Organizing child pornography evidence

When investigators examine a computer hard drive for child pornography, it can have more than 100,000 images. Tens of thousands of these images will be innocuous. They likely will include lines, boxes, shapes, buttons and Microsoft icons. The evidence itself, images of children — and even infants — being abused, will be horrific. Some of these appalling images investigators will have seen from previous cases, while others will be unique.

LACE (Law Enforcement Against Child Exploitation) software, in the final stages of development from BlueBear Inc. located in Gatineau, Quebec, Canada, helps investigators sort and categorize images found on seized computer hard drives in child exploitation cases. First used in 2006 in an alpha version by the York Regional Police, located in Ontario, Canada, LACE also helps agencies avoid duplicating efforts by enabling the sharing of image categorizations.

BlueBear was founded in 2004 and began with a facial recognition and mugshot identification product called IDLE (Integrated Digital Law Enforcement). York Regional Police worked with BlueBear to pilot the facial recognition technology. That's when Det. Constable Phil Shrewsbury-Gee of the York Regional Police became acquainted with BlueBear. At the time, Shrewsbury-Gee, working in computer forensics, had the onerous task of looking at each individual image when examining computers for child pornography evidence. After getting more and more child pornography cases, he needed help and turned to BlueBear. Shrewsbury-Gee thought software could save him and other investigators time. He asked BlueBear if an image matching software program could be created, and BlueBear accepted the challenge.

A couple of months later, Shrewsbury-Gee was pleasantly surprised. The software he had requested was more effective than he had anticipated. For envisioning LACE and developing user requirements to save time and labor, Shrewsbury-Gee was presented with an award in 2006 from the Toronto chapter of the American Society for Industrial Security.

Today Shrewsbury-Gee and another officer in the Technological Crime Unit use LACE at the York Regional Police weekly, and Shrewsbury-Gee reports a 40 to 50 percent reduction in the need for image preprocessing. York Regional Police has six cases in the database, including one case with more than 368,000 images.

The first software program Shrewsbury-Gee had used to compare images in child pornography cases compared the hash value of files (a series of numbers used to authenticate electronic file transmission). The challenge associated with looking at hash values is that any change results in a hash value change. Shrewsbury-Gee was frustrated, for example, that one image saved as a JPEG, TIFF, GIF and bitmap would be identified as four unique images.

Using the hash value to compare images reduces an investigator's workload by less than half, estimates Jeff Nash, BlueBear's director of technical sales and customer support. Image Marks (a string of numbers) used in LACE further reduce an investigator's workload by finding more matches to previously categorized images. Image Marks are similar to file hash but more tolerant of variations. If little changes are made to an image, such as adding a watermark, cropping, rotating or changing file format, the subsequent versions still will be identified as the same image.

LACE emulates the ability of humans to rationalize the similarities between pictures while using computer power to manage massive mounts of child pornography, Shrewsbury-Gee says.

Only the images that the system has not seen before must be categorized manually. This was especially true when the first case was entered into the system. Every image had to be categorized. With the second case, about half of the images were already categorized. Not only will LACE recognize that it's already seen innocuous images, it also will recognize many of the pornographic images because many of the popular images are frequently shared.