Three years ago, "Niki" was a typical sixth grader in St. Petersburg, Russia, who loved classical music. "Especially Beethoven," she says. But then she and her older sister, "Nadia," began posing nude for Internet sites.
"My mother was on vacation and accidentally discovered a nudist beach," explains Nadia. The next day, their mother returned to the beach--with her daughters. Nadia was then 14, and Niki was 11.
"On the beach I met an artist and started posing for him," says Nadia. "Soon I started working as a photographer's model for Internet pictures. My mother and father both knew about it and approved."
According to the girls' mother, modeling "was their decision," and "there is no particular need for the girls to work." The girls' mother is an accountant and their father a truck driver in the crumbling Russian economy. "I just want my children to be happy," she adds.
Niki and Nadia are currently working for a site called S----, one of thousands of such sites that the U.S. Federal Bureau of Investigation calls "Lolita sites." These sites feature nude photos of children, male and female, who range in age from as young as three years old to their mid-teens--when they are known as "older models." Like so many others, S---- has evaded prosecution by claiming that its images are art. Its founder, "Boris," claims to be an advocate for his young workers and says he previously ran a shelter for abused kids. Now, however, he runs at least three Lolita sites that sell pictures of nude and seminude girls 10 to 16 years old.
Boris operates from Russia and asked that his location not be disclosed, fearing economic shakedown from local authorities. Moreover, he requested anonymity because of death threats he received for turning in a photographer to law enforcement, allegedly for taking hard-core photographs of young girls. Boris employs two bodyguards.
SITE LINESDespite claims by Lolita sites that their photos of nude children in sexual poses are in compliance with the U.S. Constitution's First Amendment and the U.S. Child Pornography Protection Act of 1996, in many cases they are not. "As a general matter, it is unlawful to portray children in sexually explicit poses," says Jodie Kelley, a First Amendment attorney at Jenner & Block, a law firm in Washington, D.C. "The pivotal point," she says, between lawful and unlawful is "the lewd exhibition of the genitals," a standard that applies "even if the children are clothed."
Yet, violations of this standard are rampant--and not just by Lolita sites. When Red Herring clicked on a link from the index site Illegalheat.com, we were taken to Pedoland, a site displaying images of boys and girls as young as four years old engaged in various sexual acts with adults. In addition to its "Dads and Daughters" and "Men and Boys" series, the site promises its members "more than 5,000 new photos and movies never seen before." On a different visit to Illegalheat.com, Red Herring clicked on a link to Sexteens and found photographic images of very young girls with adult males. One child, about three years old, held a cookie in one hand and an adult male in the other. In other photos, a child about eight years old lay naked, blindfolded, and tied to a table.
In an investigation of Lolita sites, Red Herring uncovered highly organized commerce--possibly illegal--involving credit card firms like Visa and MasterCard, Web communities like Yahoo Geocities and Eccentrix Dot Com, third-party credit card processors like iWest and BillCards, online advertisers like Chevron and Orbitz, and Web-hosting companies like Verio and UUNet, a subsidiary of WorldCom. Thanks to the Internet's capabilities for distribution and e-commerce transactions, this dirty business has brazenly exploded into an eerily efficient and highly profitable industry.
The victims of this trade are children, many of whom live in poverty in the former Soviet Union. According to Boris and sources close to the child pornography industry, young girls can earn up to $300 monthly for posing as nude models. But not all of them: "Most Lolita sites are a very dirty business," Boris admits, explaining that he launched his first site in August 2000, when he paid a photographer to supply him with 400 pictures of naked children. "Webmasters pay the girls $25, without their parents' permission," he says. "They go to a local forest and shoot pictures and the Webmaster makes $10,000 from the photos." The owners of these sites, however, can make a king's ransom. "Some of these Russian sites make $30,000 to $40,000 per month," says Kevin Bell, a spokesperson for the U.S. Customs Service in Washington, D.C. "In the screwed-up Russian economy, just one month of that is enough to survive on for years."
The U.S. Customs Service estimates that there are more than 100,000 Web sites offering child pornography--which is illegal worldwide. Revenue estimates for the industry range from about $200 million to more than $1 billion per year. These unlawful sexual images can be purchased as easily as shopping at Amazon.com. "Subscribers" typically use credit cards to pay a monthly fee of between $30 and $50 to download photos and videos, or a one-time fee of a few dollars for single images.
When Red Herring clicked on the Join Now! buttons of child porn sites, we were taken to order pages displaying the logos of Mastercard, Visa, and other credit cards. These payment pages are managed by credit card-transaction and online-billing companies. Membership payments for a site called Illegal.cp ("cp" is pedophile parlance for child pornography), which showed a young girl of about seven years of age engaged in fellatio with an adult, were managed by iWest, a transaction-processing company that, according to its domain registry, is based in the British Virgin Islands. Payments for Susalda Is Awesome, a similar hard-core site, were managed by ElfaCom, an online-billing company based in Moscow.
Depending on the degree of knowledge and complicity of involved parties, like Webmasters, hosting companies, and banks, nearly everyone associated with the creation, transmission, and distribution of online child pornography could be prosecuted. "Nobody is immune," warns Bruce Taylor, president and chief counsel for the National Law Center for Children and Families, an organization that assists those who enforce state and federal obscenity and child exploitation laws. A former prosecutor for the U.S. Department of Justice's Child Exploitation and Obscenity Section, Mr. Taylor predicts that the needed crackdown could include legitimate businesses that thus far have turned a blind eye to their role in this illegal industry. "These companies sometimes think they're more insulated if they don't monitor their servers," he says.
THE NAME GAMELolita sites operate in plain view and can be located by performing a simple Web search. Red Herring found more than 4,400 Web sites containing "Lolita" in their name, many of them registered by legitimate domain registry companies. Take Register.com. Included among the 3.5 million names it has registered in the last two years are Web addresses like Goodlolita.com and Sweetboys.com.
"We shouldn't be making decisions on offensive site names and we don't set standards," says Register.com spokesperson Shonna Keogan. "We're not supposed to judge the future content of a site by the domain name."
Ms. Keogan claims that Register.com uses filtration software to scan for unacceptable terms it will not register, but "Lolita" is not one of them. Meanwhile, Childpornsite.com and Underagenymphos.com were both registered by the company.
Another domain registry company, Tucows, defends the registration of Lolita sites as an issue of supply and demand and claims that registration companies don't contribute to child pornography. "If there wasn't such a demand for Lolita sites in the U.S., do you think the Russians would be producing so much child porn material?" says Elliott Noss, president and CEO of Tucows.
According to Mr. Noss, his company registered 2 million domain names in 2000, taking about $10 per name. Tucows has registered the URLs All-CP.com and Underground-CP.com.
Law enforcement actions have not included registry companies. Ms. Kelley says that free speech issues notwithstanding, current U.S. laws against kiddie porn could be used to prosecute the Lolita sites that market themselves as child porn sites, if only for contributing to the furtherance of child pornography. A site with "illegal cp" in its name, she says, "would be unlawful. These sites would be holding themselves out as containing child pornography."
THE PERFECT HOSTOnce a domain name is secured, Lolita operators and child pornographers must find a Web-hosting service for their sites. Like other legitimate businesses involved in this industry, hosting companies typically turn a blind eye--until they are notified by law enforcement. When a hosting company is alerted to illegal materials on its servers, law enforcement will usually give it one day to investigate and shut down the offending Web site. Few, if any, host companies actively seek out illegal sites on their systems.
The reason for their lack of diligence? Money. "Porn pays," says Chris Lyman, former CEO of the Los Angeles-based hosting company Virtualis, which is now called Hosting.com. He says hosting companies could do more to cleanse their server farms of illegal material. "In an industry with narrow profit margins, hosting porn is profitable." Mr. Lyman estimates that a typical Lolita site generates $3,000 a month for the hosting company.
Red Herring tracked three Lolita sites to a small hosting company, Cove Software Systems, in Annapolis, Maryland, and found that child pornographers take advantage of automated sign-up processes, which, in effect, offer virtual anonymity.
"We don't police the sites for content," says Maureen Richter, chief financial officer of Cove. "We can't. I only have a staff of five. I'm barely making it financially. With the cost of bandwidth, there is no margin in my prices. If I raise prices to pay for someone to monitor my site, I lose customers."
An international network of Web site resellers who buy and sell leased space on hosting farms can further cloak site operators. "We have 500 customers, and they may resell to others, and on and on," says Ms. Richter. "I don't know how many actual pages we have on the servers and we don't know names, countries, or anything."
Red Herring also tracked a number of Lolita sites to Maxim Computer Systems, a hosting company in Fremont, California. Both Maxim and Cove said they coöperate with investigations of porn sites and that they will leave certain sites operational at the request of law enforcement. While law enforcement agencies won't comment on investigative techniques or ongoing investigations, one official cautions that, in general, "if a company says they are coöperating with us, it may not be true."
But not all Web-hosting companies are small and lean. Staying ahead of law enforcement, porn masters often move their sites among a number of hosting companies. Red Herring found Lolita sites at established Web hosters like Level 3 Communications in Broomfield, Colorado, and UUNet in Fairfax, Virginia, and child porn sites at Verio in Englewood, Colorado. Like many mainstream hosting oufits, these companies have policies prohibiting the use of their networks for illegal purposes and state that they will cooperate with law enforcement.
Thus far, however, these hosting companies have had little to fear from the law. "There's no one looking at the hosting companies or site operators. There has been no prosecution of these folks," admits J. Robert Flores, who at press time was awaiting Senate confirmation to become the Justice Department's Administrator of the Office of Juvenile Justice and Delinquency Prevention.
MEMBERS ONLYThe online publishing areas of member communities are fertile ground for Lolita operators and hard-core child pornographers. In community publishing areas, members themselves--not the portal site--create and control the content of their pages anonymously and for free. Yahoo, for example, does not screen materials published within its Geocities community. Thanks to automation and anonymity, illegal pictures can be ready for sale in a matter of clicks.
These sites are promoted on Lolita index sites, but frequently employ redirect services to conceal themselves. For instance, behind a straightforward URL for a child porn site may be layers of other URLs that steer traffic to an ultimate URL containing 50 or more characters of random numbers and letters and the community site's domain name. Red Herring found hard-core child pornography in Yahoo Geocities and Eccentrix Dot Com, a free Web-hosting and online community company. The PedoLand site, for instance, was found within Yahoo Geocities.
When online communities are exploited by pornography peddlers, advertisers are also dragged into the equation. In return for providing members a free page and Web-hosting services, the portal places pop-up ads on the members' Web pages. What began as well-intentioned online marketing and advertising rapidly becomes a corporate nightmare--thanks to automation and the uncontrolled editorial environment of member communities.
On repeated visits to Sexteens, a Yahoo Geocities child porn site, in March, sponsorship ads from Chevron, Continental Airlines, and ArtistDirect were just a few of the corporate messages that appeared. "We didn't even think to ask if our ads were running in unregulated areas. We're horrified," says Chevron spokesperson Bonnie Chaikind.
Chevron's banner advertisement promoting the Chevron credit card appeared beside explicit child porn images. The ad linked directly to an application for the credit card. "There is no way we would ever be tied to any subject like this," says Ms. Chaikind.
"This type of incident could happen anywhere there is automated technology, especially in a member publishing environment," says Tim Bajarin, president of Creative Strategies, an IT consultancy. "Because of the potential impact on a company's image, Yahoo has a responsibility to let the advertiser know this may happen."
But advertisers say they are not being told of the potential risk. Take ArtistDirect, a Los Angeles-based online fan club site containing concert dates, ticket information, and chat rooms. According to Jeff Rea, the company's vice president of marketing, ArtistDirect originally advertised in targeted music areas, but Yahoo put some of the ads on a "run of network" schedule, in which company ads would appear on Geocities sites. ArtistDirect's ad, featuring a picture of Britney Spears, appeared opposite explicit pictures of children as young as five years old. "If we knew that our ad would appear around this content we would not have done this," says Mr. Rea.
Ms. Chaikind of Chevron concurs: "We were never told that appearing on pornographic content was a possibility."
Yahoo spokespeople were reluctant to discuss the incidents in detail. Jackson Holtz, a spokesperson for Yahoo, says that all Geocities members have to agree to terms of service and that illegal materials like child pornography warrant closure of a member's site--if reported. Then, Mr. Holtz says, "We're committed to reviewing the content, generally within 24 hours." The company does not, however, proactively police the Geocities pages for child porn.
When asked if Yahoo tells advertisers in advance of the possibility that their ads may appear next to child pornography within Geocities, Mr. Holtz states only, "I can affirm that we have extensive contact with them." Yahoo responds to advertiser complaints by blocking ads from running on top of Geocities pages. Ads for Chevron, ArtistDirect, and others were later blocked from appearing on Geocities pages.
However, in October, nearly seven months after our inquiry, corporate sponsorship ads were still being displayed on sites containing illicit materials. On repeated visits to PedoLand, Red Herring saw ads for the health insurance provider Answer Center and the online travel agency Orbitz. Both companies condemn child pornography.
OFFSHORE CREDITS The industry that most makes online child pornography financially viable is credit card companies, their member banks, and their third-party transaction processors. On the subscription page of nearly all Lolita and child porn sites, prominently displayed, are the logos of MasterCard and Visa.
MasterCard and Visa state that they are opposed to child pornography and to their cards being used to purchase it. "We deplore it. We don't condone the use of our brand in this way," says Visa spokesperson Casey Watson. "We don't want to be associated with child pornography." When notified of potentially illegal activity, the company will take action to terminate a merchant's Visa-acceptance privileges.
The trouble is, neither Visa nor MasterCard have direct knowledge of how their cards are used. "It's our member banks' job to know what their customers are doing and how our card is being used," says Joshua Peirez, vice president and senior counsel for MasterCard.
Credit card companies and their member banks also have few ways to police transactions across international borders. Sharon Gamsin, vice president of global communications for MasterCard, says that often contradictory international laws make policing Lolita sites difficult. "If a Web site is located overseas, whose laws apply?" she asks.
Then there is the issue of drawing a line between what is art and what is child pornography. "It's somewhat less clear that the Lolita sites are actual pornography," says Ms. Gamsin. "It's a question of what's legal vs. what someone doesn't like."
Mr. Peirez concurs. "Should we [MasterCard] not be associated with companies selling cigarettes online because someone objects to cigarettes? It's a slippery slope for us to begin making moral judgements."
Many subscriptions to Lolita and child pornography sites are handled by third-party processors. If there is one link in the chain where there is direct complicity between illegal site operators and their revenue stream, this is likely it. "The credit card processors know where the material is coming from, and the identities of everyone involved," says Tom Hymes of the trade magazine Adult Video News. "If everyone in that industry was serious about this problem, they could put a huge dent in it."
The processing companies act as middlemen, steering payments upstream from subscribers through merchant banks to the credit card companies, and then downstream through merchant banks to site operators. For their trouble, processing companies can charge the site operators up to 22 percent of each transaction. Among the transaction-processing companies are shadowy organizations like SunBill, BillCards, and iWest.
Until last spring, SunBill was a major processor of Lolita site subscriptions. Its cheery umbrella logo appeared on many site subscription pages. According to Boris, SunBill ceased operations in late May out of fear of prosecution. Boris also claims that BillCards is now using Swiss banks to handle SunBill's accounts.
IWest provides another popular processing mechanism for many hard-core child sites. Sources tell Red Herring that iWest works out of Russia using the names Renville and Little Hollywood as its corporate fronts, and like many Russian sites, filters money through banks in Latvia. The iWest home page, registered to a company in the British Virgin Islands, meanwhile lists a phone number in Spain as its point of contact.
These processing companies are just as wily as the site operators themselves, working to hide their identities and purposes from merchant banks and the law. "Some billing companies create a new pseudocompany every week, just to get a merchant account, usually from an American bank," says Boris. "For each new account they set up a new company."
THE VICTIM NEXT DOORChild pornographers count not only on banks and high-tech companies as unwitting accomplices. Other times they exploit private citizens like "Bob and Carol Smith" from a small town in Pennsylvania.
The Smiths are suburban folks with an interest in literature. The couple was surprised when Red Herring called this past spring to ask why public records listed them as the owners of Celochka.com, a hard-core child site. Their personal and credit card information, they say, was stolen from an online bookseller where they shop. Unbeknownst to them, the information was being used to pay the site's host.
The couple noticed unusual charges on their credit card bill from about a dozen Internet-related companies like Network Solutions (now VeriSign), which had registered the site name, and Jettis.com, an online credit card-processing company that handles subscriptions for many legitimate adult sites. "It was sneaky," says the astonished Mr. Smith. "The first month there was only a charge for $10. But the next month, it was $500."
Jettis.com helped close Celochka.com's site, and its president, Kjell Petridis, explained that child pornographers often use stolen credit cards to set up illegal sites to exploit affiliate-marketing programs. "Many legitimate adult sites have affiliate-marketing programs that pay referring sites for subscribers," he says. In effect, the child porn sellers use illegal pictures as bait to scam pedophiles.
After viewing a page of child porn images, pedophiliac customers click to a Join Now page. But instead of subscribing to the child porn site, they're duped into joining a legitimate adult site. "The person running the child porn site is involved in an affiliate marketing program with this legitimate adult site," says Mr. Petridis. "Any click-throughs and sign-ups originating from the illegal site will get them a $30 referral fee."
The legal adult sites often lose money on the scam. When the subscriber later receives his credit card bill and realizes that he subscribed to an adult site and not a child porn site, he can refuse to pay the charge. Often, by the time the legal company finds out that an affiliate has used child porn as a scam, the legal company has already cut the referral check to the child porn operator. In some cases, the scam can generate hundreds of thousands of dollars per month.
"The freak [illegal operator] just has to hope he doesn't get caught before the check gets issued," which is usually within 7 to 14 days, says Mr. Petridis. "But even if he is, he'll just do it again under a different identity or he'll try to scam other affiliate program operators."
VICE SQUADThe duty of policing this trade falls upon law enforcement agencies that are overworked, underfunded, and often handcuffed by contradictory regulation. "Those online child porn communities are very organized. We lack resources and always seem one step behind," admits Mr. Bell of U.S. Customs.
Moreover, Lolita and child pornography sites have not been a priority, having blossomed in the midst of the standoff over the venue-dependent definitions of art vs. pornography. For example, what might be considered a crime in Georgia may not be considered one in California. "We won't investigate if [the Department of Justice] won't prosecute," says FBI special agent Pete Gulotta.
Most law enforcement agencies have focused their precious resources on apprehending "travelers," pedophiles who meet children online and then arrange a real-world rendezvous. The FBI and U.S. Customs Service tend to take action against online sites only in response to complaints from Web users. Then, they order hosting companies to shut down the sites. And in the fast-moving online world, having a site shut down is a minor speed bump. Child porn Webmasters typically open new sites under different names in a matter of hours.
Given the enormous volume of child porn images online, the Feds can't fight this scourge alone. Last year, Eliot Spitzer, the attorney general of New York, secured a guilty plea from an ISP, Buffnet, for knowingly providing its subscribers with access to child pornography. Also last year, a Texas man was sentenced to 1,335 years in prison for processing $1.4 million's worth of online child porn subscriptions in a single month.
Then there's the technology community, which could police itself. In September 2000, about 200 adult site Webmasters and Web hosters gathered in New Orleans for a conference on Internet child pornography. There, Mark Ishikawa, a panel member from BayTSP.com, a software company, demonstrated a new program that could rapidly scan photo files on servers and determine if they contained child pornography. He then announced he would give the product to anyone in the audience if they would use it. He had no takers. "They are out of control," Mr. Ishikawa says, noting that he still has had no takers. "They don't think any rules apply."
Mr. Lyman, formerly of Virtualis, argues that self-policing is not as hard as many Web-hosting companies claim. "Porn takes up a lot of bandwidth and child porn typically generates huge traffic spikes. Spotting these sites isn't that hard," he says. "It's simple economics. [Child porn] creates revenue, so hosting companies turn a blind eye."
At least one company is addressing the problem. Rackspace Managed Hosting in San Antonio, Texas, enacted a zero-tolerance policy toward Lolita sites after an article in a local newspaper disclosed how the company's servers were being misused. "We proactively scan our network for words that are likely to point to sites where children are being exploited," says Graham Weston, the CEO of Rackspace. "Lolita" is one of those words.
Justice Department nominee Mr. Flores says that companies involved in supporting the Lolita and child porn industry "are all waiting to see who will take the first hit."
But they may not have much longer to wait. The U.S. attorney general, John Ashcroft, has stated that prosecuting child pornographers is a priority. Already, U.S. law enforcement is stepping up international efforts. In March, U.S. Customs worked with the Moscow police to bust Blue Orchid, a Russian child porn Web site. And Justice Department insiders point to Mr. Flores's imminent confirmation as evidence that the Bush administration will soon aggressively prosecute child pornographers. "They're just going to start prosecuting people as a deterrent," says Mr. Taylor of the National Law Center for Children and Families. "Everybody involved with the Web sites could be indicted."
BORIS'S WEB Meanwhile, Boris continues to operate, and argues that he is different from other Lolita site operators. "We're making art," he claims, and says the girls come from terrible living conditions, often from broken or alcoholic families. He rationalizes that the girls "feel better about themselves emotionally when they are naked."
Besides his freelance "models," Boris has a dozen girls under contract, with their parents' permission, he claims. He says that a typical government worker in Russia is paid $20 a month but that he pays each girl about $200 monthly. The girl keeps $50, her parents keep $50, and he keeps $100 for clothing because, he says, "you can't make good pictures with clothes that are worn out."
The girls come to his studio in teams every other weekend. They are housed in a nearby apartment. Of the two weekends per month that they visit, the girls spend one weekend being photographed, and the other, Boris claims, studying English and learning computer skills.
Subscription revenue for Lolita pictures remain the economic engine behind Boris's three business entities: a Web-design firm, a transaction-processing company, and an umbrella organization for his three Lolita sites. His goal, he claims, is to teach each girl the skills needed to hold a legitimate, professional job.
In practice though, this goal only furthers the exploitation of these young girls. Nadia, now 17 and retired from Lolita modeling, works for Boris, photographing other young models for his Web sites. And Niki, now 14, continues to model. When asked why her older sister gave up modeling, Niki laughs and says, "She's too old."
Robert Grove is a Silicon Valley-based investigative reporter. Blaise Zerega is the deputy editor of Red Herring. Write to blaise.zerega@redherring.com.