Just in Plain Sight: Unveiling CSAM Distribution Campaigns on the Clear Web

TL;DR

This paper uncovers a large-scale campaign distributing child sexual abuse material on the clear web, analyzing its operation, user network, and methods to bypass security measures, revealing critical insights into its dynamics and demand.

Contribution

It is the first detailed analysis of CSAM distribution campaigns on the clear web, highlighting operational tactics, social network abuse, and user behavior insights.

Findings

Campaign used over 1,026 web pages and had at least 738,286 registered users.

Social networks and bots are exploited to facilitate the distribution.

Operational faults reveal insights into user demand and network dynamics.

Abstract

Child sexual abuse is among the most hideous crimes, yet, after the COVID-19 pandemic, there is a huge surge in the distribution of child sexual abuse material (CSAM). Traditionally, the exchange of such material is performed on the dark web, as it provides many privacy guarantees that facilitate illicit trades. However, the introduction of end-to-end encryption platforms has brought it to the deep web. In this work, we report our findings for a campaign of spreading child sexual abuse material on the clear web. The campaign utilized at least 1,026 web pages for at least 738,286 registered users. Our analysis details the operation of such a campaign, showcasing how social networks are abused and the role of bots, but also the bypasses that are used. Going a step further and exploiting operational faults in the campaign, we gain insight into the demand for such content, as well as the dynamics of the user network that supports it.