Michael H. Keller and Gabriel J.X. Dance

Millions of photos and videos of children being sexually abused exist on a wide range of platforms, from Dropbox to Facebook Messenger, for criminals around the world to see. An investigation by The New York Times found that the technology industry has consistently failed to take coordinated steps to shut down the illegal content.

Because online predators sometimes stalk people in the photos and videos, the two sisters, now 17 and 21, do not discuss their experiences publicly for fear of being recognized. They agreed, however, to talk to The Times if they were not named. They are identified here by their first initials, F. and E.

When they were 7 and 11, the sisters were sexually abused by their father. In one video, the younger sister, F., was drugged and raped by him and another man. Both men are now in prison, but the imagery continues to circulate on the web.

This year alone, photos and videos of the sisters were found in more than 130 child sexual abuse investigations involving mobile phones, computers and cloud storage accounts.

The following has been condensed and edited for clarity from recorded conversations with the sisters and their mother.

Q: What do you want people to know about online child sexual abuse?

E: It’s more than just images. When I’m in public with my little sister and I see some man looking at her, that is one of the first things I think about. You’re always worried. Already as a girl you always have to think about that kind of stuff, like guys being creepy. But then it’s something like, “Have they seen a picture of you when you were a kid?” It’s going to be there forever, and you just learn to deal with it.

F: People think I’m really fragile. I try to let people know that I went through that. I would love to speak out about it. We’re out of sight, out of mind. If it can help other people, and if I can talk to other victims and help them feel better, that’s all I want.

Q: How do you talk to friends and others about the abuse?

E: If people ask me, I’ll tell them. But I usually spare them. I’m like: “You don’t want the answer to this question. It’s going to shock you, and then you’re going to feel weird and I’m going to feel weird.” People like to ask me, “What about your dad?” And there’s just no simple answer to that. I can just say, “Oh, he’s in jail.” But everyone is going to ask why he’s in jail. And every time I’ll just tell them. I’ll just say, “He’s a child molester.” And they’re like, “You’re kidding, right?”

F: I’m ready to talk about it. It’s not easy, but I want to do it because I know that it could help someone else. I’ve heard other people talk about it, and then it inspires me. It’s very hard to talk about, but I think it’s really important.

Q: What does it mean to you that pictures of you are still out there?

E: It just sucks that it’s still going on, because the pictures are still circulating. It’s like another form of abuse. People would say: “It’s just pictures. Who are they hurting?” No, that’s so violating. If those were pictures of you, you would understand. It’s not like a harmless thing because of that.

F: It angers me more than upsets me. That stuff just really makes me mad that I’ve been through it and that so many people are still doing that stuff. It scares me for other kids because, you know, I’m more of a person where I get concerned for other people over myself. So it scares me. They have my pictures. They are out there. If you’re looking at that, you’re obviously out there looking at little girls. Eventually, you’re going to want to act on it. And I just don’t want anybody else to go through what I went through.

Q: What is the biggest burden right now?

E: What sucks is you almost get your voice taken away, too. If it were up to me, if it weren’t so dangerous, I would love to just say my name, put my face out there and say what I want to say. It takes away the personal part of it.

F: When it first happened, I was so young and I didn’t really process it for a long time. When he first got arrested, I was like, “Why is he getting arrested?” When that stuff was happening, he would drug me, so I wouldn’t really know. It was more just like losing my dad in general. But then as I grew up, more stuff was bothering me, but I didn’t know that was the cause of it. The way that I would do things, the way that I would react to things, was because of that event, but I never really made that connection. And so I would be really hard on myself. When I got older, my mom would talk about it a lot, and helped explain to me why I was like that. And now I understand fully.

Q: How do you view social media?

F: I took pictures to accentuate my body, to get attention. I just wanted attention so bad. Now I’m way more protective. I appreciate my body way more than I used to. I know that it’s a gift. I’m not useless like a rag. I am sacred.

This article originally appeared in

'If Those Were Pictures of You, You Would Understand'

Two sisters from the Midwest are among the untold number of survivors of child sexual abuse who say they are unable to escape their horrific experiences because of the internet.

[Eds: Articles in this series, ‘Exploited,’ examine the explosion in online photos and videos of children being sexually abused. They include graphic descriptions of some instances of abuse.]

The two sisters live in fear of being recognized. One grew out her bangs and took to wearing hoodies. The other dyed her hair black. Both avoid looking the way they did as children.

Ten years ago, their father did the unthinkable: He posted explicit photos and videos on the internet of them, just 7 and 11 at the time. Many captured violent assaults in their Midwestern home, including him and another man drugging and raping the 7-year-old.

The men are now in prison, but in a cruel consequence of the digital era, their crimes are finding new audiences. The two sisters are among the first generation of child sexual abuse victims whose anguish has been preserved on the internet, seemingly forever.

The digital trail of abuse — often stored on Google Drive, Dropbox and Microsoft OneDrive — haunts the sisters relentlessly, they said, as does the fear of a predator recognizing them from the images.

“That’s in my head all the time — knowing those pictures are out there,” said E., the older sister, who is being identified only by her first initial to protect her privacy. “Because of the way the internet works, that’s not something that’s going to go away.”

Horrific experiences like theirs are being recirculated across the internet because search engines, social networks and cloud storage are rife with opportunities for criminals to exploit.

The scope of the problem is only starting to be understood because the tech industry has been more diligent in recent years in identifying online child sexual abuse material, with a record 45 million photos and videos flagged last year.

But the same industry has consistently failed to take aggressive steps to shut it down, an investigation by The New York Times found. Approaches by tech companies are inconsistent, largely unilateral and pursued in secret, often leaving pedophiles and other criminals who traffic in the material with the upper hand.

The companies have the technical tools to stop the recirculation of abuse imagery by matching newly detected images against databases of the material. Yet the industry does not take full advantage of the tools.

Amazon, whose cloud storage services handle millions of uploads and downloads every second, does not even look for the imagery. Apple does not scan its cloud storage, according to federal authorities, and encrypts its messaging app, making detection virtually impossible. Dropbox, Google and Microsoft’s consumer products scan for illegal images, but only when someone shares them, not when they are uploaded.

And other companies, including Snapchat and Yahoo, look for photos but not videos, even though illicit video content has been exploding for years. (When asked about its video scanning, a Dropbox spokeswoman in July said it was not a “top priority.” On Thursday, the company said it had begun scanning some videos last month.)

The largest social network in the world, Facebook, thoroughly scans its platforms, accounting for more than 90% of the imagery flagged by tech companies last year, but the company is not using all available databases to detect the material. And Facebook has announced that the main source of the imagery, Facebook Messenger, will eventually be encrypted, vastly limiting detection.

“Each company is coming up with their own balance of privacy versus safety, and they don’t want to do so in public,” said Alex Stamos, who served as chief of information security at both Facebook and Yahoo. “These decisions actually have a humongous impact on children’s safety.”

Tech companies are far more likely to review photos and videos and other files on their platforms for facial recognition, malware detection and copyright enforcement. But some businesses said looking for abuse content is different because it can raise significant privacy concerns.

Tech companies are loath to be seen going through someone’s photos and videos, and imagery flagged in automated scans is almost always reviewed by a person later.

“On the one hand, there is an important imperative to protect personal information,” said Sujit Raman, an associate deputy attorney general in the Justice Department. “On the other hand, there is so much stuff on the internet that is very damaging.”

The main method for detecting the illegal imagery was created in 2009 by Microsoft and Hany Farid, now a professor at the University of California, Berkeley. The software, known as PhotoDNA, can use computers to recognize photos, even altered ones, and compare them against databases of known illegal images. Almost none of the photos and videos detected last year would have been caught without systems like PhotoDNA.

But this technique is limited because no single authoritative list of known illegal material exists, allowing countless images to slip through the cracks. The most commonly used database is kept by a federally designated clearinghouse, which compiles digital fingerprints of images reported by U.S. tech companies. Other organizations around the world maintain their own.

Even if there were a single list, however, it would not solve the problems of newly created imagery flooding the internet or the surge in livestreaming abuse.

For victims like E. and her sister, the trauma of the constantly recirculating photos and videos can have devastating effects. Their mother said both sisters had been hospitalized for suicidal thoughts.

“Every hope and dream that I worked towards raising my children — completely gone,” she said. “When you’re dealing with that, you’re not worried about what somebody got on a college entrance exam. You just want to make sure they can survive high school or survive the day.”

And because online offenders are known to seek out abused children, even into adulthood, the sisters do not speak publicly about the crimes against them. Their emotional conversations with the Times were the first time they’ve spoken publicly about the abuse.

“You get your voice taken away,” E. said. “Because of those images, I don’t get to talk as myself. It’s just like, Jane Doe.”

Searching for Abuse

Joshua Gonzalez, a computer technician in Texas, was arrested this year with more than 400 images of child sexual abuse on his computer, including some of E. and her sister.

Gonzalez told authorities that he had used Microsoft’s search engine, Bing, to find some of the illegal photos and videos, according to court documents.

Microsoft had long been at the forefront of combating abuse imagery, even creating the PhotoDNA detection tool a decade ago. But many criminals have turned to Bing as a reliable tool of their own.

A report in January commissioned by TechCrunch found explicit images of children on Bing using search terms like “porn kids.” In response to the report, Microsoft said it would ban results using that term and similar ones.

The Times created a computer program that scoured Bing and other search engines. The automated script repeatedly found images — dozens in all — that Microsoft’s own PhotoDNA service flagged as known illicit content. Bing even recommended other search terms when a known child abuse website was entered into the search box.

While the Times did not view the images, they were reported to the National Center for Missing and Exploited Children and the Canadian Center for Child Protection, which work to combat online child sexual abuse.

One image, the Canadian center said, showed a naked girl on her back spreading her legs “in an extreme manner.” The girl, about 13, was recognized by the center’s analysts, who regularly review thousands of explicit images to help identify and rescue exploited children and scrub footage from the internet. The analysts said authorities had already removed the girl from danger.

Similar searches by the Times on DuckDuckGo and Yahoo, which use Bing results, also returned known abuse imagery. In all, the Times found 75 images of abuse material across the three search engines before stopping the computer program.

Both DuckDuckGo and Yahoo said they relied on Microsoft to filter out illegal content.

After reviewing the Times’ findings, Microsoft said it uncovered a flaw in its scanning practices and was re-examining its search results. But subsequent runs of the program found even more.

A spokesman for Microsoft described the problem as a “moving target.”

“Since the NYT brought this matter to our attention, we have found and fixed some issues in our algorithms to detect unlawful images,” the spokesman said.

Hemanshu Nigam, who served as a director overseeing child safety at Microsoft from 2000 to 2006, called the findings a “major failing” and added that “it looks like they’re not using their own tools.” Nigam said it showed the company was seemingly unaware of how its platforms could be manipulated by criminals.

Child abusers are well aware of Bing’s vulnerabilities, according to court records and interviews with law enforcement officials. Going back years, pedophiles have used Bing to find illegal imagery and have also deployed the site’s “reverse image search” feature, which retrieves pictures based on a sample photo.

The same computer program, when run by the Times on Google’s search engine, did not return abuse content. But separate documentation provided by the Canadian center showed that images of child sexual abuse had also been found on Google and that the company had sometimes resisted removing them.

One image captured the midsections of two children, believed to be under 12, forced into explicit acts with each other. It is part of a known series of photos showing the children being sexually exploited.

The Canadian center asked Google to take down the image in August last year, but Google said it did not meet its threshold for removal, the documents show. The analysts pressed for nine months until Google relented.

Another image, found in September 2018, depicts a woman touching the genitals of a naked 2-year-old girl. Google declined to take down the photo, stating in an email to the Canadian analysts that while it amounted to pedophilia, “it’s not illegal in the United States.”

When the Times later asked Google about the image and others identified by the Canadians, a spokesman acknowledged that they should have been removed, and they subsequently were. The spokesman also said that the company did not believe any form of pedophilia was legal, and that it had been a mistake to suggest otherwise.

A week after the images were removed, the Canadian center reported two additional images to Google. One was of a young girl, approximately 7, with semen covering her face. The other was of a girl, between 8 and 11, with her legs spread, exposing her genitals. Google told the Canadian center that neither image met “the reporting threshold” but later agreed to remove them.

“It baffles us,” said Lianna McDonald, the center’s executive director.

Criminals Everywhere

The problem is not confined to search engines.

Pedophiles often leverage multiple technologies and platforms, meeting on chat apps and sharing images on cloud storage, according to a review of hundreds of criminal prosecutions.

“The first thing people need to understand is that any system that allows you to share photos and videos is absolutely infested with child sexual abuse,” said Stamos, the former security chief at Facebook and Yahoo, who is now a professor at Stanford.

Criminals often discuss in online forums and chat groups how to exploit vulnerabilities in platforms, the criminal cases show. They carefully follow the prosecutions of people who have been found with explicit imagery and learn from them. There are even online manuals that explain in graphic detail how to produce the images and avoid getting caught.

The digital trail that has followed one young abuse victim, a girl who was raped by her father over four years starting at age 4, is sadly representative of the pattern.

The girl, now a teenager living on the West Coast, does not know that footage of her abuse is on the internet. Her mother and stepfather wish it would stay that way.

“We’re just afraid of all the negative impacts that it might have — because I’ve spoken with other moms whose daughters know their images are online, and they’re train wrecks,” her mother said. “She doesn’t need to be worrying about most likely the worst part of her life available on the internet.”

Her stepfather also worries. “To her, the internet is looking up puppies.”

Sex offenders frequently share photos and videos of the girl’s abuse on sites that appear on Bing and elsewhere. When the images are detected, the FBI notifies the girl’s family or their lawyer. Over the past four years, her family said, they have received more than 350 notifications about cases across the country, including in Florida, Kansas, Kentucky, Michigan, Minnesota and Texas.

Images of the girl surfaced in a case reported to authorities by a woman who had been conversing with a Michigan man on Facebook Messenger.

The man had proposed that the woman and her children live as nudists, while also suggesting to her that incest was normal. He offered to move in with her along with his 13-year-old daughter whom, he said, he had orally raped the night before.

The man, Snehal Yogeshkumar Shah, had also been communicating on Messenger with other abusers, who recommended he download the Kik messaging app and create a Dropbox account to store his illicit material. Police found more than 400 illegal photos and videos in his Dropbox account and on his iPhone, including some of the West Coast girl. They also found chats on Kik between him and two young teenagers containing explicit imagery. He is now in prison.

Images of the girl also emerged in an investigation into Anthony Quesinberry, an Army specialist in San Antonio who shared abuse content on Yik Yak, a now-shuttered social networking app. He told investigators that he’d been addicted to the imagery for years and had obtained it using search engines, Tumblr, Dropbox, Kik and the livestreaming video platform Omegle. He was sentenced to more than 16 years.

The girl’s mother said she could see the effects of the trauma years later. Sometimes, her daughter becomes inexplicably angry. More often, she can seem detached, as if nothing bothers her. There “are things, developmentally, that she is just having to learn now,” said her mother, who agreed to be interviewed with her lawyer and only if her name and location were withheld.

When the girl turns 18, she will become the legal recipient of reports about the material. At that point, her mother and stepfather hope, she will be better able to handle the news. They also hold out hope that the tech companies will have managed to remove the images from the internet by then.

“I would love to be able to tell her they were online,” her mother said, “but they are not anymore.”

‘Pictures Are Forever’

Other parents are resigned to the possibility that the images may remain online forever.

In a foster family with multiple victims, one teenage daughter recently went on antidepressants to cope with feelings that her abuse was her fault. Another daughter found the courage to begin dating eight years after her abuse. But when her worried brother recently went online to test whether the imagery was still available, agents from the FBI visited their home. It is illegal to view child sexual abuse material, regardless of intentions.

“I don’t fool myself into thinking I’m doing great anymore,” said the foster mother, who requested anonymity to protect the privacy of her children. “I’m just surviving day by day.”

Two of her foster daughters were filmed being raped by their father, while others were abused but not photographed or filmed. The difference, she said, can be profound over time.

“They’re angry that those pictures are forever,” she said.

To discourage them from posting on social media and risk being recognized, she has told her children their abusive images live on the internet. “I don’t think they’ll ever be totally wiped out,” she said.

So far, the tech industry has proved her right.

It has been 10 years since PhotoDNA was developed at Microsoft, yet the industry’s efforts to detect and remove known illegal photos remains uneven and cloaked in secrecy.

The industry’s response to video content has been even more wanting, according to interviews, internal company emails and reviews of thousands of court records. There is no common standard for identifying illegal video content, and many major platforms — including AOL, Snapchat and Yahoo — do not even scan for it. AOL and Yahoo did not respond to requests for comment about their video policies. A Snap spokesman said the company was working with industry partners to develop a solution.

A spokesman for Kik, before it was sold last month, said the company was also working on the issue; on Friday, the new owners said it now scanned for video.

“Overall, the tech companies are doing the minimal amount necessary to maintain public respect for their organizations,” said Chad Steel, who teaches computer forensics at George Mason University and has assisted federal investigators in abuse-related cases. “But they’re not doing nearly as much as they could based on the technologies available.”

Tech companies have known for years that videos of children being sexually abused are shared on their platforms, according to former employees at Microsoft, Twitter, Tumblr and other companies. One former Twitter employee described gigabytes of illegal videos appearing more quickly than they could be taken down on Vine, the video service since shuttered by Twitter.

That was in 2013, when fewer than 50,000 videos were reported. Last year, tech companies referred more than 22 million to the National Center for Missing and Exploited Children, the nonprofit clearinghouse mandated by the federal government to act as a repository for the imagery.

Efforts to tackle the urgent problem of video content have run into roadblocks of the companies’ own making. Google, for example, developed video-detection technology that it makes available to other companies, and Facebook also has a system. But the two cannot share information because the fingerprints generated by each technology are not compatible.

In 2017, the tech industry approved a process for sharing video fingerprints to make it easier for all companies to detect illicit material, according to confidential emails and other documents that were part of a project run by the Technology Coalition, a group focused on child safety issues that includes most major companies.

One document notes the project’s justification: “Video has become as easy to create as images, and no standard solution/process has been adopted by industry.”

The lack of action across the industry has allowed untold videos to remain on the internet. Of the center’s 1.6 million fingerprints, less than 3% are for videos.

Photos and videos are each being handled in ways that give criminals great leeway. None of the largest cloud storage platforms — including Amazon Web Services, Dropbox, Google Drive and Microsoft’s OneDrive and Azure — scan for abuse material when files are uploaded, according to law enforcement officials, former employees and public statements by the companies.

While the files may be scanned later — when users share them, for example — some criminals have avoided detection by sharing their account logins rather than the files themselves.

A Florida man, Gregory Householder, told investigators that he had used online platforms for eight years and had regularly shared logins to Dropbox accounts with other offenders. Householder said he knew he was committing a crime but did not believe he would get caught.

A spokesman for Amazon, which does not scan for abuse imagery whatsoever, said that the “privacy of customer data is critical to earning our customers’ trust” and noted that the company had a policy that prohibited illegal content. Microsoft Azure also said it did not scan for the material, citing similar reasons.

Privacy concerns were raised by other companies, including Dropbox and Google. A Dropbox spokeswoman said scanning raised a specter that privacy advocates could take issue with.

Some companies, like Dropbox and Google, invoked security concerns when asked about their detection and removal practices. A spokesman for Apple declined to specify how it scanned its platforms, saying the information could help criminals.

Several digital forensic experts and law enforcement officials said the companies were being disingenuous in invoking security. Stamos, the former Facebook and Yahoo security chief, said the companies just “don’t want to advertise that they are open for business” to criminals.

“If they’re saying, ‘It’s a security problem,’ they’re saying that they don’t do it,” Stamos said.

An Uncertain Future

A heinous case in Pennsylvania warns of a tsunami of new, hard-to-detect abuse content through livestreaming platforms.

More than a dozen men from around the world were logged in to the business conference software Zoom. They were chatting while watching a livestream that had nothing to do with work: A man was sexually assaulting a 6-year-old boy.

One of the viewers, according to court documents, asked the assailant to spread the boy’s buttocks. Another to “spit in his face.” A third to “rape him.”

The boy was orally raped and violently penetrated while some of the men, appearing on cameras of their own, cheered and masturbated for the others to see.

The men also broadcast prerecorded clips of young children — including infants — being raped, beaten and urinated on.

During the trial, an investigator said that offenders often knew that livestreams are harder to detect and leave no record.

“That’s why they go to Zoom,” said the federal prosecutor in the case, Austin Berry, during his closing remarks. “It’s the Netflix of child pornography.” Prosecutions in other cases have involved livestreaming on Apple’s FaceTime, Facebook, Omegle, Skype, YouNow and others.

None of the major tech companies is able to detect, much less stop, the livestreaming through automated imagery analysis, although a technology executive at Zoom said the company had made significant improvements since the Pennsylvania case using other methods.

Child Abusers Run Rampant as Tech Companies Look the Other Way

(Exploited)

[Eds: Articles in this series, ‘Exploited,’ examine the explosion in online photos and videos of children being sexually abused. They include descriptions of some instances of the abuse.]

The images are horrific. Children, some just 3 or 4 years old, being sexually abused and in some cases tortured.

Pictures of child sexual abuse have long been produced and shared to satisfy twisted adult obsessions. But it has never been like this: Technology companies reported a record 45 million online photos and videos of the abuse last year.

More than a decade ago, when the reported number was less than 1 million, the proliferation of the explicit imagery had already reached a crisis point. Tech companies, law enforcement agencies and legislators in Washington responded, committing to new measures meant to rein in the scourge. Landmark legislation passed in 2008.

Yet the explosion in detected content kept growing — exponentially.

An investigation by The New York Times found an insatiable criminal underworld that had exploited the flawed and insufficient efforts to contain it. As with hate speech and terrorist propaganda, many tech companies failed to adequately police sexual abuse imagery on their platforms, or failed to cooperate sufficiently with authorities when they found it.

Law enforcement agencies devoted to the problem were left understaffed and underfunded, even as they were asked to handle far larger caseloads.

The Justice Department, given a major role by Congress, neglected even to write mandatory monitoring reports, nor did it appoint a senior executive-level official to lead a crackdown. And the group tasked with serving as a federal clearinghouse for the imagery — the go-between for tech companies and authorities — was ill-equipped for the expanding demands.

A paper recently published in conjunction with that group, the National Center for Missing and Exploited Children, described a system at “a breaking point,” with reports of abusive images “exceeding the capabilities of independent clearinghouses and law enforcement to take action.” It suggested that future advancements in machine learning might be the only way to catch up with criminals.

The Times reviewed over 10,000 pages of police and court documents; conducted software tests to assess the availability of the imagery through search engines; accompanied detectives on raids; and spoke with investigators, lawmakers, tech executives and government officials. The reporting included conversations with an admitted pedophile who concealed his identity using encryption software and who runs a site that has hosted as many as 17,000 such images.

In interviews, victims across the United States described in heart-wrenching detail how their lives had been upended by the abuse. Children, raped by relatives and strangers alike, being told it was normal. Adults, now years removed from their abuse, still living in fear of being recognized from photos and videos on the internet. And parents of the abused, struggling to cope with the guilt of not having prevented it and their powerlessness over stopping its online spread.

Many of the survivors and their families said their view of humanity had been inextricably changed by the crimes themselves and the online demand for images of them.

“I don’t really know how to deal with it,” said one woman who, at age 11, had been filmed being sexually assaulted by her father. “You’re just trying to feel OK and not let something like this define your whole life. But the thing with the pictures is — that’s the thing that keeps this alive.”

The Times’ reporting revealed a problem global in scope — most of the images found last year were traced to other countries — but one firmly rooted in the United States because of the central role Silicon Valley has played in facilitating the imagery’s spread and in reporting it to authorities.

While the material, commonly known as child pornography, predates the digital era, smartphone cameras, social media and cloud storage have allowed images to multiply at an alarming rate. Both recirculated and new images occupy all corners of the internet, including a range of platforms as diverse as Facebook Messenger, Microsoft’s Bing search engine and the storage service Dropbox.

In a particularly disturbing trend, online groups are devoting themselves to sharing images of younger children and more extreme forms of abuse. The groups use encrypted technologies and the dark web, the vast underbelly of the internet, to teach pedophiles how to carry out the crimes and how to record and share images of the abuse worldwide. In some online forums, children are forced to hold up signs with the name of the group or other identifying information to prove the images are fresh.

With so many reports of abuse coming their way, law enforcement agencies across the country said they were often besieged. Some have managed their online workload by focusing on imagery depicting the youngest victims.

“We go home and think, ‘Good grief, the fact that we have to prioritize by age is just really disturbing,’” said Detective Paula Meares, who has investigated child sex crimes for more than 10 years at the Los Angeles Police Department.

In some sense, increased detection of the spiraling problem is a sign of progress. Tech companies are legally required to report images of child abuse only when they discover them; they are not required to look for them.

After years of uneven monitoring of the material, several major tech companies, including Facebook and Google, stepped up surveillance of their platforms. In interviews, executives with some companies pointed to the voluntary monitoring and the spike in reports as indications of their commitment to addressing the problem.

But police records and emails, as well as interviews with nearly three dozen local, state and federal law enforcement officials, show that some tech companies still fall short. It can take weeks or months for them to respond to questions from authorities, if they respond at all. Sometimes they respond only to say they have no records, even for reports they initiated.

And when tech companies cooperate fully, encryption and anonymization can create digital hiding places for perpetrators. Facebook announced in March plans to encrypt Messenger, which last year was responsible for nearly 12 million of the 18.4 million worldwide reports of child sexual abuse material, according to people familiar with the reports. Reports to authorities typically contain more than one image, and last year encompassed the record 45 million photos and videos, according to the National Center for Missing and Exploited Children.

All the while, criminals continue to trade and stockpile caches of the material.

The law Congress passed in 2008 foresaw many of today’s problems, but the Times found that the federal government had not fulfilled major aspects of the legislation.

The Justice Department has produced just two of six required reports that are meant to compile data about internet crimes against children and set goals to eliminate them, and there has been a constant churn of short-term appointees leading the department’s efforts. The first person to hold the position, Francey Hakes, said it was clear from the outset that no one “felt like the position was as important as it was written by Congress to be.”

The federal government has also not lived up to the law’s funding goals, severely crippling efforts to stamp out the activity.

Congress has regularly allocated about half of the $60 million in yearly funding for state and local law enforcement efforts. Separately, the Department of Homeland Security this year diverted nearly $6 million from its cybercrimes units to immigration enforcement — depleting 40% of the units’ discretionary budget until the final month of the fiscal year.

Alicia Kozakiewicz, who was abducted by a man she had met on the internet when she was 13, said the lack of follow-through was disheartening. Now an advocate for laws preventing crimes against children, she had testified in support of the 2008 legislation.

“I remember looking around the room, and there wasn’t a dry eye,” said Kozakiewicz, 31, who had told of being chained, raped and beaten while her kidnapper livestreamed the abuse on the internet. “The federal bill passed, but it wasn’t funded. So it didn’t mean anything.”

Further impairing the federal response are shortcomings at the National Center for Missing and Exploited Children, which reviews reports it receives and then distributes them to federal, state and local law enforcement agencies, as well as international partners.

The nonprofit center has relied in large measure on 20-year-old technology, has difficulty keeping experienced engineers on staff and, by its own reckoning, regards stopping the online distribution of photos and videos secondary to rescuing children.

“To be honest, it’s a resource and volume issue,” said John Shehan, a vice president at the center, which was established 35 years ago to track missing children. “First priority is making sure we’re assessing the risk of the children. We’re getting this information into the hands of law enforcement.”

Rep. Debbie Wasserman Schultz, D-Fla., who was an author of the 2008 law, said in an interview that she was unaware of the extent of the federal government’s failures. After being briefed on the Times’ findings, she sent a letter to Attorney General William Barr requesting an accounting.

Stacie Harris, the Justice Department’s coordinator over the past year for combating child exploitation, said the problem was systemic, extending well beyond the department and her tenure there. “We are trying to play catch-up because we know that this is a huge, huge problem,” said Harris, an associate deputy attorney general.

The fallout for law enforcement, in some instances, has been crushing.

When reviewing tips from the national center, the FBI has narrowed its focus to images of infants and toddlers. And about one of every 10 agents in Homeland Security’s investigative section — which deals with all kinds of threats, including terrorism — is now assigned to child sexual exploitation cases.

“We could double our numbers and still be getting crushed,” said Jonathan Hendrix, a Homeland Security agent who investigates cases in Nashville, Tennessee.

The Cutting Edge

The videos found on the computer of an Ohio man were described by investigators as among “the most gruesome and violent images of child pornography.”

One showed a woman orally forcing herself on a girl who was then held upside down by the ankles in a bathroom while “another child urinates” on her face, according to court documents.

Another showed a woman “inserting an ice cube into the vagina” of a young girl, the documents said, before tying her ankles together, taping her mouth shut and suspending her upside down. As the video continued, the girl was beaten, slapped and burned with a match or candle.

“The predominant sound is the child screaming and crying,” according to a federal agent quoted in the documents.

The videos were stored in a hidden computer file and had also been encrypted, one common way abusive imagery has been able to race across the internet with impunity.

Increasingly, criminals are using advanced technologies like encryption to stay ahead of police. In this case, the Ohio man, who helped run a website on the dark web known as the Love Zone, had over 3 million photos and videos on his computers.

The site, now shuttered, had nearly 30,000 members and required them to share images of abuse to maintain good standing, according to court documents. A private section of the forum was available only to members who shared imagery of children they abused themselves. They were known as “producers.”

Multiple police investigations over the past few years have broken up enormous dark web forums, including one known as Child’s Play that was reported to have had over 1 million user accounts.

The highly skilled perpetrators often taunt authorities with their technical skills, acting boldly because they feel protected by the cover of darkness.

“People who traffic in child exploitation materials are on the cutting edge of technology,” said Susan Hennessey, a former lawyer at the National Security Agency who researches cybersecurity at the Brookings Institution.

Offenders can cover their tracks by connecting to virtual private networks, which mask their locations; deploying encryption techniques, which can hide their messages and make their hard drives impenetrable; and posting on the dark web, which is inaccessible to conventional browsers.

The anonymity offered by the sites emboldens members to post images of very young children being sexually abused, and in increasingly extreme and violent forms.

“Historically, you would never have gone to a black market shop and asked, ‘I want real hardcore with 3-year-olds,’” said Yolanda Lippert, a prosecutor in Cook County, Illinois, who leads a team investigating online child abuse. “But now you can sit seemingly secure on your device searching for this stuff, trading for it.”

Exhibits in the case of the Love Zone, sealed by the court but released by a judge after a request by the Times, include screenshots showing the forum had dedicated areas where users discussed ways to remain “safe” while posting and downloading imagery. Tips included tutorials on how to encrypt and share material without being detected by authorities.

The offender in Ohio, a site administrator named Jason Gmoser, “went to great lengths to hide” his conduct, according to the documents. Testimony in his criminal case revealed that it would have taken authorities “trillions of years” to crack the 41-character password he had used to encrypt the site. He eventually turned it over to investigators, and was sentenced to life in prison in 2016.

The site was run by a number of men, including Brian Davis, a worker at a child day care center in Illinois who admitted to documenting abuse of his own godson and more than a dozen other children — ages 3 months to 8 years — and sharing images of the assaults with other members. Davis made over 400 posts on the site. One image showed him orally raping a 2-year-old; another depicted a man raping an infant’s anus.

Davis, who was sentenced to 30 years in prison in 2015, said that “capturing the abuse on video was part of the excitement,” according to court records.

Some of his victims attended the court proceedings and submitted statements about their continuing struggles with the abuse.

‘Truly Terrible Things’

The surge in criminal activity on the dark web accounted for only a fraction of the 18.4 million reports of abuse last year. That number originates almost entirely with tech companies based in the United States.

Companies have known for years that their platforms were being co-opted by predators, but many of them essentially looked the other way, according to interviews and emails detailing companies’ activities. And while many companies have made recent progress in identifying the material, they were slow to respond.

Hemanshu Nigam, a former federal prosecutor in cybercrime and child exploitation cases, said it was clear more than two decades ago that new technologies had created the biggest boon for pedophiles since the Polaroid camera.

The recent surge by tech companies in filing reports of online abuse “wouldn’t exist if they did their job then,” said Nigam, who now runs a cybersecurity consulting firm and previously held top security roles at Microsoft, Myspace and News Corp.

Hany Farid, who worked with Microsoft to develop technology in 2009 for detecting child sexual abuse material, said tech companies had been reluctant for years to dig too deeply.

“The companies knew the house was full of roaches, and they were scared to turn the lights on,” he said. “And then when they did turn the lights on, it was worse than they thought.”

Federal law requires companies to preserve material about their reports of abuse imagery for 90 days. But given the overwhelming number of reports, it is not uncommon for requests from authorities to reach companies too late.

“That’s a huge issue for us,” said Capt. Mike Edwards, a Seattle police commander who oversees a cybercrimes unit for the state of Washington. “You’ve got a short period of time to be able to get the data if it was preserved.”

Most tech companies have been quick to respond to urgent inquiries, but responses in other cases vary significantly. In interviews, law enforcement officials pointed to Tumblr, a blogging and social networking site with 470 million users, as one of the most problematic companies.

Police officers in Missouri, New Jersey, Texas and Wisconsin lamented Tumblr’s poor response to requests, with one officer describing the issues as “long-term and ongoing” in an internal document.

A recent investigation in Polk County, Wisconsin, that included an image of a man orally raping a young child stalled for over a year. The investigator retired before Tumblr responded to numerous emails requesting information.

In a 2016 Wisconsin case, Tumblr alerted a person who had uploaded explicit images that the account had been referred to authorities, a practice that a former employee told the Times had been common for years. The tip allowed the man to destroy evidence on his electronic devices, police said.

A spokeswoman for Verizon said that Tumblr prioritized time-sensitive cases, which delayed other responses. Since Verizon acquired the company in 2017, the spokeswoman said, its practice was not to alert users of police requests for data. Verizon recently sold Tumblr to the web development company Automattic.

Law enforcement officials also pointed to problems with Microsoft’s Bing search engine, and Snap, the parent company of the social network Snapchat.

Bing was said to regularly submit reports that lacked essential information, making investigations difficult, if not impossible. Snapchat, a platform especially popular with young people, is engineered to delete most of its content within a short period of time. According to law enforcement, when requests are made to the company, Snap often replies that it has no additional information.

A Microsoft spokesman said that the company had only limited information about offenders using the search engine, and that it was cooperating as best as it could. A Snap spokesman said the company preserved data in compliance with the law.

Data obtained through a public records request suggests Facebook’s plans to encrypt Messenger in the coming years will lead to vast numbers of images of child abuse going undetected. Data shows that WhatsApp, the company’s encrypted messaging app, submits only a small fraction of the reports Messenger does.

Facebook has long known about abusive images on its platforms, including a video of a man sexually assaulting a 6-year-old that went viral last year on Messenger. When Mark Zuckerberg, Facebook’s chief executive, announced in March that Messenger would move to encryption, he acknowledged the risk it presented for “truly terrible things like child exploitation.”

“Encryption is a powerful tool for privacy,” he said, “but that includes the privacy of people doing bad things.”

‘Vastly Inadequate’

“In a recent case, an offender filmed himself drugging the juice boxes of neighborhood children before tricking them into drinking the mix,” said Special Agent Flint Waters, a criminal investigator for the state of Wyoming. “He then filmed himself as he sexually abused unconscious children.”

Michael H. Keller and Gabriel J.X. Dance

Articles written by the author

'If Those Were Pictures of You, You Would Understand'

Child Abusers Run Rampant as Tech Companies Look the Other Way

The Internet Is Overrun With Images of Child Sexual Abuse. What Went Wrong?