Fighting Child Exploitation

“I would just encourage parents to talk to their kids. Start early with age-appropriate conversations.” - Debbie Garner Share on X

Technology is a double-edged sword. It can empower us, connect us, and solve problems, but it can also be used to exploit, manipulate, and harm. When it comes to protecting children online, that line gets especially thin. Digital forensics, AI-powered image classification, and global law enforcement collaboration are now essential tools for keeping families safe in a world that moves faster than most of us can keep up.

Debbie Garner knows this world intimately. She’s a retired Special Agent in charge with the Georgia Bureau of Investigation and former commander of the state’s Internet Crimes Against Children Task Force. For years she led efforts to track down online predators and bring justice to survivors. These days she’s working in the private sector, serving on the boards of Raven and Revere Technologies, pushing for smarter tech solutions and stronger training to support those still on the front lines.

In this episode we talk about the growing problem of online child exploitation, the reality of underfunded cybercrime units and the ways technology is being used to fight back. Whether you’re a parent, an educator or just someone who cares about kids online, you need to hear this.

“There’s this element now where you don’t necessarily have to know your abuser. Predators online will lie and manipulate a child to victimize them in a variety of different ways.” - Debbie Garner Share on X

Show Notes:

[00:58] Debbie shares her law enforcement background over 30 years. She even worked undercover buying crack!
[02:19] She spent the last 8 years of her career as the Supervisor Special Agent in charge of GBI's Child Exploitation and Computer Crimes Unit.
[02:45] Now that she's retired from law enforcement, she works in the private sector with technology companies.
[05:36] It's become her passion, even in retirement, to help those who are victims of exploitation.
[07:09] Most children are victimized by someone they know. There's also plenty of predators online.
[08:55] There are multiple organizations that work on child exploitation investigations.
[10:53] People in law enforcement do tend to prioritize these types of crimes.
[12:12] We talk about how the investigations begin.
[13:53] Cases have increased from 2400 tips a year to over 30,000.
[15:17] There's never enough technology to keep up with the increase.
[16:41] RAVEN is a lobbying group to request additional funding from Congress.
[18:33] With over 30,000 tips last year Georgia made over 450 arrests.
[22:13] There's now technology that will help find CSAM on phones. There are also some amazing investigations on the dark web.
[25:15] OSINT is helping investigate and it's a collaborative community.
[27:55] Channels to report exploitation. Start with the platform, then National Center for Missing and Exploited Children, and law enforcement.
[31:34] Don't put images on the internet. Websites like Take It Down can help with images of underage people and Take It Down can help adults.
[33:43] Always mention if the person is underage when you make a report.
[34:10] Talk to your kids and start early with age appropriate conversations about CSAM.

“In Georgia, the number of cyber tips that we received doubled about every two years. And the resources absolutely have not kept up. In fact, they have not increased at all.” - Debbie Garner Share on X

Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes and leave a nice review.

Links and Resources:

Transcript:

As many know, technology both enables crimes and helps combat them. Digital forensics, AI for image classification, and collaboration between law enforcement agencies globally is becoming exceedingly vital to provide practical safety advice for families navigating today’s complex online world.

Today’s guest is Debbie Garner. Debbie is a retired GBI special agent in charge and former Georgia ICAC Task Force Commander, leading efforts to combat child exploitation. Now in the private sector, she advocates for tech-driven law enforcement solutions and robust technical training and serves on multiple boards, including Raven and Revere Technologies. I’m your host, Chris Parker, and this is the Easy Prey Podcast.

Debbie, thank you so much for coming on the Easy Prey Podcast today.

Can you give myself and the audience a little bit of background about who you are and what you do?

I suppose most of my career was spent in law enforcement with the same agency. I worked for the Georgia Bureau of Investigation for a little over 30 years, and during that time, I had a variety of assignments. I started out as undercover narcotics. They hired me straight out of college, they trained me for about seven weeks, and I drove all over the state of Georgia buying crack undercover in my personal car for $17,000 a year.

I started out as undercover narcotics. They hired me straight out of college, they trained me for about seven weeks, and I drove all over the state of Georgia buying crack undercover in my personal car for $17,000 a year. --Debbie… Share on X

That was my entrance into law enforcement, and I did that for about four years. That position doesn’t exist anymore. But from there, I went to the other end of the spectrum. I worked in healthcare fraud for many years. I worked in our state fusion center and helped manage the terrorism intelligence component of our fusion center here in Georgia.

I helped manage our Atlanta field office for a couple of years, and they basically investigate all types of crime—rape, robbery, homicide, political corruption, officer-involved use of force. But the last eight years of my career, I spent as the supervisor, the special agent in charge over GBI’s Child Exploitation and Computer Crimes Unit, and whoever holds that position in the GBI is also the ICAC commander for the State of Georgia, so the Internet Crimes against Children Task Force, I was the commander of the task force in Georgia for the last eight years of my career, and by far it was my favorite assignment.

I retired a few years ago, about three years ago, and since then I’ve been working in the private sector, mainly with technology companies who make tools and software solutions that help us in the fight against child exploitation and other crimes.

How did you originally get into law enforcement? Is that what you went to college for, or was that just an opportunistic job?

I wanted to be a pilot in the Air Force, and I was an Air Force ROTC in college. I found out I was too short. I ended up not going into the Air Force, but had a conversation with the cadre there. I didn’t want a normal job. I wanted something exciting and adventurous. We settled on changing to a criminal justice major.

I majored in criminal justice at the University of Georgia. I had to do an internship in order to graduate and did my internship with the GBI (the Georgia Bureau of Investigation). About six months after my internship, I was hired to be a narcotics agent. And that’s how my career started.

I didn’t grow up wanting to be in law enforcement. I don’t have a familial connection to law enforcement, but I didn’t want a normal job. I’ll admit I’m a little bit of an adrenaline junkie, wanting something a little bit out of the box and exciting, and that’s what I got.

I can see that there’s no way that an in the field law enforcement officer is anything but different every day.

It was absolutely different every day. I loved almost every minute of my law enforcement career.

What caused the transition into the child exploitation area?

I was promoted into that position. Admittedly, I had never really worked specifically child sexual abuse material cases or online child sexual exploitation cases. I had to learn from the people that I was supervising.

I did that by asking a lot of questions, taking training. I read lots of case files. We had sworn special agents as well as digital forensic examiners in that work unit. Again, I asked lots and lots of questions.

I will say that it is probably the only time in my career where I consistently felt as though we were really, really making a difference and arresting real bad guys on a regular basis. It has become my passion, even in retirement, to continue to help those that are still working those types of investigations.

Were you working many of those investigations pre-internet or has most of it been post-internet? When I was a kid, it was always the stranger danger until they realized, gosh, most child exploitation is by friends and family. The impression I get is with the Internet that has now shifted back to the concept of it’s less likely to be someone who’s a familial. But I may be wrong in this area.

It’s all of that, unfortunately. When I started at the Child Exploitation and Computer Crimes Unit, it was in October of 2013. We used online child exploitation on the Internet. Prior to that, the law calls it child pornography. We prefer to call it child sexual abuse material. But child pornography was traded via the mail—hard copy photos, CDs, things like that—until the Internet and those things, for the most part, went by the wayside.

As far as the type of criminal, the type of predator, most children are victimized by somebody that they know. Moveover, there’s this new element now—I guess it’s not new anymore—of you don’t necessarily have to know your abuser. There are plenty of people, predators online, who will lie, manipulate a child, in order to victimize them in a variety of different ways, whether that’s asking them to send intimate photos or monetarily.

There are a number of ways children can be victimized, not just online sexual exploitation, but a variety of ways. Yes, the predators are online, but I am not going to discount what used to be familial and people in the community. That still absolutely occurs.

Just a resources thing in terms of how law enforcement’s involved. My basic understanding of law enforcement is back in the day when it was mostly mail that becomes local and federal, because it’s crossing state lines, so to speak?

The postal inspection service used to be one of the main law enforcement entities that worked child pornography or CSAM investigations, because it was going through the mail. Now, there are several agencies or task force programs that really are the ones in the United States that concentrate on working CSAM-related investigations.

The FBI, HSI, Secret Service all have an element that works child exploitation investigations. However, really in the United States, most CSAM investigations are worked by state and local law enforcement who are part of the Internet Crimes Against Children Task Force program, which is a federally-funded task force program.

There are 61 ICAC task forces across the country. They receive federal funding as well as hopefully other funding from their states, from their agencies, in order to manage and coordinate the ICAC Task Force program and investigate CSAM related investigations. It really is local, state, and federal all working together, and even globally, international law enforcement, because these crimes don’t have a border. The Internet is obviously global, therefore these crimes are global. It really is one of the most collaborative law enforcement efforts in the world.

Is this one of those types of crimes, like I’ve heard having interviewed lots of people in law enforcement with respect to fraud. There are a lot of challenges working with counterparts in other countries because less of a priority or hey, the perception, well, maybe one of the people involved in the crime was here. We don’t feel that it was perpetrated here, it was perpetrated there. Therefore, we’re not going to provide the resources. It’s just one of those areas of crime where nobody is willing to say, yes, this is okay, or no, we don’t want to do something?

I’m not going to say that doesn’t happen. Across the globe, priorities are different. However, when you’re talking about the sexual abuse of children, people and law enforcement do tend to prioritize this particular crime. I’m not saying that’s always the case, but everyone feels equally that it’s as horrific a crime as you can commit. As far as working together across jurisdictional boundaries, that actually does happen.

Now, as far as here in the United States, for the most part—again, this is a generalization, it’s not always the case—law enforcement and the ICAC task force have agreed that whoever has the perpetrator, the suspect, will be the main law enforcement entity that works an investigation. However, our main goal is to identify victims and safeguard those victims. That is also a priority.

We end up having to work together because it’s very common to have a suspect in one jurisdiction and victim or multiple victims in across other jurisdictions. So we have to work together.

Does it tend to be the investigations started based off of a victim? Or they started based off of we found material with this particular individual and then going out trying to figure out who the victims are? Or is it a little bit of both?

It’s both, but the way that most of the ICAC task forces get their cases is from the National Center for Missing and Exploited Children.

I’ll back up even further from that. There is federal law that requires Meta, Snap, Comcast, Microsoft, Google, any Internet Service Provider or the apps on your phone, to report instances of child exploitation that they find on their platform to the National Center for Missing and Exploited Children. They’re not required to look for it. But if they find it, they have to report that.

Now, many of them do look for it, and they’re good. And that’s a whole different conversation. They report it to the National Center for Missing and Exploited Children, who then triages it, adds information to it, and then passes that—they’re called cyber tips—to one of the 61 task forces across the country.

Now, they also refer cases internationally, and they refer cases to federal law enforcement as well. But for the most part, most cyber tips that are actionable are sent to one of the ICAC task forces across the country.

I’ll tell you about the increase in that number. When I started in 2013 in Georgia, we were receiving approximately 2400 cyber tips a year, from the National Center for Missing and Exploited Children. Last year, they received over 30,000 cyber.

If you go on the National Center’s website, there are a lot of stats. You can see the total number of cyber tips that are being reported. Most of them are from Internet Service Providers. Some are from the public, but most are from Internet Service Providers. That number has increased dramatically. In Georgia, the number of cyber tips that we received doubled about every two years.

Oh my goodness. Have the resources that you guys have to work with, have those doubled every two years?

Absolutely not. In fact, they have not increased at all. Federally, the ICAC program is still funded at the same rate as it was when it was founded. It was founded way before I took over as commander in 2013. While we did receive additional funding each year in Georgia, for the most part, it did not keep up with the number of increases in cyber tips.

Across the country, ICAC task forces are grossly under-resourced. In Georgia, we were fortunate enough where the GBI supplemented, paid for all of our salaries, our equipment, that sort of thing. The ICAC task force funding that we received paid for software tooling, training of local law enforcement. There are things that funding paid for, but there were never enough people. There’s never enough technology to keep up with the influx of cyber tips. That’s true today across the country.

So for the vast majority of the local chapters, so to speak, for the most part they’re underfunded.

Absolutely.

Is there a push to increase funding? Clearly the groups want to increase funding, but is there a grassroots effort to increase funding?

Interestingly enough, when I retired from law enforcement, there were several other ICAC commanders who retired around the same time. There were several that had been retired for a few years and still working in the space like I do. We all formed a group, a lobbying organization called Raven. Raven was created to lobby Congress for additional funding for the ICAC task forces.

Now, we are retired cops. We did not know how to lobby Congress, but we did what we always had done, and we figured it out. We’ve been in existence for about two years, and we have become a resource on Capitol Hill for lawmakers in this particular area.

They had heard from NCMEC about the increase in cyber tips. They had heard from organizations like Thorn. Those are great organizations, but they had never heard from law enforcement and how all of the work that’s being done in the space trickled down to law enforcement who then did not and does not have enough resources to actually work all of the cases that are being provided to them.

The system in place is good. However, at the end of the line where law enforcement is, there are not enough resources to work all of the cases. So, Raven formed and we also help lawmakers with legislation that helps make these types of investigations easier and helps make the Internet safer.

If you know just from your experience, just roughly, what percentage of the cases and the tips result in an arrest or resolution?

I’ll give you Georgia stats. I don’t know across the board, but from what I’ve heard, it is very similar across the country. Last year or the year before, Georgia received over 30,000 cyber tips and made a little over 450 arrests. That is good, but there was so much more work. It’s not because they aren’t trying, it’s not because they’re not working. There’s literally not enough time in the day, or the week, or the month, or the year to work all of the cases that they’re getting.

Now, admittedly, I don’t want to leave people with a misconception. Thirty thousand cyber tips to Georgia, some of those can be closed because there’s not enough information in them to initiate an investigation. Some of them may be age-difficult, some of them may not rise to the level of a crime in Georgia. Some of them are closed automatically. But Georgia hovers around 450 arrests a year. I know that it seems really there’s a large discrepancy, but that’s as much as they can do.

I assume each tip is not necessarily an isolated case, in that there may be 10 tips all involving the same incident or the same perpetrator.

If we’re talking about technology, that is one of the things that NCMEC is now trying to help with because all of the cyber tips used to be pushed to us individually.

Sometimes we would say, oh, these cyber tips are related, but NCMEC actually has some technology that they’re using that will now help deconflict or group some cyber tips together, whether it’s same or similar victims, or the same suspects. They can do that in a variety of ways using technology, whether it’s IP addresses or phone numbers or email addresses. There are ways to group those together, and they’re doing that now. So yes, there are some cases that involve multiple cyber tips.

Can you talk about some of the technology that’s now being brought to bear on this issue?

Absolutely. We’ve talked about the scope of the problem but how technology helps us fight back. I work with a lot of digital forensics companies, and they are doing everything from mobile phone forensics to camera forensics, to car forensics. All of those things can be related to these types of investigations.

They’re recovering deleted data. They’re looking at geolocation, photos, chats, all of those things. I’m a huge proponent of digital forensic examiners, and I am their champion. I lovingly call us all nerd cops. But digital forensics technology, AI and machine learning, is really taking hold and helping with this crime with regard to image classification.

Say an examiner downloads a phone and is looking for CSAM on a phone. It used to be that they would literally have to scroll through tens of thousands of pictures on a phone and manually find those. There is technology now that will help them find that imagery, whether it’s hashing technology or artificial intelligence. We have databases of known imagery. Those things are definitely helping in this particular arena.

If you talk about things like undercover operations, sometimes we can tell when people are trading child sexual abuse material. We are learning how to go onto the dark web and conduct investigations there. There’ve been some amazing investigations on the dark web. Those are, super briefly, some of the ways that technology is being used in this particular crime.

Collaboration is key. Law enforcement, working with the tech companies to say, hey, these are our challenges. This is what we need. Then training providers, training people to use these tools, how to conduct investigations on the dark web. So all of those.

Is there much collaboration with the OSINT community? I remember there was a campaign from an app maker, basically saying anytime that you go into a hotel room, take a picture of the hotel room. It gets uploaded to a database. Now we have backgrounds that can be identified in abuse photos.

The OSINT community is heavily involved, especially in finding missing children who are disproportionately victimized in the trafficking world. The OSINT community is heavily involved in finding missing children. They are very, very good at that.

There is absolutely some collaboration between OSINT technology companies, OSINT practitioners, law enforcement, even the examiners and investigators. For law enforcement to have all of those skills, whether they’re a sworn badge and gun toter whose specialty is in search warrants and conducting interviews to the digital forensic examiners who are looking at the data from mobile phones, to OSINT practitioners who are conducting investigations online trying to find bits and pieces of where someone may be, all of those things have to have to go together.

Thank God. It really is an interesting collaborative community. Even in my 30 years in law enforcement, this particular crime type and the nerd cops that help investigate, the ones that understand technology, it is an incredibly collaborative community.

There are places where they congregate, whether it’s the digital forensics Discord server, whether it is LinkedIn. There’s a huge digital forensics and OSINT community on X, and some of them are migrating to Bluesky. There are lots and lots of places where they collaborate and learn from each other, not just collaborate about cases, but, hey, I learned how to do this, and I wanted to share it because I know it’ll help other people.

We’ve mostly been talking about what happens after the fact, after the exploitation happens. Is there technology being worked on to try to prevent and detect stuff earlier in the process?

I guess I’ll go to the trust and safety community with that answer. Almost all of the Internet Service Providers have a trust and safety department lane working unit within their company that basically tries to make their platforms safer. Some do a better job than others. That’s also something that Raven works on and helps others understand. But they do use technology to find this content on their platform, whether it’s photos and videos, whether it is chats inside of their messaging platforms.

There is technology that is helping find this content, but also a lot of those providers are implementing education campaigns. I know Snap has one that has recently come out, trying to educate and put safeguards in place for kids and parents online.

Again, some of them can do better. That’s also another podcast. Some of them can do better, but many of them do have these departments in place to at least try to help with those things.

I guess it’s maybe the same question. If parents, friends, or people want to report either actual exploitation or suspected exploitation or attempts, what’s the best channel to go out reporting?

I’m going to give you a few different answers. If it’s on a platform, say it’s on Instagram, there are in-app reporting features and they need to do that, especially if it’s underage. They need to report that to the platform because we want the platform to preserve that, but also take it down so it’s not still out there causing harm to someone.

You can report it to the National Center for Missing and Exploited Children. You can do it on your phone, you can do it on your computer. There is a cyber tip line reporting mechanism on their website. You can also report to local law enforcement. Those are all places where if someone is being victimized. Or even if you find illegal imagery, those are all places where you should report.

Because you’ve worked on the investigative side, are there things that people should include in those reports that they might not think to include in those reports that would be helpful for the investigation?

I’m going to say as much information as possible. Sometimes people don’t understand that that law enforcement, while if you are being victimized, say it is a sextortion, maybe you have sent intimate imagery to someone and now they are trying to get something from you, whether it’s more intimate imagery or money or something like that, cease all contact, but save the accounts, the images, the chats, all of that.

Law enforcement’s going to need that in order to help you. While we don’t want you to continue contact, we do want you to save anything that we may be able to use to identify who is doing this, to help make a case about what they did, to build a story. Sometimes people don’t. They feel like they want it deleted, they want it off their phone. I understand that feeling. But in order for law enforcement to do their job, they’re going to need that.

Particularly on platforms where messages can be deleted, I suppose.

Absolutely. There are times where in certain circumstances, law enforcement can obtain that information from the Internet Service Provider, but not always. So it’s best to save everything for law enforcement.

And be able to have dates, times, time zones, places. Be as specific as possible.

Absolutely. And accounts, what account was messaging you. Did they send you pictures? Did they ask you to go to another platform? Are there multiple platforms involved? All of that will be needed.

Got it. You talked about people wanting the initial responses. I want to delete stuff as quickly as possible because I just don’t want it out there.

They’re embarrassed, yeah.

And I get it. Totally makes sense. On the flip side of that in terms of when material is already out there and being distributed, how difficult is it to get that material taken down?

We used to tell kids, everyone, that once it’s out on the Internet, you can’t get it. It is too late. There are systems in place where you can have your images removed. If you are underage and your images are on the Internet, the National Center for Missing and Exploited Children will help you get those taken down off of the Internet.

If you Google ‘take it down,’ their website is actually missingkids.org. If you Google NCMEC or National Center for Missing and Exploited Children and ‘take it down,’ that is where you can go to have your images taken down. Now, if you’re an adult, It’s ‘stop non-consensual intimate image abuse,’ and it is stopncii.org. If you’re an adult, they will help you get your images taken down. There’s also one in Canada, and I always forget the name of it. But there are ways for you to get your images taken down.

There is legislation moving through Congress right now called the Take It Down Act. There will be requirements for individual platforms to create processes where you can more easily have your images taken down. However, if you are underage and you notify a platform that you are underage and you need this image taken down, it’s normally taken down. If they don’t, there are some penalties that they’ll have to pay.

I guess that’s one of those things that if the person is underage, make sure to mention that in the report, that way it’s clear from the beginning.

Yes.

Are there any other particular resources or technology we should be aware of?

I think the only thing is if we’re talking about CSAM and prevention of things like this happening, I would just encourage parents to talk to their kids. You start early with age-appropriate conversations. Again, the National Center on their website, missingkids.org has videos and talking points for all things, not just CSAM-related, personal information, bullying, and all sorts of things for you to talk to your children.

There’s also an organization in the UK called IWF. They have some really great talking points as does Thorn here in the United States. If you are struggling with how to start the conversation, there are places online that will give you conversation starters, and videos that you can show your children that are age-appropriate. I suppose that would probably be the only other resource that I would encourage parents to go to.

I suppose just for individuals, if any conversation or any communication is getting weird, block the person.

Absolutely. You do not have to continue that conversation, and I would encourage you to not continue that conversation. Simply block the person and have no more contact with them.

That’s probably a good starting point if something starts to go weird, just don’t even have the chance of it getting further.

I do think some people have a problem, like just stopping a conversation and doing that. But I guarantee you’ll feel a whole lot better and you won’t have to worry about it anymore.

If people want to connect with you online, either they want to help or they have questions, what’s the best way for them to get a hold of you?

I’ll give you two resources. I’m on LinkedIn fairly heavily, and it’s Debbie Garner. You’ll know it’s me because one of the first words in my tagline is Nerd Cop. You can also email me at [email protected]. I work for a digital forensics training provider. We are very involved in mental wellness as well as training digital forensic examiners to do some of the things that we’ve talked about today.

And just as an aside, for people that are in your field, this content in these situations have to put an emotional toll on people in the field. Are there resources for people in this field to get help as well?

Absolutely. In fact, people can reach out to me about that as well. There is an organization called the Innocent Justice Foundation, and they have a program called Shift. They provide wellness and resiliency training to law enforcement who work these types of investigations. The training is free because they receive federal funding from the ICAC Task Force program to provide this resiliency training to law enforcement.

There are also resources online from them, but if someone is struggling, they can certainly reach out to me and I will absolutely help them. There are plenty of people in this space that will talk to them, care providers, as well as people who have been there, law enforcement who have been through this, that will absolutely be willing to talk to someone.

Great. Debbie, thank you so much for coming on the podcast today.

Sure. I enjoyed it.

Thank you for listening to this episode of the Easy Prey Podcast. If you found something this episode beneficial, please share it with a friend and leave a review at easyprey.com/review. Notes in a transcript of this episode with Debbie Garner can be found at easyprey.com/273. This has been the Easy Prey Podcast, defending against scams, one episode at a time.

mobile-menu

mobile-search

Show Notes:

Links and Resources:

Transcript:

Logo

Show Notes:

Links and Resources:

Transcript:

Leave a Reply Cancel reply

Logo

Get Notified

When we release new episodes

Are you safe or at risk? Find out.

Hire Me To Speak

Privacy Policy

The Way We Use Information

Our Commitment To Data Security

Affiliated sites, linked sites, and advertisements

Changes to this policy

When we release
new episodes