Child-abuse images able to slip NZ’s net
Contract issue puts filter out of service for two months
An internet filter that blocks child sexual exploitation imagery from entering New Zealand stopped working for two months, allowing access to images and videos of abuse from banned sites.
Since the two-month outage last year, the Digital Child Exploitation Filter has failed on two other occasions, allowing access to online child sex-abuse material.
The failure of the filter emerged in Herald inquiries into our national approach to detecting, investigating, preventing and prosecuting online child sexual exploitation.
The investigation has also raised questions about our national approach, as other Five Eyes countries focus their efforts on national centres of excellence.
New Zealand runs its detection and enforcement through three government agencies staffed by 35 people. We have no national strategy, instead relying on a model approach for nations devised by an international NGO.
The issue with the internet filter, overseen by the Department of Internal Affairs, emerged after the previous provider cut short a contract to provide the service through to July 2023.
The Department of Internal Affairs (DIA) was told on February 28 last year that NetClean would stop providing the filter and managed to negotiate an extension until July 31. With only a few months to go, the tender to find a new provider wasn’t put out for bids until May 8.
Asked about the length of time between the contract being cancelled and the tender, DIA said a project team was set up to “clarify our requirements, decide the procurement process and ensure appropriate due diligence took place”. Israeli tech firm Allot was awarded the contract on July 6.
Minutes of a meeting with the Independent Reference Group that oversees the filter revealed it was “not fully functional” until September 22.
In that time, website addresses containing child sex-abuse material were not blocked.
DIA digital safety director Jared Mullen told the oversight group it hadn’t been possible to estimate the risk of “extra harm to children” due to the failing filter. He did tell the reference group there had also been outages under the previous provider.
“The short timeframe to get the new filter system implemented meant that DIA’s standard implementation and testing protocols were constrained,” said a spokesman. “This contributed to the performance issues experienced.”
DIA confirmed there were subsequent outages to the filter in November 2020. In one case, scheduled maintenance at an ISP in the voluntary scheme meant it was disconnected from the filter for seven hours overnight. In another case, an ISP had a cable cut by a contractor and lost connection to the filter.
DIA Digital Safety deputy director operations John Michael said the filter was “a really significant prevention tool”. On the two-month issue, he said: “It means not all of the websites on that filter list were blocked. People could access certain sites if they chose to click on them.”
The filter catches incoming web traffic and redirects users to a page where there are details of how they can seek help. Like referrals arrangements with Facebook and Pornhub, it is one of our few proactive, preventive measures.
Internal Affairs Minister Jan Tinetti said she had been told by DIA the new filter provider offered “greater resilience” than its predecessor.
A Waikato University 2017 doctoral thesis that investigated New Zealand’s handling of online child sexual exploitation found it was technically impossible to block all child sex-abuse material. Rather, it said the filter blocked those whose “curiosity” would lead them to breaking the law rather than those who were “knowledgeable and determined”.
Details obtained from DIA through an Official Information Act request failed to show data on the operation of the filter, which has existed for a decade. DIA told the Herald it could not provide detailed data on how it sorted sites for inclusion in the filter.
Mullen said DIA began gathering this data in 2020, with 4003 websites checked by its child-exploitation team, of which 359 were added to the filter.
In 2021, the proportion of those sites added to the filter rose substantially to March 31 after DIA changed its method of building the list of blocked sites, by adding those found in investigations or on the filter list the year before.
New Zealanders make at least 1000 attempts a day to access online images and videos of children being sexually abused. The true number is probably much higher. David Fisher reports on the struggle to turn back the tide
He is probably Pa¯keha¯ and in a relationship. He is most likely university educated, with a higher than average IQ. Aged between 25 and 50, he is unlikely to have a criminal record. He is probably a heavy internet user and tech savvy.
And he is trying to access images and video of children being sexually abused.
Somewhere in New Zealand, he will click on a link that — if he’s not careful, if he’s unlucky — could set in chain events that will lead to his downfall.
That click sends a signal across the internet, reaching for the image or video he has selected and drawing it back to New Zealand. Much of the internet travels through the United States, where that single click is most likely to trip wires intended to catch men like him.
There are at least 1000 attempts each day like this in New Zealand, and many more that travel the internet’s secret routes designed to tunnel under the tripwires.
If his click is intercepted, it will almost certainly be by a US tech company compelled by law to report every instance of possible child sexual abuse material to the National Centre for Missing and Exploited Children.
The NCMEC acts as a clearinghouse for the world, identifying children at immediate risk and sending leads to the country bestplaced to investigate. In 2013, it received half a million reports. In 2019, that had grown to 17 million.
Among those, a solitary click from New Zealand is bundled together with others and sent back around the world to the Department of Internal Affairs (DIA) in Wellington. In 2019 we received 3379 tips like this. And that’s where it gets complicated.
Three agencies
In New Zealand, we have three separate agencies that investigate and prosecute online child sexual exploitation.
There is Internal Affairs, where just shy of 12 staff (11.875 full-time equivalent staff) triage the NCMEC’s CyberTipline reports to New Zealand. It will investigate and prosecute some.
Others are sent to Customs, which has 14 staff, or the police’s Oceanz (Online Child Exploitation Across New Zealand) team, which has 11 specialist staff. Alongside the NCMEC reports, each team generates its own work.
Investigators across the agencies co-operate daily, and through the tri-agency Taskforce Ruru, despite being spread across a range of locations.
It’s a structure that is “far from ideal”, according to ECPAT Child Alert director Eleanor Parkes.
While she is enthusiastic about the work done by committed and
The sheer volume of the crime type, it would be a little bit false to say we’re on top of it. I don’t think anyone in the world is. Simon Peterson, Customs
hard-working staff, she says there is so much more that could be done in an area that’s struggled for years to receive attention or resourcing.
In contrast, as the problem has grown in scale and sophistication, our Five Eyes partners have developed “centres of excellence” to consolidate expertise
ECPAT Child Alert — the nongovernment agency named for its goal to End Child Prostitution and Trafficking — backs the enforcement and prosecution efforts of the tri-agency effort but says it doesn’t keep pace with the scale of the problem.
“Right now we see a small handful of staff from Customs, DIA and NZ police stretched across all of the abuse that exists on the dark web, so of course they have to prioritise.”
Data gathered by the Herald shows Internal Affairs, Customs and police prosecuted between 80 and 100 people a year from 2017 to 2019 on charges relating to possession of child sexual abuse material. The near 100 per cent conviction record relies as much on a quirk of the offending type as anything — those accused tend to plead guilty quickly to avoid a public trial and, in some cases, to avoid having investigators dig deeper into encrypted material.
Parkes said the number of convictions was “just tapping the very tip of the sexual exploitation iceberg in New Zealand”. It’s a view also held by Customs, with a briefing from the agency saying “it is likely that there are a vast number of people who are not being prosecuted”.
British research from 2012, if extrapolated to New Zealand, suggested there would be about 4000 people here who accessed
sexually exploitative material involving children.
That’s nine years ago — since then, the numbers of those accessing such imagery has exploded. In 2018, New Zealand Attorney General David Parker and then-Justice Minister Andrew Little were told during a Five Eyes meeting that the problem had grown twenty-fold in five years.
Internal Affairs records show the country’s voluntary filter system — subscribed to by most internet service providers — detects about 1000 attempts a day to access child sexual abuse material. It doesn’t pick up those operating invisibly on the dark web, hiding behind encryption or using untraceable private networks.
No national plan
Again unlike our Five Eyes partners, New Zealand does not have a national strategy to deal with the issue. Parkes: “If we had a national plan of action then we might see more collaboration with other government agencies and better resourcing.”
The issue is one in which simply adding staff numbers is not enough — although, says one investigator who has worked in one of the agencies, it would definitely help: “One hundred FTEs [full-time employees]” based centrally “would not be unreasonable”.
A more effective solution was mooted by Customs officer Kesta Dennison in 2018, speaking to a United Nations conference in South Korea.
She spoke of a combination of education, enforcement, governance and leadership — essentially closely stitching together efforts across government agencies, countries, technology companies, non-government organisations.
While Internal Affairs Minister Jan Tinetti has detailed to the Herald the international agreements New Zealand has signed up to, it appears to be a patchwork. The Herald discovered those links do not include an information-sharing agreement with Europol, the European Union’s law enforcement agency. Europe is a world centre in trafficking of child sexual-abuse material.
Discussions have been under way since 2019 when the European Commission (EC) pointed out that New Zealand was the only Five Eyes country not to have such an agreement, instead exchanging information through third parties like Interpol. A briefing document to the EC said the lack of an agreement “limits the capacity of both sides to share valuable operational information and to engage systematically with each other”.
It’s an ambitious plan from a country with 35 people in three agencies working to catch at least 4000 offenders. It’s also difficult when the lead agency — Internal Affairs — operates as the “everything drawer” of government, with more than 50 distinct business units from Archives NZ to the Fire Service under its broad umbrella.
Former Internal Affairs Minister Peter Dunne recalls occasional briefings on the department’s efforts combating online child sex exploitation and discussion about better ways of organising New Zealand’s response. The tri-agency approach is, he says, “legislation legacy and bureaucratic legacy”, with Internal Affairs and its minister taking the lead “by default”.
Customs response
Chief Customs Officer Simon Peterson says the agencies involved constantly seek out better ways to collaborate, including internationally with enforcement agencies and the “centres of excellence”. “That’s not to say there wouldn’t or shouldn’t be a more task-force approach [in New Zealand] in the future. That’s something that should always be considered and always be thought about but we’re not complaining the system we operate currently is so broken we need to fix it.
“We could co-locate. There would be definitely advantages to that and possibly disadvantages.”
At this point, though, he says “we need the tools and the legislative backing to deal with the problem differently”.
Peterson says there isn’t an “effective approach” to dealing with the unknown number of offenders.
“No one has enough resource to deal with that number of offenders. When we do find one, where we do manage to deal with one, we’re effective. The sheer volume of the crime type, it would be a little bit false to say we’re on top of it. I don’t think anyone in the world is.”
A solution was not to be found in enforcement, he says. “It needs to change at a much higher level
than that and it needs to change internationally at a much higher level. There needs to be a different approach in legislation and via communities in general.”
Asked about a national strategy, Peterson said there was good crossagency co-operation in and outside New Zealand. “It would really help if there was a national strategy.”
Internal Affairs digital safety deputy director John Michael said investigators from the three agencies did “connect up physically when we need to”.
“The resourcing we have at the moment and the collaboration we have gets us a really effective response in New Zealand.”
Internal Affairs is the lead agency of New Zealand’s response and, from that perspective, Michael confirmed there was no national strategy other than our adoption of a “Model National Strategy” developed by an international nongovernmental organisation for reference.
“The great thing about a national strategy”, he said, was it gave “clear direction, guidance and clear principles”. He believed this was being achieved without one.
Tinetti — who is also Minister for Women — said she was “proud” of and had confidence in the work done by enforcement officers.
She said the creation of a “centre for excellence” hadn’t arisen and there had been no request for extra staff to grapple with the growing problem.
Asked why New Zealand did not have a strategy, Tinetti said: “Child sexual exploitation is a global issue that demands a global response.”