First it was necessary dig into the dark web. Now to get to forums full of child pornography content one may be enough comment on TikTok. Below are seemingly harmless videos like a pizza or a child’s face generated by artificial intelligence thousands of messages appear that refer to external platforms where the same acronym is repeated: CP. It is the acronym for Child Pornography.
These two letters are immediately recognized by those looking for these contents. Even the platforms are aware: so much so that, in most social networks, typing this character pair returns no resultsbut a warning: “This term may be associated with sexualized content of minors.”
Tricks to overcome social media blocks
To bypass the filters users have developed a parallel language of imagesmispronunciations, code words. A symbolism that allows them to recognize themselves even under videos that apparently have nothing illegal about them, transforming them into sorting points towards external platforms.
If you’ve given up on the gym you can always try dopamine training, at your own risk
The core of these coded messages are precisely all combinations of words which recall, theacronym CP: Cheesy pizza, Caldo de Pollo (with its variations Caldo de Pollo, Caldo de Poio), Camiones pesodos, Cafè y pan, Club Penguin, Cepe, Ceepee, to name a few (each of which with different mispronunciations).
But the mechanism also involves videos of children made with artificial intelligence. So, below are some comments that apparently have nothing to do with the CSAM contents (Child sexual abuse material) real chains of comments are created, the so-called CP Ring. A phenomenon possible because attackers exploit the structural limits of the digital ecosystem: the speed, the quantity, the impossibility of analyzing everything in real time.
Where the links lead
The links contained in the comments they are not all the same and, tend to refer to three types of destinations: websites, telegram chat And Discord server. TikTok doesn’t allow you to directly access a link, but it’s not a big obstacle. Just copy and paste. Let’s start with the websites. Even if graphically different, the different websites that can be accessed are in fact all similar. Each presents asimilar interface and a trivial login mechanism: to log in you just need a usernameone password and the solving a simple captcha.
Once you enter the site, you are redirected to a range of short explicit videos: An example of the contents of the total library. We are talking about an apparently vast catalogue, organized into tiers, i.e. payment brackets, divided according to the content offered. We start from father and daughter category (father and daughter) of the basic plan, moving on to videos of subjects from 0 to 16 years old in tier 4, to then arrive at videos of torture and rape. To move from each step to the next, there are two possible alternatives: invite other usersbasically thirty for each step, or pay a pricewhich is usually $50 more per step.
How payments work
Each site offers various payment alternatives: gift cards, vouchers, cryptocurrencies, Cash App, PayPal. But it is not only the payment methods that are identical between the different pages: by searching the various domains you can discover that some registration locations also occur with a certain frequency. Among these, San Jose in California, Las Vegas in Nevada, Sheridan in Wyoming often return. However, further information is difficult to find: the majority of these sites rely on companies that offer anonymity services on the web such as the American Privacy Protect of Burlington or the Icelandic Withheld for Privacy of Reykjavik.
This coincidence of factors could lead one to think that it could be scam sites. In reality, in exchange for payment, the administration of child pornographic content actually takes place, as they confirmed to us Maria Pia Izzo and the lawyer Eva Balzarottiwho together lead a computer forensics firm.
Hidden contents in Telegram chats
In Telegram channels you typically interface with bots that offer paid content or who relaunch new links to external pages on a daily basis. Often also combining links with reserve channels, so as to guarantee the continuity of the network even when one of the nodes is closed. It is a system that continually regeneratesexpanding like a spider web that rebuilds and expands its threads every day.
What we saw in Discord servers
Discord is a messaging platform where you can interact with text communications, voice calls, video calls and file sharing. The interactions take place in the servers, spaces designed for virtual communities which are divided into thematic channels.
Communities can get to tens of thousands of components: through the link of a Tiktok comment we landed in a chat for more than 70,000 members.
And it is precisely through Discord that the direct path to reach the child pornographic content: some channels, through a simple reference to folders archived on Mega – an online storage and sharing service – or to Signal groups, allow you to have free access to thousands of videos, and for free. The logic is simple: platforms are exploited end-to-end encryptionwhich guarantee that the contents are visible only to the sender and the recipient.
These tools, originally designed to protect user privacy, end up making it more difficult in this context the identification and removal of illegal materials. Once inside, files can become accessible without further barriers, facilitating their circulation.
And, if on Mega you have access to a range of contents that can be freely viewed and downloaded as “spectators”, mutual exchange groups are created in the groups of the Signal messaging app, where each member can freely share the contents at their disposal or make specific requests. Specific age groups, zoophilia, necrophilia, hidden cameras and abuse are some of the claims you can read about every day.
Even sharing a link is a crime: what do you risk?
Giuseppe Croari is a lawyer expert in law related to the digital world. It is he who explains that to us too share a link it is against the penal code. There is no need to own that forum: «It is irrelevant that the user does not own the files: the so-called “making available” is sufficient». In other words, even the simple sharing of a link constitutes the crime of “child pornography”.
The problem of moderation
We asked what the origin of this problem is Maria Pia Izzowho together with the lawyer Eva Balzarotti leads a computer forensics firm: «Every minute, millions of files are uploaded. Even with advanced algorithms, no system can guarantee instant and perfect control. Then there is an often forgotten aspect: moderation always a two-speed race. Those who produce illegal content continually change their strategy: platforms, on the other hand, must balance protection, user privacy, economic resources and legal limits.”
To this factor, we add the limited liability regime typical of social media. The lawyer explains Croatians: «Platforms do not have to check everything in advance but become responsible if, after a report, they do not quickly remove illegal content. However, jurisprudence is starting to qualify some of them as “active” hosting providers, recognizing their responsibility in the event that they do not equip themselves with automatic tools to prevent crimes”.
And if the responsibility is already reduced when the contents are actually uploaded to TikTok, it is even more so in this case, in which the platform only acts as a hub towards external sites.
TikTok’s response: the videos removed after our reports
We have reported this content to platformwhich deleted and removed those in violation of their guidelines. TikTok’s spokesperson insisted on this point specify: «We do not tolerate content that depicts or disseminates child pornography, including via links external to TikTok, and we structure our platform to make it inhospitable to this type of content. We continue to strengthen our systems to proactively identify, remove and report content and accounts, and we remove 99% of content that violates these rules before it is even reported to us.”
