14. In this investigation, the Inquiry considered the role of institutions and organisations such as government, law enforcement, industry, charities and non-governmental organisations (NGOs).
15. The Home Office is the lead government department responsible for policy relating to online-facilitated child sexual abuse.[1] Its Tackling Exploitation and Abuse Unit engages with law enforcement, the intelligence agencies and industry; coordinates international cooperation to combat this abuse; identifies ways to address child sexual exploitation; and manages policy regarding the support of victims. The unit also works with other Home Office teams such as the team responsible for the Child Abuse Image Database (CAID).[2] In addition, the Home Office is responsible for making decisions on funding over and above the core budgets allocated to the NCA and the police.
16. Other government departments are involved in aspects of the response to child sexual abuse and exploitation.
16.1. The Department for Education is responsible for educating children about online safety. From September 2020, relationships education will be compulsory in primary schools in England, and relationships and sex education compulsory in secondary schools.[3] Draft guidance for these subjects includes material on online safety and, more generally, healthy relationships, boundaries and respect for others.[4]
16.2. The Ministry of Justice is responsible for the criminal law relating to acts of child sexual abuse (both contact offences and offences facilitated by the internet) and for the wider criminal justice system.
16.3. The Department for Digital, Culture, Media & Sport (DCMS) is responsible for digital issues. In October 2017, DCMS launched its Internet Safety Strategy consultation looking at various aspects of online safety (but not illegal harms such as child sexual abuse and exploitation). At the conclusion of the consultation process, DCMS and the Home Office published the Online Harms White Paper (April 2019) which specifically included the government’s proposals for combating online-facilitated child sexual abuse. These proposals are considered in more detail in Part F of this report.
17. The National Crime Agency (NCA) leads and coordinates UK law enforcement’s response to serious and organised crime. The response to online-facilitated child sexual abuse is the particular responsibility of the Child Exploitation and Online Protection Centre (CEOP), a command of the NCA. According to 2018/19 figures, the CEOP command now has 278 staff as well as 43 secondees from children’s charities and industry. Its budget for 2018/19 was £17.97 million.[5]
18. In addition to carrying out investigations, apprehending offenders and identifying and safeguarding victims, the NCA responds to public reports made via the ‘ClickCEOP’ button on the homepage of the NCA and CEOP websites. ClickCEOP is an online reporting tool which enables anyone to make a report of online sexual abuse directly to the NCA.
19. The NCA also receives reports from the National Center for Missing & Exploited Children (NCMEC), a non-profit private organisation established in the US in 1984. Electronic service providers (ESPs) based in the US are obliged under US law to make a report to NCMEC when they become aware of child sexual abuse material on their networks. Where the report relates to the UK,[6] NCMEC sends the report to the NCA. The NCA responds to the most serious reports itself and passes others on to local police forces.
20. The NCA also delivers an education programme known as ‘Thinkuknow’.[7] The Thinkuknow website provides educational resources – including films, cartoons and lesson plans – for children, their parents and teachers to stay safe on the internet. The material is tailored to children depending on their age. The NCA also trains ambassadors to deliver the programme in schools. The NCA estimates that in 2016/17 the programme reached about 5.9 million children in the UK.[8] Between April 2017 and March 2019, Thinkuknow resources were downloaded over 81,000 times.[9]
21. Much of the operational work against online-facilitated child sexual abuse is carried out by the 43 police forces in England and Wales. In 2015, the Home Secretary designated child sexual exploitation and abuse as a threat of national importance, putting it on the same footing as terrorism.[10] According to Chief Constable Bailey, the impact of this was to make “very clear” to chief constables and police and crime commissioners of the need for an effective and adequately resourced response.[11]
22. There is an agreed plan in place for how local forces will work with the NCA and regionally with one another through regional organised crime units (ROCUs). The foundation of this plan is the ‘4Ps’ approach of the Serious and Organised Crime Strategy:[12]
23. The overall performance of police forces in pursuing online offenders is monitored by the Online Pursue Board, chaired by Chief Constable Bailey.
24. The Inquiry heard evidence from a range of police forces of different sizes across England and Wales: Kent Police, West Midlands Police, Avon and Somerset Constabulary, the Metropolitan Police Service, Greater Manchester Police, Norfolk Constabulary, Cumbria Constabulary and Gwent Police. While there are differences in the ways that forces structure and finance their responses to this type of offending, there are two key common features. First, the most serious or complex cases are typically tackled by a specialist unit. Second, over the last few years, all the forces have responded to the increasing scale of offending by dedicating more resources – financial, technical and human – to their efforts. For example, in 2015/16, Avon and Somerset Constabulary increased funding for its Internet Child Abuse Team (ICAT) by 18 percent.[13] In 2016/17, further funding enabled the ICAT to expand from seven to 16 staff and the number of data forensic investigators dedicated exclusively to ICAT cases increased from one part-time investigator to three full-time investigators.
25. Within the UK, law enforcement investigations into online-facilitated child sexual abuse will usually involve the use of investigatory powers to identify offenders and acquire communications data.[14] Communications data is the “who, where, when and how of a communication but not the content” of the communication.[15] Communications data would include, for example, the billing data showing the dates and times of messages and calls between telephones but not the content of any text message.
26. In the context of online-facilitated child sexual abuse investigations, much of the data is held by companies based in the US. Prior to October 2019, the acquisition of content data (eg the words in a text message or a social media post) held by companies overseas involved a process under a mutual legal assistance treaty (MLAT).[16] The MLAT process was described as cumbersome and lengthy, with the average time for UK law enforcement to get information from overseas companies being over a year.[17] However, on 3 October 2019, the Home Secretary signed a UK–US bilateral data access agreement allowing UK law enforcement to request communications content and data directly from US-based communications service providers.[18] It is envisaged that the new agreement will mean that data can be accessed in weeks, if not days.[19]
27. Once a perpetrator has been identified and arrested, there are a number of key criminal offences:
28. In many cases where an offender is being sentenced for sexual offences, including those facilitated by the internet, the courts can impose a sexual harm prevention order. This can, for instance, place limitations on, and enable the monitoring of, the offender’s use of the internet. Failure to comply with such an order is a criminal offence. The number of such orders has increased substantially, from 1,114 in 2006/07 to 5,551 in 2017/18.[24]
29. The Inquiry heard evidence from a variety of companies that provide products and services capable of being used to enable or facilitate online child sexual abuse. Other than Kik (a messaging application founded in Canada), all of these companies have a very large presence in the UK. BT Group is the largest internet service provider in the UK.[25] Microsoft has almost 5,000 UK employees.[26] Facebook has approximately 40 million users in the UK and 2,300 full-time employees.[27] Apple does not keep specific data on the number of UK users of Apple products but estimates the number to be in the “millions and millions” and has 6,500 UK employees.[28] Google estimates that there are tens of millions of users in the UK of some of its products and has over 4,000 employees in the UK.[29]
30. The Internet Watch Foundation (IWF) was established in 1996. Its objective is “eliminating child sexual abuse wherever it occurs in the world” and it plays a key role in detecting and removing child sexual abuse images from the internet.[30] From five founding members, the IWF now has 148 members, including internet service providers and social media companies such as Google, Microsoft, Apple, Facebook and BT.[31] It is a UK registered charity and is funded primarily (90 percent) by its members, with the remaining 10 percent coming from the European Commission.[32]
31. The IWF operates a hotline for the public to report potentially criminal online content and, since 2014, has also proactively carried out searches for such content. Its members are provided with various tools and blocking lists designed to prevent access to illegal content. It issues ‘takedown notices’ to UK internet service providers requiring them to remove child sexual abuse content.
32. In its first year of operation (1996), the IWF processed 1,291 reports of potentially criminal content.[33] At that time, the UK hosted 18 percent of the world’s known child sexual abuse material.[34] By 2018, the IWF processed nearly 230,000 reports and the UK hosted 0.04 percent of such content.[35] By way of comparison, in 2018, the Netherlands hosted 47 percent of this material and 12 percent was hosted in the US.[36]
33. There are a number of third sector (voluntary and community) organisations that play a role in tackling online-facilitated child sexual abuse.
33.1. The Marie Collins Foundation, established in 2011, is a charity set up to address the recovery needs of children who suffer sexual abuse and exploitation online. It offers support services to children and their families and provides training to professionals.
33.2. The Children’s Charities’ Coalition on Internet Safety (known as CHIS), established in 1999, is made up of 11 UK children’s charities. It lobbies government and industry to improve the safety of children online.
33.3. Mr Tony Stower, Head of Child Safety Online at the NSPCC, told us about the organisation’s campaigns, research, and support for parents and children affected by this kind of abuse.[37]
33.4. The Lucy Faithfull Foundation (LFF) is a charity dedicated to preventing child sexual abuse. It runs a helpline called ‘Stop it Now!’ for adults worried about their own behaviour.[38] In January 2018, Chief Constable Bailey told us that such was the demand for help from the LFF that between April 2016 and March 2017 “only 21 per cent of callers”[39] managed to get through to the helpline when they first called. In March 2019, the Home Office announced £600,000 in funding to the LFF to increase the capacity of the helpline.[40]
34. There are also a number of international forums set up to enable institutions and organisations to collaborate with one another.
34.1. The Virtual Global Taskforce was established in 2003 as a collaboration between international law enforcement agencies and industry.[41] The NCA is a member. An example of the taskforce’s recent work is a project, led by the UK, focussed on engaging key technology companies to enhance child safety on their platforms.
34.2. The Technology Coalition, established in 2006, brings together international technology companies to collaborate in the response to online abuse.[42] It works to identify and promote technology solutions to child sexual abuse material with the aim of eradicating online child sexual exploitation.
34.3. In 2014 the WePROTECT Global Alliance was established as a forum to improve the global response to online-facilitated child sexual abuse.[43] The alliance has 85 member countries, 20 industry members and 25 leading third sector organisations.[44] In 2018, it issued a global threat assessment to provide a better understanding of the worldwide threat of online child sexual exploitation and abuse and set out what countries need to do at a national level to tackle such abuse and to provide support for victims.[45] The Home Office provides £1–2 million per year in funding for the WePROTECT Global Alliance secretariat.[46]
34.4. In June 2018 the UK ratified the Council of Europe Convention on the Protection of Children against Sexual Exploitation and Sexual Abuse, known as the Lanzarote Convention.[47] The Convention sets standards for the response to sexual offences against children. The Lanzarote Committee, established to implement the Convention, will help member states to cooperate in preventing and combating such abuse.