Child Protection: Mission Domain Intelligence Guide

The pattern that ends most sextortion cases is depressingly consistent: contact within hours, escalation within a day, and a payment demand before the child has told anyone. The intervention window is measured in hours, not weeks.

What Child Protection covers as a mission domain

Child protection in an intelligence context means detecting, disrupting and referring harm to children, and supporting the authorities and safeguarding professionals who protect them. It covers online grooming, financially motivated sextortion, the distribution of child sexual abuse material, live-streamed abuse, criminal and sexual exploitation of children by groups, and harm arising within families and institutions. The work is tightly constrained: analysts identify patterns, risk indicators and referral routes, and never handle illegal material, which is the exclusive preserve of specially authorised units and reporting bodies.

Practice divides between platform and hotline processes that detect and remove material at scale, law enforcement victim identification units working within controlled international databases, safeguarding and social care systems that manage risk around a specific child, and prevention and helpline services. Offender categories differ substantially in behaviour and response required, from organised financially motivated extortion crews to contact offenders in positions of trust, and conflating them produces poor risk assessment.

Why it matters

Reports to national hotlines run into the tens of millions annually and continue to rise, with financially motivated sextortion of teenage boys emerging as a distinct and lethal pattern linked to suicides. Harm is lifelong: material circulates indefinitely, and survivors report revictimisation each time it resurfaces. Every hour of delay in a live case matters, and every procedural error risks a prosecution collapsing and an offender returning to access.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

• Rapid escalation from first contact to sexualised conversation and a payment demand, typically inside twenty-four hours, in sextortion cases
• Pressure to move a conversation from a moderated platform to an encrypted or ephemeral channel early in the interaction
• Adult accounts using age-inflected language, school terminology or gaming references inconsistent with the stated profile age
• A child with unexplained gifts, a second phone, prepaid cards or gaming credits alongside sudden withdrawal or secrecy
• Platform hash-match alerts and hotline reports clustering around a specific service, community or game update
• Coordinated accounts sharing scripted opening messages and identical payment collection methods across many targets
• School, health or social care reports of behavioural change, absence patterns or disclosures made indirectly to a trusted adult
• Adults arranging unsupervised contact, private transport or overnight access outside an organisation's safeguarding policy

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

• NCMEC CyberTipline — The United States statutory reporting channel for suspected online child sexual exploitation, with global platform participation
• Internet Watch Foundation — Assessment and removal of child sexual abuse imagery plus annual analysis of hosting, trends and self-generated content
• INHOPE network of national hotlines — Country-level authorised reporting routes for the public and for organisations encountering material
• INTERPOL International Child Sexual Exploitation database — Victim identification resource restricted to accredited law enforcement specialists in participating countries
• WeProtect Global Alliance Global Threat Assessment — Evidence-based analysis of online child sexual exploitation trends, drivers and response gaps
• Thorn research publications — Survey-based research on youth online experience, sextortion patterns and disclosure behaviour
• NSPCC, Childline and equivalent national helplines — Aggregate contact data on what children are actually reporting, often ahead of formal statistics
• Tech Coalition and national safeguarding boards — Industry practice standards, serious case reviews and multi-agency safeguarding procedures

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

1. Receive through authorised channels only — Take reports via the designated hotline, platform trust and safety route or law enforcement channel. Never solicit, view, download or store suspected material.
2. Assess immediate risk first — Determine whether a child is in current danger. If so, escalate to police and safeguarding leads immediately, before any further analytical work.
3. Refer, do not investigate independently — Pass identifying detail to the competent authority. Victim identification and offender attribution require statutory powers and controlled databases.
4. Support pattern analysis lawfully — Analyse non-illegal artefacts such as payment methods, scripted language, account creation patterns and platform abuse trends to inform prevention.
5. Coordinate multi-agency response — Work with education, health, social care and platform teams so that removal, safeguarding and criminal process reinforce rather than disrupt each other.
6. Protect analyst welfare — Enforce supervision, exposure limits and mandatory psychological support for anyone working adjacent to this material, as a control not a courtesy.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Practised with these disciplines

• Criminal Intelligence — Intelligence Supporting Criminal Investigation
• Dark Web Intelligence — Hidden Services and Closed Criminal Venues
• Identity Intelligence — Resolving and Verifying Who Someone Is
• Social Media Intelligence — Intelligence from Social Platforms and Networks
• Legal Intelligence — Law, Litigation, and Regulatory Intelligence
• Human Intelligence — Information from People, Ethically Obtained

Worked in these data points

• Person / Name — A named individual — the subject of identity resolution and profiling.
• Social Profile — A social media profile or online account page tied to a persona or identity.
• Username / Handle — Screen name or handle used across online platforms and services.
• Image / Photograph — A still image — carries EXIF metadata and is the primary artifact for visual verification.
• Onion / Hidden Service — A Tor hidden service address on the dark web.
• Messaging Handle — An identity on a messaging platform (Telegram, Signal, Discord) used for coordination and sales.
• File Hash — Cryptographic fingerprint of a file, used for malware identification.

Adjacent mission domains

• Human Trafficking
• Dark Web Intel
• Gangs & Street Crime
• Forced Labour & Modern Slavery
• Organized Crime

Inside the platform: where Child Protection lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

• domain.php?d=cp — Child Protection dashboard
• theater.php?d=cp — Threat theater view
• search.php — Person / Name profile
• ioc-type.php?t=onion — Onion / Hidden Service profile
• correlate.php — Correlation graph
• cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

Relevant playbooks

Of the 14 incident playbooks in playbooks.php, these apply directly to Child Protection:

• Human Trafficking Triage — a step-checked workflow with the pivots, sources and handling rules already wired in.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

• Threat Hunt
• Correlate Infrastructure
• Run Alert Rules
• Summarise (Copilot)
• Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

1. Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Receive through authorised channels only is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
2. Building the picture. A single indicator is rarely the story. Refer, do not investigate independently turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
3. Producing something actionable. Analysis that ends in a document nobody can use is wasted. Protect analyst welfare feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Child Protection

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Defence organisations engage with child protection through conduct, vetting and safeguarding obligations rather than investigation. Personnel deployed near vulnerable populations create risk, and the sector has documented cases of abuse by peacekeepers and contractors, so prevention, reporting routes and accountability are the operational concerns. Analysts support vetting standards, child safeguarding policy for operations and contracts, and training on identification and referral. Constraints are absolute: any suspicion is referred to the designated safeguarding authority and to civilian police, never handled internally, and personnel must never seek out or retain suspected material under any circumstance.

🕵 National intelligence

National agencies contribute to this area only through specifically authorised units working with law enforcement and dedicated reporting bodies. The analytical contribution concerns organised financially motivated sextortion networks, payment infrastructure, and the hosting and distribution architecture, using lawful non content data. Handling requirements exceed ordinary classification because material and victim identity carry statutory protections and severe criminal liability for mishandling. Fusion supports disruption of networks and payment channels rather than victim identification, which belongs exclusively to accredited law enforcement units with access to controlled international databases.

👮 Law enforcement

Specialist units carry this work under strict legal authority: victim identification through controlled international databases, forensic examination on approved systems, and prosecution built to protect the child from unnecessary participation. Evidence handling has additional statutory constraints, since the material is itself illegal and can only be held on authorised systems by vetted personnel. Cases increasingly turn on financial and communications evidence obtained under production orders and mutual legal assistance, particularly in sextortion investigations where the offender is overseas. Safeguarding of the child takes precedence over investigative convenience at every decision point.

🔍 Private investigation and corporate security

Corporate and private investigators have a narrow and mostly protective role: platform trust and safety, employer safeguarding, and supporting families in ways that do not compromise a criminal investigation. A private actor must never seek out, view, download or retain suspected material, must not conduct undercover engagement with a suspected offender, and must not attempt to identify or confront an individual. Vigilante style activity contaminates evidence, endangers children and collapses prosecutions. The correct action on any suspicion is immediate referral to the designated national hotline and to police, and support for the family through recognised services.

📰 Journalism and OSINT media

Reporting must comply with statutory anonymity for child victims, which is far broader than withholding a name: school, town, family circumstances and images of relatives can identify a child locally. Never describe material or techniques, and never publish detail that would help an offender approach children or evade detection. Sextortion coverage should include the message that has been shown to reduce harm: that the child is a victim, that the images will not ruin their life, and that telling a trusted adult is the fastest route out. Reporting on institutional failure serves the public interest; reporting on individual cases rarely does.

🌍 NGO, humanitarian and human rights

Child protection organisations, hotlines and helplines carry the frontline burden. Practice is child centred and rights based, with the child's best interests as the primary consideration, informed and age appropriate participation, and support that does not depend on cooperation with police. Documentation for accountability must be handled with strict minimisation and protection because case records identify children. Hotline staff and moderators face severe and predictable psychological harm, so exposure limits, rotation, supervision and clinical support are mandatory controls. Referral pathways to NCMEC, IWF, INHOPE members and national police must be documented and briefed before anyone starts.

🎓 University and research

Research must be designed so that no researcher ever handles illegal material; studies work with hotline aggregate data, offender interviews under approval, survivor research with specialist support, or platform provided derived data. Ethics approval is mandatory and should address re-traumatisation, consent capacity, mandatory reporting duties and secure storage. Prevalence figures vary enormously with definition and method, so state both. Never publish technique detail. Share instruments and coding frames, publish through controlled access where data is sensitive, and be explicit that reporting statistics measure detection and platform reporting behaviour, not incidence.

Playbook: working Child Protection end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Establish the hard rules before any work begins

Write down and brief the absolute prohibitions: never seek out, view, download, copy, forward or retain suspected material; never engage with a suspected offender; never attempt to identify a child or an offender independently. Establish the referral route and who authorises escalation. A good output is a one page instruction every member of staff has read and signed, because these decisions cannot be made under pressure in the moment.

Phase 2 — Assess immediate risk first

Before anything else, determine whether a child is in current danger. If there is any indication of contact abuse in progress, imminent meeting, or a child at risk of self harm following sextortion, contact emergency services and the designated safeguarding lead immediately. Analytical work stops until that is done. The output is a recorded escalation with a time, because the response window in live sextortion cases is measured in hours.

Phase 3 — Refer through authorised channels only

Route suspected material and suspected offending to the designated national body: NCMEC CyberTipline in the United States, the Internet Watch Foundation in the United Kingdom, the relevant INHOPE member hotline elsewhere, and police in all cases involving a child at risk. Provide the minimum information necessary. Record the referral reference. A good output is a referral that lets the authorised body act without your organisation retaining anything it should not hold.

Phase 4 — Support the child and the family

Ensure the child receives age appropriate support and is told clearly that they are not to blame, that the situation is survivable and that adults will help. In sextortion cases, advise stopping contact, not paying, preserving evidence of the account and messages, and reporting to police and the platform. Signpost removal services for imagery. The output is a family that knows the next three steps, which materially reduces the risk of self harm.

Phase 5 — Preserve evidence without handling material

Where a family or organisation holds evidence, advise them to preserve devices and accounts without deleting anything, and to hand them to police rather than examining them. Do not take custody of devices that may contain illegal material. Record account names, timestamps, payment details and platform identifiers, which are lawful to hold. A good output is a preserved evidential position achieved without anyone unauthorised touching prohibited content.

Phase 6 — Analyse lawful non content signals

The legitimate analytical space is non content data: scripted opening messages, payment collection methods, account creation patterns, platform abuse trends, hosting and infrastructure. This supports prevention and disruption of organised sextortion networks without any handling of material. The output is a pattern picture that platforms and law enforcement can act on, contributed through the correct channel with handling markings. Contribute findings only through the authorised channel, never through open publication.

Phase 7 — Work the payment and platform layer

Financially motivated sextortion depends on payment collection through gift cards, transfer services and virtual assets, and on account creation at scale. These are lawful to analyse and are the fastest disruption points. Coordinate with payment providers and platform trust and safety teams, and refer to law enforcement. A good output identifies a collection method or account creation pattern that a provider can block, which protects children not yet targeted.

Phase 8 — Distinguish offender types in risk assessment

Organised financially motivated extortion crews, individuals seeking sexual gratification through grooming, contact offenders in positions of trust and peer to peer harm all require different responses. Conflating them produces poor risk assessment and misdirected prevention. The output is an assessment that names the pattern being addressed, because the intervention that works for an overseas extortion network does nothing about abuse within a family or institution.

Phase 9 — Address institutional safeguarding

Where the risk is within an organisation, work through the safeguarding framework: safer recruitment, supervision, clear reporting routes that bypass the person in authority, and an environment where children can disclose. Most abuse occurs in relationships of trust rather than through strangers online. A good output is a specific control change with an owner, not an awareness campaign, because policy that exists on paper has repeatedly failed to protect children.

Phase 10 — Coordinate multi agency response

Bring education, health, social care, police and platforms together around the child so that removal, safeguarding and criminal process reinforce each other. Ensure the child is not required to repeat their account to each agency. Agree who holds what information. The output is a coordinated plan with a single lead professional, which is what statutory safeguarding frameworks require and what practice frequently fails to deliver.

Phase 11 — Protect staff as a mandatory control

Enforce exposure limits, rotation, clinical supervision and mandatory psychological support for anyone working adjacent to this area, and treat these as controls rather than benefits. Monitor for the signs that someone should be moved out of the role. A good output is a team that can sustain this work, with a documented welfare regime and evidence it is followed, since the harm to staff is severe, predictable and preventable.

Phase 12 — Feed prevention with evidence

Convert pattern analysis into prevention that reaches children and parents: what the approach looks like, why the child is not to blame, and what to do in the first hour. Evaluate whether the message changes behaviour rather than assuming it does. The output is prevention content grounded in observed offending patterns and tested with the audience, distributed through schools, platforms and helplines.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
NCMEC CyberTipline	Open	United States statutory reporting channel for suspected online child sexual exploitation with global platform participation.	The mandatory reporting route for suspected material and exploitation involving United States platforms.
Internet Watch Foundation	Open	United Kingdom hotline assessing and removing child sexual abuse imagery, with annual analysis of hosting and trends.	Authorised reporting route in the UK and authoritative trend data on hosting and self generated material.
INHOPE network of national hotlines	Open	International network of authorised hotlines providing country level reporting routes for the public and organisations.	Identifying the correct national reporting channel wherever an organisation operates. Every organisation should record its local hotline before starting work.
WeProtect Global Alliance Global Threat Assessment	Open	Evidence based assessment of online child sexual exploitation trends, drivers and response gaps.	Strategic framing and current evidence on emerging patterns including sextortion and generated material.
Thorn research	Open	Survey based research on youth online experience, disclosure behaviour, sextortion and self generated imagery.	Evidence on what children actually experience and what prevention messaging works. Also informs the wording used in prevention messaging to teenagers.
NSPCC and Childline	Open	United Kingdom child protection charity with helpline data, practice guidance and research on abuse and disclosure.	Aggregate insight into what children report, often ahead of official statistics, and referral guidance.
INTERPOL Crimes Against Children programme	Licensed	International coordination including the victim identification database restricted to accredited specialist investigators.	The authorised international route for victim identification work by qualified law enforcement only.
Tech Coalition	Open	Industry body coordinating platform practice, detection technology and cross company response to online child exploitation.	Understanding platform detection practice and the correct trust and safety escalation routes.
Take It Down and StopNCII services	Open	Hash based services allowing removal of intimate imagery from participating platforms without submitting the image itself.	Practical removal route to offer a young person or adult whose imagery is circulating.
National safeguarding boards and serious case reviews	Open	Published reviews of cases where children were seriously harmed, identifying systemic failures and recommendations.	Evidence on how institutional safeguarding actually fails, which drives control design. Reviews consistently identify information sharing failures between agencies.
ECPAT International	Open	Global network research and country monitoring on sexual exploitation of children including travel and tourism contexts.	Country level context and policy analysis for organisations operating internationally. Particularly useful for travel and tourism related exploitation risk.
Lucy Faithfull Foundation and Stop It Now	Open	Prevention services working with people concerned about their own behaviour and with families affected by abuse.	Referral route for prevention and family support, an under used element of an effective response.
Europol and national law enforcement reporting	Open	Assessments of online child sexual exploitation trends, operational reporting and coordinated action outcomes.	Understanding organised offending patterns and law enforcement response capability. Also identifies coordinated operations and current disruption priorities.
Council of Europe Lanzarote Committee	Open	Monitoring of state implementation of the convention on protection of children against sexual exploitation and abuse.	Assessment of national legal frameworks and protective measures across member states. Useful when assessing partner country capability before working there.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Child Protection. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

• Hash matching services operated by authorised bodies — Detect known material at scale on participating platforms. Limitation: cannot detect newly produced or modified material, which is a growing share.
• Take It Down and StopNCII hash submission — Allow a person to have imagery removed without sending the image anywhere. Limitation: only works on participating platforms and cannot reach closed distribution.
• Safeguarding case management systems — Coordinate multi agency records around a child with restricted access. Limitation: information sharing barriers between agencies remain the recurring failure in serious case reviews.
• Platform trust and safety escalation channels — Enable rapid account action and evidence preservation on major services. Limitation: response quality varies widely and smaller platforms often have no functioning route.
• Payment provider abuse reporting — Disrupts gift card, transfer and virtual asset collection used in sextortion. Limitation: requires provider cooperation and offenders move quickly to new methods.
• Non content pattern analysis tooling — Analyses scripted messaging, account creation and infrastructure patterns lawfully. Limitation: deliberately excludes the content signals that would be most diagnostic, which is the correct trade off.
• Staff welfare monitoring and rotation systems — Track exposure and enforce limits for people working in this area. Limitation: only effective where managers act on the data rather than treating it as reporting.
• Prevention content evaluation — Tests whether safety messaging changes behaviour among children and parents. Limitation: rarely funded, so most prevention material is distributed without evidence of effect.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

• Threat Hunt — Runs saved hypotheses against the corpus and surfaces what matches, with the query preserved as a versioned artifact.
• Correlate Infrastructure — Builds the cross-entity link graph: shared hosting, reused certificates, overlapping registrants, repeated selectors.
• Run Alert Rules — Evaluates saved rules against new data so a first sighting raises a notification rather than waiting for review.
• Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
• Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

• The referral route is the capability. An organisation's value in this domain is knowing exactly which authorised body receives which report and getting it there fast, not building any analytical capacity of its own.
• Sextortion escalates in hours, not weeks. Contact, escalation and demand frequently occur within a single day, so prevention messaging and family response advice must be built for that timescale.
• The most protective message is that the child is not to blame and the images will not ruin their life. This has been linked to reduced self harm, and it belongs in every piece of prevention material and every conversation.
• Hash matching misses what matters most now. Newly produced, self generated and modified material evades known hash detection entirely, so coverage claims based on hash matching systematically overstate protection.
• Stranger danger framing misdirects resources. Most abuse occurs within relationships of trust, and institutional safeguarding controls protect more children than any amount of online monitoring.
• Vigilante activity harms children. It contaminates evidence, alerts offenders, causes wrongful identification and collapses prosecutions, and any organisation encountering it should route the information to police rather than engage.
• Analyst welfare is a control, not a benefit. Exposure limits, rotation and clinical support prevent serious predictable harm, and an organisation unwilling to fund them should not undertake work adjacent to this material.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Child Protection is producing anything, and they are worth baselining before you change process or tooling.

• Time from first indication of a child at immediate risk to a completed referral to police and safeguarding leads.
• Proportion of referrals made through the correct authorised channel on first attempt, with a recorded reference.
• Rate at which children and families who received support report the situation resolved without further escalation.
• Staff welfare compliance: adherence to exposure limits, rotation schedules and supervision sessions, audited rather than self reported.
• Reach and measured behaviour change of prevention messaging among the target age group, rather than distribution volume.
• Time from report to removal for imagery submitted through hash based removal services. Measured from submission to confirmed removal on participating platforms.
• Number of payment collection methods or account creation patterns disrupted through provider and platform engagement.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

• Vigilante confrontation activity, which frequently contaminates evidence, tips off offenders and results in failed prosecutions
• Assuming the account holder is the offender, when devices are shared, accounts compromised and children sometimes coerced into recruiting peers
• Estimating age from imagery or profile claims, an unreliable judgement that specialist practitioners treat with considerable caution
• Relying on hash matching alone, which misses newly produced, modified or self-generated material entirely
• Focusing on stranger-danger online while under-weighting intra-familial abuse and peer-on-peer harm, which are more common
• Allowing analysts sustained exposure without supervision, rotation or clinical support, causing serious and predictable harm

Legal and ethical considerations

Possession, viewing, copying or transmission of child sexual abuse material is a serious criminal offence with no research or journalistic exemption in most jurisdictions; only specifically authorised personnel using approved systems may handle it. Suspected material must be reported to the designated hotline or police and nothing retained. Children's identities are protected by statutory anonymity and reporting restrictions. The child's best interests take precedence over investigative convenience, and personnel require vetting, training, defined supervision and documented welfare provision before undertaking any work in this area.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Child Protection, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 6 intelligence disciplines, 7 data points, 5 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

What should someone do the moment they suspect they have encountered illegal material?

Stop immediately. Do not view further, do not download, copy, forward or save anything, and do not attempt to verify what it is. Report to the designated national body: the CyberTipline in the United States, the Internet Watch Foundation in the United Kingdom, or the relevant INHOPE member hotline, and to police if a child may be at risk now. Record that you made the referral and the reference given. Tell your safeguarding lead. Then seek welfare support, because encountering this material affects people and organisations should expect that.

A teenager is being sextorted right now. What actually helps?

Tell them clearly that they are the victim, that this is a crime being committed against them, that it happens to many people and that their life will not be ruined. Advise stopping all contact and not paying, since payment leads to further demands. Preserve the account details and messages without deleting them. Report to the platform and to police, and use a hash based removal service so imagery can be taken down without sending the image anywhere. Stay with them: the risk of self harm is highest in the first hours and is reduced by an adult responding calmly.

Can an organisation build its own capability in this area?

Only in a narrowly defined protective role, and only with the right structures. Legitimate activity includes recognising indicators, referring correctly, supporting families, analysing lawful non content patterns and improving institutional safeguarding. It never includes handling material, engaging with suspected offenders or attempting identification, which require statutory authority and controlled systems. Before starting, an organisation needs vetted staff, documented referral routes, a written hard stop policy, supervision and funded clinical support. If it cannot provide those, the correct capability is a good referral route and nothing more.

Why is hash matching not enough?

Because it only finds material already known and hashed. Newly produced material, self generated imagery, and modified or re-encoded copies are missed, and these categories have grown substantially. Generated material adds a further gap. Hash matching remains valuable for scale removal of known material and for reducing revictimisation, but coverage claims built on it overstate protection. Detection of new abuse depends on behavioural signals, platform reporting, disclosure by children and the work of specialist investigators, which is why prevention and safeguarding investment matters alongside detection technology.

How should organisations handle staff exposed to this work?

As an occupational health risk with a documented control regime. That means defined exposure limits, rotation out of the role, mandatory supervision, access to clinical support with practitioners experienced in this material, and managers trained to recognise the signs that someone must be moved. Screening before entry into the role and periodic review are appropriate. The harm is well documented and predictable, and it develops gradually, so voluntary support that people must request is insufficient. Compliance should be audited rather than assumed.

What is the correct response to encountering vigilante activity?

Do not participate, do not amplify, and pass the information to police. So-called hunter groups regularly contaminate evidence, alert offenders, misidentify innocent people with severe consequences, and cause prosecutions to fail. Their activity also removes control of timing from investigators who may be working to safeguard a specific child. Where an organisation receives material from such a group, refer it to police with an account of how it was received, and do not conduct any independent verification that would involve engaging with the suspect or handling content.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

• UN Convention on the Rights of the Child and its Optional Protocol on the sale of children, child prostitution and child pornography.
• Council of Europe Lanzarote Convention on the Protection of Children against Sexual Exploitation and Sexual Abuse.
• National statutory safeguarding frameworks such as Working Together to Safeguard Children, defining multi agency duties.
• Statutory reporting obligations to designated bodies including the NCMEC CyberTipline for United States providers.
• INHOPE hotline operating standards governing assessment, referral and handling by member hotlines.
• Statutory anonymity and reporting restrictions protecting the identity of child victims in legal proceedings and media.
• Safer recruitment and vetting standards including criminal record checking regimes for roles working with children.
• WHO and UNICEF ethical guidance on research and interviewing involving children affected by violence and exploitation.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

1. CyberTipline reporting service — National Center for Missing and Exploited Children. Statutory United States reporting channel for online child sexual exploitation.
2. Annual Report and hotline services — Internet Watch Foundation. Assessment and removal of abuse imagery with published trend analysis.
3. INHOPE hotline network — INHOPE. International network of authorised national reporting hotlines.
4. Global Threat Assessment — WeProtect Global Alliance. Evidence based assessment of online child sexual exploitation.
5. Youth online experience research — Thorn. Survey research on sextortion, self generated imagery and disclosure.
6. Take It Down removal service — National Center for Missing and Exploited Children. Hash based removal of intimate imagery for minors without image submission.
7. Crimes Against Children programme — INTERPOL. International coordination and restricted victim identification capability.
8. Lanzarote Convention monitoring — Council of Europe. Assessment of state implementation of child protection obligations.

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: routes indicators to authorised reporting channels and supports safeguarding referral without ever handling illegal material. Explore the platform, or browse the rest of the library by following any tag above.