Teens hang out on social Web sites--but so do sexual predators. They need our help staying safe.

By J. Nicholas Hoover, InformationWeek
May 1, 2006
URL: http://www.informationweek.com/story/showArticle.jhtml?articleID=187001704

Meet Rich. He's 37, loves photography--and has a penchant for the under-21 set. As for his favorite films, Rich writes, "Give me a movie with boys in it, I love it." He brags of his sexual prowess with boys.

Given his lurid obsessions, you'd think Rich would want to hide, but his profile at social networking site MySpace.com includes not only information about himself but also an E-mail address for future correspondence.

Tech-savvy teens don't always play it safe online. Photo by Sacha Lecca

MySpace and social networking sites like it offer thriving communities where young people engage in countless hours of banal chatter and photo sharing. Not coincidentally, social sites also have become hangouts for child predators, child pornographers, and other lowlifes.

It's a high-risk dynamic with potentially terrible consequences. In February, the naked, strangled body of 14-year-old Judy Cajuste was found in a New Jersey trash bin, and the body of 15-year-old Kayla Reed was discovered in a California canal. In both cases, investigators are probing possible connections to MySpace: Cajuste had told friends of meeting a 20-something man there, and Reed logged into her MySpace account the day before she disappeared. There are dozens of other examples of young people lured into "friendships" that put them in danger.

Several teens we talked to acknowledged their peers could be susceptible to come-ons from strangers. "It happens," says a 16-year-old girl. "You're a young girl, and people compliment you. You're more willing to meet them."

MySpace, in an effort to better protect its millions of young members, just hired its first chief security officer. Hemanshu Nigam, who starts this week, played a central role in online safety at Microsoft until being hired by MySpace. Before that, he chased down child predators as a U.S. prosecutor.

Tech-savvy kids, with their cell phones, instant messaging accounts, and access to PCs at home and school, are targets for sexual predators. Too many of them are ready and willing to share personal information online without a thought to how it might be misused by others. The National Center for Missing and Exploited Children reports that one in five kids online has been solicited or enticed. Reports of child pornography on the center's CyberTipline have increased six of the last seven years (see chart, below).

"The threat is frighteningly real, it is growing rapidly, and it must be stopped," U.S. Attorney General Alberto Gonzales said two weeks ago in a speech at the center. (Gonzales provided graphic descriptions of child pornography to get his point across. Child protection advocate Parry Aftab described child porn in a poignant but disturbing column that appeared on InformationWeek.com in 2005; ssee story, "The Privacy Lawyer: The Pain Behind The Pictures"). Gonzales noted that the tools of the predator trade have made it harder to investigate and bring criminal charges.

Funding for a network of 46 police task forces set up by the federal government's Internet Crimes Against Children program has more than doubled to $14 million annually, and the Bush administration recently sent legislation to Congress to increase penalties if Internet service providers find but fail to report child pornography on their systems.

Private industry also is getting more involved. The Financial Coalition Against Child Pornography, started in March, includes financial and Internet companies working with law enforcement and the Center for Missing and Exploited Children to identify child pornographers and stop them from using banks, credit cards, and Internet payment systems. AOL has worked with law enforcers since a 1995 investigation revealed child porn being traded in its chat rooms, and Yahoo regularly pulls message boards where the illicit material gets shared off its site. Microsoft helped law enforcers develop collaboration software called the Child Exploitation Tracking System, has sponsored the training of 1,300 police officers on child porn, and last week said it would provide the U.K.-based Internet Watch Foundation with more than $500,000 worth of free software. CA and Sun Microsystems have donated money and resources to the Center for Missing and Exploited Children.

Business and technology professionals may think of online child safety as a family issue, but it's a workplace issue, too. Five states--Arkansas, Missouri, Oklahoma, South Carolina, and South Dakota--require IT technicians to report child pornography if they come across it, and others are considering such measures.

Social networks aren't just a teen phenomenon. A recent survey by Web filtering company Websense found that 8% of respondents visit social networking sites while at work. Companies can use Web filters to limit access to the sites, though Websense says its customers don't seem overly concerned.

Whiling away company time on social networks is a productivity issue; luring children for sex is a criminal one. There's little evidence that sexual predators are trolling from workplace PCs, but it's been known to happen. In 2003, a Cincinnati-area police chief admitted to soliciting sex from someone he thought was a 15-year-old, using his work computer. And a deputy press secretary at the Department of Homeland Security, arrested in March for attempting to seduce a child, had his workplace computer seized as part of the investigation and gave the number to his government-issued cell phone to a police officer posing as a 14-year-old girl.

Child porn stored on company PCs and servers has been a bigger problem. Filtering and blocking can help keep the images off networks, though it's not fail-safe. Keyword and URL-based filters have spotty coverage. Other software scans images for limbs and skin tones and blocks pictures it identifies as porn, but skin often takes up too little of the photographs, and innocuous material can be inadvertently blocked.

Child predators and pornographers have tricks to conceal their identities online. One of the most common is lying about their ages, claiming to be younger than they are. To hide their IP addresses and locations, they piggyback on Wi-Fi connections or use proxy servers. Decentralized peer-to-peer networks prevent material from being tracked to a specific server, and encryption lets them keep online chats private from those policing the Web. When law enforcement, ISPs, and others take down pedophile Web sites, it's not long before they're back up, hosted by a different service.

Guys like Rich are tough to fight. Aftab, an attorney who runs child protection site WiredSafety.org, has worked with MySpace to develop its privacy and law enforcement policy and says site administrators surely would take Rich's profile down if they knew of it. MySpace declined to be interviewed for this story, but a spokesperson responded by E-mail that MySpace has worked with law enforcement since its inception. But with the site's ratio of 73 million users to 100 customer service personnel, investigating and responding to every complaint takes time. Profiles like Rich's put law enforcers in a quandary, too: Even though he claims to be 37 and talks about wanting sex with boys, arguably his speech is protected by the First Amendment as he isn't specific about whether he's acting on his fantasies.

The Justice Department's Project Safe Childhood will seek to get law enforcement agencies at the federal, state, and local levels working together to investigate and prosecute child exploitation crimes. That also means arming law enforcers with information gleaned from ISPs, and possibly forcing them to retain data much longer than they do. The Justice Department recently gathered information from a group of ISPs about how people were conducting searches to find porn online--including the legal, adult variety--in its efforts to reinstate the Child Online Protection Act, a 1998 law struck down by a federal judge that was intended to shield kids from inappropriate material by, among other things, requiring people who access porn sites to prove they're of legal age. (The American Civil Liberties Union and others argued that the law violated consumer privacy.) The Justice Department, emboldened by its efforts to get ISPs to comply with its first request, has indicated it wants them to keep records of Web activity on hand longer for future requests.

The Internet Crimes Against Children program last year investigated 2,329 cases of enticement and of predators traveling to meet minors, and 252,000 cases of child pornography. Yet those numbers provide just a glimpse of the activity, since many local police forces are too small to investigate child porn. "It's absolutely overwhelming," says Brad Russ, director of Internet Crimes Against Children's training and technical assistance program, which trains 1,000 officers each year. "The scope and the scale of the problem far exceeds our capacity." Intensifying the epidemic is that more than half the world has no laws dealing with child pornography.

But police keep trying. In March, two men were arrested in the first federal cases involving child predators on MySpace, and federal law enforcers shut down a site streaming live sexual abuse of toddlers, charging 27 people with child pornography. The 45 U.S. task forces made 1,623 arrests and identified 275 victims of child porn last year. Those charged or convicted as predators and child porn peddlers have been found in all walks of life, including schoolteachers and cops.

Vigilantes And Filters

Vigilante groups are fighting back. In January, NBC's Dateline featured a report about one such group, Perverted-Justice.org, which set up a sting that resulted in 51 men being busted in three nights. The group hasn't seen one acquittal from those it's helped bring to justice, and nearly all of its work is done with law enforcement. Bryce Clayton's blog, called The Dead Kids of MySpace, and another called MyCrimeSpace post news of recent cases involving MySpace and child predators and pornography. "Just today, I came across a half-naked 13-year-old girl posing on her bed, a 15-year-old girl whose profile picture is that of her taking a bong hit ... and numerous other underage [kids] who have posted cell numbers on their MySpace," Clayton says.

Yet some in law enforcement are wary of such efforts. "We certainly take any information that anyone has regarding an offender," says Randy Newcomb, an investigator with the New York State Police in Canandaigua, N.Y. However, vigilantes expose themselves to liability for entrapment or possession of child porn and might not properly maintain digital evidence, Newcomb says.

Any IT pro knows of the limitations of such tools. The filters don't work perfectly, and even if kids post and browse safely, social networking sites present a new set of problems. Profiles on the sites often link to other online information sources, providing the type of data a fixated predator might use to locate a child, such as a school name, says Michelle Collins, a unit director at the National Center for Missing and Exploited Children.

In addition to MySpace, Friendster.com, Facebook.com, MyYearbook.com, and social blogging sites like Xanga.com let users post pictures, videos, and blogs, and they support E-mail and instant messaging. They're hugely successful. MySpace, purchased by Rupert Murdoch last year for $580 million, has grown from 6 million users to 73 million in less than a year and is the fourth most popular English-language site on the Web. Some music groups sell tickets to their concerts largely based on word of mouth at MySpace. Friendster gets 9 million hits a month, and Facebook's 7.5 million users generate the seventh largest number of page views on the Web. MySpace and Facebook have even become verbs in the mold of Google: To MySpace someone means to look at a profile or send a message.

But kids aren't always on their best behavior on these sites, with threats and cyberbullying among the problems. Some schools block social networking sites from school computers.

About a year ago, in an effort to shield younger kids from predators, MySpace stipulated that 14- and 15-year-olds can have only "private" profiles, meaning someone can't view them without their permission. A persistent cookie tells kids younger than 14 to come back when they're older. Users can set their profiles to prevent being contacted from those who don't know their last names. The site also introduced a method by which anyone finding inappropriate content can report it to administrators with one click.

More recently, MySpace created a set of public service announcements with the Center for Missing and Exploited Children. Nearly a third of the company's 300 employees work in customer service, which has deleted 250,000 underage profiles since the site's 2003 inception and filters out nudity and obscenity when found. MySpace recently hired a law enforcement liaison.

But as Rich's profile indicates, there's more to do. Anyone can join, the site's default privacy controls are set so anyone can send messages to users, and it's easy to fool the system. One teen interviewed by InformationWeek said his 12-year-old brother established a profile on MySpace by lying about his age.

Friendster soon will have five employees working in member services, who will seek and remove questionable content and monitor the network. Yet such a small group can't scrutinize every photograph. To maintain a level of safety, Friendster has made it so users must know first and last names to befriend others and can dictate who can see their pages and message them.

Facebook users must have valid college or high school E-mail addresses, though recently selected companies have been allowed to join. Some high schools have their own domain names, and there's a protracted process by which students at schools without their own Web sites can join, and alumni aren't allowed. When teens post information, it's only public to verified friends, not the entire Web. Children aren't at high risk of receiving messages from strangers, because it's difficult to contact a user if you don't know their name.

Because of these controls, Facebook has seen few child predators, chief privacy officer Chris Kelly says. "This has been a deliberate design choice for us," Kelly says. "We're trying to re-create the way people share information in the real world. The idea to share all that information over the open Internet struck us as sort of a silly vision."

Some sites go a step further. Jeanette Symons founded Imbee.com, a place for 8- to 14-year-olds to socialize. It includes a range of parental controls, and published material is eventually deleted so that kids don't have to worry about content coming back to haunt them--for example, when a future employer runs a background check five years down the road. Parents are able to approve or deny online buddies and can control the scope of interaction between kids through direct communications with site administrators and without needing their kids' passwords or log-in names. Similar sites are in the works, including YFly, co-founded by teen heartthrob Nick Lachey. Still, even Symons admits there are ways to fool Imbee's system.

Parents can find the sites a rude awakening. "For 10 years, people have been saying, 'It's not my kid,'" Aftab says. But now, on sites like MySpace and Xanga, parents are seeing what kids have been saying all along in instant messages and E-mails, "and they're freaked."

Investigator Newcomb recently spoke to an auditorium of elementary schoolers in western New York. He asked kids in the audience how many of them had more than 200 friends on their online buddy list--a bunch of hands shot up. Out of those, he asked how many have only friends on that list they can put a face to, and half of the hands remained raised. Finally, he asked if any of the kids had ever gone and met someone they'd got to know online, and a few hands were raised. "That's just totally frightening to me," Newcomb says. "The superintendent looked like his eyes were going to pop out of his head."

It may take a village to raise a child. But in a world of online social networking, decentralized networks and servers, and increasingly tech-savvy child predators, it's going to take a united effort among government, industry, and families to keep them safe.

Copyright © 2005 CMP Media LLC