors. First is the accuracy with which the location has been reported. Sometimes, even when a definite location has been given, it can contain a vast amount of content through which the Analyst must trawl to find what appears to be the content of concern. The dynamic nature of the Internet and especially of criminal operations can mean that in a short time the information has been changed or, in many cases, whole websites have been moved.
Of the 1,966 reports processed during 2008, 40 were queries and 98 were outside of the Hotline.ie remit. These 138 reports still use a considerable amount of Analysts' time as. Where possible, an explanatory response is given to the query or, the reporter is redirected to the correct place that might deal with their complaint.
Click on the panel on the right titled, “Non-processable reports” for more details on such reports.
The remaining 1,828 reports entered the standard Hotline.ie report processing procedure. Of these, 1,275 could be both accessed and the content assessed. The remaining 553 were cases where access failed.
Click on the panel on the right titled, “Access Failed” for more details on such reports.
Assessment
Non-illegal Content as Assessed by Hotline.ie
...........................
Of the 1,275 reports which entered the assessment phase 536 were found to be probably illegal under Irish law and 739 were found to contain content that was not illegal. As can be seen from the graph of these “non-illegal” assessments, many of the reports suspected to be child pornography actually proved to be adult pornography.
Of the 536 reports referring to content that was assessed as probably illegal there were 39 duplicate reports, leaving 497 unique illegal reports. The breakdown of these is shown below.
Tracing
Having assessed a report as probably illegal, the Analyst then uses a suite of tools and services to trace the apparent location of the content. Material assessed as “not illegal” is not traced. In the case of a website, a trace includes the IP address of the website, the ISP where the website is hosted, and the applicable jurisdiction. For e-mail it consists of identifying the IP address which was allocated to the sender of the e-mail, the ISP who provided that account connection and the applicable jurisdiction. Similarly for peer-to-peer file-sharing and other services the objective is to trace the ISP who provided the account connection.
Countries Where CP Appeared to be Located in 2008
...........................
In 2008 the results of tracing the 536 illegal reports are shown in the graph on the left. (Click on the graph to enlarge).
Apparently duplicate reports (i.e. the having the same URL) when received some time apart are traced again because it is possible the content has been moved to a different IP address. Only where both the URL and the IP are the same is the report accepted as being a duplicate.
Unfortunately tracing is not always successful and in some cases the Analysts can not always tell with any degree of certainty which jurisdiction was the source. Also some ISPs’ networks straddle borders so the best estimate is used. This is why the Hotline.ie always uses the term “apparent location”.
Forwarding
The next stage in the process is to make a "forwarding report" to notify authorities in the apparent location. Hotline.ie tries to avoid multiple reports being sent about illegal content. Therefore only unique illegal reports are forwarded (i.e. duplicates have been removed).
Forwarding contd.
Where an INHOPE hotline exists in the country where the apparent location was traced to, the report is forwarded to that hotline. If there is no INHOPE hotline in the jurisdiction, it is forwarded to An Garda Síochána so they can send it through police channels to Interpol, who in turn passes this to police in the jurisdiction of the apparent location. For more information on what is sent in a forwarded report, click on the panel titled, "Forwarded Details" on the right.
The pie chart below shows to whom forwarded reports were sent and cases where the jurisdiction to which it should be sent could not be identified (Report referral failure). In many cases where illegal content is not child pornography, reports are forwarded directly to ISPs, site owners (web 2.0 services) and other appropriate agencies.
Forwarding contd
The added value of the presence of an INHOPE hotline in the jurisdiction of the apparent location, is that forwarding and follow-up action is extremely rapid. The receiving hotline will also check that the reported content is illegal under the legislation of that State. The hotline being placed in the country is in a better position to verify that the target illegal content is actually hosted or being distributed from their jurisdiction. Assuming the receiving hotline can verify the report details, action can be very swift, as that hotline has a direct point of contact into their police and, depending on the national procedures, to the ISPs. In many cases illegal content reported in Ireland and traced to another INHOPE country can be taken down within less than a day.
Summary of Actions Taken on Illegal Content
...........................
The graph contained in the thumbnail link on the left, shows reports forwarded to INHOPE Hotlines, those reported to An Garda Síochána, and 44 which could not be successfully traced. In many cases where illegal content is not child pornography, reports are forwarded directly to ISPs, site owners (web 2.0 services) and other agencies.
