Assessing the Impacts of Enhanced Cybertip Reports on AFP Child Abuse Material Triaging and Investigative Referral Processes

Project summary

The AFP is introducing a new reporting and intelligence system (Hubstream Intelligence Server Enterprise - HISE) to manage Child Abuse Material (CAM) triaging and prioritization of cases for investigative action. HISE will provide triage staff with access to international Cybertip reports that contain more detailed user generated content and geo-locational data than was available using the old reporting and referral system. This joint research project aims to assess the impacts of HISE and the associated enhanced Cybertip reports on the AFP’s existing CAM triage and referral decision making processes and the ongoing operational viability of the UQ-AFP designed Triage Referral Investigation Support Tool (TRIST).

Project description

The Child Protection Triage Unit (CPTU) within the Australian Centre to Counter Child Exploitation (ACCCE) is the AFP’s focal point for the receipt, analysis and on-referral of Cybertip reports associated with Child Abuse Material (CAM). The role of the CPTU is to triage and evaluate the incoming Cybertip reports to ensure finite AFP and/or State and Territory investigative resources are directed towards the most serious matters. The CPTU seeks to optimise the timeliness of the triage and evaluation processes while ensuring the distribution of high-quality referrals to Joint Anti Child Exploitation Teams (JACETs) for investigation.

The CPTU receives the vast majority (approx. 90%) of its CAM Cybertip reports from the CyberTipline managed by the National Center for Missing and Exploited Children (NCMEC). This US clearing house distributes Cybertips about suspected online offending to law enforcement agencies all over the world. In recent years there has been a dramatic escalation (six-fold increase in 2013-2018) in the number of Cybertip reports received by the CPTU and COVID-19 has compounded the problem further with a 318% increase in the period April 2019 – May 2021.

The CPTU analyses the Cybertip reports and uses a UQ-AFP designed decision support tool to assist with referral and prioritization decision making – the Triage Referral Investigation Support Tool (TRIST). In the vast majority of cases, the Cybertip report contains very limited digital evidence relating to the identity of the CAM offender or victim which means that CPTU staff are attempting to piece together a jigsaw with missing pieces. While TRIST has proven effective as a decision support tool, the CPTU is still very reliant on the individual operator’s professional judgement and experience to ensure appropriate categorization and prioritization of cases for investigation.

The introduction of HISE potentially changes the triaging and referral landscape for the CPTU. With access to richer and more complete digital artefacts associated with instances of CAM possession, production or distribution, it is possible that the triage staff’s decision making will need to adapt. It is also possible that the current structure and algorithms contained in TRIST will require adjustment to cater for the more fulsome offence-related data and metadata contained in HISE / NCMEC Cybertip reports.

This proposed research will comprise a mixed methods approach in two phases. In Phase 1 (Qualitative), the workflow processes of the CPTU staff utilising HISE will be observed and structured interviews will be conducted to elicit the staff’s perceptions of the impacts associated with processing enhanced Cybertip reports. In Phase 2 (Quantitative), six months of 2020-21 TRIST data (Hubstream 1) and six months of 2021-22 TRIST data (HISE) will be used for comparative statistical analyses examining risk / priority ratings and referral rates to JACETs.

This proposal builds on a body of UQ-generated research evidence associated with CAM triage and referral decision making. It is innovative in the way that it explores information processing and decision making in a complex cyber operating environment at a critical juncture for the ongoing development of the AFP’s operational capabilities.