Email: Trends in Financial Sextortion: NCMEC CyberTipline data

Raw text

Transcribed text as recorded, including headers and formatting fragments.

Message From: Nam Nguyen Engineering @meta.com] Sent: To: 4/2/2024 10:32:23 PM Trina @meta.com]; Anastasia @meta.com]; Melissa @meta.com]; Sandy @meta.com]; Brian @meta.com]; Rachel @meta.com]; Kristin Hendrix @meta.com]; Ashley @meta.com]; Katie @meta.com]; Laura @meta.com]; Elizabeth @meta.com]; Nino @meta.com]; Sayed Otaru @meta.com]; Nam Nguyen Engineering @meta.com]; Carly @meta.com]; Rachany @meta.com]; Max Eulenstein @meta.com] Subject: Message summary [{"otherUserFbId":null,"threadFbId":7339488532754274}] Attachments: Financial-Sextortion-Report-Briefing_Meta_03252024.pdf; ThornNCMEC-report-on- Financial Sextortion_EMBARGOED-1.pdf Max Eulenstein (4/02/2024 14:30:08 PDT): >Hi everybody!! Nam Nguyen Engineering (4/02/2024 14:32:24 PDT): >Hi! :) (is this the lightweight or heavyweight group?) ;) (sorry to those without context will explain later) Sayed Otaru (4/02/2024 15:32:10 PDT): >Seeking @Rachany's legal counsel. > PRIV >_As a reminder, please don't share embargoed documents externally as they are provided under privilege to the company.. Sayed Otaru (4/02/2024 15:32:23 PDT): shared: Financial-Sextortion-Report-Briefing_Meta_03252024.pdf Sayed Otaru (4/02/2024 15:32:23 PDT): shared: ThornNCMEC-report-on-Financial Sextortion_EMBARGOED-1.pdf CONFIDENTIAL PLTF EX PLTF EX-04320 PLTF EX-04320_0001 METANMAG-122-00085627 APRIL 2024 Trends in Financial Sextortion An investigation of sextortion reports in NCMEC CyberTipline data Research conducted by Thorn in partnership with the National Center for Missing & Exploited Children THORN 1 CONFIDENTIAL NATIONAL CENTER FOR MISSING & EXPLOITED CHILDREN CONFIDENTIAL - DO NOT DISTRIBUTE | METANMAG-122-00085628 PLTF EX-04320_0002 Sextortion The threat to expose sexual images of someone if they don't yield to demands. THORN CONFIDENTIAL CONFIDENTIAL - DO NOT DISTRIBUTE 2 METANMAG-122-00085629 PLTF EX-04320_0003 METHODS & LIMITATIONS Sample Analysis Limitations • Subset of public and ESP CyberTipline reports received by NCMEC between 2020 and 2023. • Sampled data totaled more than 15 million reports. ML + Manual annotation completed by data scientist in partnership with CT analysts. • Data tagged across multiple variables including tactics, platform mentions, monetary quantities, and victim impacts. • Analysis is limited to the data contained in CT reports. • Sampling means findings represent an estimate, not full measurement. • Rapidly evolving abuse type. THORN 1 CONFIDENTIAL CONFIDENTIAL - DO NOT DISTRIBUTE | 3 METANMAG-122-00085630 PLTF EX-04320_0004 Scale THORN CONFIDENTIAL CONFIDENTIAL - DO NOT DISTRIBUTE 4 METANMAG-122-00085631 PLTF EX-04320_0005 SCALE Financial sextortion cases predominantly impact boys age 14-17 THORN 1 CONFIDENTIAL 632 sextortion reports of any kind per week, over the last year of estimates. Reports per week Fig 2a | Sextortion demands over time Reports per week, split by the demands of the perpetrator 800 600 400 429 financial sextortion reports per week (explicitly or likely financial), over the last year of estimates. 200 0 2020-08 2020-11 2021-02 2021-05 2021-08 2021-11 Sampling period 2022-02 2022-05 2022-08 2022-11 2023-02 2023-05 2023-08 Content/Other Sextortion Sextortion, unclear demands Sextortion, likely Financial (based on location) Financial Sextortion CONFIDENTIAL - DO NOT DISTRIBUTE | 5 METANMAG-122-00085632 PLTF EX-04320_0006 SCALE Cases are global, though largely resolving to Cote d'Ivoire and Nigeria. Fig 5a | Reports linked to a country For countries linked to twenty or more reports THORN 1 CONFIDENTIAL 64% of all reports linked to a country were linked to either Nigeria or Cote d'Ivoire. Cote d'Ivoire (Ivory Coast) Nigeria United States Philippines United Kingdom India Indonesia Turkey Australia Canada France Brazil 0 200 400 600 800 1000 1200 1400 1600 Number of reports CONFIDENTIAL - DO NOT DISTRIBUTE 6 METANMAG-122-00085633 PLTF EX-04320_0007 VICTIM IMPACT The most common outcome noted in reports was the distribution of images to friends, family, or the public. Fig 3b | Victim threats For the 9.2% of reports where any victim impacts were reported Multiple impacts Other victim concerns 18.8% 13.1% Discussion of suicide/self harm 13.6% 1 in 3 Of those who reported making payments continued to be threatened THORN 1 CONFIDENTIAL Victim paid 19.0% 1 in 8 Victim paid + follow-up demands 6.3% Victim says images were disseminated 29.3% Of those who reported impact described thoughts of suicide or self harm. CONFIDENTIAL - DO NOT DISTRIBUTE | 7 METANMAG-122-00085634 PLTF EX-04320_0008 Tactics THORN CONFIDENTIAL CONFIDENTIAL - DO NOT DISTRIBUTE 8 METANMAG-122-00085635 PLTF EX-04320_0009 TACTICS The majority of images were sent in response to catfishing/sexting Fig 2e | Acquisition information Rate of reports with information about how imagery was acquired % of sextortion reports with an acquisition method THORN 1 CONFIDENTIAL Reciprocating Images (Catfishing/Sexting) Fake/Inauthentic 12.8% Images Hacking 12.1% Violence/Non-image 7.2% Threats Relationships/ Grooming 2.3% Offers 1.7% of Money 70.2% 0 20 40 60 80 100 CONFIDENTIAL - DO NOT DISTRIBUTE | 9 METANMAG-122-00085636 PLTF EX-04320_0010 TACTICS 1 in 3 chats included threats of life altering outcomes Fig 3a | Pressure threats Methods used to pressure victims, out of chats with pressure tactics Exaggerated Impact/Ruin Countdowns/ 11.6% Deadlines Demand for 9.6% Constant Contacts Framing Payment as Charity 5.8% Threatening Jail/ Accusations 4.8% THORN 1 CONFIDENTIAL 0 20 32.0% 40 60 80 100 Percent of total sextortion reports with chat logs Phrase describing extreme impact appearing in at least 4 chat logs. blocking me won't stop me from posting it viral ... you do not ask my age before masturbate, i just want to say that i am a girl of 15 years you will be locked up for 5 years in prison I have ur nudes and everything needed to ruin your life ... or send this to ur school and u know u will be expelled from ... CONFIDENTIAL - DO NOT DISTRIBUTE | 10 METANMAG-122-00085637 PLTF EX-04320_0011 TACTICS Use of countdowns and rapid deadlines increases victim's isolation Fig 3a | Pressure threats Methods used to pressure victims, out of chats with pressure tactics Exaggerated Impact/Ruin Countdowns/ 11.6% Deadlines Demand for 9.6% Constant Contacts Framing Payment as Charity 5.8% Threatening Jail/ Accusations 4.8% THORN 1 CONFIDENTIAL 0 20 32.0% 40 60 80 100 Percent of total sextortion reports with chat logs Increases pressure and stress for the victim Decreases opportunity to weigh options clearly Decreases opportunity to seek help CONFIDENTIAL - DO NOT DISTRIBUTE | 11 METANMAG-122-00085638 PLTF EX-04320_0012 TACTICS Threats often continued despite paying 33% Reported paying in response to threats 30% Experienced continued threats after paying Fig 4d | Payment methods over time Trends in largest two payment methods over time 100 80 THORN 1 CONFIDENTIAL $400 Median payment demanded in threats $100 Median payment reported by victims Portion of mentioned payment apps 40 20 0 60 2021-11 2022-02 2022-05 2022-08 Sampling period 2022-11 2023-02 2023-05 2023-08 Other Gift cards Payment App #1 CONFIDENTIAL - DO NOT DISTRIBUTE | 12 METANMAG-122-00085639 PLTF EX-04320_0013 Platform Trends THORN CONFIDENTIAL CONFIDENTIAL - DO NOT D STRIBUTE 13 METANMAG-122-00085640 PLTF EX-04320_0014 INITIAL & SECONDARY MEETINGS IG is the leading platform reported for initial meeting Fig 4a | Platforms used for initial contact Platforms mentioned ten or more times as an initial meeting platform Fig 4b Platforms used as secondary destinations Platform mentioned as destination where conversation is moved to Instagram Facebook 6.4% 4.7% 4.3% 2.1% 0 20 35.0% 40 45.0% 60 80 100 Percent of all 469 reports that explicitly mention an initial-contact platform A report was counted in multiple categories if multiple platforms were discussed. THORN 1 CONFIDENTIAL 31.5% 29.4% WhatsApp 12.6% 8.3% Instagram - 7.7% 3.4% Facebook 2.9% 2.6% 0 20 40 60 80 100 Percent of all 588 reports that have platforms in that role Platforms included if mentioned 15 or more times in this role. A report was counted in multiple categories if multiple platforms were discussed. CONFIDENTIAL - DO NOT DISTRIBUTE | 14 METANMAG-122-00085641 PLTF EX-04320_0015 IMAGE DISTRIBUTION IG was the leading platform for both threats and reports of distribution Fig 3c | Threatened dissemination platform Platforms discussed as place where imagery would be disseminated Platforms named in threats of distribution Platforms named in reports of distribution THORN 1 CONFIDENTIAL Instagram 26.5% 4.6% 25.5% Facebook 6.9% 10.4% 16.9% 6.4% 2.3% 2.0% 0.8% 61.8% 81.5% 0 20 40 60 80 CONFIDENTIAL - DO NOT DISTRIBUTE | 15 100 METANMAG-122-00085642 PLTF EX-04320_0016 Platform COUNTRY DIFFERENCES There were some platform differences among the most common countries Fig 5f Country differences by reporting platform Countries linked to reports submitted by top platforms Fig 5d | Secondary plaform use by country For the most common countries, as a percentage of reports to each Cote d'Ivoire (Ivory Coast) 0.7% Nigeria United States Unknown 5.1% 2.6% 1.3% 7.7% 0.1% 0.3% 0.8% 2.3% WhatsApp 0.5% 0.1% 0.5% 2.2% 0% 0.5% 0.1% 0 1 2 3 4 5 6 7 8 Percent of reports THORN 1 CONFIDENTIAL Number of reports 175 150 125 100 75 Number of reports 600 500 400 300 200 100 0 5025 0 2021-11 2022-02 2021-11 2022-02 2022-05 2022-08 Sampling period 2022-11 2023-02 2023-05 2023-08 2022-05 2022-08 Sampling period 2022-11 2023-02 2023-05 2023-08 Facebook Other Unknown United States Cote d'Ivoire (Ivory Coast) Nigeria Instagram Other Unknown United States Cote d'Ivoire (Ivory Coast) Nigeria 16 METANMAG-122-00085643 PLTF EX-04320_0017 REPORTING LANDSCAPE Increases are not always bad and can be a result of better detection and reporting. Fig 6a | ESP reporting trends Number of reports per week submitted by an ESP or to NCMEC public form. Dashed line indicates last point of data collection of public data. Platforms shown if they submitted 5 or more sextortion reports per week. 800 61% of all ESP reports in our data are through Instagram. THORN 1 CONFIDENTIAL Number of reports 600 400 200 0 2020-08 2020-11 2021-02 2021-05 2021-08 2021-11 2022-02 2022-05 2022-08 2022-11 2023-02 2023-05 2023-08 Facebook Instagram Direct to NCMEC (public) METANMAG-122-00085644 PLTF EX-04320_0018 REPORTING LANDSCAPE Variability in reporting landscape Fig 6b | Reporting delay Median number of days between incident and submission of report to NCMEC 60 Facebook Instagram 10 days Days of delay 50- 40 30 20 was the average delay between incident and an 10 0 ESP report to NCMEC in the last two years of data. THORN 1 CONFIDENTIAL 2021-11 2022-02 2022-05 2022-08 2022-11 Report period 2023-02 2023-05 2023-08 CONFIDENTIAL - DO NOT DISTRIBUTE | 18 METANMAG-122-00085645 PLTF EX-04320_0019 THORN 1 CONFIDENTIAL REPORTING LANDSCAPE Report details can contain information critical to assess risk in emergent cases Fig 6c | Trends of data quality Whether reports have escalations and/or additional chat information Escalation summary only, no additional context Escalation summary AND additional information provided Unescalated conversation logs/excerpts Unescalated data with only report text 160 140 120 100 Facebook 30 60 40 20 0 400 300 Instagram 200 100 70 60 50 40 30 0 2021-11 2022-02 2022-05 2022-08 Report period 2023-02 2023-05 2023-08 2021-11 2022-02 2022-05 2022-08 Report period 2022-11 2023-02 2023-05 2023-08 2021-11 2022-02 2022-08 Report period 2022-11 2023-02 2023-05 )0 NOT DISTRIBUTE | 19 METANMAG-122-00085646 PLTF EX-04320_0020 REPORTING LANDSCAPE Public reports shows a number of additional platforms involved in sextortion Fig ód Platform mention in public reports Platforms mentioned 30 or more times in sextortion cases THORN 1 CONFIDENTIAL Instagram WhatsApp Facebook 0 500 1000 1500 2000 2500 3000 Number of reports mentioning platform (including those outside the sampling periods) CONFIDENTIAL - DO NOT DISTRIBUTE | 20 METANMAG-122-00085647 PLTF EX-04320_0021 REPORTING LANDSCAPE For some platforms, the public is reporting more sextortion events to NCMEC than the platform Ratio of ESP reports to platform mention in public reports Average reports per week made by platform Average mentions per week in public reports Ratio of ESP reports to platform mention Average reports per week made by platform Average mentions per week in public reports Instagram THORN 1 CONFIDENTIAL Facebook SHOWN AT 200% in public reports Instagram 229.19 28.32 8.09:1 WhatsApp Facebook 98.5 1.19 82.61:1 35.44 26.61 1.33:1 1.38 0.61 2.27:1 0.25 1.46 1:5.88 0.06 0.49 1:7.69 0.06 0.54 1:8.33 WhatsApp 0.06 1.58 1:25 WhatsApp 0 0.49 0:1 CONFIDENTIAL - DO NOT DISTRIBUTE | 21 METANMAG-122-00085648 PLTF EX-04320_0022 Key Findings & Discussion THORN CONFIDENTIAL CONFIDENTIAL - DO NOT DISTRIBUTE | 22 METANMAG-122-00085649 PLTF EX-04320_0023 FINDINGS & DISCUSSION Technology is being used to scale attacks while threats of dire outcomes - which often mirror societal warnings - fuel victim's isolation. Financial sextortion is a global phenomenon. Financial sextortion does not exclusively target children who have shared an intimate image, and use of genAl technologies may lead to an increase in these cases. Financial sextortion relies heavily on inflaming a victim's fears around the impact of having their nudes exposed, such as that they would go viral or send the child to jail. THORN CONFIDENTIAL CONFIDENTIAL - DO NOT DISTRIBUTE | 23 METANMAG-122-00085650 PLTF EX-04320_0024 FINDINGS & DISCUSSION Platform reporting of sextortion is widely varied and sextortion is less likely to be reported on some platforms. Reports from the public concerning financial sextortion suggest a far wider list of impacted platforms than are actively reporting to the CyberTipline. Currently available data limits our ability to explore the efficacy and extent of proactive detection practices vs user reporting direct to platforms. THORN CONFIDENTIAL CONFIDENTIAL - DO NOT DISTRIBUTE | 24 METANMAG-122-00085651 PLTF EX-04320_0025 PLATFORM OPPORTUNITIES Increase user awareness of tactics and use of safety features Leverage light, accessible messaging to increase user awareness of threat Proactively educate users on blocking and reporting and ensure tools are widely accessible Elevate a variety of resources for education and support THORN 1 CONFIDENTIAL CONFIDENTIAL - DO NOT DISTRIBUTE | 25 METANMAG-122-00085652 PLTF EX-04320_0026 PLATFORM OPPORTUNITIES Layer proactive and reactive solutions to create less hospitable environments for sextortion Deploy text classifiers to surface high risk exchanges THORN 1 CONFIDENTIAL Pair risk signals with user interventions Anticipate an increase in hostile behavior targeting minors in less moderated spaces CONFIDENTIAL - DO NOT DISTRIBUTE | 26 METANMAG-122-00085653 PLTF EX-04320_0027 PLATFORM OPPORTUNITIES Share knowledge and signals across the ecosystem Known repeat profile pictures for sextortion aggressors Common scripts and snippets, across languages Account and network signals THORN 1 CONFIDENTIAL CONFIDENTIAL - DO NOT DISTRIBUTE | 27 METANMAG-122-00085654 PLTF EX-04320_0028 Thank you. THORN 1 CRM W NATIONAL CENTER FOR MISSING & EXPLOITED CHILDREN THORN CONFIDENTIAL CONFIDENTIAL - DO NOT DISTRIBUTE | 28 METANMAG-122-00085655 PLTF EX-04320_0029 2024 inom EMBARGOED COPY CONFIDENTIAL APRIL 2024 Trends in Financial Sextortion An investigation of sextortion reports in NCMEC CyberTipline data Research conducted by Thorn in partnership with the National Center for Missing & Exploited Children THORN NATIONAL CENTER FOR MISSING & CHILDREN PLTF EX-04320_0030 METANMAG-122-00085656 2024 Thom EMBARGOED COPY CONFIDENTIAL Table of Contents 4 Introduction 6 Key Findings 7 Methods and Limitations 9 How Sextortion Unfolds and to Whom GOED 15 Tactics of Pressuring Victims and Victim Impacts 20 The Role of Platforms in Sextortion 24 Perpetrator Differences by Country 28 Platform Reporting Landscape 35 Conclusions PLTF EX-04320_0031 METANMAG-122-00085657 EMBARGOED COPY Acknowledgments Understanding the complex intersection of technology and child sexual abuse empowers us to safeguard kids from the ever-evolving threats they face online. This can only be done through multi-stakeholder collaboration that builds on the insights and talents of all in the ecosystem: nonprofits, policymakers, tech companies, communities, and most importantly, the young people we commit to serve. This research was conducted by Thorn in partnership with the National Center for Missing & Exploited Children. The National Center for Missing & Exploited Children (NCMEC) is a private, non-profit 501(c)(3) corporation whose mission is to help find missing children, reduce child sexual exploitation, and prevent child victimization. For more information about NCMEC, please visit our website at www.ncmec.org. Thorn is a 501c(3) nonprofit organization with a mission to build technology to defend children from sexual abuse. For more information about Thorn, please visit our website: www.thorn.org. For inquiries about this research, please email research@thorn.org. Research team Tim O'Gorman, Thorn Melissa Stroebel, Thorn Jennifer Penrose, National Center for Missing & Exploited Children Ashleigh Chambers, National Center for Missing & Exploited Children Jennifer Newman, National Center for Missing & Exploited Children Lauren Coffren, National Center for Missing & Exploited Children Design and publication Yena Lee, Thorn Cassie Coccaro, Thorn Heidi Mihelich, cre8ivenergy Suggested citation 2024 Thom CONFIDENTIAL Thorn and National Center for Missing and Exploited Children (NCMEC). (2024). Trends in Financial Sextortion: An investigation of sextortion reports in NCMEC CyberTipline data PLTF EX-04320_0032 METANMAG-122-00085658 EMBARGOED COPY Introduction Trends in Financial Sextortion | Introduction 4 DEFINITION Sextortion The threat to expose sexual images of someone if they don't yield to demands. Sextortion-threatening to expose sexual imagery depicting someone if they don't yield to demands- has been a source of harm to youth for some time, but it has gained added urgency in recent years. Over time, several studies have examined how this abuse takes shape, its prevalence, and those impacted. Importantly, while sextortion can affect all ages, this report focuses explicitly on the sextortion of minors. Between 3.5 and 5% of people are believed to have experienced sextortion before reaching adulthood,2 with girls more likely than boys to be impacted. Historical surveys have found demands most often were sexual or relational in nature, including but not limited to demands for additional intimate imagery, engaging in sexual acts, or returning or staying in a romantic relationship. Research has also found the source of threats is mixed, with roughly half coming from people in a victim's offline community such as acquaintances or romantic partners/ex-partners, and the other half involving people they met online.4 In the last several years, concerns about a unique form of sextortion-financial sextortion-have been on the rise. Distinct from more often observed forms of sextortion, which frequently impacted girls and involved demands that were sexual or relational in nature, financial sextortion appears to more often impact boys and involves demands specifically for money. In addition, financial sextortion marks the emergence of new organized endeavors leveraging the internet to engage in financial sextortion at scale. In both cases, the impact on children can be devastating, leading to severe trauma and, in extreme cases, suicide due to sextortion. Older surveys of sextortion victims found that 12% reported they "moved to a new neighborhood, community or town" and that 24% reported that they "saw a mental health or medical practitioner as a result of the incident."5 The National Center for Missing & Exploited Children (NCMEC) has received more than 144 million reports, as of year end 2022,6 of possible online child sexual exploitation, including sextortion, and was among the first organizations to raise alarms about the rise of financial sextortion. This report provides a deep 1 Wolak, Janis, David Finkelhor, Wendy A Walsh and Leah Treitman. "Sextortion of Minors: Characteristics and Dynamics." The Journal of adolescent health: official publication of the Society for Adolescent Medicine 62 1 (2018): 72-79.; Cross, Cassandra, Karen M. Holt and Roberta Liggett O'Malley. ""If U Don't Pay they will Share the Pics": Exploring Sextortion in the Context of Romance Fraud." Victims & Offenders 18 (2022): 1194-1215. 2 Patchin, Justin W. and S. Hinduja. "Sextortion Among Adolescents: Results From a National Survey of U.S. Youth." Sexual Abuse: A Journal of Research and Treatment 32 (2020): 30-54.; Finkelhor, David, Heather A. Turner and Deirdre Colburn. "Prevalence of Online Sexual Offenses Against Children in the US." JAMA Network Open 5 (2022) Wave2Report 121919.pdf 3 Thorn (2017). Sextortion: Summary findings from a 2017 survey of 2,097 survivors. https://www.thom.org/wp-content/uploads/2019/12/Sextortion. 4 Thorn (2017). Sextortion: Summary findings from a 2017 survey of 2,097 survivors. https://www.thorn.org/wp-content/uploads/2019/12/Sextortion_Wave 2 Report 121919.odf 5 Wolak, Janis and David Finkelhor 2016 "Sextortion: Findings from a Survey of 1,631 Victims." https://www.thorn.org/wp-content/uploads/2016/08/Sextortion Report.pdf 6 https://www.ncmec.org/ourwork/impact 2024 Thom CONFIDENTIAL PLTF EX-04320_0033 METANMAG-122-00085659 EMBARGOED COPY dive into the reports submitted to NCMEC regarding sextortion, with a focus on the evolving trend of financial sextortion. The overall trend in NCMEC reports shows a large wave of sextortion cases since the beginning of 2022. Although the numbers do not, on their face, differentiate among types of sextortion, analysis of report details demonstrates this increase is largely driven by reports involving financial sextortion, Figure 1a outlines the rates of all reports made to NCMEC and categorized as sextortion, showing an average of 632 reports of sextortion per week in the last year of data analyzed (from August 2022 to August 2023) and 436 reports/week in the last two years of data (from August 2021 to August 2023), which come from reports submitted to NCMEC by both the public,7 as well as a large quantity of cases identified by social media platforms (ESP reports, listed as "from platform"). These rates have many details and limitations, which we measure through sampling and manual coding. Furthermore, there are limitations due to the nature of the reports submitted to NCMEC. For example, although we find that the vast majority of cases submitted in this period are financial in nature, we cannot know how much of this is due to cases, particularly non-financial sextortion, being underreported. Fig 1 Sextortion Cases Per Week From platform Public Trends in Financial Sextortion | introduction 5 Reports per week 800 700 600 500 ARGOED 400 300 200 100 0 2020-08 2020-11 2021-02 2021-05 2021-08 2021-11 Sampling period 2022-02 2022-05 2022-08 2022-11 2023-02 2023-05 2023-08 Every one of these cases is a specific instance of a child being targeted and extorted by perpetrators seeking to amplify their fears and force them to give in to demands. This report focuses on the chat logs and incident descriptions in these reports because they provide insight into how these incidents unfold and into the situation in which victims find themselves when they experience sextortion. 7 Note that for logistical reasons, the final period (2023-08) does not include analysis of reports submitted directly to NCMEC via public or hotline data, but that does not mean that no reports were submitted 2024 Thom CONFIDENTIAL PLTF EX-04320_0034 METANMAG-122-00085660 EMBARGOED COPY Trends in Financial Sextortion | Key Findings 6 Key Findings Sextortion, and particularly financial sextortion, continues to be a major and ongoing threat, with an average of 632 reports of sextortion per week to NCMEC in the last year of data analyzed, and with reason to expect that the vast majority of those reports are financial sextortion. (See How Sextortion Unfolds and to Whom) The two countries from which most sextortion perpetrators seem to be operating, Nigeria and Cote d'Ivoire, make use of slightly different tactics and platforms. (See Perpetrator Differences by Country) 2024 Thom Perpetrators leverage tactics to intentionally fan a victim's worry about the life-changing impacts of their nudes being shared-often repeating claims that it will "ruin their life". (See Tactics of Pressuring Victims and Victim Impacts) Reports submitted by Instagram constitute a clear majority of all reports of apparent sextortion submitted to NCMEC. However, there are reasons to worry not only about whether other platforms are underreporting but also about changes in the level of information provided in reports. (See Platform Reporting Landscape) While we find that Instagram and Snapchat are the most common platforms used for sextortion, we observe trends regarding the emergence of additional end-to-end encrypted messaging apps to move victims to secondary platforms and the prevalence of Cash App and gift cards for methods of payment. (See The Role of Platforms in Sextortion) CONFIDENTIAL PLTF EX-04320_0035 METANMAG-122-00085661 EMBARGOED COPY Trends in Financial Sextortion | Methods and Limitations 7 Methods and Limitations Methods of Analysis NCMEC received over 32 million reports in 2022. US-based ESPs must report to the NCMEC CyberTipline if they become aware of child sexual abuse material (CSAM) on their platform?; these ESPs submitted 99% of NCMEC CyberTipline reports in 2022.8 In the remaining cases we refer to as "public," a victim or member of the public directly reports through the public form (report.cybertip.org) or the NCMEC hotline. In addition to reports of potential CSAM, NCMEC also receives reports concerning potential sextortion, grooming, or other forms of online enticement, but online enticement does not currently have the same legal reporting requirements for companies. These reports represent a small but growing percentage of the total reports received by NCMEC each year. NCMEC received 80,524 online enticement reports in 2022, an 82% increase over the 44,155 online enticement reports submitted the previous year. To focus on a representative but reasonable amount of data, our analysis focused on a subset of reports received between 20209 and 2023. We defined four two-week periods each year for the last three years (every three months, starting on the 8th and ending on the 21st of February, May, August, and November) and studied all reports submitted to NCMEC within those periods (the sampled data totals more than 15 million reports). Our analysis then highlighted all reports appearing to relate to sextortion, building off initial annotations provided by NCMEC analysts as part of the report intake process. For example, of the 3,550 reports identified as sextortion in 2022 in the eight weeks of our sampling windows, 1,938 reports (55%) were already identified as sextortion by that NCMEC analysis. 10 This report started from those annotations and augmented the initial sample of sextortion reports using machine learning algorithms to identify potential sextortion cases for additional annotation. Cases flagged through this process were then manually reviewed to verify they should be included in the research as a likely report of sextortion. Across all sextortion cases in those sampling windows, we manually coded those reports to measure specific tactics for sextortion, including the role that platforms mentioned in those reports played in the sextortion. This was done so that we could study not only how often a platform was mentioned, but also more specific questions such as how often that platform was used to first contact the child. When present in financial sextortion reports, we also manually coded monetary quantities with details regarding whether they referred to payments, mere demands, or payments followed by ongoing demands. Contact Thorn for an appendix listing all the labels and definitions used in the data coding and providing further details regarding the annotation methodology. Limitations to This Report The most significant limitation of this work is that it only measures phenomena when explicitly stated in the report text. This is particularly important for reports where a platform (or victim) only submits a few 7 This is a requirement defined in federal statute 18 USC 2258A; see https://www.ncmec.org/cybertiplinedata for more details. 8 According to https://www.ncmec.org/cybertiplinedata 9 While sextortion as a phenomenon predates 2020 (see NCMEC 2016 sextortion fact sheet, Thorn 2018), this report is focused on the current wave of financial sextortion that started in earnest in 2022; data was studied from before 2022 in order to test whether the trend started earlier than expected. 10 This rate is lower in 2023, as our analysis of the final sampling period (August of 2023) was done before the rigorous stages of report intake were complete. 2024 Thom CONFIDENTIAL PLTF EX-04320_0036 METANMAG-122-00085662 EMBARGOED COPY sentences of summary text, since such brief summaries may not provide insight into how those cases unfolded. • We attempted to limit the potential for measurement bias, but it is a complex process: While a large number of cases go through the rigorous review of analysts at NCMEC, additional coverage is gained by data scientists for this report. That additional coverage also used machine learning to surface cases for annotation, which always presents the possibility of model bias - further information on model quality is provided in the Appendix (available upon request from Thorn). • Sampling limitations: We sampled from specific time windows, which means that these numbers are an estimate rather than a full measurement of all sextortion cases in a year. Trends in Financial Sextortion | Methods and Limitations 8 reference some checks done on November 2023, but those data points did not receive the full manual analysis used for the rest of our data, and so we treat that data only as a tentative hint regarding whether trends seen in our analysis have persisted. ARGOED • Fundamental reliance on platforms: For ESP reports, there are a range of places where platforms can be biased in how they detect sextortion or how they respond to user reports of sextortion. • Specific biases for low-resource languages and countries: For non- English reports, we relied upon automatic translation tools, and we expect some ESPs to also need to do so. This injects many possibilities for error but specifically does so for speakers of low-resource languages spoken in India, Southeast Asia, and Africa, for whom automatic translation quality is often far worse. • This is a quickly moving space, both because platforms, perpetrators, and other actors (such as law enforcement) are constantly changing their tools and tactics, and also because of specific trends that have developed or continued in 2023, such as Al-generated deepfakes for sextortion and shifts of specific platforms towards end-to-end encryption. Because the last time period we fully studied was August of 2023, our visibility into those recent developments is limited. We do 2024 Thom CONFIDENTIAL PLTF EX-04320_0037 METANMAG-122-00085663 EMBARGOED COPY Trends in Financial Sextortion | How Sextortion Unfolds and to Whom How Sextortion Unfolds and to Whom The most common form of sextortion found in the studied sample is the financial sextortion of teenage boys. These reports most often include the use of "catfishing"-in this case, a perpetrator impersonating another young person-to manipulate a teenage boy into sharing sexual images or videos of himself. That perpetrator then threatens to share that imagery with family, friends, or followers unless they are paid. Although that is the prototypical scenario, sextortion can have demands other than money, target victims other than teenage boys, and can get imagery in ways other than catfishing. This section outlines the range of differences seen in the NCMEC reports regarding what is demanded during sextortion, who the victims are, and how blackmail material is obtained or produced. The findings should be interpreted with an awareness that not all sextortion ends up in these reports: for example, many financial sextortion cases target young men rather than boys," and historically, sextortion was often the extortion of girls by people they knew offline with demands for CSAM or sex. 12 Established Information to Know: The vast majority of financial sextortion cases of children seem to start with some form of "catfishing" targeting teenage males, convincing them to exchange images or get on a video call. Key New Findings: Of the reports where we have discussion of how the imagery was acquired, more than 20% of situations involve either hacking or fake/inauthentic imagery. While this is a minority of the whole, one should not assume that every single sextortion starts with the child sharing their sexual imagery with the perpetrator. The Vast Majority of Demands are Financial, but Not All Are Explicit The vast majority of sextortion cases reported to NCMEC in the years we studied are financial sextortion cases, in which the child is told to pay the perpetrator money in order to prevent the sharing of their intimate imagery. However, there are many other cases of sextortion in which a victim is extorted using their sexual imagery either for additional sexual imagery, for other sexual demands, or to stay in a relationship, and such non-financial demands were the predominant form of sextortion before the current financial sextortion crisis. Such cases have a very different distribution of victims as well. In surveys of survivors preceding the current financial sextortion trend, 83% of victims were female (Wolak and Finkelhor 2016), and the majority of victims reported being extorted by people that they also knew offline (such as ex-partners or schoolmates), often in the context of intimate partner violence or stalking. An older study of sextortion in NCMEC data13 (spanning 2013-2016) noted similar trends, reporting that 78% of the reports involved female children, and that only 7% of perpetrators in that period demanded money, with 5% of those perpetrators demanding to meet for sex and 78% demanding additional content of the child. 11 C3P (2022). An Analysis of Financial Sextortion Victim Posts Published on r/Sextortion. https://content.c3p.ca/pdfs/C3P_AnalysisOfFinanSextortion PostsReddit.en.pdf 12 Wolak, Janis and David Finkelhor 2016 "Sextortion: Findings from a Survey of 1,631 Victims." https://www.thom.org/wp-content/uploads/2016/08/Sextortion_Report.pdf 13 https://www.ncmec.org/content/dam/missingkids/pdfs/ncmec-analysis/sextortionfactsheet.pdf 2024 Thom CONFIDENTIAL PLTF EX-04320_0038 METANMAG-122-00085664 2024 Thom Reports per week EMBARGOED COPY Trends in Financial Sextortion | How Sextortion Unfolds and to Whom 10 Figure 2a shows the spread among the current sample of sextortion cases reported to NCMEC, including both clear financial sextortion cases ("Financial sextortion") and some non-financial demands ("Content/ other sextortion"). That same figure also shows a large middle ground of cases that are clearly sextortion (i.e., there is a threat to expose the child's imagery if they don't give in to demands) but where the data provided to NCMEC does not make it clear that the demands are monetary. These cases often refer to vague demands, requesting that the victim cooperate or accept the deal, but the specific payment details may have been communicated elsewhere (e.g., in the audio of a video chat). We have separated a subset of these - shown as "Sextortion, likely financial (based on their location)" - where we have a clear-cut reason to assume they are financial sextortion because they are reports that have been linked to Nigeria or Cote d'Ivoire, the two countries linked to the financial sextortion. Such reports often contain threats similar (or even identical) to those seen in reports making explicit financial demands. To contextualize what this means for overall rates of sextortion: over the last 12 months of analysis, we see an average of 632 reports per week of sextortion total, of which 429 reports per week are financial or likely financial, and of which 293 reports per week have explicit monetary demands in the reports themselves. That rate of 429 financial sextortion reports per week would imply at least 22,000 financial sextortion cases per year, although that number is a conservative estimate rather than an official count. Fig 2a | Sextortion demands over time Reports per week, split by the demands of the perpetrator 800 600 400 200 CONFIDENTIAL 0 2020-08 2020-11 2021-02 2021-05 2021-08 2021-11 2022-02 2022-05 2022-08 2022-11 2023-02 2023-05 2023-08 Sampling period 632 sextortion reports of any kind per week, over the last year of estimates. Content/Other Sextortion ✔Sextortion, unclear demands Sextortion, likely Financial (based on location) 429 financial sextortion Financial Sextortion reports per week (explicitly or likely financial), over the last year of estimates. PLTF EX-04320_0039 METANMAG-122-00085665 EMBARGOED COPY Trends in Financial Sextortion | How Sextortion Unfolds and to Whom 11 Victims Being Targeted - Age, Gender The vast majority of victims of financial sextortion submitted to NCMEC are male teenage victims; of minors in the NCMEC data with both age and gender, 90% were males between 14 and 17.14 For financial sextortion, it's important to remember that the reports submitted to NCMEC are connected to a larger trend of sextortion of young males that includes those 18 and older; the C3P study of financial sextortion discussions in Reddit 90% of victims were males between 14 and 17, of reports submitted to NCMEC public sources that had age and gender data. data 15 also found predominantly male data (98% male), but only 38% were under 18. However, the fact that financial sextortion of minors is part of a larger romance fraud trend, including young adults, should not be interpreted to mean that it is age indiscriminate or that adults are the only intended targets of sextortion. While we cannot know the intentions of perpetrators for certain, this report notes specific tactics and platforms that are possibly being used to gain access, or to gain leverage specifically over minors. For example, threats around the victim going to jail because they shared intimate imagery would only be relevant for minor victims. Similarly, use of gift cards may be designed to create a way for minors to get funds without the same access to cash an adult might have. A small group of reports in the current sample (represented by the "Content/other sextortion" line in Figure 2a) include demands for producing and sharing CSAM or returning to/entering into a romantic relationship. Such non-financial sextortion cases were the vast majority of cases in older surveys of victims of sextortion, fielded in years predating the current financial sextortion trend - surveys wherein only 14% reported demands for money. 16 In that study, the victims were 77% female and only 20% male; it's therefore important to emphasize that while financial sextortion is predominantly targeting males, other forms of sextortion exist which most commonly target girls. While such content- based sextortion is rare in the studied NCMEC data, it is also a crime with connections to stalking and intimate partner violence, very often committed by people who know the victim, and thus reports may act differently and be less likely to end up with NCMEC. Victims Being Targeted - Location We have two ways of measuring where the victims are located, shown in Figures 2b and 2c below. Some reports analyzed by NCMEC have coding of "victim location," which provides a distribution over a range of countries, although the US and Canada top the list. However, the fact that NCMEC is a US-based hotline may inject some bias in this measure, as North American victims may be more likely to submit reports to NCMEC. 45% 300000000000000000000000 Another method of gauging victim demographics is by detecting which language is being used by a victim when a platform reports their chat logs.. While the most common language is English, we have a large number of French-speaking victims, followed by Tagalog, Spanish and German. While the language spoken is only an approximate hint regarding a victim's actual location, this variety of languages spoken highlights how global the sextortion issue is. of all sextortion reports with chat logs used languages other than English. 14 We measured this over all analyzed sextortion cases studied by NCMEC (not just those in the sampling windows), totaling 3,600 cases. 15 C3P (2022). An Analysis of Financial Sextortion Victim Posts Published on r/Sextortion. https://content.c3p.ca/pdfs/C3P_AnalysisOfFinanSextortion Posts Reddit.en.pdf 16 Wolak, Janis and David Finkelhor 2016 "Sextortion: Findings froma Survey of 1,631 Victims." https://www.thom.org/wp-content/uploads/2016/08/Sextortion Report.pdf 2024 Thom CONFIDENTIAL PLTF EX-04320_0040 METANMAG-122-00085666 EMBARGOED COPY Fig 2b Country of victim Reports listed as victim location in pubilo reports United States Canada Philippines Australia Mexico Other 0 50 100 150 200 250 300 350 Number of total sextortion reports Trends in Financial Sextortion | How Sextortion Unfolds and to Whom 12 Fig 2c Languages in reports Language used in reports with chat logs English French Tagalog Spanish German Indonesian Italian Other 0 500 1000 1500 2000 2500 Number of total sextortion reports How Blackmail Imagery Is Acquired Although children are most commonly sextorted through nudes that they sent to the extorter under false pretenses (often reciprocating after receiving sexual imagery they believe to be from the person they are talking to), additional tactics were apparent in the study. Event details provided in the sampled reports included descriptions of minor's accounts being hacked and their imagery taken without their permission, having images photoshopped, deepfaked, or otherwise created can be extorted with imagery they did not take, and being offered money or other incentives (modeling contracts for example) to coerce the minor into sharing their nudes. Actually measuring the distribution of different methods, however, is difficult. Sometimes, there are clear assertions (either in a victim's report or even in a chat log) describing how blackmail images or videos were acquired, such as a report claiming that they were hacked; however, such reports are rare. Of the studied reports, 78.6% of reports do not provide any information about how imagery was acquired, and 15% are cases where perpetrators offered to exchange nudes with the child (or to go on a mutual video chat to show nudity). We expect that most of the cases involving offers to exchange imagery are "catfishing" - where the perpetrators are impersonating someone else (usually an attractive person of a similar age to the child) to make it easier to get those images or videos; however, currently-available data is insufficient to confirm or refute this hypothesis. 2024 Thom CONFIDENTIAL PLTF EX-04320_0041 METANMAG-122-00085667 EMBARGOED COPY Trends in Financial Sextortion | How Sextortion Unfolds and to Whom 13 Of the 21% of cases where we have specific methods for getting imagery from the child, catfishing is seen in the majority of reports. However, additional tactics, such as threats of creating fake/inauthentic intimate imagery or hacking, also appear. In 13% of reports, the child reports they did not send sexual imagery of themselves but were threatened with images that were in some way fake or inauthentic, such as the child's face being added to explicit images of an adult or another child. In slightly fewer reports, children report they were either threatened with hacking or had intimate imagery stolen following an account hack. We studied other ways that perpetrators might coerce imagery from children (such as with offers of money) but found lower rates. Figure 2d shows the different ways that this blackmail imagery was acquired by perpetrators for the 21% of reports that included information about how the imagery was acquired (note that totals do not sum to 100 because reports may mention more than one method). 70% 00000000000000000000 of reports with information about imagery acquistion had signs of reciprocating images in response to the perpetrator sharing imagery. Fig 2d How imagery was acquired Method used, out of reports that have acquisition information No information on acquisition 78.6% Fig 2e | Acquisition information Rate of reports with information about how imagery was acquired % of sextortion reports with an acquisition method Reciprocating Images (Catfishing/Sexting) Fake/Inauthentic 12.8% Images Hacking 12.1% Has any information on acquisition 21.4% Violence/Non-image 7.2% Threats Relationships/ Grooming 2.3% A report was counted in multiple categories if multiple tactics were used. 2024 Thom CONFIDENTIAL Offers of Money 1.7% 70.2% 0 20 40 60 80 100 PLTF EX-04320_0042 METANMAG-122-00085668 EMBARGOED COPY Trends in Financial Sextortion | How Sextortion Unfolds and to Whom 14 Hacking - What This Looks Like in the Context of Sextortion Sometimes, children send sexual content within apps or platforms (or even simply save that content on their phone, or use an app image storage feature), and perpetrators can acquire this imagery by hacking. In many reports, the only information about this comes from a statement such as "they believe they were hacked"." While mentions of "hacking" appear mostly tied to ways that images or videos were acquired, it also appeared in reference to threats levied by perpetrators to hack a victim's account for the purpose of making it appear they are posting their own imagery directly. Fake/Inauthentic Imagery in Practice Threatening children with fake sexual imagery occurs in roughly 13% of the reports in which tactics were apparent. While this category includes photoshopping a child's face onto sexual content or even the use of Al-generated images or "deepfakes," the majority of these were cases in which a perpetrator threatened the child with imagery that was not of that child but which were simply an image of someone else. In such cases, perpetrators with a non-sexual image that shows a child's face would threaten to send that image alongside a face-less nude photo that might be the same child, claiming that the child sent them both. While this does not yet quantitatively show increases in sextortion connected to Al-generated image production techniques, the FBI has warned of an increase in sextortion using generated imagery, 18 and the prevalence of simple methods for extorting children using fake images highlights just how vulnerable children may be to more serious "deepfakes" methods in sextortion contexts. Other Coercion Methods We also measured mentions of three other methods that can be used to get imagery from children: offers of money, threats of violence, and acquiring imagery through relationships (e.g., grooming, in-person relationships, etc.). Of these, "offers of money" are the most clear-cut, although rare: situations in which children are either propositioned for imagery or in the context of a future monetary reward (e.g., posing as modeling agents), but in which the images or videos are immediately turned around to use in extortion. Other cases of violent or violence- adjacent threats are prototypical situations in which the offender threatens to hurt a child unless they provide imagery. In practice, we did not end up separating out threats of violence or threats of sharing their location for initial imagery vs. other threats of violence raised during sextortion, and so this may be even rarer than the current rate implies. Finally, this studied sample included a small subset of grooming or relationship instances, such as where a child reports that they gave imagery to a boyfriend or girlfriend who then extorted them. Survivor studies have reported this to be highly common in studying non- financial sextortion. Victims surveyed in 2015 reported that 59% knew their perpetrators offline, and of those that did only know their perpetrator online, 62% shared imagery because they were "In a wanted romantic or sexual relationship." In our sampled data, we only had eight instances flagged as such, but only one involved financial sextortion, with three of the rest having "content/other" demands, asking the child to provide CSAM or to be in a relationship. E 17 We take all accounts by a victim about how their images or videos were acquired at face value for the purpose of this report, with the awareness that there may be cases where victims who were coerced into sharing imagery may believe there will be less judgment stating that their imagery was hacked or deepfaked instead. 18 https://www.ic3.gov/Media/Y2023/PSA230605 19 Wolak, Janis and David Finkelhor 2016 "Sextortion: Findings from a Survey of 1,631 Victims." https://www.thorn.org/wp-content/uploads/2016/08/Sextortion Report.pdf 2024 Thom CONFIDENTIAL PLTF EX-04320_0043 METANMAG-122-00085669 EMBARGOED COPY Trends in Financial Sextortion | Tactics of Pressuring Victims and Victim Impacts 15 Tactics of Pressuring Victims and Victim Impacts Many of these financial sextortion threats seem designed to focus children on the risk of others seeing them in intimate imagery-whether actual or manipulated-and the potential for perceived life-ruining impact as a result. This threat is used to pressure children to pay before they have time to either process these threats or seek support. It is therefore important for victims to know that the best course of action is generally not to pay, to report the extortion to both NCMEC and the ESP, and to block the offender-but equally important to understand the work that offenders are doing to convince children that their lives will be ruined. Such threats can also become a roadblock to reporting or seeking help. This is particularly true if a child receives similar messaging from caregivers or others in their community. Established Information to Know: Sextortion can be a very stressful situation for children, leading to high stress or even self- harm or suicidal ideation. However, paying the perpetrators can simply lead to more demands. Key New Findings: There is a range of methods perpetrators use to pressure children and increase the perceived severity of their imagery being exposed. against different victims, as if operating off of a script designed to quickly and efficiently coerce victims to pay. 20 Shared across all cases, in addition to any of these distinct threat types, is the emotional stress associated with threats to have personal intimate imagery released to others. Fig 3a | Pressure threats Methods used to pressure victims, out of chats with pressure tactics Exaggerated Impact/Ruin Countdowns/ 11.6% Deadlines Demand for Constant Contacts Framing Payment as Charity 9.6% 5.8% Threatening Jail/ 4.8% Accusations 32.0% 0 20 40 60 80 100 Figure 3a outlines the overall frequency of the various tactics perpetrators used to pressure victims out of all reports where conversation data could be measured. When these tactics show up in conversations, they are often very formulaic; perpetrators use extremely similar or even identical threats Percent of total sextortion reports with chat logs A report was counted in multiple categories if multiple tactics were used. 20 A new report by NCRI shows some specific examples of such sextortion scripts. https://networkcontagion.us/wp-content/uploads/Yahoo-Boys 1.2.24.pdf 2024 Thom CONFIDENTIAL PLTF EX-04320_0044 METANMAG-122-00085670 EMBARGOED COPY Trends in Financial Sextortion | Tactics of Pressuring Victims and Victim Impacts 16 Exaggerating Impact 32% 5000000000000 of reports with chat logs included exaggerated impacts and/or threats of ruining While threats to share content with a victim's family, friends, or followers are inherent to this issue, a large percent of these sextortion cases involved threats of much more dramatic impact-that the extorter would make the content go viral, would make the content get onto the news, would share it in a way that the child would never get a job, or more broadly that it would ruin the child's life. Many such threats are formulaic, repeated nearly identically from victim to victim. Table 2a shows examples of threats that perpetrators have repeated in this exact form four or more times over different reports: the victim's life. Table 1a Example Phrases Used in Exaggerating Impact to Victims blocking me won't stop me from posting it viral or send this to ur school and u know u will be expelled from you lose a lot of things - your honor - your dignity - your family life . I have ur nudes and everything needed to ruin your life u will be exempt from universities if u don't cooperate Listed phrases appeared in at least 4 reports Legal Threats and Framing for Harassment/ Rape/Abuse Some sextortion reports involve more specific threats relating to legal consequences for the minor. Threats can focus on the fact that the child 2024 Thom CONFIDENTIAL sent nude imagery of themselves (since that imagery is CSAM, offenders threaten children with legal consequences for producing/sending it) or may focus on accusations that the child was abusing another child (as the perpetrator may have assumed a juvenile persona when initially soliciting the images or videos). Instances were observed in the data of perpetrators threatening to frame or publicly accuse the child of soliciting or abusing younger children or of generally being a pedophile (the youngest example of this in our data accused the child of sending content to a 10-year- old). Table 1b outlines example phrases that are commonly used in such threats; like other threats, these accusations are so formulaic that the exact phrasing can occur in many different reports: Table 1b | Examples of Accusation Threats Used you do not ask my age before masturbate, i just want to say that i am a girl of 15 years ... you know very well that this is an act pedophile and that is prohibited by law you will be arrested by the interpol police ... you will be locked up for 5 years in prison Listed phrases appeared in at least 4 reports Countdowns/Deadlines and Demands for Constant Communication Perpetrators seem to employ a range of methods to attempt to make sure that their victims are required to make quick decisions, attempt to pay quickly, and do not have an opportunity to seek help from their caregivers or other sources of support. We coded two ways in which perpetrators imposed such urgency: firstly, the use of countdowns and deadlines to make the victim rush to pay, PLTF EX-04320_0045 METANMAG-122-00085671 EMBARGOED COPY Trends in Financial Sextortion | Tactics of Pressuring Victims and Victim Impacts 17 and secondly, the demand for constant communication and access. With countdowns and deadlines, perpetrators would give children fixed periods to encourage payment or to extract a promise of a method and amount of payment. For the second method in which perpetrators demanded constant communication from the child, perpetrators would threaten to expose a child's imagery if children simply disconnected from the video chat or did not respond in text chat quickly enough. Such threats might have a range of reasons, including both mental reasons to pressure the child or to prevent them from seeking help as well as enabling verbal instructions (which are more challenging to report). "Donation to Charity" Tactics An additional tactic that perpetrators use is the framing of their sextortion as being done for the sake of humanitarian donations-usually a perpetrator claiming that the only reason they are demanding money is for a sick child, sibling, or parent. As with other tactics, this could involve a range of reasons, which might include financial details (e.g., they may want payment details to appear like a charitable donation) as well as to manipulate the children or make them more likely to pay or less likely to report the sextortion. Victim Impacts - Mental Stress, Payment, and Dissemination Reports also provide insight into the impacts of sextortion on the victims, which can range from discussion of whether their imagery was disseminated to mental/emotional impacts on the victim to discussion of giving into the perpetrator's demands for money. Although we only see discussion of impacts on the victim in a small set of reports (9.2% of cases), those reports can illuminate the different ways that sextortion Fig 3b | Victim impacts For the 9.2% of reports where any victim impacts were reported Other victim concerns 18.8% Victim paid 19.0% Victim paid + follow-up demands 6.3% Multiple impacts 13.1% Discussion of suicide/self harm 13.6% Victim says images were disseminated 29.3% Categories are exclusive: any instances where a report described a combination of multiple harm types is solely represented in the "multiple impacts" category. might impact victims. Figure 3b outlines how often these different victim impacts appear in reports. A significant category of sextortion impact is the actual sharing of the victim's imagery with friends, family, and the public. While this is the most commonly mentioned outcome when victims talk about the impacts of sextortion, this shouldn't be viewed as inevitable: only 3.5% of total reports studied discuss imagery ultimately being disseminated. 21 Perpetrators often claim that disseminated content will become public and potentially viral. However, in many reports where a victim states that their imagery 21 The small percentage of victims stating that their imagery was shared is a lower bound: there may be more victims who did not yet know their imagery was shared or did not choose to disclose. 2024 Thom CONFIDENTIAL PLTF EX-04320_0046 METANMAG-122-00085672 EMBARGOED COPY Trends in Financial Sextortion | Tactics of Pressuring Victims and Victim impacts 18 Fig 3c | Threatened dissemination platform Platforms discussed as place where imagery would be disseminated Platforms named in threats Platforms named in reports of distribution of distribution threaten to post content (as illustrated in Figure 3c), only Instagram (and to a lesser extent, Snapchat) were commonly discussed when a victim also identified that their imagery had been shared ("Victim says images were disseminated" in Figure 3b). 61.8% Instagram 81.5% 26.5% Youtube 4.6% 25.5% Facebook 6.9% 10.4% Snapchat 16.9% 6.4% Twitter 2.3% 2.0% TikTok 0.8% When mental and emotional impacts on victims do get reported, we split such content into two categories: a more severe category of discussions of suicidal ideation and/or self harm and a more general category of "other victim concerns" and mental stresses. 22 In both cases, only a small subset of cases include mention of a victim's situation in report texts-it can be assumed that many victims do not explicitly provide such information about the mental or emotional impact of this experience in the report. 0 20 40 60 80 100 Percent of reports where platform was the threatened or reported place of distribution Shows platforms mentioned 10 or more times for distribution. Of 1012 reports with one or more platforms of threatened distribution, 130 confirmed distribution. 000000000000000000000000 was disseminated, the content was shared privately and with a limited number of people. This can be highlighted by looking at reports where particular platforms were coded as being the place where the victim's imagery would be shared: while it is common for Instagram, Facebook, and YouTube to be platforms where perpetrators 82% of reports stating that images had been shared listed Instagram as a location of that dissemination. One in three (33%) reports with impact information mentioned making payments. 30% of victims who mentioned paying their perpetrator discussed ongoing demands. Other sources of information, such as news articles regarding sextortion victims, can shed light on how these pressure tactics and the overall threat of image sharing can culminate in severe consequences such as suicide. In one such case, a news article notes 23 that perpetrators told the child that he "...would be labeled a pedophile. His parents wouldn't love him. He wouldn't be able to get into college or get a job. They would hurt or kill his parents." In a separate case, an article 24 quotes a parent as saying, "The information we collected shows that the pressure [the victim] was under was unbearable to the point that during this exchange" and notes that the victim "... finally tells [the perpetrator], 'hey, I'm going to commit suicide, I'm going to kill myself, and they respond with, 'go ahead, because you're already dead." 20000 800000000000000000000000 800000000000000000000000 22 Reports given the "mental stress" label included a range of experiences such as observations the victim was scared or worried to more severe discussions of panic attacks or concerns from victims about their safety if their parents were to find out. Reports with the tag "suicide/self-harm" were a subset of this group. 23 Warsmith, Stephanie. "You might as well end it now': Terrorized by sextortion plot, a 17-year-old takes his life" USA Today, May 9, 2023. https://www.usatoday.com/in-depth/news/nation/2023/05/09/parents-spread- sextortion-warning-after-sons-death/70197048007/ 24 "Starkville father goes on Fox News to warn parents about sextortion" WTVA, February 20, 2023. https://www.wtva.com/news/starkville-father-goes-on-fox-news-to-warn-parents-about-sextortion/article_cc645a- da-b14e-11ed-9aae-8f6fc94bb084.html. 2024 Thom PLTF EX-04320_0047 CONFIDENTIAL METANMAG-122-00085673 EMBARGOED COPY However, these payments often did not deter continued harassment; 30% of victims who mentioned paying their perpetrator discussed ongoing demands experienced after a first payment (shown as the "paid + follow- up demands" slice in Figure 3b). This is a commonly noted trend, and some sources suggest it may be even more common than that; the report from C3P25 studying public discussions from sextortion victims on Reddit found that 93% of posts discussing payment discussed further demands for money after the initial payment. Overall, we found that the median payment mentioned by a victim was $100 but that the median amount demanded by a perpetrator was $400, highlighting that perpetrators are starting with high demands but accepting whatever amounts they can get from children. Trends in Financial Sextortion | Tactics of Pressuring Victims and Victim impacts 19 EMBARGOED 25 C3P (2022). An Analysis of Financial Sextortion Victim Posts Published on r/Sextortion. https://content.c3p.ca/pdfs/C3P AnalysisOfFinanSextortion Posts Reddit....en.pdf 2024 Thom CONFIDENTIAL PLTF EX-04320_0048 METANMAG-122-00085674 EMBARGOED COPY Trends in Financial Sextortion | The Role of Platforms in Sextortion 20 The Role of Platforms in Sextortion Sextortion does not happen in a vacuum; how children interact with platforms and specific design features can facilitate these sextortion events. We can see this by examining which platforms are used to initially contact children, and which were used as a secondary location that perpetrators would move the conversation to. Established Information to Know: We add metrics to the most common use of platforms - children meeting a perpetrator on Instagram and moving to a platform such as Snapchat. Key New Findings: We highlight the role of apps designed for random interaction with strangers - Omegle and Wizz as places to initially meet children, and the use of other secure messaging apps like Google Chat and/or Hangouts and Telegram as secondary locations. To avoid bias introduced by platform reporting behaviors (which platforms report and how do they report) we analyzed how platforms are used in sextortion events via explicit platform mentions in report text (such as in chat text or descriptions of the event provided by victims). 26 Any platform mentions were coded to capture how the platform was being discussed. Coding included labels such as whether perpetrators threatened to share imagery on that platform (discussed in Figure 3b), whether they explicitly discussed that the initial contact happened on that platform (e.g. "they added me on _"), when there was explicit mention of moving to a secondary platform ("the conversation moved to "). Contact Thorn for an appendix with labels and definitions. Platforms Mentioned as Places Where Perpetrators Contacted Children Of the 2,276 reports that explicitly discussed how platforms were used, 377 had an "initial contact" label; a few core platforms dominate the studied reports as places used for that initial point of contact, shown in Figure 4a. Instagram, Snapchat, and Facebook were the most common platforms mentioned - and they were also frequently cited as initial contact points. For many of these mentions, a report simply stated that the child was "first contacted" on the platform or that they met on the platform. However, chat logs sometimes provide the initial conversation, which can often involve statements from perpetrators such as, "You don't know me, but your profile was recommended to me by [platform]"; such discovery systems may help perpetrators justify random connections to children. Two smaller platforms for randomly meeting strangers, Omegle 27 and Wizz, were also both explicitly mentioned as the "initial contact" point more than ten times, highlighting the role that such systems might have in enabling perpetrators to get new connections to children (while Omegle shut down in the second half of 2023, many similar competitors exist). Wizz, in turn, has been highlighted 28 by NCMEC and C3 as a common platform mentioned by the public regarding sextortion, and a recent NCRI report29 has found instructional videos for perpetrating sextortion over Wizz. 26 We measured this over approximately 100 names of platforms, listed in the Appendix; most of the platforms checked for were mentioned rarely or not at all. 27 Most of the reports analyzed in this study predate the shutdown of Omegle in November 2023. % of reports with information about the platform of first meeting mentioned Omegle or Wizz as an initial contact point. 28 https://www.nbcnews.com/tech/social-media/friend-finding-app-offered-safe-space-teens-sextortion-soon-followed-rona91172 29 Raffile et al. (2024) A Digital Pandemic: Uncovering the Role of 'Yahoo Boys' in the Surge of Social Media-Enabled Financial Sextortion Targeting Minors. https://networkcontagion.us/wp-content/uploads/Yahoo-Boys 1.2.24.pdf 2024 Thom CONFIDENTIAL PLTF EX-04320_0049 METANMAG-122-00085675 EMBARGOED COPY Trends in Financial Sextortion | The Role of Platforms in Sextortion 21 Fig 4a | Platforms used for initial contact Platforms mentioned ten or more times as an initial meeting platform Instagram Snapchat Facebook 6.4% Omegle 4.7% Wizz 4.3% Wink 2.1% 0 20 35.0% 40 45.0% 60 Percent of all 469 reports that explicitly mention an initial-contact platform A report was counted in multiple categories if multiple platforms were discussed. 80 Platforms Mentioned as Secondary Contact Thorn surveys of children have found that 65% of children had experienced someone attempting to get them to "move from a public 100 chat into a private conversation on a different platform,"30 and this is a common event in sextortion situations, with perpetrators moving children to platforms that are less likely to detect the event and/or where the child may be more likely to share content. When we look at platforms that were coded as being used as a "secondary location," where a report identified that the victim was moved from one platform to another (471 reports mention such a secondary location), we found that the most common platform to which these interactions are moved is Snapchat, as shown in Figure 4b. Perhaps due to features such as disappearing DMs, Snapchat is a common platform for sending self-generated CSAM (SG-CSAM or nude selfies); recent surveys of youth found that 39% of 13-17-year-olds who had shared their own nudes did so via Direct Message (DM) "in apps where content disappears, like Snapchat." 31 However, Snapchat is not the only platform used: Google messaging products (Google Chat and Google Hangouts), WhatsApp, and Telegram are also common, followed by Instagram32 and iMessage. Discussions of such secondary apps generally do not provide explicit reasoning for why such a switch is done or why a specific platform is selected, but the requests are often connected to offers to exchange nudes - there are many statements along the lines of "download [platform] so that we can trade nudes / chat naked." While many of these tools share the ability to have end-to-end encrypted text messaging (and thus may be less likely to detect sextortion 33), another notable feature of platforms such as Google messaging apps and Telegram is that they can be operated 30 Thorn (2022). Online Grooming: Examining risky encounters amid everyday digital socialization. https://info.thom.org/hubfs/Research/2022 Online Grooming_Report.pdf 31 Thorn (2023). LGBTQ+ Youth Perspectives: How LGBTQ+ Youth are Navigating Exploration and Risks of Sexual Exploitation Online. https://info.thorn.org/hubfs/Research/Thorn_LGBTQ+Youth Perspectives...... June2023_FNL.pdf 32 Note that since the majority of sextortion reports with clear chat logs submitted to NCMEC were submitted by Instagram (discussed further in the report), it is possible that there are specific biases due to being the place of discussion: for example, two people chatting on Instagram are unlikely to suggest moving the conversation to Instagram. 33 We should acknowledge that such platform shifts, if they are successful in avoiding detection or reporting by a platform, would not show up in our platform data. They may, therefore, indicate particular blind spots in our understanding of the sextortion landscape. 2024 Thom CONFIDENTIAL PLTF EX-04320_0050 METANMAG-122-00085676 EMBARGOED COPY Fig 4b | Platforms used as secondary destinations Plotform mentioned as destination where conversation is moved to Snapchat 31.5% Gchat 29.4% WhatsApp 12.6% Telegram 8.3% Instagram 7.7% iMessage 3.4% Facebook 2.9% Discord 2.6% 0 20 40 60 80 100 Trends in Financial Sextortion | The Role of Platforms in Sextortion 22 Fig 4c | Platforms used for payment Payment platforms mentioned in reports Zelle 7.8% Gift cards 30.1% Other 5.7% PayPal 16.7% Crypto 3.0% Venmo 10.6% Cash App 22.1% Apple Pay 4.0% Percent of all 588 reports that have platforms in that role Platforms included if mentioned 15 or more times in this role. A report was counted in multiple categories if multiple platforms were discussed. A report was counted in multiple categories if multiple payment methods were discussed. using a desktop version. This capability may be preferred by perpetrators attempting to prove their persona by "spoofing" webcams (making a saved video appear as if it is a live video chat). Payment Platforms and Systems Chats frequently involve mention of payment methods or platforms. We measured not only named payment platforms but also a few more general payment approaches such as using gift cards or cryptocurrencies. The most common payment method, more common than any one payment app, was simply gift cards. While perpetrators sometimes request specific kinds of gift cards (e.g., "Steam gift card" or "iTunes gift card"), many other reports simply generically mention gift cards. After those gift cards, the next most popular payment methods were easy-use payment apps such as CashApp, PayPal, and Venmo. Figure 4c shows the relative amount of mentions of each platform method: one can see that the dominant methods are gift cards and CashApp. The dominant methods of payment are gift cards and CashApp. These findings broadly agree with payment platform trends noted in the C3P study of disclosures on a sextortion subreddit, with some notable differences. That study - which unlike this 2024 Thom CONFIDENTIAL PLTF EX-04320_0051 METANMAG-122-00085677 2024 Thom Portion of mentioned payment apps EMBARGOED COPY Trends in Financial Sextortion | The Role of Platforms in Sextortion 23 work, included adults - found largely similar rates overall, but slightly less use of gift cards and CashApp, and higher rates of use for wire transfer/ remittance systems (e.g. Western Union) and cryptocurrency. While the data from the two sources cannot be cleanly compared, it would be unsurprising to find higher rates of simple and easy-to-access payment systems in the NCMEC reports given the focus on child victims. This also suggests that while minors are likely not being targeted for sexual purposes in financial sextortion cases, tactics are being deployed specific to minor targets. The dominance of gift cards and Cash App has slightly increased over time. If we map the use of gift cards, Cash App, and other payment platforms over time (Figure 4d), one can see the slow increase of Cash App and Payment platforms relative to all the other payment apps. Fig 4d | Payment methods over time Trends in largest two payment methods over time 100 80 60 40 20 0 2021-11 2022-02 2022-05 2022-08 2022-11 Sampling period 2023-02 2023-05 A report was counted in multiple categories if multiple payment methods were discussed. CONFIDENTIAL 2023-08 GO Other PayPal Venmo Gift cards Zelle Payment methods included in "Other" Apple Pay 4.0% Cash App Crypto 3.0% 7.8% 10.6% 0 2 4 6 8 10 12 14 16 18 Percent of mentioned payment apps Platforms included if mentioned 10 or more times in this role. PLTF EX-04320_0052 METANMAG-122-00085678 16.7% EMBARGOED COPY Trends in Financial Sextortion | Perpetrator Differences by Country 24 Perpetrator Differences by Country Financial sextortion appears to often be an organized endeavor, where many cases use nearly identical language (as if using the same scripts), have been reported to use the same profile pictures, and are largely resolving to a few international locations (based on information provided in ESP reports to NCMEC). The large majority of cases in this study appear to be originating from Nigeria and Cote d'Ivoire (and to a lesser extent, the United States). Established Information to Know: A large percent of these events are from individuals based in Nigeria and Cote d'Ivoire. Key New Findings: We highlight that perpetrators across different countries seem to differ across tactics used to influence children, which messaging apps they move the conversation to, and the victims themselves. Fig 5a | Reports linked to a country For countries linked to twenty or more reports Cote d'Ivoire (Ivory Coast) Nigeria United States Philippines United Kingdom India Indonesia Turkey Australia Canada France Brazil 0 200 400 600 800 1000 1200 1400 1600 Number of reports Country-Level Trends Many financial sextortion cases are emanating from what seems to be organized criminal groups in two countries, Nigeria and Cote d'Ivoire, 34 and reports submitted to NCMEC are often linkable to those countries. These two countries constitute the vast majority of reports submitted to NCMEC that are financial sextortion cases and are the two locations that have been postulated as the locations of organized sextortion groups. 35 Figure 5a shows the overall breakdown of all countries with more than 20 reports; for the largest sources of sextortion, such as Nigeria and Cote d'Ivoire, we have enough data to also dig into differences in how the tactics and platforms used (as discussed in prior sections) vary from country to country. Note that we discuss a report being linked to a particular country when the report lists that country in the NCMEC 64% of all reports linked to a country were linked to either Nigeria or Cote d'Ivoire. 34 https://www.justice.gov/usao-wdwa/pr/fbi-and-partners-issue-national-public-safety-alert-financial-sextortion-schemes 35 The recent NCRI sextortion report covers sextortion manuals and scripts within Nigerian perpetrators in particular - Raffile et al. (2024) A Digital Pandemic: Uncovering the Role of 'Yahoo Boys' in the Surge of Social Media-Enabled Financial Sextortion Targeting Minors. https://networkcontagion.us/wp-content/uploads/Yahoo-Boys 1.2.24.pdf 2024 Thom CONFIDENTIAL PLTF EX-04320_0053 METANMAG-122-00085679 EMBARGOED COPY Trends in Financial Sextortion | Perpetrator Differences by Country 25 "international country" field. While this field often refers to the location of the perpetrator, it is not guaranteed to do so; if the only location known is the country associated with the victim, that child's location would be provided in that field instead. Differences in Methods by Country We see differences in both how offenders attempt to get blackmail material of children, as well as the pressure tactics that they use once they have that material. Figure 5b outlines the labels with the most variation: from the data, it appears that accounts in the US are more likely to make use of methods like hacking to get data, whereas data from the Ivory Coast is more likely to have explicit discussion of exchanging imagery, although since a large amount of all of these cases likely involve catfishing and exchanging images, those cases may simply be more explicit about it. We also found some trends in different tactics used to pressure children (the tactics discussed in the earlier section on victim impact). Reports linked to Cote d'Ivoire seemed more likely to pressure children using threats to get them sent to jail (e.g., scaring them with the illegality of their own nudes) and more likely to insist on constant contact (such as not disconnecting from a chat). Other tactics were more comparable - reports Fig 5b | Acquisition tactics by country For the most common countries, as a percentage of reports to each Cote d'Ivoire (Ivory Coast) Nigeria United States Unknown Method used to acquire images Reciprocating images/ catfishing 10% 16.4% 7.8% 2.1% Fake/ inauthentic images 4.2% 4.6% 2.2% 1.2% Hacking of images 0.9% 2.8% 0 5 10 20 25 30 35 Percent of reports EMBARO Fig 5c | Threat tactics by country For the most common countries, as a percentage of reports to each Cote d'Ivoire (Ivory Coast) Nigeria United States Unknown 34.5% Tactics from perpetrators Exaggerated impact/ruin 40.0% 40.4% 55.3% 20.1% 8.9% Threatening jail/accusation 3.4% 3.5% 2.6% Countdowns/ deadlines 19.0% 15.3% 7.0% 5.8% 21.6% Demands for 1.2% constant contact 5.3% 3.4% 13.3% Framing payment 0.2% as charity 10% 2.0% 0 10 20 30 40 50 Percent of chat logs A report was counted in multiple categories if multiple tactics were used. 2024 Thom CONFIDENTIAL A report was counted in multiple categories if multiple tactics were used. PLTF EX-04320_0054 METANMAG-122-00085680 Platform EMBARGOED COPY from both countries made use of countdowns/deadlines and extensive use of more general exaggerations of impact (such as threats to make a child's imagery go viral). We also see differences in the platforms themselves being used, in particular, for the messaging apps where children are moved to after initial contact. Sextortion from Nigeria relied almost entirely (in the time period studied in this report) upon Snapchat, whereas data from Cote d'Ivoire also uses other messaging apps such as Google Chat/Google Hangouts, WhatsApp, and Telegram. Fig 5d | Secondary plaform use by country For the most common countries, as a percentage of reports to each Trends in Financial Sextortion | Perpetrator Differences by Country 26 Differences in Victim Languages Spoken It is not surprising that there is more sextortion in French from perpetrators in the Cote d'Ivoire (which has French as an official language) and more use of English in Nigeria for the same reason. However, the distribution of languages used in chats shows the Cote d'Ivoire sextortion data is very multilingual, having cases in English, Italian, German, and Spanish, and even a long tail of other languages such as Russian and Polish. Chats in all such languages can often involve nearly identical formulaic language to what shows up in French sextortion cases, including some overly literal translations from French (such as threats with pourrir la vie, to ruin someone's life, but literally to rot their life). This may suggest the use of automatic translation tools to target a wider range of victims. We can see these differences in Figure 5e, which highlights the differences in language used. Cote d'Ivoire (Ivory Coast) 0.7% Snapchat Nigeria United States Unknown 5.1% 2.6% 1.3% Gchat 0.1% 0.3% 0.8% 2.3% WhatsApp 0.5% 0.1% 0.5% EMBA Telegram 0% 0.5% 0.1% 0 1 Fig 5e Language by country Languages used in chat logs linked to Nigeria and Cote d'Ivoire 4 5 6 7 8 French 22.4% Percent of reports A report was counted in multiple categories if multiple platforms were discussed. 2024 Thom CONFIDENTIAL English 58.5% Other 4.6% Italian 7.2% German 7.3% English 97.4% Language of chats linked to Cote d'Ivoire (Ivory Coast) Language of chats linked to Nigeria Other 2.6% PLTF EX-04320_0055 METANMAG-122-00085681 EMBARGOED COPY For most reports, we can speculate on victim location based on the language spoken in chats but cannot derive confident trends. Perpetrator groups based in Cote d'Ivoire do target many victims speaking languages that are common in Europe, such as French, Italian, and German, but we cannot be certain about that link; e.g., for French, many such victims may be in countries such as Canada. Trends Over Time by Perpetrator and Country Differences When we look at how reports submitted by platforms (ESPs) link to countries, a trend emerges in which sextortion reports submitted by Instagram tend to be linked to Cote d'Ivoire, and sextortion reports submitted by Snapchat are often linked to Nigeria (and never linked to Cote d'Ivoire). This reflects the trends seen above in the explicit mentions of platforms in text, which also found that reports connected to Nigeria are more likely to attempt to move victims to Snapchat. However, one can see in Figure 5f that this trend becomes somewhat chaotic in the most recent periods of our analysis, with even reports from Instagram linking more to Nigeria, more to the US. Although very preliminary checks against the latest November 2023 data do suggest that this shift may be temporary, 36 it is not clear why such shifts occurred, nor whether they are due to encouraging developments (e.g. increasing success investigating these crimes in a particular area) or other developments such as shifts in moderation systems. Number of reports Number of reports 70 60 50 40 30 20 100 Trends in Financial Sextortion | Perpetrator Differences by Country 27 Fig 5f Country differences by reporting platform Countries linked to reports submitted by top platforms Number of reports 600 500 400 300 200 100 0 2021-11 175 150 125 100 75 50 25 0 2021-11 2022-02 2022-05 2022-08 Sampling period 2022-11 2023-02 2023-05 2023-08 2022-02 2022-05 Sampling period 2022-08 2022-11 2023-02 2023-05 2023-08 Facebook Other Unknown United States Cote d'Ivoire (Ivory Coast) Nigeria Instagram Other Unknown United States Cote d'Ivoire (Ivory Coast) Nigeria Snapchat Other Unknown United States Nigeria 2021-1 202-02 222015202-08 20221 202302 2025-050202300 Sampling period O reports from Cote d'Ivoire (Ivory Coast) from Snapchat 36 Specifically, although the full analysis of the data concluded with August 2023, we did preliminary measures of November 2023 data, and found that Instagram sextortion reports in that period shifted back to predominantly being linked to Cote d'Ivoire (68% of reports in November 2023) rather than Nigeria (4% of reports). However, this finding is tentative, as it was measured only over reports matching specific patterns (escalation or incident types mentioning sextortion or blackmail) without the manual confirmation steps used in the full analysis. 2024 Thom CONFIDENTIAL PLTF EX-04320_0056 METANMAG-122-00085682 EMBARGOED COPY Trends in Financial Sextortion | Platform Reporting Landscape 28 Platform Reporting Landscape Reporting activity across ESPs relating to sextortion is widely varied. ESP reports of sextortion are currently the overwhelmingly leading signal into NCMEC that a child is being sextorted, making up 82% of the total reports of sextortion during the sampled timeframe. 37 Three platforms stand out as the driving force behind these numbers: Facebook, Instagram, and Snapchat. Importantly, the number of reports made to NCMEC should not be taken to directly equal the number of sextortion instances occurring on those platforms. In fact, in some cases, increased reporting is also reflective of increased commitment to detecting and reporting such instances. Increases are not always bad since they can be a result of better detection and reporting. 3000000000000000000000000 In addition, it's important to acknowledge that not all sextortion cases are reported either because they are not detected and reported by the ESP or a victim is not prepared to disclose. To build a more complete understanding of how sextortion is appearing on individual platforms, this study explores both the patterns in reports made by individual ESPs (such as overall volume and time between when an event occurs and when the report is made) and patterns in reports made by the public, thereby broadening our understanding of where sextortion may be occurring beyond merely if ESPs are reporting. Established Information to Know: Reports from Instagram constitute a huge percentage of all ESP reports coming in where sextortion is reported, followed by Facebook and Snapchat. Key New Findings: We highlight a big peak and drop in the data from Instagram, highlight that some of those trends may be due to internal changes, and highlight that there are other platforms that might be expected to report more than they do. Most Reports are Submitted by a Few Companies There are a number of notable changes in the trends over time for reporting platforms, shown in Figure 6a (these trends are purely about the reporting platform itself, and thus are not necessarily proportional to where the sextortion took place). The first is a sharp increase of cases submitted by ESPs starting in the middle of 2022; that increase could reflect the actual increase in sextortion at that time but might also reflect work that NCMEC did in raising alarms about financial sextortion to the platforms in June of 2022. A second notable trend is the variability we see in the number of reports from platforms, such as increases in reports from Instagram in November of 2022 and a drop in reports in May of 2023, as well as a possible decline in reports from Snapchat in August 2023 (although there are indications that Snapchat reporting has recently increased 38). As Instagram reports 37 Since ESP reports make up 99% of all reports to NCMEC when looking at all report types (the majority being reports of CSAM), this 82% measure is actually reflective of a relatively high number of public reports for sextortion, underscoring the critical importance of public reporting. 38 Data collected for November 2023 data suggests recent increases in the amount and quality of Snapchat reports; however, since that is outside of the main analysis here, we cannot provide full confirmation yet regarding that trend. 2024 Thom CONFIDENTIAL PLTF EX-04320_0057 METANMAG-122-00085683 EMBARGOED COPY Fig 6a | ESP reporting trends Number of reports per week submitted by an ESP or to NCMEC public form. Dashed line indicates last point of data collection of public data. Platforms shown if they submitted 5 or more sextortion reports per week Number of reports 800 600 400 200 0 2020-08 Trends in Financial Sextortion | Platform Reporting Landscape 29 2020-11 2021-02 2021-05 2021-08 2021-11 Sampling period 2022-02 2022-05 2022-08 2022-11 2023-02 2023-05 2023-08 Facebook Instagram Snapchat Direct to NCMEC (public) constitute the majority of all reported sextortion, those changes in Instagram reports can dwarf all other trends in order to define the overall trends in sextortion. A third trend, the drop-off in public reports in August of 2023, is simply missing data and can be ignored: those reports had not passed through the NCMEC analysis pipeline by the time of analysis. 61% of all ESP reports in our data are through Instagram. 0000000000000000000000 Reporting Delays and Report Informativeness Looking at the amount of time between when these sextortion events happened and when they were reported to NCMEC by an ESP can give insight into these overall trends, pointing to differences between the overall rates of sextortion instances and the time it takes for platforms to report these cases to NCMEC. Of note, several things may influence the time between event and report to NCMEC by an ESP, not all of which are in control of the ESP submitting the report. Among them: existence and efficacy of proactive detection practices, changes in offender tactics, dependence on user reporting, and efficiency of content moderation pipelines. Figure 6b presents the median delay between sextortion events and their reports for the main three sextortion-reporting platforms over the last two years, showing that both Facebook and Instagram reports shifted from a pattern of rapidly submitting reports within days of an incident to more recently having a median delay of over a month. In the second half of 2022 (where Facebook and Instagram show the greatest amounts 2024 Thom CONFIDENTIAL PLTF EX-04320_0058 METANMAG-122-00085684 EMBARGOED COPY of report activity), the time between event and report is the shortest (typically a matter of days). In comparison, in the sample studied in Aug 2023, the time between event and reports is considerably longer (over a month in some cases), suggesting this cohort of reports may be delayed reporting corresponding to the overall dip in report volume observed in the May 2023 timeframe. 39 Put another way, the data suggests the dip in reports by Instagram and Facebook in May 2023 is less a reflection of a drop in sextortion activity on these platforms and more likely a reflection of delays in the content moderation pipeline submitting these reports to NCMEC. Similarly, the data suggests the spike in report activity in late Fig 6b | Reporting delay Medion number of days between incident and submission of report to NCMEC Days of delay Facebook 60 50 40 30 20 10 0 Instagram Snapchat MB 2022-11 2023-02 2021-1 2022-02 202-05 2022-08 Report period 2023-05 2023-08 Trends in Financial Sextortion | Platform Reporting Landscape 30 2022 is not a result of a reporting backlog, as the time between event and report is relatively short, but may point to improved detection and/or increased sextortion activity. 10 days was the average delay between incident and an ESP report to NCMEC in the last two years of data. Although increasing time lags in reporting are concerning, it is important to recognize the inherent difficulties in detecting and responding to sextortion cases. We do not know if these delays are primarily due to changes in content moderation, advances in detection technology, or shifts in user or perpetrator behavior. Furthermore, we should acknowledge the positive impact of periods where platforms were swiftly responding to sextortion incidents, and focus on how platforms can be encouraged to maintain such responsive reporting to NCMEC. When an ESP observes signals suggesting immediate risk to a minor, they may utilize an "ESP escalation" field in which a report can be flagged to NCMEC for more urgent study, with a summary characterizing the event such as "This account is sextorting an apparent minor." Apart from that escalation field, some sextortion reports include chat excerpts or additional context, which shed light on the platforms and tactics used or the situation's urgency. The distribution of reports with escalations, and with those pieces of additional information, is shown in Figure 6c. Historically, Facebook and Instagram have frequently escalated sextortion cases and provided additional context such as chat information. In contrast, Snapchat has typically provided basic report information but has seldom escalated cases and rarely included chat information or child victim information. In these rapidly escalating cases, hours can mean the difference for a 39 Tentative data collected after the main analysis found that the time lag in November 2023 was much lower than this peak in August 2023, supporting that this may be a temporary issue. 2024 Thom CONFIDENTIAL PLTF EX-04320_0059 METANMAG-122-00085685 EMBARGOED COPY victim. Child victim information, in particular, is vital in deploying local emergency response services to safeguard that child in danger. In the last period analyzed, we observed a decline in how many reports from Facebook and Instagram included information other than an escalation summary, such as chat logs. Although tentative checks against the latest data suggest that this recent drop in informativeness from Instagram and Facebook may be temporary, 40 all such inconsistencies or gaps in report detail may hinder analysts or investigators from providing support to victims. In contrast, reports from Snapchat have seen some improvements in the information that reports provide with the addition of small chat excerpts or other information about the victim, although limitations remain. The causes of many of these changes in report quality or responsiveness are unclear. Such changes and inconsistencies could affect the ultimate value of such information for victim identification and safeguarding. They also highlight the importance of transparency regarding future shifts, particularly because recent and upcoming shifts towards more end-to-end encryption 41 might decrease the amount of (or the informativity of) reports. 40 Preliminary checks of data from November of 2023 suggest a return to the practice of including additional context into escalated reports. 41 https://about.fb.com/news/2023/12/default-end-to-end-encryption- on-messenger/ 2024 Thom CONFIDENTIAL Fig 6c | Trends of data quality Whether reports have escalations and/or additional chat information Escalation summary AND additional information provided Escalation summary only, no additional context Facebook 400 300 Instagram 200 70 60 50 Snapchat 40 30 20 10 0 100 0 2021-11 160 140 120 100 80 60 40 20 0 2021-11 2022-02 2022-02 2022-05 2022-05 2022-08 Trends in Financial Sextortion | Platform Reporting Landscape 31 2022-11 Report period 2022-08 Report period 2022-11 Unescalated conversation logs/excerpts Unescalated data with only report text 2023-02 2023-05 2023-08 2023-02 2023-05 2023-08 2021-11 2022-02 2022-05 2022-08 Report period 2022-11 2023-02 2023-05 PLTF EX-04320_0060 METANMAG-122-00085686 EMBARGOED COPY Trends in Financial Sextortion | Platform Reporting Landscape 32 There are Many Points Where We Would Expect to See More Reports Than We Do However, one should not give scrutiny only to the platforms that report the most, but also to platforms that report less than expected. Examining the number of times specific platforms are mentioned in public reports as compared to volume of reports made to NCMEC by the individual ESPs offers one tentative way to estimate how many reports one might expect. Figure 6d shows a distribution over how often platforms are mentioned in sextortion "cases submitted to NCMEC by the public (via public form Fig ód | Platform mention in public reports Platforms mentioned 30 or more times in sextortion cases Instagram Snapchat Wizz WhatsApp Gchat Facebook Discord Omegle Wink EMBA 0 500 1000 1500 2000 2500 3000 Number of reports mentioning platform (including those outside the sampling periods) or hotline) over the last three years, as logged by NCMEC analysts 42 - it shows that Snapchat is mentioned almost as often as Instagram, and that there are a range of platforms that are mentioned more than 20 times in any direct reports to NCMEC.43 In this data, we see gaps between how many reports of sextortion an ESP submits to NCMEC, compared to how often that ESP is mentioned in public reports. For example, while Snapchat was mentioned nearly as often as Instagram and far more than Facebook in public reports, report volume directly from the platform is less than half that of Facebook and a sixth as many as Instagram (35.4 sextortion reports from Snapchat per week, to 98.5 per week from Facebook and 229/week from Instagram), although there are tentative indications our checks of recent November 2023 data suggesting an uptick in Snapchat reporting. Similarly, Discord was mentioned in public reports at a somewhat similar pace to Omegle, Wizz, and Wink (all being mentioned in sextortion reports roughly once every two weeks) and half as often as WhatsApp, but Discord submitted 22 reports of sextortion to NCMEC in the periods we sampled, whereas the other platforms submitted either one or zero reports. 44 Table 1 below provides those numbers, ordered by the ratio of the number of reports submitted each week per public mention a rough way of approximating whether they are submitting as many sextortion reports as one might expect. Importantly, lower rates than anticipated by comparing public and ESP reports could have several reasons. Some platforms may be better at proactive detection, so that they can find cases even if the victim did not report. Some parts of the sextortion experience may be more likely to be reported by the victim (e.g. children may be more likely to report to platforms where imagery was posted or threatened to be posted). Most importantly, however, some platforms may not have reporting flows that 42 NCMEC analysts coded all public reports that they analyzed (not just those within the time samples we focused on) in terms of the platforms used, and so we use that data here in order to have a larger sample size for this discussion. 43 "Other" contains platforms with less than 20 mentions, including Telegram, Kik, Skype, Yubo, Tiktok, Twitter. 44 We should note that some companies are not based in the US, such as the France-based Wizz app, and thus may report to other agencies. 2024 Thom CONFIDENTIAL PLTF EX-04320_0061 METANMAG-122-00085687 EMBARGOED COPY Table 2 | Comparison of reporting rates to mentions Platform mentions in all public sextortion reports, compared to ESP report Trends in Financial Sextortion | Platform Reporting Landscape 33 Instagram Facebook Snapchat Discord Google Wink Omegle WhatsApp Wizz 229.19 98.5 35.44 1.38 0.25 0.06 0.06 0.06 0 Average reports per week made by platform Average mentions per week 28.32 1.19 26.61 0.61 1.46 in public reports Ratio of ESP reports to platform mention in public reports 8.09:1 82.61:1 1.33:1 2.27:1 Ratio of ESP reports to platform mention in public reports Average reports per week made by platform Average mentions per week in public reports EMBARGOD No reports were submitted by Wizz. 2024 Thom CONFIDENTIAL 0.54 1.58 0.49 1:8.33 1:25 0:1 Discord Wink WhatsApp Facebook Snapchat Google Omegle Wizz NMOHS Discord Google Wink Omegle WhatsApp Wizz PLTF EX-04320_0062 METANMAG-122-00085688 Trends in Financial Sextortion | Platform Reporting Landscape 34 EMBARGOED COPY allow victims to easily make these reports and convey that sextortion is occurring, or may fail to pass along the data clearly to NCMEC. It is important for platforms to examine aspects of reporting and moderation processes to make sure that victims of sextortion are heard and reports are escalated appropriately to get victims services in these high risk cases of exploitation. necessary, both because many victims will not report it and in order to potentially prevent sextortion from occurring. SARGOED We should note that financial payment platforms may also report to NCMEC. These platforms play a valuable role in combating financial sextortion, especially through enhanced signal sharing between these payment companies and other platforms involved in sextortion. We observe sextortion reports from PayPal Inc., which includes both Venmo and PayPal. However, many other financial service companies are not registered to report to NCMEC, or do not make substantive reports. For example, our analysis does not have any reports from Block Inc., which includes CashApp, the most commonly mentioned payment platform in sextortion reports we examined. While some cases of sextortion over a payment platform may not be easily detectable, the value of PayPal reporting sextortion instances underlines that there are actions that can be taken to keep children using financial platforms safe, whether through reporting to the CyberTipline or through other ways to respond in a targeted way to sextortion. In addition, public reports will not fully encompass the scale or platform landscape of sextortion cases as we know many victims of sextortion do not report their experiences. Only 43% of 13-17 year-old children who had experienced blackmail or threats reported it to a platform in a recent survey: 45 an older survey specific to sextortion found that 21% of victims of sextortion 46 reported their experience to a website/app and 16% to law enforcement. This means that proactive detection of sextortion may be 45 Thorn (2023). LGBTQ+ Youth Perspectives: How LGBTQ+ Youth are Navigating Exploration and Risks of Sexual Exploitation Online. https://info.thom.org/hubfs/Research/Thom_LGBTQ+Youth Perspectives... June2023 FNL.pdf 46 Wolak, Janis and David Finkelhor 2016 "Sextortion: Findings from a Survey of 1,631 Victims." https://www.thorn.org/wp-content/uploads/2016/08/Sextortion Report.pdf PLTF EX-04320_0063 METANMAG-122-00085689 2024 Thom CONFIDENTIAL EMBARGOED COPY Trends in Financial Sextortion | Conclusions 35 Conclusions We hope that the findings throughout this report inform better awareness of the issues and better prevention efforts addressing sextortion. Here are some specific ways that our findings might connect to further action: 2024 Thom Though common, financial sextortion does not exclusively target children who have shared an intimate image, and use of genAl technologies may lead to an increase in these cases. This study shows the majority of financial sextortion is enabled by catfishing of teenage boys. However, it also highlights several techniques being leveraged to threaten victims without them needing to share an image directly. Reports of account hacking and use of generativeAl technologies to create (or threaten to create) photorealistic explicit imagery were also identified. While discussing the risks that come with a decision to share intimate images remains an element of many safeguarding conversations, perpetrator tactics no longer exclusively rely on a victim sharing imagery. Acknowledging these additional tactics is critical to effectively combating financial sextortion and preventing the weaponization of intimate imagery to silence and isolate victims. Financial sextortion relies heavily on inflaming a victim's fears around the impact of having their nudes exposed, such as that they would go viral or send the child to jail. This study showed those perpetrators targeting victims for financial sextortion regularly employ language that focuses on extreme outcomes to the victim. In addition, they attempt to keep the victim silent and isolated by using countdowns and rapid, repeated, messaging, reducing the likelihood for the victim to get help. The potential of viral spread of images, prosecution, and other life-altering outcomes are being weaponized in these cases. Groups working on prevention efforts should consider such fears during prevention campaigns and care must be taken to avoid messaging that overly relies on negative outcomes and the permanence of these outcomes, instead ensuring messaging includes opportunities to act to reduce negative outcomes and reduces the shame of victimization. In addition, the velocity of these cases demands proactive safeguarding on these topics so young people are empowered with the knowledge that deliberate attempts may be made to isolate them. CONFIDENTIAL PLTF EX-04320_0064 METANMAG-122-00085690 2024 Thom EMBARGOED COPY Trends in Financial Sextortion | Conclusions 36 Perpetrators of financial sextortion often leverage accounts that pose as children or hacked child accounts. While progress has been made by some platforms in limiting how adults can contact children on their social media platforms, a significant portion of financial sextortion threats are originating from accounts that appear to be other children, thereby evading basing platform safeguards that prevent accounts that identify as adult to interact with minors. It is essential for platforms to develop and implement safeguards for these contexts, where systems designed for detecting and limiting contact from suspicious adults might not be effective. Financial sextortion is a global phenomenon. We have observed that perpetrator groups from some countries are targeting victims other than English-speaking children. Detection tools, moderation endeavors, and prevention messaging should avoid focusing too narrowly on English when addressing sextortion issues, keeping the global nature of this issue in mind. Currently available data limits our ability to explore the efficacy and extent of proactive detection practices vs user reporting direct to platforms. The reports made to the CyberTipline by ESPs can originate from both user reports to the ESP and proactive detection practices. Unfortunately, we are unable to differentiate which reports come from which source in this study, thereby limiting our ability to fully explore opportunities for increased impact. This distinction becomes particularly important as shifts towards end-to-end encryption may put a halt to some forms of proactive detection and many platforms have highlighted the reliance on user reporting to ensure these environments remain safe. It is important to have transparency regarding whether planned changes will have large impacts on sextortion prevention and reporting. Reports from the public concerning financial sextortion suggest a far wider list of impacted platforms than are actively reporting to the CyberTipline. Platforms play a vital role in combating online child sexual exploitation. However, worryingly, this report highlights that there are many platforms where sextortion is occurring but for which few reports are submitted. CONFIDENTIAL PLTF EX-04320_0065 METANMAG-122-00085691 EMBARGOED COPY Trends in Financial Sextortion | Conclusions 37 Platforms should ensure they have clear policies prohibiting the use of their service for the purposes of sextortion and have scaleable content moderation tools and workflows that can enforce such policies. In addition, platforms should explore ways to optimize reports to the CyberTipline for maximum impact on child safety. Finally, platforms should work closely with experts in the child safety space and other members of industry to stay current on the evolving tactics being leveraged in these cases. Intelligence sharing across the ecosystem can accelerate and improve detection of such abuses, creating safer online places for young people. Financial sextortion continues to be a major issue, and it is important to have resources available that can address financial sextortion and help children. Some important resources are provided below: Resources for those experiencing sextortion or worried about their imagery: https://report.cybertip.org/ (or contactgethelp@ncmec.org or call 1-800-THE-LOST) Internationally: https://www.inhope.org/EN#hotlineReferral https://www.stopsextortion.com/ https://nofiltr.org/resource/what-is-sextortion/ EMBARGOED Resources for those worried about their imagery being shared: https://takeitdown.ncmec.org (for minors) https://StopNCIL.org (also for adults) https://www.ncmec.org/gethelpnow/isyourexplicitcontentoutthere Additional resources and information on sextortion: https://www.ncmec.org/theissues/sextortion • https://www.thorn.org/research/grooming-and-sextortion https://www.fbi.gov/how-we-can-help-you/scams-and-safety/common-scams-and-crimes/sextortion NCMEC Connect Sextortion module https://connect.missingkids.org 2024 Thom CONFIDENTIAL PLTF EX-04320_0066 METANMAG-122-00085692 THORN thorn.org | info@thorn.org 2024 Thom CONFIDENTIAL ncmec.org NATIONAL CENTER FOR MISSING & EXPLOITED CHILDREN PLTF EX-04320_0067 METANMAG-122-00085693