Child Abuse and Open Source Intelligence (OSINT) Landscape

Europol’s Child Abuse Image Geo-Located In Ukraine using OSINT: A Forgotten Story Hidden Behind A Landscape

The following report contains a reference to a child modeling studio producing child sexual abuse material in 2001. All names related to the studio are fictitious. The original source did not contain any explicit material. All the images accessed and used during the investigation were already censored, but for the avoidance of doubt, it must be noted that the researchers did not obtain, look or download any explicit content.

The original source was shared with Europol before the publication of this report and cannot be revealed for the protection of the victims and as to not impede the investigations. Although the main objective of the article is to show the method by which an image listed by Europol was geo-located, Bellingcat has decided to publish some details found in the investigation to create awareness of the subject and to support Europol’s #StopChildAbuse campaign.

Europol currently holds more than 40 million images of child sexual abuse from across the world.

In June 2017, Europol launched a crowdsourcing campaign called Stop Child Abuse – Trace an Object. Censored extracts from explicit images are regularly published on their website and members of the public are asked to help to trace their location or country of origin. These tips are then used to inform the competent law enforcement authority to further investigate the lead and to assist in the identification of the offender and the victim.

As of 23 March 2019, Europol has received more than 23,000 tips, which led to the identification of eight victims and the prosecution of one offender.

In recent reports, Bellingcat wrote about their contribution to geo-locating images in China and Russia.

For several months, the image shown in Figure 1 was live on Europol’s website. From now on we will refer to this image as “ImageC5” in the text. Bellingcat team members and other Twitter users previously pointed out the difficulty of geo-locating this image. The main reason: There are no mountains, landmarks, roads, posters, signs, brand names, or any remarkable object featured on it. Instead, there is a rather desolate landscape flooded with weeds and few rural buildings in very low resolution. What we did not know then was the dark story ImageC5 hid, the number of victims affected by it and how the story itself would allow us to geo-locate this image to Kalahliya, a Ukrainian village 47 km southwest of Odessa.

Figure 1: ImageC5 as listed by Europol on their website #StopChildAbuse #TraceAnObject (left). The image was geo-located to a village called Kalahliya, which is southwest of Odessa in Ukraine. The red mark indicates the approximate location from which the original photo was taken from; just on the northeast corner of a group of building ruins (right).

The Initial Research

Our first observations about the image were as follows:

• A small gradient in the terrain with a few sudden drops across the land
• Rural houses and buildings with metal roofs (single and multiple pitches)
• Tall dried weeds and broken branches as well as reeds and grasslands
• An orange/brick construction with a dark roof far on the right side of the image
• The image was edited by Europol to protect the victim. The censoring process was done in such a way that almost 10% of the landscape was reconstructed. Small fractions from other points on the image were merged into the cropped area. This caused the repetition of items in several points of the landscape.

Important Definitions and Key Facts

Child Sexual Abuse Material (CSAM), also called child pornography, refers to any representation, by whatever means, of a child engaged in real or simulated explicit sexual activities or any representation of the sexual parts of a child for primarily sexual purposes.

In 2014, Russia was reported to host the second-highest amount of CSAM in the world, accounting for 24%.

In 2016, Ukraine was the first in Eastern Europe. The traffic of children for sexual exploitation to Moscow and St. Petersburg from Moldova and Ukraine has also been documented.

The type of houses observed on ImageC5 suggested a very small village which seems to be a rural Soviet construction style, as opposed to western European.

ImageC5 did not feature either any type of tropical, coniferous, or desert vegetation. Therefore Asia, the Middle East and densely forested areas in Europe and North America were not considered. Grasslands are located across Moldova, Ukraine and a thin belt along the border between Russia and Kazakhstan.

Intersecting all these geographical and architectural observations with the information about Children’s Sexual Abuse in the region, the initial search was chosen to be within the area marked in red on the map in Figure 3, particularly those villages with links to major cities such as Moscow and Kyiv.

Figure 2: Vegetation map of the former Soviet Republics. Grasslands are found across Ukraine and a thin Belt into Russia.

Figure 3: Initial region selected to start the search for ImageC5. The area included West Moldova, South and East Ukraine, and the area around the Ukraine-Russia Border, Moscow, and the River Volga.

It was initially believed the brick construction on the far right side of the picture could have been a Soviet-era railway water tower or a small train station. Railway routes, travelers’ videos, and hundreds of photos were checked to understand the landscape, as well as the typical layout and architecture of small villages.

The first slight landscape similarities with ImageC5 were found in eastern Ukraine within the Sumy oblast. Unfortunately, with no defined landmarks to look for and the limited availability of imagery and street views outside main cities, further visual checks were unproductive. No evidence found was significantly relevant to draw any conclusion. The place could have been anywhere in the marked region if it existed there at all.

A Breakthrough In The Search

The next step was to find more details about Child Sexual Abuse cases in the suspected region that could then be associated with ImageC5. In early June, after following a lead from a regional children exploitation report, a comprehensive investigative file was found containing details of a child modeling studio trafficking children from Moldova to Ukraine for the production of CSAM.

Important Note

The source of such files cannot be revealed for the protection of the victims and as to not impede the investigations. The original source was shared with Europol before the publication of this report. All the images accessed and used by the Bellingcat team during the investigation were already heavily censored by the original source of the files, but for the avoidance of doubt, we will once again note that the researchers did not obtain, look or download any explicit content. All names related to the studio used in this report are fictitious.

What information was found in the files and how did we use it to geo-locate ImageC5?

The investigative file described the operation of the studio and its associated websites. Most of the CSAM created by the studio was reported as having been produced in the Odessa region in Ukraine. The file also included a list of unknown locations where at least 60 models were photographed in 2001 for Website2.

All unknown locations appeared classified as Coast, Inland or Ruins, followed by a sequential number, their respective group of censored thumbnails, and a brief description of the surrounding landscape or visible buildings. No specific geo-location was given.

To our surprise, in the group called “Location Ruins (1 & 8)”, a thumbnail containing the same ImageC5, as published by Europol, was found. A direct link between ImageC5 with an official Child Sexual Abuse case was established.

Other censored thumbnails found next to ImageC5 showed several building ruins and a red building in the background, which, according to the file description, could have been a church in a nearby village.

The search for a desolate landscape had evolved into a search for more identifiable landmarks – the building ruin and “the red church.”

Having new information about other potential unknown locations related to the case, our strategy was to “encircle” ImageC5’s location in the Odessa region by a simultaneous hunt for the red church, Location Ruins (1 & 8), Ruins (2,3 & 7), Inland (3,6 & 7), Inland (8) and Coast (1 & 6). This selection of censored thumbnails included the most recognizable items for each one of the locations and constituted the key to finding ImageC5. A diagram with all the material used is presented in Figure 4.

Figure 4: Selection of unknown locations listed in the investigative files and related to ImageC5. All images accessed and used by Bellingcat during the investigation were originally censored by the source of the files.

“The Red Church” And Landscape Features

Initial efforts were made to find the red church by exploring the area using Google Earth and Yandex. The number of churches in Odesa oblast (approx. 33.000 km2) was too large to scrutinize them one by one and many did not have photos easily available for checks.

We also noticed that in some cases the colors and features of churches were changed, due to upgrades and repairs. This made the initial search for the church extremely difficult. Although we were initially unsuccessful, valuable landscape and architecture information was gathered. Different points across the region were analyzed with similarities found in several areas; for example, Anan’iv Pershyi and Vyzyrka. Based on this and other examples, it was likely the location to be found along the coastal area of Odessa.

Using Google imagery, dimensional analysis was done on several churches to establish a reference geometric pattern (see Figure 5):

• The height of the bell tower was the same as the altar tower, excluding the domes.
• The width of the altar tower was approximately double of the bell tower.
• Exterior made of red bricks. But we noted that it could have been repainted.
• Both towers could feature either round, semi-round, pitched or onion type domes.
• In church architecture, altar towers are normally oriented to the East. In almost all cases in Odessa there was no exception. This meant Ruins (1 & 8) were very likely to be located southeast of the church. A very important check to do when finding potential geo-locations.

Figure 5: Dimensional characteristics of the similar church in Odessa oblast.

The Ruins

Group Ruins (1 & 8) featured what seemed to be the ruins of a small industrial facility. Scattered precast pillars could be seen on the ground. There were walls with faded pink tones, large holes, and bullet marks on many of them. The holes seemed similar to those left by a projectile impact. Presumably, these ruins were the result of previous conflicts in the area.

But where to find this type of ruin in an area of 40,000 km2 including Odessa oblast and west Moldova? Furthermore, do the ruins still exist or have the sites been cleared up to give way for new developments? Also, which conflict could have inflicted such damage on a rural structure before 2001?

Using Google imagery, examples of ruins were gathered to establish a visual reference as shown in Figure 6.

Two main events were considered: WWII and the Transnistria conflict in 1992.

WWII front lines were studied according to literature as per the maps in Figure 7. In 1941, a system of 3 defense rings was established by the Soviets to protect Odessa; with the outermost ring located at a 50km mark from the city. From March to April 1944, the Red Army launched offensives to liberate Odessa. In August 1944, as part of the Jassy–Kishinev operation to reclaim the Moldavian SSR, the Red Army engaged a large German-Romanian contingent with heavy battles starting with the Akkerman landing.

In both conflicts, WWII and Transnistria, there were fronts localized on several points along the Dniester River and Dniester Estuary. This line would become a focus of attention later in our search.

Geo-locating ImageC5 By Finding Other Locations Related To The Case

1. Location Ruins (2,3 & 7) – The Greenhouse

Ruins (2,3 &7) appeared to be part of a period property or castle featuring a glass roof structure typical of those found in old greenhouses. The studio was reported to operate from several apartments in the city of Odessa. Their approximate location was investigated and pinned as shown on the map in Figure 8. It was believed that one or several of the locations could have been nearby their studios. Hence, we started to explore the area with Google Maps along Road F. From north to south, we looked for abandoned buildings, castles and ruins where any of the studio’s sets could have been located.

A landmark symbol led us to the ruins of greenhouse Marazli, originally built in 1889. Pictures found in Yandex dated back to 2016 were gathered and analyzed.

Many features in its interior matched those found in the censored thumbnails of ruins (2, 3 & 7), especially the angle of the glass roof structure, supporting beams, door features, windows and stone masonry (See Figure 9 ). The location served its purpose until the 1990s, but various events ultimately contributed to its abandoned state. The source reported the location was used by the studio to produce several CSAM between July and August 2001. No signs of location Ruins (1 & 8) or the red church were noticed in the surrounding areas.

2. Location Inland (3,6 & 7) – Oleksandrivske Reservoir

A thumbnail within the Inland (3 & 6) group featured a river or lake. A transmission tower in the background could be seen just opposite the bank from where the shot was taken. Another shot, believed to have been taken in the opposite direction to the first, featured another transmission tower, dried grasslands, and small trees in the background.

Using Google Earth, narrow bodies of water with these characteristics along the coast were investigated.

On the south end of Oleksandrivske Reservoir, a peninsula with transmission lines on its west side was identified. Across the reservoir, another transmission tower and cables crossing above the water were noticed. By setting the time bar to 05/06/2008, the grass on the peninsula showed up as dried and small trees could be seen clearer now on the east side of the peninsula, just behind the transmission tower. A match was found (see Figure 10). The source reported this location was used by the studio to produce several CSAM between July and August 2001.

Checking the rest of the reservoir for more clues, a white building with a slim tree in the front was noticed east of the previous location. These elements matched those displayed on location Inland (7). After analyzing the image, it was determined the shot was taken from the south shore of the Oleksandrivske Reservoir (see Figure 10). The source reported this location was used by the studio to produce CSAM in October 2001. No signs of Ruins (1 & 8) or the red church were identified in the surrounding areas.

3. Location Inland (8) – Kuyalnik Estuary

The unknown location Inland (8), featured a water body and sand around the shores. Despite the low quality of the censored thumbnails, a pink/red tone to the sand was noticed. On the left side of the image, along the cliff which ended in the horizon line was visible. Looking at the background, no buildings or mountains were seen. The body of water seemed to be quite elongated.

In our initial searches around Odessa, we had noticed Kuyalnik Reservoir, which had pink sands. We re-visited the images of Kuyalnik for a reinspection. The result: a Google maps image featuring the same cliff on the west shore of the reservoir.

The cliff exhibited the same angular lines converging downwards and touching the horizon. Dark pink sand was also noticed as well as curved watermarks. Another location verified. The source reported the location was used by the studio to produce CSAM in September 2001. No signs of Ruins (1 & 8) or the red church were identified in the surrounding areas.

4. Location Coast (1 & 6) – Mykolaivka Village (Dniester Estuary)

Many of the censored images within the group Coast (1 & 6) featured a peninsula with a slim tree on it. The images seemed to have been taken on a shore very close to a grassy cliff.

Rocks bigger than 1.5 meters in diameter, which had become detached from the cliff, appeared in almost every shot from different angles.

All main elements were numbered (1 to 10) and organized by scene (A to D). The tree and the peninsula were selected as landmarks with more potential to be identified in satellite images.

Having checked other bodies of water on the northeast side of the coastal region of Odessa, the southwest area around the Dniester Estuary was to be explored using Google Earth. On the east coast of the estuary at the level of the village Mykolaivka, a small peninsula was found. This peninsula had several trees on it but only one produced a long shadow relative to the size of the peninsula and matching the relative position to the one shown in the censored thumbnails.

From the 2014 satellite image, large rocks could be seen all along the shore. After careful analysis, all rocks and trees were identified. Another image geolocated. The source reported the location was used by the studio to produce several CSAM between the end of July and beginning of August 2001.

5. The Final Search And Verification

After geo-locating four different sites related to the case, a 50 km radial perimeter was established around the city of Odessa. This perimeter coincided with one of the battlefronts that took place during WWII on the east shore of the Dniester Estuary. Hence, it was believed that some type of ruins, if linked to the war at all, were likely to be found around this area.

The main road connecting the village of Mykolaivka and Ovidiopol (T1625) was checked for any signs of the red church or ruins. When doing a visual inspection with Google Earth around the village of Kalahliya (Калаглія / Калаглия ), a church was noticed at coordinates 46.281507, 30.358500 on June 2. Its name: Церква Миколая Чудотворця, i.e. the Church of St Nicholas. All the features matched our references. A Twitter user, Lorenzo Romani, also confirmed finding the same church on June 22 through someone in his network.

But was this truly the right place? Were there any ruins around?

Checks were done in the immediate surroundings southeast of the church but there were no signs of any recognizable ruin structure. Then, the historical view of Google Earth was changed. A compound in ruins was visible in other years, with 2007 being the earliest image available.

Despite the lack of street views on Google Earth and Yandex for this location, Images and YouTube videos of the village were scrutinized in order to identify all the buildings visible on ImageC5. A drone video found offered the best view of the site and it helped us not only to identify each of the elements but also to estimate the position of the camera (See Figure 15 and Figure 16).

Further checks were done on two of the buildings featuring on ImageC5: the single pitch roof building (marked in yellow) and the brick construction on the far right (marked in red). We found videos recorded from Road T1625 which connects Kalahliya with Ovidiopol and passes just behind these buildings. The type of windows, roof, masonry colors, as well as relative position, matched those shown on satellite views as well as ImageC5 (see Figure 17).

Satellite images and all thumbnails in group Ruins (1 & 8) were carefully analyzed to extract information such as the positions of trees, shadows sizes, sunlight direction, vegetation, exterior paint colors, and the relative position of debris. A solar calculation was done for early September 2001 as representative data for the month when the CSAM was generated.

Putting all of the puzzle pieces together, a basic sketch of the ruins was done to understand more about the site and to indicate the relative points where the thumbnail photos were taken from (See Figure 18).

The size of the construction and the presence of gates to the southeast and northwest ends of the main structure reconfirm the possibility that the building was an old, small-sized industrial/army facility. The reconstruction should be taken only as an intuitive guide only.

With all elements identified, the site has been verified and ImageC5 has been now officially geolocated. The source reported the location was used by the studio to produce several CSAM between August and September 2001. A summary of the geolocation process followed is offered in Figure 19.

 

“Studio A” And Their Associated Websites

Although our main goal was to share information on how ImageC5 was geolocated, we also want to offer a brief summary of the operation of the studio and its websites as reported by the source. Though almost 20 years have passed and there is little reference to it on the internet, this studio impacted the world of CSAM production and contributed to its development. It is a clear example of how purveyors of CSAM adopt the guise of benefactors.

• First, they pay off the victims’ typically impoverished families.
• Second, they develop a child education and entertainment program designed to quell the parents’ and the public’s distrust in the studio.
• Finally, they take advantage of then-underdeveloped CSAM legislation in Ukraine and an emerging worldwide internet. This is a business model that is still being followed by many modern criminal organizations.

This following section was extracted from the files and by no means expresses the views of the authors – it is rather meant to raise awareness of how such criminal enterprises operate. For legal reasons and for the protection of the victims and offenders, we cannot disclose the source. All names used here are fictitious.

Studio A was a company founded by Denis M. & Sergey P. in the early 2000s with funds coming from several European financiers. Denis was an IT expert and Sergey was a photographer known for nude “artistic” work with teens.

Both individuals met in the summer of 2000 and made several arrangements with other webmasters and studios to set up Website1. Sergey would generate the photographic content and be the main model finder; whereas Denis would be in charge of the technical side.

By September of the same year, Website1 was fully operational, with the material being produced by Sergey in Ukraine. All websites associated operated on a subscription basis. The studio operation included transportation, admin, and security crews. The latter were mainly previous law enforcement officers.

Most of the underage children featuring in their productions were scouted around schools in eastern Europe – mainly Moldova.

They usually came from impoverished backgrounds and were offered “modeling work” to help their families with money equivalent to a month’s salary of their parents. Knowing the conditions required by the studio, many parents reportedly agreed to send their children from Moldova to Ukraine with Studio A.

The victims lived in different apartments owned by the studio across the city and received a computer, arts, and English lessons when they were not “modeling.” In efforts to further legitimize the criminal enterprise, the studio organized outings with the parents. Also, according to interviews reported in the files, Denis had falsely claimed on several occasions that the business was “socially responsible” and part of a charitable project in partnership with a worldwide human rights organization.

According to the files, Sergey, who managed the business independently, had a serious addiction to heavy drugs.

According to victims’ testimonies, as per the files, Sergey not only photographed victims naked but would then physically sexually assault them and offer them addictive substances. What ultimately happened to Denis and Sergey’s partnership remains unclear, but it is reported that tensions between Denis and Sergey increased and they parted ways in early 2001. Denis renamed the company Studio A* and Sergey kept the original enterprise. Studio A. Sergey convinced a number of parents and children to stay him, while another of the other children exploited by Website1 moved on to Studio A*.

Denis then created another website, Website2. The initial material used for this website came from Russia-based projects that featured nude underage girls. Later, Denis started to create new material for which he recruited new victims in Moldova. Sergey kept most of the material created for Website1 and sold it to other parties on the web. Sergey kept working for other studios and also created a new brand, Studio C.

Both Website1 and Website2 went down starting in 2002. According to Denis, Website2 was hijacked and redirected to another page that apparently contained more explicit abuse material. According to the files, Denis placed responsibility for that on organizations based in Russia.

After the 9/11 attacks in the U.S., federal authorities and international agencies started to investigate all sorts of irregularities on the web more closely.

It is likely that Ukrainian authorities at this point came under more pressure, while the police had information about the frequent trafficking of minors from Moldova to Ukraine. In 2002, two women traveling with four children were detained in a train station close to the Ukraine/Moldova border for interrogation. They were carrying false documentation to take these minors abroad.

During questioning, all underage girls mentioned they were paid an average of $50 per session in exchange for taking part in explicit photography produced by two individuals: Denis & Sergey. The police proceeded to raid all studios and seized all computer equipment, drugs, and CSAM. Both Denis and Sergey had fled by then, presumably alerted by their corrupt contacts on the police force.

Denis moved to Switzerland and then to Moldova, whereas Sergey was reported to have lived in Moldova, Germany and the U.S.

The Ukrainian government initiated a case against both individuals in 2002 for the production, sale, and distribution of CSAM. Surprisingly, charges against Denis were dropped in 2003. Ukrainian legislation at that time did not have any provisions for CSAM production.

According to the source, Denis relaunched Website1, but without any nude material. He also created a new studio called Studio B and closed Studio A*. By 2004, both websites Website1 and Website2 were down. In 2007, Denis married one of the girls that worked for the studios – it is unclear how old she was at the time and when she was first recruited – and the ceremony reportedly took place in Moldova. A documentary film was also produced to portray Denis and girls who worked for the studio in more recent years. This production was never commercialized.

Most of the CSAM Sergey produced remains undocumented due to missing data. Sergey was put on a wanted list by police in Germany in relation to the abuse of minors as well as for CSAM dissemination. There is no information available to determine whether Sergey was prosecuted or not.

Post-Analysis: Key Facts from the Investigative Files

• ImageC5 was produced for Website2
• At least 60 victims between the ages of 8 and 17 were hired to work for Website2
• More than 7300 images were produced in less than a year
• The website published approximately 270 sets of images
• 60% of the CSAM was produced in studio facilities, while 40% was produced in outdoor locations
• On average, 3% of the production was done in each one of the Ukrainian outdoor locations with an 8% maximum produced in Russia.
• There were seven “photographers” working for the page including Denis and other unidentified individuals associated with the studio.
• The source reported the studio employed assistants, drivers, teachers, and security staff. The latter have had previously worked in law enforcement.
• $250,000 were received on the personal accounts of Denis and Sergey for the operation carried in Ukraine.

Conclusion & Recommendations

ImageC5 on its own contained no relevant information. The initial geolocation process for this image proved to be unproductive via employing traditional methods. More details were needed to be able to take the research further.

This time, an in-depth literature review on child sexual abuse cases supplied the information required to narrow down the search. Without knowing the details of the case, ImageC5 would have been never geolocated. By finding other locations related to the case, valuable landscape, architectural, war zone, and terrain data was collected. The iteration process of the search converged quicker towards the location where ImageC5 photograph was taken from.

After intensive research, Images are normally geolocated accurately. A great deal of information related to the cases is usually gathered through the process. Not all details found in our investigations are shared – due to the need to protect victims. In this case, the investigative files found came from an anonymous source that Europol has been informed about.

Eighteen years have passed since the discovery of the dark operation of Studio A.

The case was known to both Ukrainian and international authorities. If data and privacy laws permit, It could be helpful to see that for any child abuse case already processed by law enforcement bodies in Europe, all CSAM images seized should be entered into a centralized database. Law enforcement agencies could then run algorithms for an internal image reverse search to assist future geolocations and investigations. In this way, images for which there is already a background case would be left out of any crowdsourcing campaign. Moreover, if the amount of data collected is large, maybe the algorithm could be capable of comparing landscapes and other information between old and new images, thus drawing a preliminary geographical search area or creating leads for new cases.

The Studio A case is a clear example of child sexual abuse and human trafficking.

The operation persuaded stakeholders of their “socially responsible” approach to leverage their business. The production of CSAM was allowed by an archaic legal framework and corruption, but also by the families of the victims, who exploited their children for financial gain. This business model has been copied by many crime organizations disguised as “modeling studios.” After many years, the situation in Ukraine has changed – but it has changed for the worse. The problem has been aggravated by the development of technology and faster communications. There are new forms of criminality and an intensified production and dissemination of child abuse material in the Ukraine-Moldova-Belarus-Russia region.

In sharing our investigations and search methods we believe we can contribute with authorities to bring offenders to justice, and that we can make the #StopChildAbuse network stronger while raising awareness about the problem.

Our intention is to encourage members of the public and OSINT professionals to be vigilant and pass any known information to the competent authorities. Although some images published by Europol might seem old, new cases might be related to those pictures and any lead or input into their database could mean the difference between continuous abuse or rescuing the victims. At Bellingcat, we are strongly committed to these efforts.