Online offenders are refusing to give up passwords which might reveal even worse abuse of children. Photo / stock image
Offenders caught with online child sexual abuse material are refusing to surrender passwords to their encrypted content, trading off a maximum three months in prison against potentially much longer sentences.
Investigators working on such cases say the discrepancy shows how increasingly sophisticated technology is outstripping the law.
In cases identified by the Herald, those found with some illegal content have refused to provide passwords to encrypted devices that may conceal further offending.
In those cases, court documents show the strategy worked, with judges telling offenders they couldn't hand out tougher sentences on potentially illegal material. Instead, sentences of just a couple of months for withholding the passwords were imposed.
Refusing to provide passwords carries a maximum three months in prison, while allowing investigators access - should devices contain abuse images - could lead to 14 years inside.
Internal Affairs Minister Jan Tinetti told the Herald a proposed law change stemming from a 2017 report aimed to increase the sentence to six months in prison or a $20,000 fine.
Investigation teams at the Department of Internal Affairs (DIA) and Customs have found encryption is among issues allowing those using child sexual abuse material to find new ways to access, hide and share it.
The scale of online child sexual material has grown exponentially. Evidence presented to the United States Senate last year showed investigation leads from tech companies to the National Centre for Missing and Exploited Children's CyberTipline increased from 500,000 reports in 2013 to 17 million in 2019.
From there, the NCMEC passes the information to agencies around the world and is the source of almost all leads followed by the three investigative agencies fighting online child sexual exploitation in New Zealand.
The DIA received 3379 tips in 2019 which its 12 full-time equivalent staff triage, referring cases to police or Customs where an immediate priority is placed on tips suggesting risk to children.
DIA digital safety deputy director John Michael said offenders were becoming increasingly skilled and sophisticated in obtaining imagery and evading the law. As offenders became more technically aware and security conscious, the technology to assist them had also developed.
He said issues included a rapid increase in internet speed in recent years, allowing faster downloading and uploading. The speed increase also led to an expansion in live-streamed abuse, which allowed people accessing such sites to pay for the ability to direct abuse.
Along with this have come improved ways to hide. The dark web has grown as an anonymous place to find illicit goods, where 80 per cent of traffic is related to child sexual exploitation. Mobile phones now have the capability of personal computers of just a few years ago, yet are portable and disposable.
Those with illegal content could now distance possession through cloud storage or on portable hard drives with near-unbreakable encryption.
Michael said the DIA relied on forensic capabilities to deal with encryption. "We can't do that in every case," he added.
"You can't enforce your way out of the problem because there is such a high level of offending in this space."
Prosecutions for possession of child sexual abuse material have among the highest success rates of any offending, with the DIA recording a success rate of 100 per cent and Customs achieving 90 per cent.
Academic research by a Customs officer working in the field found the prosecution approach effective - when an offender is found they will almost certainly be convicted - but also warned it "could also suggest that the agencies focus on those only with a high level of probability for conviction".
Factors specific to the offending help support high conviction rates - guilty pleas avoided defended hearings exposing socially devastating details and stopped investigators digging deeper to find other offending.
Chief Customs Officer Simon Peterson said there was a "disconnect" between the benefits and costs to offenders of withholding passwords.
"If it's three months, which you're going to get for not giving your password, then that's way better than having your whole hard drive opened up to the world."
The field was rapidly evolving - a sign of the speed with which technology developed and its relative newness creating a rapidly shifting landscape.
Technology also confounded resourcing for those working in the area - with no actual data on the scale of the problem.
Peterson said those countries dealing with numerically greater levels of child abuse material had more success changing policy, getting stronger legislation and using that as a foundation for developing better tools to fight the problem.
Even then, better resourcing would still leave New Zealand with a small pool of people with the forensic, legislative and technical skills to do a job where aptitude and ability also required the will to work in one of the most unsavoury parts of the developing online world.
"It starts at policy," says Peterson, pointing to the aftermath of the 2019 Christchurch mosque attacks, the intense focus on online media and how it is treated through a legal lens. "That's the kind of work that needs to be done to give us a more secure footing in this space.
"There are issues in the balance of privacy and victims' rights. These are the arguments around end-to-end encryption of social media. They are being had at the moment with Facebook and other big companies.
"There is a desire to protect clients' privacy but the balance of that can't be at the expense of hiding victims under the carpet. Victims also have a right not to be victimised and that can't be trumped by someone's right to privacy."
Eleanor Parkes, ECPAT Child Alert director, said the legislation challenge was international, with global tech companies moving towards automatic encryption. She cited Facebook's Instagram and Messenger platforms as those without safeguards to stop the sharing of "explicit, illegal and highly damaging sexual abuse content".
"More work is desperately needed for legislation to keep up to date with increasing technological sophistication that is making it easier every week for people to create, share and access child sexual abuse material."