United States Senate Committee on the Judiciary “The EARN IT Act Holding the Tech Industry Accountable in the Fight Against Online Child Sexual Exploitation” March 11 2020 Testimony of John Shehan Vice-President Exploited Children Division National Center for Missing Exploited Children I Background A Creation of NCMEC The National Center for Missing Exploited Children NCMEC is a private non-profit organization created as a grassroots response to an unthinkable tragedy In 1981 6-year-old Adam Walsh was with his mother in a Florida shopping mall when he vanished without a trace His devastated parents John and Revé Walsh had nowhere to turn for help The search for Adam revealed many inadequacies that plagued missing children investigations at the time There was no coordinated response across multiple law enforcement agencies to search for Adam no AMBER Alert system to quickly deliver critical information to the public and no place for families to go for guidance or emotional support Revé and John endured 10 excruciating days searching for Adam before he was found murdered 100 miles away The Walshes channeled their grief and came together with other child advocates to create NCMEC in 1984 Over the past 35 years NCMEC has grown to become the leading nonprofit organization and the nation’s congressionally designated clearinghouse on missing and exploited children issues Today NCMEC has more than 340 employees who work to prevent child abduction recover missing children and combat child victimization through five main programs of work relating to 1 missing children 2 exploited children 3 community outreach 4 training and education and 5 family resources B Evolution of NCMEC Programs to Combat Online Child Sexual Exploitation As the Internet became more accessible to the general public in the 1990s NCMEC began to receive a growing number of reports relating to the sexual exploitation of children on the Internet In response to this trend NCMEC created the CyberTipline www missingkids org cybertipline in 1998 The CyberTipline serves as an online mechanism for members of the public and electronic service 1 providers ESPs to report incidents of suspected child sexual exploitation including child sex trafficking online enticement of children for sexual acts child sexual molestation child pornography child sex tourism unsolicited obscene materials sent to children misleading domain names and misleading words or digital images While NCMEC receives CyberTipline reports relating to each of these reporting categories the vast majority of reports NCMEC receives relate to apparent child pornography or child sexual abuse material 1 After NCMEC’s creation of the CyberTipline Congress enacted a statute 18 U S C § 2258A2 which contained a basic requirement that ESPs report apparent child pornography content to the CyberTipline when they become aware of such content on their systems While this reporting requirement leads to the submission of reports to the CyberTipline it does not require ESPs to take proactive or consistent actions to report such content or to develop or implement baseline protocols and technologies to detect and remove such content from their platforms and servers These gaps and inconsistencies are discussed in greater detail in Section II NCMEC’s operation of the CyberTipline is a core part of fulfilling its mission to prevent the further sexual victimization of children NCMEC analysts constantly triage CyberTipline reports for two central purposes 1 to try to determine a potential geographic location where a child is being harmed so the report can be made available to the appropriate law enforcement agency and 2 to ensure that reports containing images of children who appear to be in imminent danger are prioritized for immediate action Every day NCMEC bears witness to the constant flow of horrific child sexual abuse and exploitative material flooding into the CyberTipline Since its inception almost 22 years ago the CyberTipline has received more than 65 million reports The volume of annual reports to the CyberTipline has grown rapidly from under 10 000 in 1999 to over half a million in 2013 to over a million in 2014 and to over 16 million just last year in 2019 While the volume of reports has increased at nearly inconceivable levels in recent years so too has the amount of child sexual exploitation content included in each report In 2018 NCMEC received just over 18 million CyberTipline reports containing 45 million suspected child sexual exploitation images videos and related content In 2019 NCMEC received slightly fewer reports – just under 17 million – but these reports contained over 69 million suspected child sexual exploitation images videos and related content It is important to note that virtually all reports made to the CyberTipline relate to content that is being shared stored and distributed on the open web not the dark web At this time there are no specific reporting mechanisms or requirements relating to the reporting of child sexual abuse material on the The term “child pornography” is used in NCMEC’s CyberTipline reports because this is the term designated by U S federal and most state laws Outside of this legal context NCMEC refers to these images and videos as “child sexual abuse material” to most accurately reflect what is depicted – the rape sexual abuse and sexual exploitation of children Importantly the EARN It Act S 3398 will codify the replacement of the term “child pornography” with “child sexual abuse material” throughout the criminal code 1 2 The EARN It Act will provide key updates to §§ 2258A-D the CyberTipline reporting statute to improve reporting by ESPs facilitate analysis of CyberTipline reports by NCMEC and ensure that valuable NCMEC information relating to online child sexual exploitation can be used by and shared within the child protection community 2 dark web though NCMEC is aware that the dark web is increasingly where new and virulently explicit child sexual exploitation content is solicited traded and discussed among predators In addition to increases in the sheer volume of reports and suspected child sexual abuse material contained in each report submitted to NCMEC the complexity of the reported content also continues to increase As an example between 2017 and 2018 videos of the sexual abuse of children reported to the CyberTipline increased by 541% For the first time last year videos constituted the majority of content reported to NCMEC While just five years ago the number of videos reported to NCMEC’s CyberTipline was under 350 000 last year over 41 million videos of child sexual abuse were reported Additionally the emergence and popularity of chat and messenger services has led to increasingly complex reports that often combine verbal enticement and grooming with the eventual distribution of sexually abusive images and videos and the infliction of sexual blackmail or sextortion on children While the phrase child sexual abuse material more clearly describes this content than the current legal term child pornography it is essential to understand the nature of the material being reported to the CyberTipline These images videos and related content are not merely sexually suggestive or older teenagers who “look young ” This is content that depicts crime scene activity and active attempts to entice and sexually abuse children In these images and videos children – including many infants who are preverbal and cannot even call for help – are raped and abused This abuse is then documented on film and video and distributed repeatedly on hundreds of online photo-sharing platforms email services gaming sites messenger apps and file-serving services Children are physically abused each time an image or video is made and revictimized every time one of their sexually abusive images is traded and a new predator takes pleasure in their anguish or uses the image to entice another child In NCMEC’s experience any online service that enables members of the public to share content – no matter the size the structure or the intended focus of the service – can be misused by offenders to abuse children and to perpetrate this abuse by distributing their sexually abusive images online Current requirements under the law voluntary efforts by the tech industry including several of the largest ESPs currently on the market and growing public awareness of this problem is not sufficient to address the rampant online sexual abuse of children A new paradigm is needed to craft a response that for the first time will consistently and effectively address these issues on an industry level so that we can turn the tide against child sexual exploitation on the Internet II Current Gaps and Inadequacies in Combatting Online Child Sexual Exploitation NCMEC is fortunate to have strong partnerships with many technology companies that embrace their societal and corporate responsibilities to manage content on their platforms and to actively detect and remove child sexual exploitation content These valued stakeholders often go above and beyond the requirements of current law and look for innovative methods to address child sexual abuse material and implement sophisticated tools and technologies to identify this content online report it to NCMEC and get it quickly removed But NCMEC knows that too many companies are not proactive in fighting this insidious problem of online child sexual abuse material and engage in half-measures decline to participate in voluntary initiatives or information-sharing opportunities and too often put child protection secondary to organizational financial and broader liability concerns 3 A Lack of Statutory or Regulatory Requirements or Consistently Adopted Voluntary Initiatives to Combat Online Child Sexual Exploitation One of the largest complications in diminishing the posting and circulation of online child sexual abuse and exploitation material is the lack of appropriate legal guidelines or consistent best practices for ESPs to 1 screen for sexually abusive material 2 use commonly available applications and technology and adopt uniform best practices to detect and remove this content 3 report content in a consistent manner to the CyberTipline or 4 bear responsibility to a child victim even when an ESP recklessly enables her or his sexually exploitative material to be circulated online Without any legal requirements or standardized voluntary initiatives to guide ESPs on how to curtail this activity on their servers children continue to be sexually abused online around the world and in vast numbers – many undetected unreported and continually revictimized B Lack of Reporting to the CyberTipline Commensurate with an ESP’s User Base The number of ESPs on the market compared with the number of ESPs reporting to the CyberTipline and the numbers of reports made by each ESP highlights a basic highly problematic gap in reporting While publicly available reports indicate that there are approximately 7 000 ESPs on the market only about 1 400 ESPs have voluntarily registered to report to the CyberTipline Of the ESPs that are registered to report only 169 actually reported to the CyberTipline in 2019 And of these ESPs that did report just 10 ESPs were responsible for the vast majority of the millions of CyberTipline reports received by NCMEC see http www missingkids org gethelpnow cybertipline#bythenumbers Too many ESPs are not registered to report to the CyberTipline do not report at all to the CyberTipline or report at rates that are not remotely commensurate with the user base of their platforms and services C Lack of Consistent Best Practices and Technology to Detect and Report Online Child Sexual Abuse Material The failure of ESPs to uniformly adopt and implement consistent best practices to combat online child sexual exploitation is one of the most significant gaps in combatting this devastating crime Over the past 10 years NCMEC has offered and participated in several voluntary initiatives designed to encourage and enhance tech industry collaboration and create and drive consistent best practices Most of these initiatives have focused on facilitating the voluntary sharing of hashes among ESPs and child-serving non-profit organizations and assisting with the sublicensing of hashing technology such as PhotoDNA 3 In NCMEC’s experience when ESPs participate in hash-sharing initiatives or engage in consistent best practices there is a marked increase in the detection and reporting of child sexual abuse content to the CyberTipline From an operational perspective NCMEC saw this occur after the initial implementation of PhotoDNA by a range of ESPs when the volume of reports escalated as a result More recently NCMEC has witnessed the power of consistent implementation of innovative technology and practices in the dramatic rise in reporting of video content after a 3 In 2009 Microsoft and Dartmouth College partnered together to develop PhotoDNA a technology that creates unique digital signatures or hashes of images and can be used to locate copies of the same image across large volumes of content ESPs’ use of PhotoDNA has been instrumental in helping to detect and report images of child sexual exploitation to the CyberTipline 4 handful of companies implemented new measures to locate child sexual exploitation videos Additionally when reports are generated under consistent best practices they are often more analytically complete therefore increasing the amount of content available to assist law enforcement in recovering the victimized child D Lack of Adequate Legal Recourse by Child Victims When ESPs Recklessly Permit the Distribution of a Child’s Sexually Exploitive Content Online Currently a child victim whose images are circulated online perpetuating their abuse in an endless cycle has no civil recourse against an ESP that recklessly permits or enables this proliferation on its platforms or services This is the case even when the child puts the company on notice that its platforms are being misused to perpetuate this abuse against the child The child victim also cannot appeal to their state criminal justice system for help Both the child and the state attorney general are barred from seeking relief against any ESP that distributes or receives sexually abusive images or videos of the child regardless of the ESP’s knowledge awareness or involvement in the abuse NCMEC believes that child victims must have the right to access justice through civil lawsuits as a fundamental aspect of a victim-centered approach to combatting online child sexual exploitation The ability of state attorneys general to add to the efforts of federal prosecutors to prosecute anyone – including an ESP – who is involved in the distribution of child pornography online also is essential to create heightened urgency and increase vigilance in protecting children online E Lack of Adequate Financial Support to NCMEC Law Enforcement and Other ChildServing Professionals to Handle and Analyze CyberTipline Reports Investigate Crimes and Rescue Children and Develop Innovative Technology and Techniques to Combat Online Child Sexual Exploitation A range of entities is actively involved in combatting online child sexual exploitation and overall funding generally has failed to keep pace with the explosive increase in the volume and complexity of online child sexual abuse There are not adequate resources to handle current report caseloads create innovative technology and protocols nurture and create voluntary initiatives with industry and strategize about using public-private partnerships to better deter detect report and address child sexual exploitation online and serve child victims of online sexual exploitation Relatively static governmental funding to address the horrifying increase in child sexual exploitation content being circulated worldwide has become an impediment in effectively combatting this problem Addressing the funding issue and increasing support for law enforcement and non-profit partners combatting this issue commensurately is a key goal in the fight against online child sexual exploitation III The EARN It Act S 3398 Creating Consistent Best Practices to Detect Report and Combat Online Child Sexual Exploitation The EARN It Act is a child protection bill that addresses many of the gaps identified by NCMEC in this written testimony regarding current efforts to combat the proliferation of child sexual abuse and exploitative material online including 1 lack of adoption of consistent practices and technology across the tech industry to combat the problem 2 failure of companies to implement best practices 5 across all of their platforms and services 3 reliance on wholly voluntary measures to protect children from being enticed groomed online for sexual abuse and to prevent images of their rape and sexual abuse from circulating online 4 absence of incentives for ESPs to invest and engage in best practices to keep children safer online and 5 denial of a child victim’s right to his or her day in court against all parties including tech companies that have recklessly contributed to the child’s revictimization when sexually abusive images are recirculated online The EARN It Act addresses each of these gaps shortcomings and inconsistencies Organizationally NCMEC has long-recognized the value of creating best practices for private industry and public institutions to keep children safer – ranging from NCMEC’s best practices for law enforcement to search for children with special needs best practices for 9-1-1 operators to handle calls regarding missing children and best practices for parents to discuss online safety with their children NCMEC has for years recommended certain best practices to companies who asked us how they could better address child sexual abuse material on their systems However there has never been a coalition or consortium of experts who worked to compile and update best practices on how to deter report and remove child sexual exploitation content online The lack of consistently implemented best practices by ESPs has exacerbated the explosive spread of online child sexual exploitation content over the past few years Now is the time to ensure that the tech industry is presented with standardized best practices so the industry can take a collective step forward to address the posting and circulation of horrific child sexual abuse images on their services NCMEC supports the EARN It Act because it will create a unified roadmap of specific up-to-date consistent best practices developed by academic subject matter and industry experts for ESPs to better combat the online sexual exploitation of children NCMEC has witnessed how a disparate piecemeal approach by many ESPs to detecting reporting and removing child sexual abuse material has failed to appropriately respond to the problem The lack of any incentive for ESPs to collectively undertake and implement some form of best practices has endangered children online and denied children their day in court against all entities – their abuser the predators who share and collect their sexually abusive images and the ESP that recklessly permits the repeated transmission of their sexually abusive content online As the national clearinghouse on exploited children issues and having operated the CyberTipline for over 20 years NCMEC also recognizes the powerful impact that the particular best practice categories enumerated in the EARN It legislation will have on online child safety There is a crucial need for standardized guidance on how companies can best detect and identify child sexual abuse material online through the use of voluntary initiatives shared technology and data sets and also train and support content moderators who have the vital but immensely difficult role of reviewing and vetting this content NCMEC also applauds the inclusion of a best practice relating to transparency regarding ESPs’ efforts to combat child sexual exploitation on their services Transparency in this area informs and educates the general public about the scope and extent of this danger to children online and how ESPs are working to address the problem and creates commercial incentives within the industry for all companies to strive to do more In addition to its creation of a Commission to develop best practices for the tech industry the EARN It Act also includes two crucial revisions to the child protection landscape that will impact how these 6 crimes against children can be handled The legislation for the first time requires that incidents of child sex trafficking and online enticement or grooming be reported to NCMEC’s CyberTipline Over the past 5 years NCMEC has seen disturbing increases in children being trafficked or enticed for sex online yet we have not been able to provide consistent services to these children ensure law enforcement is alerted to these crimes or gain valuable analytics around this trend because ESPs have not been required to report these incidents Ensuring mandatory reporting of these crimes to the CyberTipline will increase detection and reporting of these incidents ensure law enforcement can more consistently help recover these children and investigate offenders and facilitate a deeper understanding of how these crimes occur which will inform prevention and funding considerations The EARN It Act also will ensure that the U S legal system replaces the sanitized term “child pornography” with the term “child sexual abuse material” throughout the criminal code This revision will reflect the true criminality of the recording dissemination and possession of material depicting the rape and sexual abuse of children and will recognize the actual circumstances of the child’s abuse and trauma NCMEC applauds the authors of the bill for including this additional measure in the EARN It Act and ensuring that the world is not desensitized to this horrific abuse In conclusion NCMEC thanks the Committee for its dedication to addressing the alarming increase in online child sexual abuse material and its leadership in introducing the EARN It Act to strengthen protections for children online We look forward to continuing to work with the sponsors of the EARN It Act to move the bill through Congress and to working with the Committee and other members of Congress to support the families and children impacted by this issue and the professionals working in partnership to help reduce child sexual exploitation and prevent child victimization online 7