Written submission from the National Crime Agency (PFF0007)

The Director General would like to thank the Committee for visiting the National Crime Agency on 23 January.

We are grateful for the interest the Committee took during the visit and in particular for the questions that were raised during the Vulnerabilities Command briefings provided by Director Will Kerr and the Child Sexual Exploitation and Abuse (CSEA) team.

This briefing paper provides a detailed follow-up response to those questions. 

Key Question 1

‘What criteria are used by the NCA when assessing CSEA reports and which lead to cases being investigated by the NCA/CEOP, referred to local police forces for investigation, or dropped without action/investigation.’

Context

In early 2015, the then Director General of the NCA, Keith Bristow, was not satisfied that there was sufficient activity to assure him (under his statutory remit) that there was evidence of a fully effective and efficient response to the online CSE threat.

On 26 February 2015 he utilised, for the first time, s5(1) Crime and Courts Act ‘voluntary’ tasking powers to task Sir Jon Murphy, the then Chair of the National Police Chief’s Council (NPCC) Crime Business Area, to produce a plan to address this.

In April 2015, the NPCC agreed with the NCA a framework for the online CSE Pursue response. This set out clear organisational roles and responsibilities at a local, regional and national level against six pillars of threat/demand. This is now referred to as the ‘18 Box Grid’ (see Annex B on page 13). Monitoring of delivery against agreed areas of threat or demand at the local, regional, and national level is monitored by the online CSE Pursue Board attended by Assistant Chief Constable regional leads, the NCA and other stakeholders.

The NCA’s prioritisation of Serious and Organised Crime threats to the UK places CSEA as a high priority threat. Structurally, the response to this threat sits within the Vulnerabilities Command which responds to two connected threat strands: CSEA which is the remit of the NCA’s Child Exploitation and Online Protection Centre (CEOP), and modern slavery and human trafficking (MSHT).

The 18 Box Grid provides the context within which the NCA assesses the cases it receives to determine the appropriate response, depending on the pillar under which it sits, and when it would be the responsibility for local forces to investigate.

Investigation by the NCA

The NCA will take primacy where a national response is deemed necessary: for the application of niche capabilities, in severe or complex cases (see case studies at Annex A (pages 10 to 12 below), where a case has a multiple police force or significant international element, or where there are indications of an organised criminal network committing contact abuse. As well as responding reactively to cases it receives, the NCA also undertakes proactive work to identify highly sophisticated offenders operating in hard to tackle areas such as the dark web.

In respect of the action undertaken by the NCA and local police forces within the six ‘threat pillars’ of the 18 Box Grid:

Pillar One – Sharing of Indecent Images of Children (IIOC)

Law enforcement proactively deploys sensitive techniques to identify individuals sharing indecent images of children across the internet. Under this pillar, the NCA actions cases it receives which do not resolve to a single force area, while police forces action cases resolving to their force area. In the two years ending  2017, this activity by UK forces and the NCA has resulted in 3,878 arrests; the scale of file sharing has reduced by approximately 75% since 2014.

Pillar Two - Volume Referrals

The NCA receives, assesses and progresses as appropriate and where possible, volume referrals from a number of sources: industry partners (referrals are mainly received via the US National Centre for Missing and Exploited Children (NCMEC)), members of the public (via the online public reporting portal Click CEOP[1]), or law enforcement (for example from an overseas law enforcement agency targeting online offenders, and identifying users residing in the UK).

Local forces will then investigate cases disseminated to them by the NCA where the offender is identified as residing in their force area, and undertake child safeguarding where a victim has been identified.

Progression of Industry Referrals

The overwhelming majority of referrals are from industry partners, and involve individual instances of the online distribution of indecent images of children (IIOC).

All such referrals are reviewed, triaged and categorised as Grade 1, 2 or 3 by the NCA within two working days of receipt. Graded referrals will attract the following response, depending on category:

• Grade 1 – This includes referral where we identify an immediate threat-to-life of a child. These are prioritised and actioned as soon as possible, utilising NCA officers and resources and/or tasked local policing officers and resources.
• Grade 2 – The category includes exceptionally urgent operational requirements for the prevention or detection of serious crime against a child. They are prioritised and actioned as soon as possible (within a maximum of 48 hours).
• Grade 3 – This category applies where CSEA material or information in a referral is identified as actionable and is allocated to a case officer. Allocation of cases based on a Grade 3 referral is on an ‘oldest case first’ basis.

In line with the 18 Box Grid, the vast majority of cases are disseminated directly to a corresponding local police force. The volume of referrals received and the priority afforded to the higher risk, grade 1 and 2 referrals, has frequently delayed the point at which grade 3 referrals can be disseminated to forces.

To help mitigate this, and following a successful pilot, there was a change in process on 1 March 2017. This change ensured that a proportion of grade 3 referrals are now disseminated to forces based on their geo-location.

This national implementation followed agreement by the NPCC in January 2017, and 40% of all disseminations to force from industry referrals in 2017 were made based on geolocation.

Progression of Law Enforcement Volume Referrals

Volume referrals are received sporadically by the NCA, principally from overseas law enforcement partners. Over the course of a year, this can amount to tens or hundreds of thousands of lines of data, which can vary in quality or detail; some lines of data are anonymised, limiting the options to identify an offender. These are all reviewed and processed, following which they reduce down to a smaller number of identified offenders. The majority of cases identified from such referrals are disseminated to forces, though some will be adopted by the NCA where they meet the above mentioned criteria.

Progression of Public Reports

Since August 2012, review and response to public reports has been led by qualified social workers within the NCA (Child Protection Advisors). All cases are reviewed and the vast majority are progressed through local safeguarding, liaison with schools, and/or provision of advice direct to the reporting person, depending on the nature of the report.

Where appropriate, referrals will be made to children’s social care and local forces in parallel. This mostly occurs where both a suspect and a victim have been identified, and so there is both a criminal investigation and a safeguarding requirement.

In the year ending December 2017, forces made 2,980 arrests and safeguarded 3,359 children in response to volume referrals from industry and law enforcement.

Pillar Three – Victim Identification

The NCA Victim Identification (VID) team identifies and locates victims in cases where the images are unknown to law enforcement, and so may be newly generated (also known as ‘first generation images’). This can indicate that a victim has recently been abused or is currently being abused and therefore needs to be urgently identified and safeguarded.

VID work includes referrals which can’t be resolved to a force area or region as well as victims identified in the course of NCA investigations. Vast numbers of indecent images of children are repeatedly circulated or modified by and between offenders. We proactively focus our effort on high risk and threat environments where first generation images may be created.

Local forces have a designated victim identification SPOC or unit to support their local investigations. 117 victims were identified by UK police forces and the NCA in 2014/15,  rising to 450 in 2015/16 and 524 in 2016/17.

Pillar Four – Live Streaming

The live-streaming of abuse (which involves networking between offenders via online conferencing platforms and 'commercial' live streaming of abuse for payment - particularly from countries in South Asia) continues to be a growing threat. The NCA is leading overarching activity to combat the threat, including streaming activity that has an international aspect. Our work has enabled the arrests of a significant number of offenders who are involved in the purchasing of indecent images of children or live-streaming of abuse from these countries.

Local forces will then investigate live streaming cases disseminated to them by the NCA as a result of volume referrals, where the offender is identified as residing in their force area, or undertake child safeguarding where a victim has been identified.

Pillar Five – Online Grooming and Blackmail

Law enforcement proactively deploys sensitive techniques to identify individuals involved in online grooming and blackmail for the purposes of child sexual exploitation and abuse.

Local forces will also investigate blackmail or online grooming cases, including those disseminated to them by the NCA.

Pillar Six – Complex, International and Specialist Cases

Please refer to Annex A for examples of complex, international and specialist cases, as undertaken by the NCA. Cases of this type are unlikely to be passed to local force for investigation.

Cases Not Resulting in Enforcement Action

Developing the information received, and disseminating a viable intelligence product for operational action, relies upon our ability to identify and locate a suspected offender. This is not always possible, for example where the IP address cannot be resolved.

Though there has been an exponential rise in the number of industry reports, around 50% of these reports are “informationals”. This is the term used for cases reported to NCMEC but which have been assessed to be “viral images”[2], adult pornography images, images of children who are clothed, or where the electronic service provider has acknowledged an omission due to a technical reason[3]. Informationals are therefore largely referred to the NCA by NCMEC for information purposes, and in almost all cases do not indicate the commission of a crime.

A further proportion of reports are duplicates, while in other cases there is no evidence of criminality. The remaining cases are disseminated to forces or the NCA for action.

All information, including for those cases that cannot be progressed, is retained on our corporate record for intelligence purposes. New referrals are then checked against information already held to identify whether new opportunities are available to progress them.

Key Question Two

‘Provide details of the number of cases received by the NCA overall during the last year for which data has been collected, and between 2010 and the latest recording year. Also detail the percentage increase in cases during that period.’

Law enforcement as a whole receives high numbers of referrals from the public and industry concerning online CSE. There are increasing numbers of referrals to the NCA reporting abuse images and criminal behaviour online. This trend shows no sign of abating, as demonstrated in table 1 below. This table highlights the number of referrals received by the NCA since 2010[4].

Cumulatively from December 2010 to December 2017, there has been a 1,239% increase in the total number of industry reports received, and a 102% increase in the number of public reports. A 68% increase in public reports in 2017 followed the launch in October 2016 of the ‘CEOP Safety Centre’[5] which provides a streamlined reporting form. The form has made it easier for children, young people, parents, carers and professionals to report incidences of child sexual abuse directly to the NCA.

The number of indecent images available for exploitation by offenders has increased through the self-generation of images by children for sharing amongst their peers. The NCA anticipates that referrals and detections will continue to increase as a result of public awareness, industry engagement, and proactive law enforcement efforts.

Table 1: Industry and Public Reports Received by NCA and Precursor CEOP, by Year

Key Question 3

‘Detail the number of cases investigated by the NCA (CEOP), and the number of cases referred to local police forces for investigation.’

Cases investigated by CEOP

The vast majority of industry referrals which can be progressed are disseminated to UK forces. NCA/CEOP only undertakes those cases which involve the use of its niche capabilities, for example:

• Operation PREVOMER: a Case Study

On 1 September 2017, Derek Hutton was jailed for 10 years[6] after he admitted inciting children under 13 to perform sex acts on themselves on at least 50 occasions. He also admitted engaging in sexual activity in front of children on at least 250 occasions. Hutton admitted to creating more than 400 accounts on a children’s social media site in order to lure victims on to separate video chat platforms for private one to one interactions. He also pleaded guilty to a third charge of attempting to engage in sexual activity on at least 500 occasions, as well as 11 further sex offences relating to seven victims. Our officers arrested Hutton after the administrators of the website MovieStarPlanet alerted us upon becoming aware of  his activity. Critically, the site’s owners gave full assistance to the investigation. Working closely with the site’s staff we were able to secure evidence, finding that between August 2014 and June 2016 Hutton had created 407 user accounts. Together with partner agencies (including local authorities) we safeguarded 72 children during the investigation.

The NCA’s operational activity is primarily focused on the sixth pillar of demand in the 18 Box Grid. The operations by year are summarised below:

Table 2: NCA CSEA Operations by Year

We secured 284 disruptions[7] against the CSEA threat in 2016/17 compared with 103 disruptions in 2014/15. NCA-led activity resulted in the safeguarding or protection of 1,896 children in 2016/17, compared with 278 in 2009/10.

Referrals to Local Forces for Investigation

Table 3: CSEA Disseminations by NCA and its Precursor CEOP, by Year

Table 3, above, lists the number of disseminations as a result of industry referrals, and the total number of disseminations since 2010. The latter comprises disseminations resulting from industry and law enforcement referrals and proactive NCA activity. The overwhelming majority are disseminated to forces, with a smaller number to overseas partners. The vast majority are intelligence leads regarding single offenders.

In 2017, 9,782 of disseminations were made to forces (90% of all disseminations).

Between 2010 and 2017, there has been a 316% increase in industry disseminations, and a 340% increase in disseminations. The increase in disseminations for 2013 was primarily as a result of Project SPADE (a significant referral from Toronto Police), which resulted in 2,345 disseminations. The 92% increase in industry disseminations between 2016 and 2017 is due in part to the dissemination of 3,361 cases to forces based on their geo-location, compared with 320 in 2016, and none in the preceding years.

Key Question 4

‘What is the overall demand from CSEA upon NCA/CEOP and the 43 police forces, and the nature of cases not pursued/investigated’

Table 4: Disseminations to Forces and Outcomes Achieved in 2016 and 2017

Table 4 (above) provides an illustration of the overall demand on police forces as a result of disseminations made by the NCA in 2016 and 2017.

Cases adopted in 2016 and 2017 are higher than the disseminations received as they include referrals made to forces in the preceding year. Additionally, forces will also undertake their own proactive investigations, and they also receive referrals from members of the public and other police forces.

The majority of cases that are closed with no further action are due to difficulties in attributing the IP address provided in the referral to a specific location. This could be because an IP address resolves to a multiple-occupancy building, relates to individuals already arrested for CSEA offences, or the information received pre-dates their arrest and so has already been captured as part of an earlier investigation.

ANNEX A: Case Studies – Complex, Specialist and International Operations Undertaken by the NCA

Case Study 1: Operation THEREVA

This operation concerned an investigation into Richard Huckle, aged 29, a UK national who pleaded guilty to sexually abusing 22 children in Malaysia and one in Cambodia. His offending included taking images of the abuse, posting it online within the dark web network and advertising for sale the abuse material in return for bitcoin online currency. Huckle travelled to, and lived in, Malaysia where he raped and sexually assaulted children - preying on pre-pubescent vulnerable children from minority communities with whom he had ingratiated himself.

He outwardly presented as a legitimate student, photographer, and philanthropist when in fact he was a systematic abuser of children he deceitfully said he cared for. As he put it: ‘ .. .impoverished kids are definitely much easier to seduce than middle class western kids ... "" ... my freedom relies on the hush mentality of the locals on this kind of thing.’

Huckle was arrested on 19 December 2014 at Gatwick Airport. On 2 February 2015 he was charged with sample charges while the full particulars were considered: three of raping a girl under 13 years, and a charge of taking indecent photographs of a child. On 21 October 2015, the full indictment of 91 charges were brought against him: involving 25 children aged between 0 and 13 years old, who he sexually abused between 2006 and 2014.

A number of digital devices were seized from Huckle's hand luggage on his arrest at Gatwick Airport. On examination, some were found to contain child abuse material - including the same indecent images of children that were uploaded to the Tor website. Over 20,000 indecent images of children have been recovered, over 1,000 are believed to have been first generation images taken by Huckle. These images and videos show offences including the rape of a 3-year-old girl and the sexual assault of a baby - estimated to be six months’ old.

The 23 victims in this case were identified from analysis by the VID teams and from written records of abuse found on one of the devices. When analysts were able to break through the encryption on Huckle's laptop, a Microsoft Excel document with the title “ptsrecord” was recovered in which Huckle “scored” the number of child sexual offences he had committed.

This spreadsheet records his score of 1,305 points in the year Nov 2013-Nov 2014. Huckle wrote a 60-page paedophile manual titled Paedophiles & Poverty: Child Lover Guide, which contained detailed guidance on how to pick victims in poor communities, handle their family, groom them, avoid detection or incriminating evidence, and practical/technical advice on how to have sex with them. In June 2016, Huckle was sentenced to 22 life sentences and ordered to serve a minimum of 25 years’ imprisonment.

Case Study 2: Operation CARAPAX

An investigation into indecent assaults, rape, and child sexual abuse committed in Thailand and the UK by Mark Frost (aka Andrew John Tracey), a UK national. In July 2015, the Dutch National Police contacted NCA/CEOP in relation to a Dutch national found in possession of indecent images of children and Skype chats. These images included videos of Frost carrying out rapes and sexual assaults against a child aged under 13 years. The Dutch national appeared to direct some of the abuse that Frost inflicts on the victims.

Post-investigation, on 14 March 2016, a European Arrest Warrant (EAW) was issued by the UK for the arrest of Frost under Section 72 Sexual Offences Act 2003. Following his arrest on 17 March 2016 by the Guardia Civil in Alicante, Spain, he was extradited to the UK on 28 April 2016 and charged with 22 offences relating to the sexual abuse of children[8].

On 1 July 2016, Frost pleaded guilty to 17 of the 22 charges, and on 1 September 2016 he pleaded guilty to the outstanding five counts on the 22 count indictment. The case was adjourned and Frost was remanded in custody. The adjournment was to allow for new matters to be brought against Frost. Extensive enquiries in Thailand and the UK identified further allegations of non-recent child sexual abuse by Frost dating back to 1989-1992, when he was a teacher in the UK. These matters required the consent of the Spanish authorities before he could be further prosecuted as they were not shown on the relevant extradition papers (the basis for which Frost was initially arrested in Spain in March 2016). Consent from Spain was granted and on 8 December 2016 Mark Frost was charged with 67 additional offences of child abuse committed in Thailand and the UK.

On 1 February 2017, Frost pleaded guilty to a further 23 charges, including six charges in relation to non-recent offences committed in the UK between 1989 and 1992, with the remainder to lay on file. Sentencing was re-listed for 8 February 2017. On 8 February 2017, Mark Frost was given 13 life sentences and will serve a minimum of 16 years in prison (total sentence was 48 years - reduced for early plea to 32 years).

Case Study 3: NCA/CEOP Victim ID Team

An example of how dynamic intelligence from our CEOP VID teams can be quickly prioritised and actioned to safeguard the most vulnerable children at risk from those who should be protecting them, is as follows:

On 5 August 2016, we became aware that an individual had posted on a website first-generation llOC showing the sexual abuse of a child. An individual was identified and on the same day was arrested, the victim was identified and safeguarded, and the premises were searched. The perpetrator was charged on 7 August 2016 with: rape of a child under 13 (s.5 Sexual Offences Act 2003); assault of a child under 13 by penetration (s.6 Sexual Offences Act 2003); sexual activity with a child (s.9 Sexual Offences Act 2003); and taking indecent images of children (s.1 Protection of Children Act 1978). The victim was the suspect's daughter.

On 27 January 2017, he pleaded guilty to 21 serious sexual offences against children, including: rape of a child by penetration, causing a child to engage in sexual activity, taking indecent images of a child, distributing indecent images of

children, and possession of extreme pornography. He was sentenced to a total of

18 years imprisonment.

Case Study 4: Activity in relation to live streaming of child abuse

On 7 September 2017,  Philip Crabtree, 35, was sentenced to eight years and eight months in prison after admitting incitement to commit rape, eight counts of encouraging the distribution of IIOC and three counts of making IIOC. He encouraged and directed a child sex abuser who live streamed the rape of a six-year-old boy. He was in the chatroom 166 times during five months in 2015.

Annex B:  The 18 Box Grid