Feb 6, 2024 - Technology

Exclusive: New partnership helps domains stop child abuse

Illustration of a teddy bear wearing glasses looking at a laptop.

Illustration: Shoshana Gordon/Axios

A new partnership shared first with Axios is promising to help domain registries crack down on the spread of child sexual abuse materials (CSAM).

Why it matters: Those who host CSAM often hop between various domains, and not all top-level domain registries have the resources to pay for tools that could help them better detect when hosts change websites.

  • The partnership between the Public Interest Registry (PIR) and the Internet Watch Foundation (IWF) hopes to democratize some of the most premium detection tools.

What's happening: The PIR will soon start paying to give registries free access to two IWF tools that track where CSAM materials are shared.

  • One tool is Domain Alerts, which provides alerts to registries if they're hosting a domain that's sharing CSAM.
  • The other is access to the Top-Level Domain Hopping List, where the IWF tracks when a website operator changes domain names to circumvent detection.

The big picture: Currently, only a dozen registries take advantage of the two IWF tools, according to a joint press release announcing the partnership.

  • Registries are the organizations that operate domain name spaces, such as .com, .org and so on. Registries then sell access to those domains via retailers like GoDaddy and Namecheap.
  • The Internet Corporation for Assigned Names and Numbers (ICANN) lists well over 1,500 top-level domains that are available today.

What they're saying: "All of the dot-com, all of dot-net, there are thousands now — there's everything from dot-food to dot-kids," Jon Nevett, CEO of the PIR, told Axios.

  • "We're going to sponsor any registry that's not currently getting the alerts from IWF. We're going to sponsor them to do that for free," he said.

Between the lines: Similar to other cybercriminal sites, those sharing CSAM online often will just change the domain of their website once they're detected — although the IP address remains the same.

  • For example, someone could easily change their site from BadAbuseSite[.]com to BadAbuseSite[.]de to sidestep a complete removal.
  • And because the domain registry that runs .de websites is smaller, it might not have the financial resources to pay for the IWF's tools.

What's next: Domain name registries interested in participating in the program can reach out to the IWF to enroll.

Go deeper