Hotline Actions
Report Processing And Access
Once a report is logged in the Hotline.ie database, an Analyst will try to access the content that the reporter suspects to be illegal. If it can be accessed the Analyst will then try to find and assess the content reported. Unfortunately this is often less than easy due to a combination of factors. First is the accuracy with which the location has been reported. Sometimes, even when a definite location has been given, it can contain a vast amount of content through which the Analyst must trawl to find what appears to be the content of concern. The dynamic nature of the Internet and especially of criminal operations can mean that in a short time the information has been changed or, in many cases, whole websites have been moved.
Of the 2,117 reports processed during 2009 there were 542 reports where the Hotline could not enter into the full content assessment process. Of great concern were the 132 of these reports where insufficient detail was given to allow the Content Analysts begin to try and find the content that prompted the reporter to make the complaint. There were also 97 reports comprisng of issues or queries on matters which are outside the Hotline’s remit. Such reports can take up a considerable amount of analysts’s time as, where possible, an explanatory response was given or the reporter was redirected to the correct place where a particular complaint should be addressed. Click on the panel on the right titled, “Non-processable reports” for more details on such reports.
The were also many cases where the access process to the reported content failed. This can be for a variety of reasons. Click on the panel on the right titled, “Access Failed” for more details on such reports.
Assessment
Of the reports which entered the assessment phase 284 were found to be probably illegal under Irish law. Of these 149 were reports that were derived from the external reports. This means that of the 1,968 external reports (i.e. 2,117 minus 149) received only 135 were themselves directly assessed as probably illegal. However, it was many of these that led Analysts through links appearing on the reported content to illegal content at other locations. These are usually commercial child pornography sites run by criminal organisations. Often one illegal site can yield multiple derived reports and in many cases it is obvious, due to the page style, text and purchasing domain, that these are run by the same criminal group.
Non-illegal Content as Assessed by Hotline.ie
...........................
In all the remaining cases where the content could be assessed the Analysts determined that the material seen, at the time of processing the report, was not illegal. As can be seen from the graph (click on thumbnail image above left to view) of these “non-illegal” assessments, many of the reports suspected to be child pornography actually proved to be adult pornography.
Categories of Unique Illegal Reports
...........................
Of the 284 reports referring to content that was assessed as probably illegal there were 9 duplicate reports, leaving 275 unique illegal reports. The breakdown of these is shown in the table that may be viewed by clicking on the thumbnail miniture to the left.
Tracing
Having assessed a report as probably illegal, the Analyst then uses a suite of tools and services to trace the apparent location of the content. Material assessed as “not illegal” is not traced. In the case of a website, a trace includes finding its IP address, identifying the hosting ISP and establishing the applicable jurisdiction. For e-mail it consists of identifying the IP address which was allocated to the sender of the e-mail, the ISP who provided that account connection and the applicable jurisdiction. Similarly for peer-to-peer file-sharing and other services the objective is to trace the ISP who provided the account connection.
Countries Where CP Appeared to be Located in 2009
...........................
In 2009 the results of tracing the 284 illegal reports are shown in the graph on the left. (Click on the graph to enlarge). Apparently duplicate reports (i.e. the having the same URL) when received some time apart are traced again because it is possible the content has been moved to a different IP address. Only where both the URL and the IP are the same is the report accepted as being a duplicate.
Unfortunately tracing is not always successful and in some cases the Analysts can not always tell with any degree of certainty which jurisdiction was the source. Also some ISPs’ networks straddle borders so the best estimate is used. This is why Hotline.ie always uses the term “apparent location”.
Forwarding
The next stage in the process is to make a "forwarding report" to notify authorities in the apparent location. Hotline.ie tries to avoid multiple reports being sent about illegal content. Therefore only unique illegal reports are forwarded (i.e. duplicates have been removed). As mentioned previously, in 2009 there were 275 "unique illegal reports" which could potentially be forwarded.
Where an INHOPE hotline exists in the country to which the apparent location was traced, the report is forwarded to that hotline. If there is no INHOPE hotline in the jurisdiction, it is forwarded to An Garda Síochána so they can send it through police channels to Interpol, who in turn passes this to police in the jurisdiction of the apparent location. For more information on what is sent in a forwarded report, click on the panel titled, "Forwarded Details" on the right.
Forwarding Destinations Grouped By Type
...........................
The pie chart to the left (click thumbnail to enlarge) shows where reports were forwarded by category of recipient. It also shows where in some cases the source jurisdiction could not be identified (Report referral failure). In many cases where illegal content is not child pornography, (for example, phishing sites, financial scams, etc.) reports are forwarded directly to ISPs, site owners (web 2.0 services) or other appropriate agencies. It is significant that as more Hotlines have been established the proportion of reports having to be sent via Law Enforcement has dropped from 37% of all reports in 2007 to 13% in 2009. The proportion of reports sent via INHOPE hotlines in that two year period has increased from 57% in 2007 to a massive 83% in 2009. This shows how development of the INHOPE network can save considerable amounts of police time, not just in An Garda Síochána but also at Interpol, as in the absence of an INHOPE Hotline in a recipient country they would have the burden of routing these reports to the appropriate jurisdiction.
