Tip brings Internet porn bust

The numbers behind an international child pornography bust Wednesday were themselves disturbing: Nearly 2,400 suspects from 77 countries allegedly paid to view videos depicting sexual abuse online. But the nature of Internet traffic makes it sadly unsurprising that people would figure they could hide so much hideous material.

Finding and stamping out such content “is needle-in-a-haystack work,” said Carole Theriault, a security consultant with Sophos PLC in London.

Austrian authorities said an employee of a Vienna-based Internet file-hosting service approached his national Interior Ministry last July with word that he had noticed the pornographic material during a routine scan.

The videos showed “the worst kind of child sexual abuse,” said Austrian Interior Minister Guenther Platter, citing the rape and sexual abuse of girls and boys younger than 14. At times the children could be heard screaming.

Lead investigator Harald Gremel said the videos were online for at most a day before they were discovered. The Austrian Internet service employee blocked access to the videos while recording the computer addresses of people who tried to download the material, and gave the details to authorities.

Within 24 hours, investigators recorded more than 8,000 hits from 2,361 computer addresses in 77 countries around the world, including the United States, according to Gremel.

In another sign of the ring’s international tentacles, Gremel said investigators believe the videos were shot in Eastern Europe and uploaded to the Web from Britain. A link to the videos was posted on a Russian Web site, which is no longer in operation, and hosted on a server in Austria. Some of the material was free, but the Russian site charged $89 for access for a “members only” section, Gremel said.

Why did finding this take what would seem a lucky break by a network administrator? Because everything traversing the borderless Internet looks the same while in transit. Whether it’s a mundane e-mail or videos as insidious as this, all traffic gets splintered into packets of data that don’t identify what they contain.

Consequently, unless a nefarious Web site advertises itself with spam e-mails or shuttles an inordinate amount of traffic, several factors can conspire to keep it in the shadows.

For example, Theriault noted that the perpetrators could send footage over peer-to-peer networks or computers that had been surreptitiously co-opted by Internet worms.

“You could have this stuff on innocent machines and the owner wouldn’t even know it,” Theriault said. “It can get ugly and complicated, absolutely.”