The topic of online sexual exploitation of children (OSEC) in the country is one that I’ve often returned to in this column, not only because it is part of my work in the Department of Justice, but because of the gravity of the crisis. The Philippines has become “the world’s largest source” of materials relating to OSEC, according to a recent report from the International Justice Mission (IJM), and the problem is only going to grow worse due to the pandemic. Economic hardships coupled with the fact that the digital chain of supply for OSEC was largely unaffected by the quarantine are likely to lead to an increase in OSEC cases. Stay-at-home orders concerning children may make things worse on the OSEC front, as the perpetrators are often relatives of the victims – even at times their own parents.
While OSEC cannot be tackled solely through technological means, neither can it be fully addressed without resort to technological solutions. Cyberspace is a realm with fragmented rules and jurisdictions, without clear authorities or organs of enforcement, and where systems evolve almost faster than they can be analyzed. This allows it to be abused in a manner that profits from the pain of our most vulnerable and hides their captors from view.
It’s here that Internet Service Providers (ISPs) become important partners in combating OSEC. ISPs are holders of legislative franchises and, in return for the privilege of being allowed operation, certain responsibilities are imposed on them to protect the public they serve. These responsibilities are laid out not only in their franchises, but in subsequent laws duly enacted, including the Anti-Child Pornography Act of 2009 (RA No 9775).
Just last month President Duterte approved the recommendations of the Department of Justice to impose sanctions on ISPs who are not able to fulfill their duties under RA No. 9775. These responsibilities include notifying the PNP or NBI within seven days upon knowledge that their server is being used for child pornography, to preserve evidence for investigation and prosecution, to furnish the particulars of users involved in child pornography and to install technology to intercept and block access to child pornography.
Of course, requirements of the law must be interpreted within the context of capacities. The IJM recently released a report on the role of ISPs in the fight against OSEC that sheds some light on the capabilities of ISPs. ISPs do not control what content is on the internet – they cannot delete content that is not present on their own servers. Nor is it accurate to say that an ISP can spy on everything that its users do online. Legal prohibitions aside, what an ISP has the capacity to view is limited: the URL visited, how long was spent there, whether or not data was transmitted – but specifically what the user did on that site, or what data was sent, is largely beyond their ability to know.
While there are many ways in which an ISP’s hands are tied, there are other things they could do to combat OSEC. The focus of many ISPs has been on filtering software and the blocking of sites that have been identified as hosting child pornography. But as the IJM report mentions, much OSEC takes place not at special websites, or even the dark web, but via routine and everyday platforms such as Skype and Facebook, which cannot be summarily blocked.
While such apps and sites must also do their part in preventing and discovering ongoing broadcasts of OSEC, at present most OSEC incidents are discovered after the fact. As the Philippines is usually the source of the OSEC materials, when OSEC is discovered (usually in the country of the client/recipient through specialized hotlines or investigations) the IP address involved is flagged and notification sent to our authorities. This IP address is oftentimes the only link we have to the source of the OSEC materials, and thus our best chance at rescuing the children.
However, IP addresses are usually not static. Each ISP has a limited number of IP addresses and each IP address may be shared by thousands of users. This can make it almost impossible to link a flagged IP address with a particular user, and without that link, law enforcement cannot find the victimized children.
This is why, should Philippine ISPs implement two of the recommendations of the IJM in its report, the ability of the government to combat OSEC will be vastly improved. The first recommendation is that ISPs maintain logs, for a reasonable time, of the subscriber they assign an IP address to, at a given date and time. This will allow the government to – subject to a court order – access that data and be better able to forge a link between the flagged IP address and a particular user. As what is being recorded is merely the assigned IP address (rather than records of data transmitted), there is no heightened jeopardy to the right of users to the privacy of their acts online, the content of their messages or their online identities and transactions. Neither does this constitute the monitoring or surveillance by an ISP that is prohibited by law.
The catch is that ISPs have informed us that they are currently unable to single out a particular user that is using an IP address at a given time. Because of a shortage of IP addresses, thousands of users may share the same IP address at the same time.
This is where the second recommendation would help: to complete the transition from Internet Protocol Version 4 (IPv4) to IPv6. While this shift would entail many technical benefits to the functioning of the internet, in our case the most relevant is that it significantly expands the pool of available IP addresses, so that the number of users that share a given IP address would be greatly lessened. Again, this would aid in identifying the source of the flagged OSEC content.
The problem posed by OSEC is real and complex, and its solution requires multilateral cooperation and a balanced approach. Yet this does not mean either the government or its private partners can take a passive stance. We must explore every possible avenue available to us. Our duty to our children calls upon us to do no less.