For most internet startups, "abuse" means users violating the terms of service by posting hate speech or sending spam or advertising adult services. But in some parts of the tech industry, the stakes are different. The cybersecurity firm Intelliagg didn't set out to hunt down child abusers. But when the problem fell in its lap, the company's staff didn't feel like they could stand by and do nothing. Intelliagg didn't just call the cops -- the company also offered up its services to them, pro bono.

An important part of Intelliagg's day-to-day work is indexing the whole internet. But there's a problem with doing that -- you run into thousands of very unsavory characters. Some of them spend their time on outright child pornography sites, looking for sexual photos and videos of minors, as well as sharing their sick fantasies.

Intelliagg doesn't intentionally seek out child porn sites, but the content inevitably ends up in its system. That's what happens when you ingest every piece of accessible online material. In order to deal with the problem. Intelliagg, which is based in London and San Francisco, has formed relationships with law enforcement agencies in the U.K. and the U.S. The company hopes to help arrest some of the people who disseminate child pornography online.

How it works.

Why exactly is Intelliagg encountering child porn in the first place? Well, the company doesn't index just the parts of the internet that you can access through Google, a.k.a. the open web. Intelliagg also "spiders," or digitally trawls, most of the deep web and the darknets.

The deep web entails any website closed off from free access -- a membership site like Facebook qualifies, for example. (Banking portals are also part of the deep web, but Intelliagg avoids them for obvious reasons.) The darknets, on the other hand, act as versions of the internet that can be accessed only with special software, such as Tor or I2P.

Intelliagg scans all three domains to gather intelligence for its clients, whose purposes range from detecting breaches of personally identifiable information, which happen when a website gets hacked, to pinpointing death threats against high-profile personnel. The technology that Intelliagg has built can find those crucial needles in the haystack by automatically sifting through reams and reams of data. For example, Intelliagg informed one of its clients, a news organization, when a war reporter was being discussed on a jihadist forum. The journalist was able to change hotels at the last minute and avoid being hurt.

"We call it content-based threat intelligence," Intelliagg R&D executive Eric Michaud told Inc. "We augment security teams who already do this." Some of those teams are still sitting in a room, typing queries into Google, and trying to find useful information that way. "We go through millions and millions and millions and millions of URLs and pages per day, which is way faster than a human could ever do it, so we basically make them way more productive."

And that leads to accessing child porn. "Most CP sites have moved onto Tor hidden services, and our system finds practically every Tor hidden service," Michaud said. "Our system also automatically creates logins and starts indexing," which helps Intelliagg ingest content from the deep web and the darknets as well as the open web.

"We index every picture we run across, because we take snapshots of every site," Michaud said. "We make PDFs and then we hash them for potential use for our customers, like if they have to go to court, we have forensic evidence for them." (Michaud explained that "a hash is a unique mathematical fingerprint that indicates the file has not changed, which can be used for forensic chain of custody.")

"What this means is that we run across CP, and sometimes our system puts that in front of our analysts. We obviously don't want to do that to them, and also we don't want to be indexing that content."

Getting the cops involved.

When Intelliagg first started encountering child porn, a couple of years ago, the whole team was understandably horrified. "We had an internal conversation among all the staff," Michaud said, to decide what to do. Intelliagg could have tried to avoid child porn altogether using techniques like blacklisting certain keywords. But the company decided that it would rather help catch the child pornographers and hopefully get them thrown in prison.

At that point, Intelliagg reached out to several law enforcement agencies in both the U.K. and the U.S. (The company declined to be more specific.) "We built up relationships with major crime units," Michaud said. CEO Thomas Olofsson told Inc. via email, "Intelliagg is collecting a vast amount of data that has no direct monetary value to us or our clients. Some of the sources we are monitoring are quite disturbing, so using this excess data to research and help other organizations prevent child abuse feels like the natural and decent thing to do."

Michaud confirmed that active investigations have resulted from Intelliagg's collaboration with law enforcement, although no criminals have been locked up yet. "Since they are active investigations, as far as we know, we're sending information in, [Intelliagg's law enforcement contacts] don't tell us the status, so I couldn't tell you because I don't know. If there were indictments we would definitely know that."

Michaud also explained that Intelliagg's own legal liability is low -- although he made sure to specify that he is not a lawyer -- because the company is working directly with law enforcement. "We have authorization from these organizations," he said. "Since we do work with law enforcement, they are aware that we have this data, and they're not going to be arresting us anytime soon." Handling child porn in any capacity is risky -- Facebook once reported BBC journalists to law enforcement when they informed the social media giant that sexualized images of children were live on its website.

Intelliagg does try to limit its contact with the material. "When we come across CP, it gets flagged, automatically tagged, and encrypted," according to Michaud. "Then it gets sent to [law enforcement] as an encrypted attachment, to the system that they choose, and they review it. It will also include timestamps, links, anything we come across on those pages. We give them as much information as we can in an automated fashion."

Because of the company's unique line of work, and its special capabilities, Intelliagg is positioned to help pursue justice for victims of child pornography. The staff chose not to take the easy road by avoiding that opportunity altogether. As a result, people who hide out in dark corners of the internet to avoid accountability may have to deal with closer scrutiny than they expected.

Published on: May 18, 2017