Missing the mark? Identifying child sexual abuse material forum structure and key-players based on public replies and private messaging networks

Abstract: Darknet forums dedicated to child sexual abuse material (CSAM) attract thousands of users interacting with each other through online communications. Given finite resources, law enforcement agencies seek ways to effectively prioritise their investigative efforts by identifying key-players that are central to the forum community. For the identification of such users, law enforcement agencies typically rely on the communication network that can be derived from messages posted on the public part of the forum. Many forums, however, also allow for private communications between members, raising the question to what extent relying on only a single mode of communication biases key-player identification. Using data on both public and private communications on two large-scale darknet CSAM forums, two communication networks are derived and their structures analysed. Measures of centrality robustness are applied to ascertain the level of bias introduced when determining key-players on only one of the available networks. Findings show only a minority of members to participate in forum communication, and limited overlap between participants active in public and private communications. Key-players emerging from combining the public and private communications resemble those from the public network only, suggesting that police prioritisation based on public postings only is still ‘on mark’. Members who are central to the private communications network may nevertheless be of special law enforcement interest.