Measurement and Analysis of Child Pornography Trafficking on Gnutella and eMule

Peer-to-peer networks are the most popular mechanism for the criminal acquisition and distribution of child pornography (CP). In this paper, we examine observations of peers sharing known CP on the Gnutella and eMule networks, which were collected by law enforcement using forensic tools that we developed. We characterize a year’s worth of network activity and evaluate different strategies for prioritizing investigators’ limited resources. First, we focus on strategies for reducing the number of CP files available on the network by removing a minimal number of peers. We present a metric for peer removal that is more effective than simply selecting peers with the largest libraries or the most days online. We show that any successful strategy must target offenders from all countries. Second, we characterize the aggressiveness of six peer subgroups, including: peers using Tor, peers that bridge multiple p2p networks, and the top 10% of peers contributing to file availability. We find that these subgroups are more aggressive in their trafficking, having more known CP and more uptime, than the average peer. Finally, while in theory Tor presents a challenge to investigators, we observe that in practice offenders use Tor inconsistently. Over 90% of regular Tor users send traffic from a non-Tor IP at least once after first using Tor.