Investigating child sexual abuse material availability, searches, and users on the anonymous Tor network for a public health intervention strategy

Abstract

Tor is widely used for staying anonymous online and accessing onion websites; unfortunately, Tor is popular for distributing and viewing illicit child sexual abuse material (CSAM). From 2018 to 2023, we analyse 176,683 onion domains and find that one-fifth share CSAM. We find that CSAM is easily available using 21 out of the 26 most-used Tor search engines. We analyse 110,133,715 search sessions from the Ahmia.fi search engine and discover that 11.1% seek CSAM. When searching CSAM by age, 40.5% search for 11-year-olds and younger; 11.0% for 12-year-olds; 8.2% for 13-year-olds; 11.6% for 14-year-olds; 10.9% for 15-year-olds; and 12.7% for 16-year-olds. We demonstrate accurate filtering for search engines, introduce intervention, show a questionnaire for CSAM users, and analyse 11,470 responses. 65.3% of CSAM users first saw the material when they were children themselves, and half of the respondents first saw the material accidentally, demonstrating the availability of CSAM. 48.1% want to stop using CSAM. Some seek help through Tor, and self-help websites are popular. Our survey finds commonalities between CSAM use and addiction. Help-seeking correlates with increasing viewing duration and frequency, depression, anxiety, self-harming thoughts, guilt, and shame. Yet, 73.9% of help seekers have not been able to receive it.

Figures (7)

• Figure 1: We investigate the availability of CSAM hosted through the Tor network and its users. (a) Tor enables anonymous web publishing through onion domains. These websites host a variety of content, and there are Tor-specific search engines for searching. 21/26 of the popular Tor search engines allow CSAM websites. (b) Our web crawlers collected online content from 176,683 different onion domains from 2018 to 2023. (c) Using text-based CSAM detection methods, we investigate the number of websites sharing CSAM. The identification methods provide us with 404 phrases that accurately identify CSAM content. (d) This enables text-based detection and filtering for Tor search engines. CSAM-related searches are among the most popular of the 239 million total queries. Out of 110 million search sessions, 11.1% are seeking CSAM. (e) The search engine directs CSAM-seekers to self-help websites and asks them to complete our survey. The results indicate that they want assistance and are motivated to stop using CSAM.
• Figure 2: We measure the proportion of CSAM onion websites inside the Tor network in 2018--2023. (a) We use a sample of 10,000 unique onion domains for each year. (b) Many websites have several onion domains. We compare the title and sentences of the pages to detect duplicates, and restrict to a single domain if multiple domains share identical content. (c) We execute text-based CSAM detections against the content of these distinct domains. Some CSAM websites do not use explicit sexual language, and text-based detection fails. Using three separate methods -- manual validation, phrase matching, and the naive Bayes classifier -- we discover that the detected percentage of websites sharing CSAM is 16.2--23.8% in 2023. Comparing automated methods to human validation by hand yields consistent results (22.1% in 2023 and 19.5% in 2022). We randomly select the plain text representations of 1,000 onion websites for each year, 2018--2023, and read the text content of these websites to determine whether they share CSAM and what the English vocabulary is for this type of page.
• Figure 3: Ages between zero and 17 included in the CSAM search sessions and search sessions seeking 18-year-old and 19-year-old adults as a comparison (N = 479,555). 16-year-old (N = 61,083 of 479,555 -- 12.7%) is the top-mentioned age. 54.5% of age-revealing searches (N = 261,162 of 479,555) target those aged 12--16 years old. Outside of this age range, the interest declines.
• Figure 4: In the context of explicit CSAM search sessions, there are a total of 2,287,057 broad age-indicating searches with terms 'toddler', 'infant', 'baby', 'pthc' (preteen hardcore), 'preteen' (preadolescence, ages between nine and 12), 'lolita' (refers to a girl around 12--14 years old), and 'teen' (when included with CSAM terms).
• Figure 5: Our anonymous survey received responses from 11,470 individuals who sought CSAM on three popular Tor search engines. (a) The survey results indicate that 65.3% (N = 7,199 of 11,030 who replied to the question) of CSAM users first saw the material when they were under 18 years old. 36.7% (N = 4,048 of 11,030) first saw CSAM when they were 13 years old or younger. 50.5% (N = 4,843 of 9,599 who replied to the question) report that they first saw CSAM accidentally. (b) We asked the respondents what types of images and videos they view. Viewing CSAM depicting girls is more prevalent, with a ratio of 7:3. (c) The survey results indicate that 48.1% (N = 4,120 of 8,566 who replied to the question) of CSAM users are willing to change their behaviour to stop using CSAM, and 61.6% (5,200 of 8,447 who replied to the question) have tried to stop using CSAM. However, only 14.0% (N = 985 of 7,013 who replied to the question) of CSAM users have sought help to stop using CSAM, and an even smaller portion of 3.7% (N = 257) have actually received help. Notably, 21.4% (N = 1,498) are afraid to seek help.