Wednesday 21 January 2009

The Child Exploitation and Online Protection Centre responds to request about Internet Service Provider (ISP) costs

In December 2008 the BBC submitted a request to CEOP asking for the number of requests made to ISPs and the cost of these to the organisation. The following text is the transcript of an interview given this week by Jim Gamble to the BBC in response to this. Below the text are the figures requested.

How important is internet/email data in trying to protect children?

The information that Internet Service Providers (ISPs) hold is critically important for us. Historically we’d need to put telephone numbers to people so we’d know that that call came from a particular number. Being able to identify an email address or an online transaction between people is exactly the same. This exposes to us the person who’s been involved in that communication, and if that person has been involved with some criminal intent it will help us explode out the network that they are part of and, very often in the cases at CEOP, enable us to identify, safeguard and rescue a child who’s the subject of abuse, abuse which began very often in the online environment that the ISPs deliver as part of their business.

Can you give an example?

If you’re a child in a social networking site you will expose certain information about yourself – CEOP runs online safety programmes to educate children about staying safe online - and we want children to go to those environments and enjoy them. As a predator I can go into that environment – as a customer of the ISP – and I collect information, perhaps meet the child in another part of the internet. If I then lure that child and subsequently that child is abused or reports to us, an investigation will take place. The social networking site – and I only use that as an example – is a wholly legitimate business, and one that we support. However in our case we would have to pay the ISP in many cases to identify the information that we have around the IP address. That’s anomalous in my view. I accept, as a professional police officer, that we don’t expect the online industry to behave like public servants and to do our job for us. So if I’m investigating terrorism, if I’m investigating burglary, if I’m investigating any of the myriad of serious crimes, I’d expect sensible, balanced proportionate cost recovery. Where, however, we’re engaging as a police officer in this technical, internet world which is created by industry to bring children there for advertising benefit to be accrued, then its absolutely anomalous that I would pay to allow our officers to go in there to investigate a crime properly and to make our environment safer. And a good example is that if you’re on the train travelling from London to Birmingham, the British Transport Police are there to make you safer. They’re actually paid for by the companies that operate the rail system. They won’t have to buy a ticket to get on the train - and you compare the train system to the online network; they won’t pay or have to cajole or convince the conductor to give them the information about the threatening person who’s in the carriage down the back. They recognise that they’re there to make that environment safer so that more people will feel able to use the train. So what we need to do is get the whole of the online industry – because many of them already provide this info to us for free- to get the whole industry to behave more reasonably on this particular issue. So I’m very clearly separating the two: traditional crime – those investigations that we’ve always done – of course there needs to be sensible cost recovery. But child protection within the online environment is everybody’s business and we support business in the online community. What we need to make sure that they do is to recognise the benefit that we bring to them, and we shouldn’t be paying for the privilege.

What they would say that they are companies that have to make profit, clearly, and that as they get tens of thousands of requests from police forces a year, they simply can’t afford to give the information out for free.

Well then they simply can’t afford to do business. Because at the end of the day I think I’ve been very clear: where it’s any type of ordinary criminal offence that doesn’t manifest because people have occupied the public place which is the internet, then of course we need to pay and of course if we’re diverting industry from their core business we need to recompense them for that. No argument. But where it is an online environment created by industry as a business entity, where children are encouraged to go so that they can make money through advertising, then it’s ridiculous that we would have to pay. And let me put this in context: by the end of this financial year we’ll have paid more than £100,000 to ISPs to reconcile the information we need to identify and locate and rescue children, or to identify locate and hold to account those criminals who go online and threaten children and make the online environment less safe than it should be. That could have put a number of specialists to work here – doing the right thing, making the environment safer, making it even more commercially viable. We all have a mutual interest here. And we need to work more effectively together.

Are you in a sense asking ISPs to act more as private citizens than companies, giving information as they should, than as private companies making money?

They’re always going to be private companies making money and we encourage that and - especially in today’s environment - business is something we want to thrive. But when they’re dealing with this particular issue - because it’s unique to that environment - then of course they need to think about it differently. We in CEOP, the Child Exploitation and Online Protection Centre, wouldn’t exist without our partners in industry. They help us develop an understanding of not only what’s happening today but what’s going to happen tomorrow. Within the police service we have a fabulous relationship historically with the old telecommunications companies and with the new internet service providers. Most of them - if you speak to them as parents, as members of the public, as citizens - they will tell you that they don’t understand this anomaly themselves. And we need to reconcile it, it’s not good enough. We should be paying for two extra investigators downstairs as opposed to be paying this type of money to reconcile the information we have discussed.

But the law itself allows ISPs to charge you for that service?

And the law is sensible and the law was developed having recognised the way we’ve done business in the past. So the law basically allows for reasonable cost recovery. And that’s right. I’m not saying that any of these big companies are public servants. So where we divert them from their core business, we have to recompense them. But this isn’t diverting them from their core business. Their core business, in this instance, is the online environment. Their core business is bringing customers, of whatever age, to that environment. And where those customers going into their core business area commit a crime or represent a threat of crime, then it’s ridiculous that we would have to pay to successfully investigate that to identify the predator or to rescue the child and thereby to make that a safer environment. So we’ve got to reconcile this, it’s been lingering in the margins too long. Let me be clear yet again. We need cost recovery for industry. Industry is in a very difficult place, with small companies being taken over by bigger companies, they need to reconfigure. They need to look at the system one company had in the past and make sure it works with their systems. So there is a cost. We don’t want people to lose jobs, absolutely not, so we support that. What the Home Office is doing - working with us and industry to look at a more centralised approach where we can achieve some equity, some transparency around cost recovery – absolutely all for that. The piece we’re talking about is that anomalous area in the margins: it’s about children. The new citizen that occupies the online environment in a way that perhaps you and I at our age don’t understand. These kids live there, and they live there because they’re enticed – very legitimately – because they want to go to those places that are fun, they want to use Web 2.0 and create images and share them. Other people will take advantage of that. And in the same way that we support the policing of the real infrastructure, through the trains and the British Transport Police – we need to look at a better way of supporting the policing of the online environment.

So, in a sense, what is your solution? Is it simply to play on the goodwill of the companies so they all decide not to charge or is it to get the Home Office to change the law?

I would hate to think that we would need to change the law with regard to the small area which I’m talking about. I think the law has been developed in consultation with industry and others. It makes sense to recompense a business if you force it to divert for our purposes. But where… and perhaps the easiest example is this: in the past if I made a number of nuisance phone calls to you, we wouldn’t pay the telephone company to get the information that was required to deliver what they considered to be a customer service to stop that person phoning you and find out who it was. This is no different. We don’t need new legislation, we need new thinking. We need sensible thinking. We don’t need people to throw in the red herring and say “well this is just the tip of the iceberg, next year you’ll want everything for free”, that’s not what we’re saying. What we’re saying is this: you create a public place and you have responsibilities when you do that. And you need to live up to those responsibilities, in that public place which is frequented by children.

ISPs may well take this as a personal slight. Are you prepared for those relationships to possibly grate a little after these kinds of comments?

Well I hope that the vast majority of the ISPs that we deal with recognise that. Firstly, this isn’t the first time I’ve said it; secondly, it’s absolutely not personal – we wouldn’t exist without some of the internet service providers who are out there, but we have been served a Freedom of Information request. In my view, I need to put that information into context. What I’m trying to do is to say that I don’t believe that ISPs should give us everything for free, of course not. And I’m trying to explain a particular area around child protection where they, the public and agencies like CEOP and the police service, have a mutual interest in making sure as quickly and effectively as possible we do the right thing for children. And diverting £100,000 of our budget which could put child abuse investigators in seats here isn’t the right use of our budget.

Amount CEOP has paid to ISPs in each relevant accounting period since setting up in 2006:
£171,505.99
Financial year breakdown:
Financial year 2006/2007 = £37,184.32
Financial year 2007/2008 = £69,717.46
Financial year 2008/2009 (up to Dec 08) = £64,604.21
Requests CEOP has made to ISPs for information since setting up in April 2006:
= approximately 9,400
Financial year breakdown:
Financial Year 2006/2007 Total applications = 1200
Financial Year 2007/2008 Total applications = 3600
Financial Year 2008/2009 Total applications = 4600
Total = 9400

(NB: the cost of resolving data varies according to ISP provider so these figures do not give an indication of cost per request).

Back to full list