Authors: Carolina Christofoletti, Hericson dos Santos and Jorge André Domingues Barreto

Link in original: Click here

Whoever woke up in Brazil this May 18th morning (National Day for Combatting Child Sexual Abuse and Exploitation) woke up also with shocking news on the TV: The Brazilian Civilian Police was conducting, this very morning, what was maybe the biggest Child Sexual Abuse Material (CSAM) Law Enforcement Operation this country has ever seen. The operation was named Operation Lotus and its data is expected to be, for CSAM research, more insightful than ever.

The tips of Operation Lotus came, at this time, not from international partners, but from Brazilian Civilian Police itself. Operation Lotus is said to be the ongoing result of a prior investigation done by the Brazilian Civilian Police on the behalf of another CSAM Operation that happened in the country in November 2020, the so-called Operation Black Dolphin. Once again, from a CSAM club on the Darknet (Black Dolphin), the Brazilian law enforcement authorities came to another – with a probably huge Open Web interface- CSAM club (Lotus), and the final numbers are expected to put the two operations on the podium of a problem that remains, despite all efforts, still hidden in Brazil: The national production of Child Sexual Abuse Materials.

In a country of 27 federated states, 19 states were implicated in the Lotus Operation launched today. Only with these numbers, we can have a preview to think about the size of the problem. Although there is still no information related to victim identification, we expect to see lots of “national” material there. Up to today’s morning, 68 arrest orders were already issued, with São Paulo alone (15), followed by Rio de Janeiro (9), concentrating respectively 22% and 13% of them. More arrests are expected to come as Operation Lotus evolves, so as more data relating to the victims of this national CSAM network.

For the purpose of this article, we are focusing in a very particular issue among many others: A printed CSAM collection. In times of online and transnationally organized CSAM clubs, the fact that police officers found, between the suspects, a significant amount of in-paper-printed CSAM called our immediate attention. But no, we are not talking about an in-paper only CSAM collection.

The suspected was hosting, apart from this old-fashion collection, another huge amount of CSAM materials digitally in his personal device. But why were some images geographically separated from the others? Is there here any CSAM club mechanic that we are missing?

Like CSAM offenders usually do, the suspect probably was showing, by that, a special care for a fragment of his “CSAM collection”. Some images were, different from others, selected to be printed in a A4 paper, “zoomed” in this new dimension. But would that special care (and even preference) for some images itself explain why the suspect printed it? Maybe. Maybe, also, those kinds of material caused him some “digital aversion”.

Who, at the end of the day, printed those images, authoring the CSAM production here? Did the suspect have a printer in his house, or did he print it elsewhere? What was the suspect’s intention with that: Transport it more easily, burn this evidence more easily, or maybe possessing it with lower chances of law enforcement detecting it? The very fact that there were printed images says a lot for an investigation, specially, if we are eventually talking about a case where the suspect had no printer at his disposal, having moved it, maybe, through a Pen Drive of any kind.

Why were those files geographically isolated from the others? A further analysis is needed for saying whether something as a CSAM archive existent only in paper existed in this case or whether the suspected was also digitally some of them. Are we talking about a preference for some images, or rather about files whose upload, download or host somewhere could trigger an alert? (known images)

And the sole fact that, far away from CSAM technology detection tools, someone is physically possessing those images should interest all stakeholders. Are those files new, old, and, if old, were they occasionally downloaded from a platform with a lower level of CSAM detection tools integrity? What is going on with those files? Where did they come from?

Could it but be that the printed pictures correspond to materials that the suspect himself had produced, and the reason why they were printed and not digitally stored is simply a conventional one (e.g., printing it directly from an external device)? Could it be that, being him who photographed the children in question, the act of physically storing it was an attempt to physically hide his own authorship on another crime?

Could it be that the printed materials are considered to be more morally serious (e.g. torture, penetration, bestialism) by the offender than those hosted via a virtual folder, which is why those have been stored in a geographically distinct location, what could also contribute to their rapid destruction in case the police come to his house? Or even the opposite, and the case one in which those are images were printed, mainly, because they were exactly the ones where CSAM classification was harder, creating the “reasonable doubt” in case the police came?

Could it be that the suspect considered those files as being more valuable to him, protecting it geographically so that, in the case of his digital collection being sized, he would be able to keep with those?

Could it be that those were CSAM materials that the accused bought from or change it with somebody, whom he probably knows in person, so this kind of non-digital “CSAM market” is still existent?

Could anybody have mailed him those files? Could those be part of his “private collection”, which, in case he was getting the other files from any online CSAM club, he never shared with others.

So far, the data we have until now are not sufficient to explain, with conclusive decisions, what was happening here. But investigations are still in place. Especially because it concerns the identification of victims, besides the mapping of the structure of the criminal network, the data is of interest.

Last but not least, is the case an isolated one or does it represent a trend, and, in the second hypothesis, what does it indicate to the police intelligence forces?

Questions to think about.