Predicting CSAM-only vs. Dual Offending from Digital Forensic Artifacts

• In Event: Child Sexual Abuse Research Reduction Network: Showcasing Research on Technology-Facilitated Child Sexual Abuse and Exploitation

Abstract

Online child sexual exploitation and abuse are a global problem facilitated by technological advancements. Recent research argues for the need for a formalized hybrid risk assessment model that combines current online child sex abuse risk measures with the analysis of digital forensics artifacts. Digital forensic artifacts are evidence or information (e.g., messages, imagery, browsing history) recovered through digital forensic analysis of digital devices (e.g., laptops, mobile phones, smartwatches). We conducted a feasibility study as an initial step toward formalizing the hybrid risk assessment model by identifying high-level digital forensic artifacts that have the potential to be valid and reliable indicators of risk, with a focus on CPORT Items 5, 6, 7. Law enforcement investigators from a High Tech Crime Unit (HTCU) randomly selected seven closed cases; selection criteria included: male offender over 18, forensic image of offender’s mobile phone, child sexual abuse material (CSAM) offense, and 2019–2023 index offense. Mobile devices are the most common digital device collected in every criminal investigation; therefore, we required that a mobile phone was seized from the offender. Investigation details related to probable cause, final charges, conviction, and offender risk were not disclosed. Statistical information (f, %) for the following digital forensics artifacts was examined: 1) pornography collection (e.g., % of media, content type, gender ratio) and 2) evidence of networking/grooming and other problematic online activities (e.g., number of native messages vs. application messages; type of installed apps). The analysis predicted whether the offender was a CSAM-only or dual offender and if our findings agreed with the level of risk for reoffending suggested by CPORT Items 5, 6, 7. Results were shared with the HTCU and scored for accuracy, with the model successfully predicting 6/7 cases. We conclude adding digital forensic artifacts is feasible and provides valuable insight when examining CSAM offender behavior.

Authors

• Kathryn Seigfried-Spellar, Purdue University

• Marcus K Rogers, Purdue University

• Nina Matulis, Purdue University

• Jacob S Heasley, Purdue University