UMass’s Rescue Lab uses GeoIP2 to Help Rescue Children from Abuse

Leveraging the strengths and understanding the limits of IP geolocation, the Rescue Lab plays a critical role in rescuing children from online sexual exploitation crimes.

Warning: The following article discusses child sexual abuse and may be disturbing to some readers.

The scale of the problem is staggering. Every month, more than 800,000 people share images and videos of children being sexually abused. The sharing of these images is a re-victimization of the abused, haunting them well into their adulthood. And the investigation of sharing by law enforcement has time and time again led to the rescue of a different child being actively abused. The sheer volume of child sexual abuse materials being shared online poses what was, for many years, an impossible logistical challenge.

The issue isn’t a lack of people who care. The problem is one of sorting. If there’s a pool of 800,000 potential cases, all of which occur in the geographically nebulous space of “the internet,” how do you distribute these cases among the thousands of people—law enforcement officers—who have devoted their lives to fighting child sexual abuse? Without a method to effectively sort investigations into geographical jurisdictions, the cases are unmanageable. Figuring which of these offenders may be in your area would be like looking for a needle in a haystack.

“What do you do with an IP address if you don’t have MaxMind?”

Prior to the Rescue Lab’s involvement, the process was inefficient. If a law enforcement agency received a tip about child sexual abuse materials being shared online, they could usually track down an IP address. “But what do you do with an IP address if you don’t have MaxMind?” asked Professor Brian Levine of UMass. It could take many days of work to investigate, gather evidence, and subpoena billing records from an ISP, only to find that the offender wasn’t in your jurisdiction at all. You could forward the case to the proper jurisdiction, but it would be hard to justify investigations of this kind with no guarantee that many days of investigative labor would have any bearing on the officer’s local community. A law enforcement officer could sort through thousands and thousands of cases without finding anything that they were empowered to act on. In order for agencies to effectively take action, you would first need to direct the cases to the people empowered to take action.

“One of the first things we did ten years ago when we got started was use MaxMind,” Prof. Levine remembers. The researchers at UMass’s Rescue Lab realized that if they could help law enforcement accurately sort cases to the proper jurisdiction, they could drastically magnify the effectiveness of law enforcement. “It may seem too simple, but it’s just critical. If you don’t know where to send a case, what can you do?”

This was, in and of itself, an important forensic tool for law enforcement agencies. Suddenly, a much larger proportion of the cases could be accurately delegated to the proper investigative authorities. Beyond the immediate application of determining jurisdiction, GeoIP2 data has helped the Rescue Lab better analyze the problem of child sexual abuse material file sharing. MaxMind’s data has allowed Prof. Levine and others to measure the geographic distribution of online, public crimes against children over time, and helped measure the rise of mobile networks in these crimes. This research has helped to inform policy and the strategies law enforcement agencies take to protect children and rescue them from abuse.

“We’ve always known about the limitations of IP geolocation.”

As powerful a tool as IP geolocation is, it is critical to use the tool correctly, and the Rescue Lab is keenly aware of its limitations. “We’ve always been very careful in our training of law enforcement officers to be clear about the tool’s limitations,” Levine recalls, “If anything, we ask them to treat the data as less accurate than it really is, because we don’t want people to make mistakes with it. Forensic tools are just the start; they can’t be used in isolation, and they have to be coupled with properly trained investigators.”

The Rescue Lab is careful to ensure that its partners understand that IP geolocation data, even data that is as maintained and accurate as GeoIP2, will never be able to link an IP to something like a street address. Taking the next step in rescuing a child from abuse requires steps beyond MaxMind and Rescue Lab tools. For example, to discover a street address investigators require days of work following proper legal process, including subpoenaing an ISP and performing other kinds of investigative research. Rescue Lab’s tools don’t remove the need for thorough, careful investigations; they just ensure that those investigations can be carried out successfully by the people who can act on them.

Making a measurable impact on children’s safety

Over the last ten years, the forensic tools developed by the Rescue Lab have found their way into daily use in every US state and by many federal agencies that investigate crimes against children. Using GeoIP2 data, these tools have resulted in the rescue of hundreds of sexually abused children. If you would like to support the critical work of the Rescue Lab, you can make a tax deductible donation or learn more on their website: .