Missing the mark? Identifying child sexual abuse material forum structure and key-players based on public replies and private messaging networks

Darknet forums serve as virtual convergence points for offenders, facilitating the exchange of illegal goods, information, and social interaction. A significant portion of these forums focuses on the sharing of child sexual abuse material (CSAM), posing a substantial challenge to law enforcement due to the large number of users involved. To effectively allocate limited resources, law enforcement agencies often prioritize investigations based on identifying key players within these online communities. Traditionally, this identification relies on social network analysis of public forum communications. However, many forums also allow for private messaging, raising concerns about potential biases in key player identification if only one communication mode is considered. This research explores the extent to which relying solely on public communications might lead to inaccuracies in identifying key players in CSAM darknet forums by examining both public and private communication networks.

Prior research on darknet criminal marketplaces often identifies key players based on their centrality within the public communication network. Studies have shown that a small subset of forum members actively participates in public discussions, with a few highly communicative members disproportionately influencing the conversation. Centrality in these networks is linked to various risk indicators, such as higher involvement in discussions of cybercriminal activities. In the context of CSAM forums, previous research has either focused on the structural properties of the websites themselves or on the relationships between users within a specific forum, again primarily analyzing public communications to identify key members. However, the role of private messaging in these networks remains largely unexplored. Existing literature highlights the potential discrepancies between public and private communications and suggests that neglecting private messaging could lead to inaccurate key player identification and biased law enforcement prioritization.

This study utilizes data from two large-scale darknet CSAM forums obtained from law enforcement agencies. The data comprises digital trace data on both public replies and private messages. Two distinct communication networks were constructed for each forum: one representing public replies and the other representing private messages. A 'flattened' network combining both layers was also created. The networks were analyzed using social network analysis techniques. Measures of centrality (in-degree and out-degree) were calculated for each layer. To assess the similarity between layers and the robustness of centrality measures, Spearman rank correlations and centrality robustness measures (Top 1, Top 3, Top 10%, overlap, and Szymkiewicz-Simpson coefficient) were employed. The analyses were performed in R using the igraph package. Descriptive statistics, including network order, size, density, number of components, and various centrality measures, were calculated for each layer and compared. The study also examined the distribution of nodes and edges across layers and investigated the relationship between communication activity and the sharing of CSAM (proxied by the presence of hyperlinks in messages). Network plots visualized the interactions of the 100 users with the highest total degrees in the flattened networks, highlighting the roles held by these users within the forums.

The study found that only a small percentage of registered users actively participated in communication on both forums. The distribution of communication activity was heavily skewed, indicating the presence of highly central users (hubs). The overlap between users active in public and private communications was limited, varying between the two forums. In one forum, a significant portion of members active in private messaging did not contribute to public discussions. The analysis of centrality robustness revealed that the most central users identified in the public network often overlapped with those in the flattened network, implying that relying on public communications alone may not significantly bias the identification of key players, at least in terms of overall centrality. However, there were also cases of highly central users in the private communication layer who didn't show up as central players in the public layer, highlighting that there might be separate communities active in the private messaging networks. The distribution of degrees (in-degree and out-degree) varied significantly between forums, suggesting diverse communication dynamics within different CSAM forums. In one forum, users with special roles were more strongly interconnected and central in the network than those without such roles; this was less obvious in the other forum studied. Analyzing hyperlinks as proxies for CSAM sharing revealed only moderate overlap between the most central users and the users sharing the most CSAM.

The findings suggest that while private messaging networks exist and exhibit different characteristics compared to public networks, law enforcement's current practice of prioritizing users based on public communication activity may not be grossly inaccurate. The high similarity in key player identification between the public and flattened networks supports this conclusion. However, the existence of users central only to the private messaging network warrants further investigation. The potential of private messaging as a separate channel for exchanging particularly harmful CSAM or engaging in different types of coordinated activities should be further examined. Future research should also investigate the content of both public and private messages to better understand the role of different communication modes and their relationship to the distribution of harmful content.

This study provides a valuable insight into the structure and communication patterns within darknet CSAM forums. While public communication is a reliable indicator of key players, focusing only on public data may overlook important individuals active primarily within the private messaging network. Future research needs to explore the content of private messages and the characteristics of users who are primarily active in private spaces. Investigating cross-forum activity and integrating other sources of information could further enhance the identification of key players and facilitate more effective law enforcement strategies.

Several limitations of this study should be acknowledged. The anonymity of darknet users limits the identification of individuals, and the possibility of individuals operating under multiple user handles might affect the accuracy of centrality measures. The analysis is confined to single forums and may overlook individuals central to broader cross-forum networks. Data limitations resulting from deleted posts introduce uncertainty in the analysis. The small sample size (two forums) limits the generalizability of the findings to other CSAM darknet forums.