Organizing child pornography evidence

LACE (Law Enforcement Against Child Exploitation) software, in the final stages of development from BlueBear Inc. located in Gatineau, Quebec, Canada, helps investigators sort and categorize images found on seized computer hard drives in child...

Every computer hard drive will have some unique images — maybe family photographs or pornographic pictures taken by a suspect that haven't yet been shared — that need to be manually categorized.

The more previously categorized images there are in the known image database, the fewer images will need to be manually categorized. As a result, a lot of time can be saved. Instead of spending months categorizing images, Nash says an investigator can be done in days.

Ready for court

Police who use LACE spend less time but do a better job and bring more cases to trial with appreciably less effort, Nash says.

Investigators might pick out a sampling of the most disturbing images for presentation as evidence in court. They might tell a judge, for example, that 100,000 images were found on the computer — 20 percent were Type 1, horrible child pornography — and then show some representative images. When images were not categorized and representative images were presented in court, the defense argued the image sample was not representative of the overall hard drive content, Nash says.

"The argument was the representative images were downloaded by accident," he says. "When the entire hard drive is categorized, that argument disappears."

LACE does not definitively say that an image is evidence. While the program was designed to reduce workloads, investigators still must be responsible for identifying the evidence to be introduced in court.

Info sharing

The work and effort of all agencies using LACE is collected and organized to facilitate significantly increased efficiency in prosecuting perpetrators, Nash says. Information regarding the categorization of the image files is shared among agencies using a database system. The shared information does not include the actual images — only numeric representations of the images used for rapid searching and matching.

Nash notes more agencies are prepared to use LACE as soon as the current field trial round is complete. The more police organizations use LACE, the more images will be categorized, and the more Image Marks will be shared by the participating agencies, Nash says.

"Everyone benefits from everyone else's efforts," he says.

Here's how it works:

Individual agencies analyze their own hard drives and maintain their own databases of images. After doing a forensic audit of a hard drive, the results are inputted into LACE. File hash and Image Marks are automatically created for all unknown images. If a hash match is found, then that image is not searched using an Image Mark (to save time). Images that have matches (hash or Image Marks) will be automatically categorized. Remaining unmatched, unknown images need to be manually categorized.

New hash and Image Marks entered by individual agencies are periodically synchronized with a centralized, derived database, and updates are made available to all participating law enforcement agencies. The derived database contains no images, just file hash and Image Marks. It is not possible to regenerate an image from Image Marks because they are comprised of a string of numbers used only for comparison.

Identifying victims and suspects

Another benefit of LACE is that it integrates with IDLE, which contains a face identification module. Because LACE detects and extracts faces, it can facilitate the creation of suspect, witness and victim facial databases that can be automatically searched for matches using BlueBear's IDLE. Faces of victims, suspects and witnesses detected and extracted by LACE's multi-view face detection/extraction system are stored in IDLE's unique database.

Unknown faces from surveillance video, child exploitation facial image databases and other digital facial images can be compared against criminal mugshot databases. IDLE easily handles large facial databases and achieves matching results against centralized or distributed mugshot databases, Nash says.

Reducing redundancy
  • Enhance your experience.

    Thank you for your regular readership of and visits to To continue viewing content on this site, please take a few moments to fill out the form below and register on this website.

    Registration is required to help ensure your access to featured content, and to maintain control of access to content that may be sensitive in nature to law enforcement.