How Do Pedophiles Tweet? Investigating the Writing Styles and Online Personas of Child Cybersex Traffickers in the Philippines

”Child abuse casts a shadow the length of a lifetime.”

- Herbert Wood

Cybersex or computer sex is an activity where two or more people, anonymous in some cases, connect over the Internet to engage sexually gratifying performances [1]. Activities such as sharing, watching, downloading and trading explicit online content across websites and social media platforms such as Facebook, Twitter, and Instagram are all under the umbrella term of cybersex [2]. Behaviors exhibited in cybersex activities include solitary acts of self pleasure, consensual interactions, and to coercive and forceful activities which often considered as rape [3].

In its essence, cybersex allows exploration of sexual urges and private fantasies while maintaining anonymity [4] as well as providing a safe space for physically-separated partners to connect over the Web and continue to be sexually intimate [1]. However, in a moral and ethical point-of-view, the conduct of cybersex activities should only be between consenting and legal-aged partners. Non-consensual cybersex often target extremely underprivileged women and minors where the produced media are peddled, trafficked, and sold worldwide. Although most justice and intelligence agencies in countries around the world enforce strict laws on minors involved in cybersex activities, the problem still pose as one the major challenges for poor, developing areas in Southeast Asia, Africa, and South America where they are often labelled as hotspots of child sex tourism from 2014 to 2016 [5].

For this study, we collected over 69,675 raw tweets related to child sex trafficking and peddling in Twitter from October 2019 to July 2020, over a year’s worth of data. We used a bounding-box feature from the Twitter API to capture tweets only published within the area of the Philippines. In addition, we used hashtags such as #bagets (colloquial term for the word ’children’) and #sarapngbagets (conveys sexual desire for children) which were reported to be commonly used by child sex traffickers as bookmarks or subject tags for their tweets [25]. After cleaning and removal of retweets and duplication, only 32,899 unique tweets were left for the analysis proper.

For the writing style analysis, we conduct two methods: the word cloud visualization for getting a bird’s eye view of the most frequent words present within the collected data and mapping of trigram co-occurrence network for understanding series of word connections used to spread child pornographic content.

The word cloud visualization in Figure 2 showcases top used terminologies in tweets with respect to the size of each word. The word jakol or masturbation, tamod or semen, and boso or voyeur are seemingly three of the most used words in the context of child pornography. In addition, the hashtag #alterph is also often appended in tweets to signal that the account used for uploading content is an alter account with the suffix ph indicating the user is in the Philippines and prefers interaction with users also coming from the same country. Action words are frequently used in context such as chupa or fellatio and salsal or motion of stimulating a man’s penis as well as words used for targeting children such as bagets for hire or children for hire and altergc which means alter groupchat, indicating that there are also other platforms where videos and contents are shared and not just in Twitter.

Figure 3 describes the chain reaction-like structure of words that are co-occurring or are seen together in semantically similar tweets. From a corpus containing 2,498 unique words, only three subgraphs are formed which signify that the overall lexicon used by pedophiles and child traffickers are somewhat limited in a way that terms are often reused repetitively. From the figure, the first subgraph on the upper left contains only two connected words, ctto or credits to the owner and trade. These two words describe user accounts that share tweets by giving unofficial crediting of the source of contents as well as the notion of exchanging resources by trading links of online repositories where videos are stored as seen in Figure 1. The largest subgraph in the middle, on the other hand, contains terminologies forming sequences denoting instruction for proliferation and attention such as follow and rt (retweet), dm me (message me), and follow me. And lastly, the third subgraph on the lower left with word sequence open thread to denotes the spread of content to be in the form of threads or series of posts. Overall, these subgraphs model how posts containing child pornographic content such as lewd photos and videos are structured. It also describes how users behind alter accounts sway other users to spread their malicious content by convincing them to use Twitter’s interaction features such as (a) retweets for sharing and (b) likes for increasing the exposure of the content to a wider audience.

Aside from just analyzing the overall stylistic writing patterns of potential pedophiles and child sex traffickers on Twitter, we want to understand deeper roles played by these entities in the platform. To do this, we trained a short-text clustering model using the Gibbs Sampling Dirichlet Multinomial Mixture (GSDMM) [26] trained from the pre-processed tweet corpus. The GSDMM model aggregates words into clusters or groups that are similar to each other in terms of usage and meaning. As seen in Table I, we obtained four main homogeneous clusters symbolizing four different online personas or roles played by users behind alter accounts that are tied with child pornography.

From the table, each persona has its own unique set of thematic words forming an underlying vocabulary used for specific purposes. First, we have the Propagator which is mainly responsible for spreading child pornographic content in the platform. Keywords often used by this type of user are similar to the ones highlighted in Figure 3 such as rt or retweet, follow, like, post, and comment. Next, the Peddler which is responsible for the hidden market or trading, buying, and selling of child pornographic content. Keywords often used by peddlers are dm or direct message, price, php, avail for their business transactions and looking and willing for enticing possible victims who are willing to trade sexual content such as photos and videos for money. Third, the Social acts as someone who encourages users to meet physically or digitally for activities such as jakol or masturbation. This persona often uses descriptive words such as pogi or handsome as well as semi-coercive words such as tara or let’s go and sino pwede jan? or who is available? to convince potential users having the same interests. Lastly, we have the Voyeur which often targets minors for their voyeuristic content. The main keyword used by this persona is boso or the act of spying undressed or naked people for sexual pleasure and often used in tweets with targets such as bagets or children, baby, and boys. This persona also frequently makes use of the word cr or comfort room where hidden camera are often installed.

This study makes use of extremely sensitive data involving sexual words that are often used to target minors. However, the proponents felt compelled to do this type of study as something has to be done in order to understand and be able to alleviate the problem of child pornography landscape in the Philippines. In addition, for the safety of minors, no personal information is revealed in any part of this document.

In the Philippines, child pornography and other illegal cyber-sex activities are widespread especially on social platforms like Twitter where users can hide behind anonymous accounts. In order to further gain understanding and deeper insights for the reason behind the rapid proliferation of child pornographic content online, we used three types of analysis, namely word cloud visualization, trigram co-occurrence analysis, and persona analysis. Results show basic terminologies often used by child traffickers and peddlers that often co-occur with each other. In addition, these entities can be classified into four possible roles or online personas based on their vocabulary use. Continuation of this study involve partnership with local government units concerned with cybercrime prevention and child protection to track down active child pornography peddlers and traffickers.