Introduction

The darknet, in simple terms, is a network available on the Internet. This network requires specific software and an individual’s Internet-capable device configured in a way that marks the darknet available to their device. At present, the world wide web has 5.07 billion users per day (Datareportal 2022). While the number of daily users on the darknet is estimated to account for only 0.04% of the total number of daily Internet users, this still amounts to around 2.5 million users per day (Wise 2022).

In May 2021, the police arrested five German men, aged between 40 and 64, who are suspected of having run “Boystown,” one of the largest child sexual abuse forums on the darknet (Connolly 2021). According to the police, the forum had been online for 2 years and, at the time it was shut down, had over 400,000 registered members. Three of the men arrested were accused of founding and maintaining the forum, and one was described as one of the forum’s most active users, contributing over 3500 posts. Research conducted in 2015 found there were 900 child sexual abuse forums like “Boystown” active on the darknet at the time, together receiving an average of 168,152 requests per day (Owen and Savage 2015).

Given the central place the Internet takes in our present-day society, clinicians, therapists, and other professionals who deal with individuals who have committed sexual offenses against children may be confronted with those whose sexual offending, partly or wholly, involved viewing, sharing, or downloading images of child sexual abuse on darknet forums like “Boystown.” In the current review, we describe the evolution of these online child sexual abuse forums and review the scant academic literature on the topic to inform practice and “de-mystify” darknet child sexual abuse offending. We then conclude with implications for practice.

What is the darknet?

While predecessors of the world wide web were being developed as early as the 1950s, and the “birth” of the Internet is typically situated in the second half of the 1990s, it was not until 2004 that the Internet placed itself at the core of our daily routine activities. The Internet was used by half of the households in North America in the early 2000s and by most (90%) of the households by 2018 (Martin 2021). Similar percentages apply to European countries (Eurostat 2022). The Internet’s global rise in popularity was aided by technological progress that on the one hand increasingly provided households with the hardware—such as laptops, tablets, and smartphones—needed to access the Internet, while on the other hand improvements in the software allowed a speedy and reliable transfer and storage of increasing numbers of data. With it, the Internet changed nature from a publishing medium to a participatory medium; a place where users can communicate, interact, and create user-generated content in budding virtual communities. By now, some of these communities have become household names (e.g., Facebook, Twitter), every day serving billions of users worldwide. Outside the mainstream, however, hundreds of thousands of smaller virtual communities exist orbiting around a user’s personal characteristics and experiences, religious beliefs or political opinions, and other subjects of shared interest.

The global use of the Internet also generated a need for anonymous online interactions, for military personnel but also for journalists and representatives of political and religious minorities living under autocratic regimes. To serve this need, the US Navy developed the first prototypes for The Onion Router (TOR) as early as the 1990s. In 2002, TOR became publicly available, providing a network of thousands of servers that can be used to obscure the identity of its users. TOR encrypts the online traffic, by rerouting the IP address of the user through randomly chosen servers making it nearly impossible to trace it back to its original address. TOR quickly increased its popularity in 2008 after the launch of its browser version that can be downloaded on computers or smartphones making it easily available to the wider public.

The TOR browser, on its own merits, is an application and preforms as an Internet browser, enabling the user to access the world wide web, while ensuring anonymity for the end user. In addition to these “clearweb” sites, the TOR browser accommodates darknet sites or onion sites—websites whose url ends with .onion. These darknet sites are websites, forums, and other online archives that are not indexed by publicly recognized search engines, referred to as “hidden services” or HSes.

While the darknet is heralded for playing a key role in boosting social movements, the anonymity of TOR also provides home to a broad array of criminal marketplaces, where users sell and buy illicit products and services, from arms, drugs, and hacked credit cards to hitmen and human organ donors. Infamous HSes marketplaces like Silk Road and Alphabay serve hundreds of thousands of online customers. They mirror the workings of legal marketplaces on the clearnet, such as Ebay, and facilitate vendors in advertising their product and offer escrow services to customers paying for their purchases in Bitcoin or other crypto currencies. Many marketplaces also have chat forums that vendors and customers alike use to introduce themselves and their products, review their experiences, and provide feedback and tutelage to others in the online community.

Child sexual abuse material in the digital age

Being in the wake of the sexual revolution, the climate toward adults having sexual relationships with minors in the 1970s and early 1980s was more open than it is now, but even then sexual attraction to underaged children was generally viewed as atypical. During those times, persons attracted to minors congregated in support groups where fantasies were openly discussed among the like-minded attendants. Typically, to avoid the attention of law enforcement, organizers of such support groups ensured no child sexual abuse material (CSAM) was openly exchanged during these meetings. Although illegal, those interested in CSAM could, however, resort to adult book shops selling dedicated magazines, or order periodicals containing sexually explicit images of underaged children by surface mail. Fueled by several highly mediatized cases of child sexual abuse, public opinion and law enforcement practice during the 1990s tilted toward a much less tolerant stance. In response, many local support clubs were disbanded, and adult book shops narrowed their range of products to avoid prosecution.

The rise of the Internet brought with it new opportunities. Following the success of Napster, a peer-to-peer network that allowed users to search local disks of neighboring computers for music files and, when found, download them directly, other more extensive peer-to-peer networks developed that also facilitated sharing digital images and movie clips (Europol 2021). Images and movies sought for and shared also included CSAM. The rise of social media also gave rise to dedicated online forums focusing on “child love” (Goldman and Ronken 2000). Before, support groups had been a local matter, their clientele mostly coming from the city they were held in. Social media changed this and allowed associations with like-minded others from across the globe. As with the offline support groups, however, moderators of these forums had to be keen on members not committing crimes while in the forum environment. Although visitors of these forums used nicknames to communicate online, they were very aware that their true identity could easily be exposed, either by hackers or by the police.

The darknet reduced the worry of being exposed. By hosting forum websites only accessible to other TOR users, the darknet offered the ideal platform for creating online spaces where those with a sexual interest in minors could come together to freely discuss their thoughts and feelings without fear of being identified. The anonymity provided by the darknet also offered a new venue to access and exchange CSAM, connecting demand and supply on an unprecedented global scale. The growing availability of smartphones with ever better cameras also blurred the distinction between consumers and producers, further increasing the amount of CSAM circulating. At present, darknet CSAM forums are at the heart of a global online community that serves the interests of hundreds of thousands of individuals with a sexual interest in children (Europol 2021).

The scope of the CSAM in the darknet

While it is recognized that the darknet was initially used to create an application or modus for free speech, particularly in areas of political conflict, in reality, its anonymity has rendered much of the darknet a criminal marketplace. As per the Global Commission on Internet Governance (Global Commission on Internet Governance 2015), “the darknet certainly is the seedy underbelly of the Internet. Its sordid nature is exemplified in a few stories about drugs, assassination, trolling and child abuse” (p. 2).

The rise of child sexual offending on the darknet was identified by law enforcement agencies (LEA) as recently as 2009 with the Freedom Hosting service in Ireland (Pierluigi 2013), which led to an 11-year legal procedure to extradite the site’s administrator to the United States. In 2011, Europol partnered with 13 countries under Operation Rescue, specifically targeting darknet CSAM offending sites. Operation Rescue led to 670 suspects identified, 184 arrests made, and 230 children safeguarded from sexual harm (Europol 2011). At the time, this operation was a high-impact law enforcement operation on the darknet, with LEAs having to navigate jurisdictional issues, technical barriers, and the ability to translate technical evidence to everyday language during court procedures. More recently, Europol still identifies the darknet as a criminal threat. Under the European Multidisciplinary Platform Against Criminal Threats (EMPACT 2022+; Council of the European Union 2023), technological threats are stated to be: “Peer-to-peer (P2P) networks and anonymised access like darknet networks (e.g., Tor). These computer environments remain the main platform to access child abuse material and the principal means for non-commercial distribution. These are invariably attractive for offenders and easy to use. The greater level of anonymity and the strong networking possibilities offered by hidden internet that exists beneath the ‘surface web’ appear to make criminals more comfortable in offending and discussing their sexual interests” (Europol 2022).

In general, technology companies still believe that the darknet has merits, and that it supports political and religious freedoms. A further notion is that the darknet’s prevalence rates for CSAM websites are similar to the prevalence volume of CSAM sites on the clearnet. A 6-month program was undertaken to measure the number of darknet sites, the content type of these sites, the length of time they were available, and the frequency of new darknet sites being made available within the network (Owen and Savage 2015). Over the period of the research study, the authors used content classifiers to identify different types of darknet sites. In total 80,000 unique .onion addresses (the unique identifier for darknet sites) were identified with a daily average of 45,000 active sites. Of these “active sites,” 16% (n = 7200) were related to drugs and 2% (n = 900) were related to child abuse sites. For clarity, considering the whole of the darknet, drugs sites were at the highest end of classified darknet sites and child abuse sites were near the lower end. Still, in the same period (2015), the Internet Watch Foundation identified 1991 unique domains on the clearnet hosting CSAM. This accounted for 0.001% of reported active domains in the clearnet in January 2016 (IWF 2022). Hence, taking the total number of sites into account, CSAM sites are approximately 2000 times more prevalent on the darknet than on the clearnet.

Owen and Savage (2015) also examined the level of Internet-based traffic and found that child abuse sites within the darknet accounted, on average, for over 80% (n = 168,152) of browsing requests per day. While there are some technical parameters that may have caused a slight increase in traffic levels in the child abuse sites (i.e., law enforcement’s investigations), it is improbable the high level of traffic was due solely to law enforcement actions. In short, the Owen and Savage (2015) study found that there are many (popular) sites on the darknet that actively promote communities of users who have a sexual interest in the exploitation of children.

Darknet CSAM forums

Location and appearance

Getting to know the location of the CSAM forum is the first step in the offending process (van der Bruggen and Blokland 2021a, see also: Leclerc et al. 2021). Darknet CSAM forums are by their very nature not indexed by search engines or any other mechanism. While the Hidden Wikies (see Fig. 1) act as a guiding list for users seeking offending sites, access to these wikies can only be obtained through the TOR application. When we consider CSAM websites, one of the security protocols to keep the community safe is to only share the .onion address with like-minded users. With the increasing technical capabilities of law enforcement agencies (e.g., Federal Bureau of Investigation [FBI] 2017), the addresses in the darknet are circulated in encrypted communications, offending communities in other darknet sites, or through requests from one community member to another. The maintaining of a publicly advertised list is discouraged and when identified, the .onion address is quickly changed in order to prevent LEAs from becoming aware of its existence.

Fig. 1
figure 1

The Hidden Wiki provides .onion addresses for various offending sites on the darknet. For reasons of security, darknet CSAM forum site addresses, however, are typically shared privately

Full size image

Darknet CSAM forums are mainly built on open-source code, like phpbbFootnote 1 (PhPBB 2022), with some users with coding skills creating similar open-source forum coding, which readily caters to online offending communities. The sites are simple in their appearance, mainly due to the limited technical capabilities of individuals and the community. Consequently, most darknet CSAM sites do not have a high-security technology. Security is driven by the exclusivity of membership, the site being hidden from index search engines, and the hosting location of the site not being easily identified. The bulk of the forums’ security is through the encrypted capability of TOR. There is a misconception that CSAM forums are run by highly technical people. However, from the experience of LEA during investigations, the site administrators are typically not “technical geniuses.” For example, during Operation Pacifier (the FBI’s operation on the darknet site Playpen), the administrator and creator was found to a man in Naples, Florida, who ran an excavation trucking company with no formal training or employment within the technical industry (Associated Press 2017). The creator set up the darknet site, which was stated to have over 150,000 members. This site was set up in August 2014, with the individual running it until his arrest in February 2015. Due to technical mismanagement of the site, leaked data led to the identification of the site and ultimately the administrator in Florida (Dordal 2018).

The landing pages for CSAM forums are not like the high-end enterprise social platforms that general web users have become familiar with in this technological age. They typically are dark, bland, and often have a pre-1990s feel to their structure, displaying a simple landing page with lists of topic-specific “chat rooms” (Fig. 2). Users typically must register either by way of an invite from the site owner, the site moderation team, or other high-level members (members who actively contribute or are considered VIPs on the site) of the site prior to accessing the site.

Fig. 2
figure 2

Actual child sexual abuse material forum landing page

Full size image

When entering the forum, the user first needs to commit to the “rules” of the community, which might or might not correspond with the reality of the community. Some forums, for instance, allow only “light” penetration on children under the age of 4 years, or prohibit hurt core—CSAM showing pain and anguish. Like social network sites in the clearnet, darknet CSAM forum members maintain profiles and are known to other users by their nicknames. Forum members may communicate with each other not only in discussions and in private messaging but also by liking each other’s posts or the contents of the media sections.

Upon entering the forum, the user usually sees separate sections for pictures, videos, and further content. These sections are again divided into several sub-topics, for instance, according to the gender and age of the victim and/or the nature of the content, such as soft core, hard core, and different kind of fetish also found in adult pornography, including, diapers, doctor, and bondage (see Fig. 3). In addition to CSAM pictures and videos, the communities maintain large textual sections. These include discussion areas (chat rooms), within which users discuss topics varying from mundane everyday life issues, news and politics, notable research studies, and law enforcement operations, to how best to approach children and commit sexual offenses in the offline world. The discussion areas are often provided in many languages including ones that are not widely spoken, such as Czech, Hungarian, or Scandinavian languages, reflecting the global reach of these CSAM communities. The textual section typically also includes a tech forum within which inexperienced users can find technical advice on how to operate safely on the darknet (van der Bruggen and Blokland 2021a). The largest communities report of having hundreds of thousands of registered users. However, the total number of active CSAM forum users is unknown.

Fig. 3
figure 3

Screenshot of the darknet forum TweenFan Island

Full size image

Forum organization

Much like a regular business, the typical darknet CSAM forum is hierarchically organized, and different forum roles are distinguished (see Fig. 4; van der Bruggen and Blokland 2021b).

Fig. 4
figure 4

Different forum roles cropped from the CSAM forum landing page depicted in Fig. 2

Full size image

Administrators

At the top of the hierarchy are “administrators,” sometimes further subdivided in “head administrator,” “administrators,” “co-administrators,” and “moderators” depending on the forum’s size and complexity. Administrators or “admins” set up and maintain the forum environment. On a strategic level, they decide on the course of the forum, both in terms of its contents and the rules of the forum and in terms of its membership. One of the leadership roles for administrators is to determine the type of content that can be added (uploaded) by the forum members. The administrators will agree to block certain content from the forum—forums propagating “child love” (sexual contact with children) may, for instance, ban hurtcore. Admins also decide on what is required to become a registered forum member. Certain sites will require candidate members to upload CSAM to the forum environment or to participate in discussions before allocating full membership. Administrators also shape forum publicity in their efforts to attract new forum members. On a more day-to-day level, forum administrators are responsible for keeping the forum environment readily understood and easy to navigate. It is also their duty to safeguard the forum from online attacks by hacktivistsFootnote 2 and permeation by law enforcement. Behind the scenes, their role is to ward off hackers flooding the site with traffic rendering the forum unavailable for its members and maintaining up-to-date levels of security to shield the identities of its users from police investigation.

On the forum itself, administrators, together with other users, continuously educate forum members on security procedures, and issue warnings—and sometimes forum bans—to those who fail to abide by the rules. In criminological terms, administrators can be viewed as digital place managers responsible for organizing the digital place, regulation of members’ conduct on the forum, control of access to the forum, and the acquisition of resources needed to carry out these tasks (Madensen 2007). Major difference between forum administrators and place managers, in the common criminological use of the term, is that crime is assumed to occur in physical locations where place management is absent, ineffective, negligent, or corruptible (Eck 1994). On the darknet, digital place managers are, however, pivotal in actively shaping the opportunity to offend.

Very important persons

On the second rung in the forum hierarchy are VIPs; members with a privileged status, sometimes further differentiated into “SVIPs” (super very important persons), “VIPs,” “producers,” and other “honorary members.” VIP status is allocated by the administrators of the forum, and can be based on membership seniority, outstanding contributions to the online community (e.g., writing technical tutorials), or, in the case of “producers,” by creating exclusive forum content. The CSAM forums often have restricted areas that only administrators and VIPs have access to. On certain forums, SVIPs and VIPs will have more latitude to the rules. If an SVIP or VIP breaks the rule, administrators will address it but will, in general, not ban them. This latitude is based on the SVIP’s and VIP’s status and the potential for a negative reprisal to cause unrest within the forum community.

Cappers

A group called “cappers” has recently gained attention and respect in many of the CSAM communities. “Capping” is a recent phenomenon and a novel way to create CSAM through the recording, editing, and sharing of live-streamed online CSA. Distant live streaming of CSA differs from other online CSAM offences: It is financially motivated and has virtual and physical elements (Cubitt et al. 2021). The facilitators of the live-streaming sessions target sexual violence on the child in front of a webcam for financial benefit. The customers, in turn, order virtual sessions without being physically present (ECPAT International 2020; Europol 2021). The child victims are often based in developing countries (Europol 2021). Live streaming of child sexual abuse involves the digital trafficking of children, where an individual procures and directs the sexual abuse of children. The platforms used are within a clear web. Unless the abuse is recorded by the capper, the capturing of the evidence for the abuse is difficult for law enforcement to detect. For cappers, editing such contents is risky, because it necessitates the downloading of illegal content into one’s own hardware for editing. This leaves digital traces that can be used by LEAs in potential investigations. These individuals have obtained or procured CSAM directly from a child victim or their molesters while recording the abuse. However, the risk is outweighed by the prestige of sourcing new CSAM, as these individuals are aware that new CSAM is in high demand in the communities. This contributes to the influence that cappers command within the forums.

Regular forum members

Below administrators and VIPs are regular forum members. Depending on forum policy, “full members,” “registered members,” and “inactive members” can be distinguished. Full members have registered on the forum and meet all other requirements of membership, such as, for instance, a minimum number of posts to forum threads. Registered members have begun the process of registering on the forum but have yet to meet other requirements of membership. Finally, inactive members were once full or registered members, but have failed to meet the requirements set by the forum to maintain their membership status. Inactive members can usually regain full membership status by starting to comply, for example, by regularly interacting with other members through forum posts.

Forum members’ activity patterns

Like research on other types of social media, research examining the communication patterns on darknet CSAM forums finds that a small percentage of forum members account for a disproportionate amount of the forum’s public communications. In a study on a darknet CSAM forum with nearly 15,000 active members and over 400,000 posts, Van der Bruggen and Blokland (2022) found that the 109 most active posters (0.7% of all forum members) were responsible for 40% of the forum’s public communication, each submitting over 500 posts. This study further revealed that many forum members refrained from subsequent communication after their first post—which was a requirement to obtain full membership of the forum under scrutiny. About one in five forum members, however, showed an escalating or continuously high frequency of forum communications throughout much of the period the forum was online. Among those frequently communicating on the forum are many VIPs and administrators, once more underlining their importance in sustaining the online CSAM community. Studying a darknet CSAM forum—one that did not require candidate members to submit a post—Van der Bruggen et al. (2022) found that during the 8‑month period this forum was online, nearly 97% of its visitors did not communicate on the public part of the forum. These 97% accounts were classified by this research as “lurkers” or commonly referred by members of the online CSAM communities as “free-riders”—users who benefit from the community but do not contribute. However, despite so few visitors communicating, nine out of every ten forum visitors did attempt to download CSAM at least once (van der Bruggen et al. 2022). The average visitor was active on the forum for a period of 2–3 months, spending almost 1 h per week browsing through the forum content.

Forum members actively contributing to the public discussion on the forum commonly write and share (erotic) stories and poetry involving children, follow media and literature concerning pedophilia and child sexual abuse, and post relevant clearnet and darknet links to other pedophilia and CSAM forums, reflecting that sexual interest in minors is an underlying motive to be part of such communities. Forum posts often contain cognitive distortions (Holt et al. 2010). For example, forum members regularly argue that they act in the interest of children:

“We give them our time and attention and concern. We CARE about them, and their futures. Sure, there are the rapist among us […] But, that’s a tiny minority of ALL men, of all sexualities. Most boylovers truly care about their boys, sacrifice for their boys, and give them a lot in return for the lovemaking. And our boys enjoy the lovemaking not only for the pleasure itself, but for how happy it makes us, knowing a sense of security in that pleasure with us. Knowing it binds us together, even if they don’t fully understand it.”

Many posts view children as sexual beings able to initiate and enjoy sex—and benefit from it (Szumski et al. 2018). For example, one poster wrote:

“Truth: Some boys and girls benefit from and enjoy sexual attention from men and women (probably more than we know.) Truth: Society will continue to suffer as long as we deny our truth and deny it for others.”

A common neutralization that appears is the argument that sexual violence does not cause injury, but that children benefit from sex (O’Halloran and Quayle 2010). According to one posting member:

“So, basically, the boylover is the perfect mentor to the boy. He will devote the time and effort required to give the boy the skills he needs as a man. And, AS a man, that boy will be an ally to the older man who trained him, so, training up a few boys is old age protection. It ensures your status in the tribe remains strong, because the new vital males have stronger affection for you. More positive reinforcement for evolution to fix into our species.”

Many members of the darknet CSAM community believe that their sexual behaviors should be regarded as just another sexual preference rather than criminalized. In one forum examined as part of the current research, the topic thread “pedophilia-the-next-sexual-right” was highly active in the “News Articles” area of the forum. One post stated:

“Pedophilia certainly is a sexual orientation by any definition. Problem is, for us, that this is the earliest beginnings of its acceptance—akin to being gay in America in the 1930’s. I think, if it ever is successfully argued, won, and accepted by society, it will be long after our ball sacks are dried up and shrivelled. Maybe late in this century, if we’re lucky, will a man be able to date a 13-year-old girl openly and without prejudice. Which technically would only be a return to a human sexual norm that was held in a previous era. IMHO though, I highly doubt society will ever legally allow an adult to have sex with a preteen. It’s simply too much of a violation of the parental rights to oversee their children’s guidance. Sex with your own preteen child may be another story though.”

The CSAM communities continuously monitor the actions and prosecutions that are taken by LEAs, especially when it comes to identifying darknet users. In an operation conducted by Homeland Security Investigations (HSI) in 2012 in the United States—codenamed Operation Sunflower—123 child victims of sexual abuse were identified and rescued. This operation was considered the “first” of its kind, a concentration of LEAs activity on a darknet site. This operation used victim identification specialists, analyzing images seized from child sexual offending websites, including darknet sites. The operation led to 245 individuals being arrested. Within darknet CSAM forums, articles and videos about the operation were critically analyzed, resulting in an update of security advice from forum administrators. The security advice included measures to be adopted by their members prior to uploading images and videos to the sites; moderators to be proactive in removing metadata from the material; and for all the members to engage in counter-victim identification techniques.

When such operations are taken by LEA, community members of a “taken down” site will “go quiet” [become inactive] for a number of days. This enables the CSAM community to understand the consequences of the LEA operation. However, as the members realize that they are not subject to investigation—e.g., their residence has not been searched under an LEA warrant—they quickly communicate with friends and members of the community. They discuss an online rendezvous point, where they either join or re-engage with another active CSAM darknet forum.

The following example may serve to illustrate forum members’ monitoring of LEA activity. In 2013, “a producer” was arrested in Russia for the production and distribution of child sexual abuse material. The producer was recording the sexual abuse of his 12-year-old niece over a 3-year period. The images were analyzed by the Russian Interior Ministry, resulting in the identification of the child and the offending individual. In the public statements made by the authorities, a number of investigative techniques were disclosed resulting in darknet users advising the community that they “should never show the girls eyes and never show anything else than the girl” (see Fig. 5).

Fig. 5
figure 5

Communication cropped from an actual darknet CSAM forum, discussing law enforcement agencies’ investigative techniques

Full size image

Academic research on perpetrators and victims of child sexual abuse is also regularly discussed in darknet CSAM communities. Forum members do seem to cherry pick results that align with their beliefs, or twist research outcomes so as to validate their viewpoints. Within CSAM forums, these viewpoints are then spread to other community members as fact.

The psychology of darknet CSAM forum members

To date, psychological research on darknet forum members is scarce. Van der Bruggen and Blokland (2022) used methods taken from life-course criminological research to explore patterns in forum members’ posting behavior, and linked these to typologies of CSAM offenders previously proposed based on theories on sexual offending, problematic Internet use, and casuistic law enforcement experience. As data on members’ posting were limited to the timing, frequency, and topic, caution is needed when attempting to relate forum members’ observed posting sequences to theoretically derived psychological profiles.

Woodhams et al. (2021) use forum postings and private emails/messages of 53 individuals suspected of CSA/CSAM offences from four different darknet CSAM forums that were under police surveillance at the time of data collection. Based on content analyses of transcripts of these forum postings and private emails/messages, Woodhams et al. were able to obtain novel insights into the suspects’ demographic characteristics (e.g., 34% of the sample reported having regular access to children), their motivations for using the darknet (e.g., for 32% it was accessing CSAM material), their sexual interests (e.g., sadism [26%] and incest [17%] being most frequent), their suspect–suspect interaction behaviors (e.g., sexual exploitation and abuse of children featured in most of the interactions), their technical and security precautions (e.g., cautioning one another about their behavior), and reported engagement in child sexual abuse (e.g., for 21% there was evidence that they had or were inciting another person to sexually abuse a child).

In another innovative study, Protect Children launched two surveys that were presented to individuals searching for CSAM on the darknet using certain keywords (Insoll et al. 2021). The first report was of a sample of 8484 respondents of whom 61% (n = 5171) answered numerous questions on their feelings, interests, and behaviors. Respondents reported being exposed to CSAM already at an early age—70% were younger than 18, and 40% were younger than 13 at the time of first exposure. Over one in three respondents (37%) indicated they were currently interested in violent and brutal CSAM or CSAM involving toddlers (0–3 years). Over half of the respondents feared that viewing CSAM will cause them to sexually offend against a child, while 37% had sought direct contact with children. Half of the respondents indicated they would like to stop viewing CSAM, whereas the other half had no such desire, or had not given it any thought; 62% had tried to stop engaging with CSAM in the past but failed to do so. In short, the scant research available to date indicates that darknet users on CSAM forums are heterogeneous and likely have varying offending risk.

Implications for academic research

It is without a doubt that access to darknet online behavior within darknet CSAM fora constitutes an unobtrusive data source, making it possible to analyze the criminogenic needs of the offending darknet population. Rogers et al. (2021) stress the point that online behavior using computing technology will leave a trail of digital “breadcrumbs” behind, which they refer to as “forensic digital artifacts.” Future research should examine these forensic digital artifacts to investigate CSAM forum members’ online behavior on, for example, a temporal and relational level. The temporal dimension comprises not only the volume of this activity (e.g., the number of posts, or the amount of CSAM exchanged) and developments therein over time, but also the types of activity (e.g., type and diversity of the topics under which the member is active, and the nature, severity, and novelty of the CSAM exchanged). This type of research could examine relationships between activity in sub-topics (e.g., gender, age, fetish) and discussion areas (e.g., mental health). Also, it would be possible to try to predict illegal behaviors (e.g., downloading videos) based on previous forum activity. Research can also use insights from social network analysis to examine the relational dimension of how the individual member is positioned in the communication network underlying the forum (e.g., the members’ level of connectedness and centrality in the network; e.g., Fonhof et al. 2019). Here, it would be possible to predict an individual’s standing within the offending community based on online behavior (liking of posts, badges, awards). Finally, getting a better sense of the criminogenic needs and risk profiles of the darknet users would be essential as the current evidence base suggests variability in user characteristics.

Practical implications

The darknet provides a haven for those who want to go unnoticed, including those who are keen to break laws. Law enforcement agencies are now confronted with online communities of unprecedented size and reach in which attitudes toward offending are generally positive and neutralizations are often nurtured (at least by the most vocal users), and in which offending is facilitated through dedicated websites geared to the exchange of illegal goods, including CSAM. The anonymity provided by the darknet challenges LEAs in identifying both victims and perpetrators. The sheer number and size of CSAM forums active on the darknet forces LEAs to prioritize and allocate their available resources to those individuals who are deemed to pose the highest risk. These would include forum administrators, but also producers, cappers, and other forum members who are central to the CSAM community. Detailed insight into the patterns of online behavior that characterize these subgroups may be used to provide insights for intervention efforts. Distinguishing subgroups of CSAM groups may also aid preventive efforts, as some forum members may be more receptive to interventions than others. To the extent that individuals become desensitized or their sexual interest in minors or sexual preoccupation is elevated when interacting with community members, online interventions, like the one offered by Protect Children (Insoll et al. 2022), may reach those open to outside influence and persuade them to refrain from harming children. Presenting individuals searching for CSAM on the darknet with warning banners emphasizing the illegal nature of their actions may help to prevent some of them from entering CSAM forums altogether (Prichard et al. 2022).

Conclusion

The access to technology and a connected community via the Internet has enabled the distribution, possession, and creation of child sexual abuse material (CSAM) to increase. Although previously seen as an unreliable, slow, and access-restrictive technology, the darknet is now an everyday tool for 2.5 million Internet users (Wise 2022). Home Internet connections and faster upload and download speeds have enabled a technology-driven revolution in the lifestyles of modern society. This is also accurate for individuals who seek to access on-demand CSAM and to communicate with likeminded persons. The hundreds of forums dedicated to CSAM presently active on the darknet cater to this demand (Kloess and van der Bruggen 2021). The current review article summarized the state of knowledge of the darknet as it pertains to CSAM offending.

First, we provided a summary of the structure of the darknet. Not being identifiable on the Internet’s regular search engines, the darknet provides security to these forums through obscurity. Instead, their locations are communicated through channels where a quid pro quo trust has been established between members of CSAM forums and communities (Kloess and van der Bruggen 2021). Darknet CSAM forums are organized and have a clear hierarchical structure (van der Bruggen and Blokland 2021b). Their communities are bound by rules and etiquette, and those that distribute the newest CSAM are held in high esteem. The presence of individuals on these forums is not by chance. They have obtained the location of the forum through connections within CSAM communities, and they have used specialized software to bring them to these locations. To what extent this directly reflects their level of sexual interest in children, however, remains a question that warrants additional research (Seto et al. 2006).

The prevalence of CSAM forums, hidden from the public face of the Internet, generates the need for law enforcement agencies (LEAs) to increase their capability in detecting these hidden communities. It is, however, impractical to think that law enforcement has the legal and technical resources to identify and prosecute the totality of each CSAM darknet forum seized through LEA operations. Given that forum membership figures have been found to transcend 400,000, law enforcement is required to make strategic decisions based on the potential risk. Gaining detailed insight in the online behavior of darknet forum members through digital forensic artifacts may aid LEA in prioritizing their targets.

For practitioners working with individuals who commit CSAM offences, it would be important to know whether interventions would differ if the CSAM was accessed in the darknet versus the clearnet. Given the large variability in darknet users (e.g., some posting comments suggesting attitudes tolerant of sexual offending vs. those not posting any comments), some sort of assessment would be required to identify treatment targets and rank order individuals in terms of risk to (re)offend. Clear intervention pathways should also be established to deter the onset or perpetuation of CSAM offending, thus enabling law enforcement to focus on those forum members who pose the greatest risk to children and who encourage cognitive distortions of forum users. There is a cohort of darknet forum members that discuss wanting to seek help to stop engaging with CSAM (Insoll et al. 2022). However, due to the suspicious disposition of CSAM forum members, there may be a reluctance by them to engage with therapeutic interventions advertised on the clear web. Further research is needed to develop deterrence and intervention strategies within these CSAM darknet forums, which could potentially reduce the number of potential or onset individuals accessing CSAM.

Overall, we have a growing understanding of the environment of these darknet forums on a technical and community level. Yet, there is an absence of research in understanding the risk and psychological profiles of these users and research to inform and design successful interventions to deter memberships to CSAM sites that encourage offending. For example, the creation of a clear and secure pathway for members who have a desire to stop engaging with CSAM should be deployed on the platforms where these darknet CSAM forum communities are present to ultimately reduce the growth of the CSAM darknet membership. Research on the darknet is not easy and requires a combined effort from LEA, academia, technology service providers, and non-govermental organisations. The scant research (McMahan et al. 2023) suggests that individuals who commit sexual offences via the darknet can be assessed using available assessment measures but may have different profiles from clearnet users. By better understanding users of CSAM darknet sites, practitioners and LEAs would be better able to address the needs and risks posed by this subgroup of individuals at risk for sexual offences. We hope this review provides researchers and practitioners alike with an overview of the darknet and encourage research to better understand users of darknet CSAM forums, so as to ultimately inform management and prevention efforts.