Organizing child pornography evidence

When investigators examine a computer hard drive for child pornography, it can have more than 100,000 images. Tens of thousands of these images will be innocuous. They likely will include lines, boxes, shapes, buttons and Microsoft icons. The evidence itself, images of children — and even infants — being abused, will be horrific. Some of these appalling images investigators will have seen from previous cases, while others will be unique.

LACE (Law Enforcement Against Child Exploitation) software, in the final stages of development from BlueBear Inc. located in Gatineau, Quebec, Canada, helps investigators sort and categorize images found on seized computer hard drives in child exploitation cases. First used in 2006 in an alpha version by the York Regional Police, located in Ontario, Canada, LACE also helps agencies avoid duplicating efforts by enabling the sharing of image categorizations.

Image matching

BlueBear was founded in 2004 and began with a facial recognition and mugshot identification product called IDLE (Integrated Digital Law Enforcement). York Regional Police worked with BlueBear to pilot the facial recognition technology. That's when Det. Constable Phil Shrewsbury-Gee of the York Regional Police became acquainted with BlueBear. At the time, Shrewsbury-Gee, working in computer forensics, had the onerous task of looking at each individual image when examining computers for child pornography evidence. After getting more and more child pornography cases, he needed help and turned to BlueBear. Shrewsbury-Gee thought software could save him and other investigators time. He asked BlueBear if an image matching software program could be created, and BlueBear accepted the challenge.

A couple of months later, Shrewsbury-Gee was pleasantly surprised. The software he had requested was more effective than he had anticipated. For envisioning LACE and developing user requirements to save time and labor, Shrewsbury-Gee was presented with an award in 2006 from the Toronto chapter of the American Society for Industrial Security.

Today Shrewsbury-Gee and another officer in the Technological Crime Unit use LACE at the York Regional Police weekly, and Shrewsbury-Gee reports a 40 to 50 percent reduction in the need for image preprocessing. York Regional Police has six cases in the database, including one case with more than 368,000 images.

The first software program Shrewsbury-Gee had used to compare images in child pornography cases compared the hash value of files (a series of numbers used to authenticate electronic file transmission). The challenge associated with looking at hash values is that any change results in a hash value change. Shrewsbury-Gee was frustrated, for example, that one image saved as a JPEG, TIFF, GIF and bitmap would be identified as four unique images.

Using the hash value to compare images reduces an investigator's workload by less than half, estimates Jeff Nash, BlueBear's director of technical sales and customer support. Image Marks (a string of numbers) used in LACE further reduce an investigator's workload by finding more matches to previously categorized images. Image Marks are similar to file hash but more tolerant of variations. If little changes are made to an image, such as adding a watermark, cropping, rotating or changing file format, the subsequent versions still will be identified as the same image.

LACE emulates the ability of humans to rationalize the similarities between pictures while using computer power to manage massive mounts of child pornography, Shrewsbury-Gee says.

Only the images that the system has not seen before must be categorized manually. This was especially true when the first case was entered into the system. Every image had to be categorized. With the second case, about half of the images were already categorized. Not only will LACE recognize that it's already seen innocuous images, it also will recognize many of the pornographic images because many of the popular images are frequently shared.

Every computer hard drive will have some unique images — maybe family photographs or pornographic pictures taken by a suspect that haven't yet been shared — that need to be manually categorized.

The more previously categorized images there are in the known image database, the fewer images will need to be manually categorized. As a result, a lot of time can be saved. Instead of spending months categorizing images, Nash says an investigator can be done in days.

Ready for court

Police who use LACE spend less time but do a better job and bring more cases to trial with appreciably less effort, Nash says.

Investigators might pick out a sampling of the most disturbing images for presentation as evidence in court. They might tell a judge, for example, that 100,000 images were found on the computer — 20 percent were Type 1, horrible child pornography — and then show some representative images. When images were not categorized and representative images were presented in court, the defense argued the image sample was not representative of the overall hard drive content, Nash says.

"The argument was the representative images were downloaded by accident," he says. "When the entire hard drive is categorized, that argument disappears."

LACE does not definitively say that an image is evidence. While the program was designed to reduce workloads, investigators still must be responsible for identifying the evidence to be introduced in court.

Info sharing

The work and effort of all agencies using LACE is collected and organized to facilitate significantly increased efficiency in prosecuting perpetrators, Nash says. Information regarding the categorization of the image files is shared among agencies using a database system. The shared information does not include the actual images — only numeric representations of the images used for rapid searching and matching.

Nash notes more agencies are prepared to use LACE as soon as the current field trial round is complete. The more police organizations use LACE, the more images will be categorized, and the more Image Marks will be shared by the participating agencies, Nash says.

"Everyone benefits from everyone else's efforts," he says.

Here's how it works:

Individual agencies analyze their own hard drives and maintain their own databases of images. After doing a forensic audit of a hard drive, the results are inputted into LACE. File hash and Image Marks are automatically created for all unknown images. If a hash match is found, then that image is not searched using an Image Mark (to save time). Images that have matches (hash or Image Marks) will be automatically categorized. Remaining unmatched, unknown images need to be manually categorized.

New hash and Image Marks entered by individual agencies are periodically synchronized with a centralized, derived database, and updates are made available to all participating law enforcement agencies. The derived database contains no images, just file hash and Image Marks. It is not possible to regenerate an image from Image Marks because they are comprised of a string of numbers used only for comparison.

Identifying victims and suspects

Another benefit of LACE is that it integrates with IDLE, which contains a face identification module. Because LACE detects and extracts faces, it can facilitate the creation of suspect, witness and victim facial databases that can be automatically searched for matches using BlueBear's IDLE. Faces of victims, suspects and witnesses detected and extracted by LACE's multi-view face detection/extraction system are stored in IDLE's unique database.

Unknown faces from surveillance video, child exploitation facial image databases and other digital facial images can be compared against criminal mugshot databases. IDLE easily handles large facial databases and achieves matching results against centralized or distributed mugshot databases, Nash says.

Reducing redundancy

One of the primary benefits of using LACE is not only is work made easier and faster, investigators don't have to look at the same pornographic images repeatedly. When categorizing images, investigators only need to look at the new images.

Nash observed Shrewsbury-Gee as he manually categorized images.

"I just couldn't look at the images," Nash says. "Disgusting doesn't even begin to describe them; they're really horrible."

He understands how investigators can have a high stress level, get burned out and want to move on to another job.

Shrewsbury-Gee says: "It's actually sickening when you sit there and see these images — the general public just doesn't realize how disgusting these images really are. People don't equate child pornography with infants, children who are barely old enough to breathe. If there's audio, you can sometimes hear children screaming. You can see the pain and anguish on their faces as they're being abused, and it really, really weighs heavily on an investigator.

"If you can reduce the amount of pornography investigators have to see repetitively, then obviously that has a profound benefit. We are human, just like everybody else out there, and these things negatively impact us. When you keep seeing them, it actually makes you physically ill. If we can reduce the amount of things we have to be exposed to, then obviously the investigators are going to benefit tremendously and they're going to be more effective."

Future technology

BlueBear's ultimate goal is for LACE to be used as an international tool to combat child pornography trafficking.

In the near future, BlueBear will be adding the ability to handle video files to the LACE application. This will include matching the video, matching portions of the video, and automatically detecting and extracting faces from video.

Currently LACE does not automatically identify elements within images, such as a location, car or chair. Shrewsbury-Gee would like to be able to identify portions of a picture and put them into a database for comparison with other pictures. An example he gives is a tattoo found on a suspect that would help identify who the suspect is and how many crimes the suspect has committed.

By recognizing objects, technology would be able to identify portions of pictures. These portions, such as an image of a tattoo or a design on wallpaper, could be saved to help identify perpetrators and locations. The quicker they can be identified, the less a child victim will be physically or emotionally harmed, Shrewsbury-Gee says.

Both today and tomorrow, he says, "That's the No. 1 goal: to rescue the children."

Rebecca Kanable is a freelance writer who specializes in law enforcement topics living in Wisconsin. She can be reached at kanable@charter.net.

Loading