Combating Human Trafficking With Threat Intelligence — Prosecution

Editor’s Note: The following post is an excerpt of a full report. To read the entire analysis, click here to download the report as a PDF.

We analyzed current data from the Recorded Future® Platform, as well as both closed and open sources, to identify threat intelligence solutions to aid prosecution efforts in combating and mitigating human trafficking. This report is the second in a 4-part series; the first report focused on prevention and in subsequent months, we will publish 2 additional reports that cover protection and partnership efforts, offer threat intelligence solutions, where applicable, and provide mitigation recommendations.

Executive Summary

Threat intelligence solutions that help aggregate and analyze sources and data can support law enforcement efforts to investigate and prosecute human trafficking offenses. Human traffickers have historically used classified web pages, such as Backpage and similar websites, to advertise exploitative services. Following Backpage’s closure, online ads for adult services moved to multiple, similar classifieds websites. Recorded Future harvested and analyzed information from 8 Backpage-like websites, collecting over 66,000 posts from adult classified ad pages. This data serves as a proof-of-concept (POC) study demonstrating that threat intelligence solutions can identify potential human trafficking indicators and leads to inform investigation and prosecution efforts.

When advertising exploitative services, human traffickers use various identifiers and points of contact such as usernames, email addresses, and phone numbers. Coupled with other indicators, warning signs, and behaviors associated with human trafficking, this information can aid law enforcement in generating valuable leads for initiating investigations and building cases.

From the dataset of over 66,000 posts collected from adult classified web pages, we identified 17,152 unique phone numbers and 3,357 unique email addresses. The analyzed sources predominantly catered their content to a US-based audience, with only a small fraction of listings referencing other countries and territories such as Canada, the United Kingdom (UK), Germany, France, Egypt, the Dominican Republic, the Cayman Islands, the Turks and Caicos Islands, and the Bahamas.

Email addresses can prove to be fruitful leads when coupled with various open-source intelligence (OSINT) tools that can help identify additional online accounts associated with them. In particular, the local part of an email address (the part that comes before the domain) can be searched separately to identify additional online accounts in which the local part is used as a username. Using this method, we built potential leads, uncovering full or partial names, physical appearance information, and a timeline of recent online activity. We found that similar methodology was used in recent anti-human trafficking efforts led by the Polk County Sheriff’s Office Vice Unit in Florida, as well as the Anti-Human Trafficking Intelligence Initiative (ATII).

Key Findings

• The most referenced phone numbers were those with the prefix/area codes of the following US states: California, Florida, New York, New Jersey, and Texas. California prefix/area codes were the most referenced (at approximately 19%) of all identified phone numbers.
• Among identified email addresses, approximately 97% had gmail.com as their email domain. The remaining 3% of email addresses detected were from the following domains: yahoo.com, mail.com, mail.aol.com, protonmail.com, and a small number of disposable temporary email domains (such as mojzur.com and wgraj.com).
• In the analyzed datasets, we identified warning signs and potential human trafficking indicators in the form of commodifying and derogatory language describing people as objects, such as items that can be bought and sold.
• Based on our research and analysis, we built the following methodology for identifying potential human trafficking leads: Identify and collect contact information from suspected human trafficking sources. Triage contact information to identify any commonalities or trends. Investigate contact information using various OSINT tools.

Background

Human trafficking is a complex issue requiring a multifaceted approach, like the one set forth in the United Nations’s Palermo Protocol. The Palermo Protocol serves as the foundation of the 4P paradigm which is composed of prevention, protection, prosecution, and partnership measures. In this framework, “prosecution” refers to both investigating and prosecuting human trafficking offenses.

Threat intelligence can aid law enforcement agencies’ investigative efforts by gathering and identifying, or “surfacing”, warning signs and potential indicators of human trafficking. Knowing where to look for leads on human trafficking and employing threat intelligence solutions that help collect, aggregate, and analyze sources and data can provide additional visibility, ways to identify the crime, and enable data analysis for additional insights.

As we noted in our first report, traffickers have historically used classified web pages, such as Backpage and similar classified websites, to market exploitative services. Threat intelligence can offer proactive research, monitoring, and analysis of suspected trafficking websites. Traffickers use various points of contact such as email and phone numbers as they advertise exploitative services on Backpage-like websites. Identified and known points of contact can be used to surface other posts, online communities, and threat actors that can further point to traffickers and behaviors associated with human trafficking.

Backpage (backpage[.]com) was a classified advertising website that was active in the US between 2004 and 2018. The website was owned by New Times Media (also known as Village Voice Media) and served as a similar service to Craigslist, allowing its users to post ads and listings under various categories including personals, automotive, rentals, jobs, and adult services. On April 8, 2018, Backpage was seized by the US Department of Justice for charges related to prostitution, including “ads depicting the prostitution of children” and money laundering. Critics have argued that the closure of Backpage has made it more difficult for sex workers to vet dangerous clients and for law enforcement to track potential traffickers. Following Backpage’s closure, online ads for adult services did not end but instead moved to multiple, similar classifieds websites. The 2 bills that were created in response to the growing threat of internet-enabled human trafficking, Stop Enabling Sex Traffickers Act (SESTA) and Allow States and Victims to Fight Online Sex Trafficking Act (FOSTA), have also been criticized for their far-reaching consequences to free speech on the internet and First Amendment rights.

In our research, we have discovered websites that use the “Backpage” name in their domains and branding, as well as outlines and visuals similar to those used by Backpage. We harvested information from 8 Backpage-like websites, collecting over 66,000 posts from adult classified ad pages. Our analysis of collected information represents a POC study demonstrating that threat intelligence solutions can help law enforcement surface potential human trafficking indicators and leads to inform investigation and prosecution efforts.

We believe that with continuous monitoring of Backpage-like websites, researchers can surface further insights by correlating listings with publication dates. Continuous monitoring, such as daily data harvesting for months or years, can identify patterns, highlighting increases or decreases in activity over select periods of time. Since many Backpage-like websites do not date their posts, making it difficult to identify the specific day and time when a listing was posted, continuous daily data harvesting of the suspect sources can potentially address this evasive technique by building a timeline of new events. Even without continuous monitoring, researchers can still harvest information from the Backpage-like websites, creating valuable datasets representing active listings at the time of data scraping and using this data to conduct keyword- or location-specific searches.

Threat Analysis

From the dataset of over 66,000 posts collected from adult classified webpages, we identified 50,397 total phone numbers and, of these, 17,152 were unique. The most referenced phone numbers were with the prefix/area codes of the following US states: California, Florida, New York, New Jersey, and Texas. California prefix/area codes were most referenced (at approximately 19%) from all identified phone numbers (see Figure 1).

We found that the analyzed sources predominantly catered their content to a US-based audience. This was reflected in the references of locations found in the datasets as well as prefix/area codes of identified phone numbers. Besides the US (over 45,000 references), we detected mentions of the following countries and territories: Canada, the UK, Germany, France, Egypt, the Dominican Republic, the Cayman Islands, the Turks and Caicos Islands, and the Bahamas. Countries other than the US represented only a small fraction of listings in the analyzed data. Similar to the now-defunct Backpage, the analyzed sources were heavily focused on the US, with some only breaking up adult sections per state and city located in the US. Countries other than the US had dedicated sections only on 4 out of 8 analyzed sources.

We found that some of the same phone numbers appeared across multiple sources and posts. For example, a phone number with the 973 prefix/area code, associated with the state of New Jersey, was posted on 4 different sources and appeared in 55 listings.

Human traffickers are known for giving the impression that sexual exploitation is a voluntary, consensual choice of those engaged in providing adult services. According to the United Nations Convention Against Transnational Organized Crime, the consent of a trafficking victim is irrelevant. Human trafficking can take place even if the victim initially consented to provide exploitative services. Traffickers are notorious for advertising exploitative services as independent and unorganized. However, the volume of some of the posts with potential warning signs and human trafficking indicators, where the same phone number or email address appears hundreds of times, suggests that these advertisements are organized and managed. In some listings, we found warning signs and potential human trafficking indicators in the form of commodifying and derogatory language that is rarely, if ever, used by self-organized individuals. When querying the datasets by the English keyword “management”, we identified the organized nature of some of the advertised services.

We found numerous other examples of commodifying language, often used by traffickers and pimps, but chose not to include them as illustrations to this report due to their derogatory and explicit nature. In essence, the terms used (similar to the ones we illustrated above) reduce people to objects, commodifying and objectifying individuals as items for sale on a marketplace.

We queried harvested data against the list of human trafficking keywords in the English language provided in our first report and found references to some of the keywords, including “brothel”, “buyer”, “whore”, “vic”, and “purchase”.

Another potential human trafficking indicator is classified ads that list multiple locations as potential meet-up places (Figure 5), which are likely part of a circuit. For example, the West Coast trafficking circuit, which includes San Diego, Las Vegas, Portland, and the cities between these locations, is a popular route used by traffickers.

Identifying keywords of interest, such as those illustrated above, can aid law enforcement in generating valuable leads for initiating investigations and building cases.

Other than phone numbers, within our dataset of over 66,000 posts collected from Backpage-like websites, we identified 21,687 total email addresses, of which 3,357 were unique. Approximately 97% of email addresses used the gmail.com domain. The remaining 3% of email addresses were detected with the following domains: yahoo.com, mail.com, mail.aol.com, protonmail.com, and a small number of disposable temporary email domains (such as mojzur.com and wgraj.com).

The data points gathered from analyzing listings on Backpage-like websites can be further investigated by law enforcement to identify and locate potential victims or traffickers. By obtaining and serving subpoenas to public commercial communication service providers such as Google or Yahoo, it is possible to obtain further information about the account holder including name, account creation information, associated email address(es), phone number(s), sign-in IP address(es) and associated timestamp(s), email content, and more. While some of the information used for account registration can be inaccurate or fake, investigators can compel internet service providers (ISPs) to identify the individual who was assigned the IP address(es) used to sign-in to email providers. ISPs can provide the user’s name, physical address, and other identifying information, which can be confirmed by conducting a mail cover or checking utility bills.

Similarly, for phone number records, investigators can use a subpoena to compel telecommunications companies to disclose basic subscriber and session information including the subscriber’s name, physical address, local and long-distance telephone connection records, records of session times and durations, length of service (including start date) and types of service utilized, other subscriber numbers or identification, including any temporarily assigned network address[es], and the means or source of payment for such service (including any payment card or bank account number[s]).

Editor’s Note: This post is an excerpt of a full report. To read the entire analysis, click here to download the report as a PDF.