How violent porn sites manage to hide information that should be public


Private investigator Garth Bruen can't reliably determine who owns and operates disturbing Web sites because of the cloak of anonymity enjoyed by many businesses online. Bruen says he thinks that sometimes privacy goes too far. (Michele McDonald/For the Washington Post)
December 6, 2013

Researcher Garth Bruen long has investigated the seamier corners of the Internet, but even he was shocked to discover Rapetube.org, a site urging users to share what it called “fantasy” videos of sexual attacks.

Bruen gradually discovered dozens of similar sites offering disturbing variations — attacks on drunken women, on lesbians, on schoolgirls — to anyone with a credit card. Some made clear that the clips were fictional, but other sites had the word “real” in their titles. At least a few touted videos that he feared might show actual crimes.

Sickened, Bruen tried to determine who operated the sites, a first step toward possibly having them shut down. But he quickly hit a wall: The contact information listed for Web sites increasingly is fictitious or intentionally masked by “privacy protection services” that offer ways around the transparency requirements built into the Internet for decades.

That is especially true for sites offering illicit or controversial content, studies have found. As a result, although governments have increasingly powerful tools for tracking individual behavior on the Internet, it’s harder than ever for private citizens to learn who is responsible for online content, no matter how objectionable.

To Bruen, this is the dark side of Internet privacy.

“That’s not privacy. That’s secrecy,” said Bruen, 42, a security fellow at the Digital Citizens Alliance, a Washington-based advocacy group that combats online crime. “That’s corporate secrecy.”

The desire for sunshine is at odds with the libertarian ethos of cyberspace, where free speech often has been understood to include the freedom to share content anonymously. Bruen seeks a finer line that, while shielding personal conversations and other private behavior, would demand those selling content to accept a measure of accountability by making their identities known.

That long has been required by the Internet Corporation for Assigned Names and Numbers, a California-based nonprofit group that, under contract with the U.S. Commerce Department, has broad authority over the issuing of Web addresses worldwide. The group, typically called by its acronym, ICANN, requires that site operators provide “accurate and reliable contact details” but has struggled to enforce compliance amid the transnational lawlessness of cyberspace.

An ICANN study released in September found massive problems with contact information throughout the Internet. Among “adult” Web sites, nearly half used services to mask the identities of site operators or listed no contact number at all. When investigators attempted to reach site operators whose numbers were listed, the effort was successful for less than 6 percent of the “adult” sites surveyed.

“In principle, the information is supposed to be accurate,” said Stephen D. Crocker, chairman of ICANN’s board. Yet he acknowledged that it often is not, with the “dark corners” of the Internet most resistant to efforts at accountability.

For Rapetube.org, the official contact information listed a man with an East Asian last name, a French phone number and an e-mail address issued by a Chinese company. When Bruen sent e-mails, they bounced back as “undeliverable.” When he called the phone number, nobody answered.

Still, whoever operated the site remained active, promising in text posted amid pictures of bound, sometimes bloodied women that there would be “regular updates” to what it claimed was “the biggest rape porn site for violent sex videos.”

Transparency vs. privacy

Transparency was built into the Internet from its earliest days, when site operators needed to reach one another to resolve technical problems. That led to the creation of the “Whois” database, a consolidated source of contact information that became a popular tool for police, journalists, political activists and companies looking to combat abuse of their brand names and registered trademarks.

When activists against domestic violence in 2001 discovered a site called wifebeatersunion.com — it featured an animated image of a fist punching a woman’s face — there was enough information available to lodge complaints that eventually got the site shut down.

“It felt really good to take some action,” said Cindy Southworth of the National Network to End Domestic Violence. “If there is horrible, hateful content out there, it would be useful to know who hosts it.”

More recently, pressure from activists and advertisers persuaded Facebook in May to crack down on what it called expressions of “gender-based hate.” But such tactics have little chance of success when protesters can’t figure out whom to target in their protests.

The declining reliability of the Whois database is quietly embraced by many privacy advocates, who see the forced provision of contact information as contrary to free speech protections. U.S. courts recognize a right to speak anonymously as central to the First Amendment, on the grounds that voicing controversial ideas can be dangerous.

“We benefit from creating breathing room for anonymous and pseudonymous content,” said Eric Goldman, a law professor at Santa Clara University, in Silicon Valley. “Some categories of highly valuable information to society are especially susceptible to legal threats, and allowing content publication without attribution can help that content see the light of day.”

But courts also distinguish among kinds of speech, with pornography receiving less protection than, for example, political commentary or literature.

Most nude images of people younger than 18 are illegal to record, share or view. Some activists for women’s rights in recent years have been pushing for legal sanctions against non-consensual pornography — often called “revenge porn” — in which pictures or videos of sexual acts are uploaded to Web sites after a relationship ends, typically to embarrass a former romantic partner.

“Here we have images of private people,” said Danielle Citron, a law professor at the University of Maryland. “The public has no legitimate right to know about that.”

In a world of more than a billion smartphones, clips of sexual encounters recorded by bystanders are also increasingly appearing online. Some of these depict consensual acts, but others are from assaults, as was the case with video last year of a 16-year-old girl in Steubenville, Ohio, who was raped while intoxicated.

But if Web sites show videos of attacks that are not real, there are few practical legal restrictions.

When asked about sites that feature “rape porn,” the FBI said in a statement: “These types of Web sites are not unknown to law enforcement. We use a variety of operational strategies to combat this problem and remain committed to identifying those people who would exploit children. In terms of other types of pornography (other than child pornography) that would draw FBI scrutiny — we make that determination on a case by case basis.”

Rapetube.org appeared to operate in this gray area, as part of an extreme niche within the multibillion-dollar online porn industry. Sites offering what they describe as “fantasy” videos of sexual assaults receive little attention from law enforcement or the kinds of activist groups that track child pornography. Determining the amount of money involved — or even who receives the profits — is made difficult by the sketchy information available in the Whois database.

Archived versions of Rapetube.org carry claims that the people depicted are professionals who are at least 18 years old. “We do not condone non-consensual sex,” it says. “This site is about ROLE PLAYING FANTASY only and performed by professional actors and models.”

Elsewhere, however, the site makes clear that any registered user can upload content. “Submit your own videos, rate the vids you watched and join the community. Enjoy your stay! Bookmark Rape Tube!

Many of the videos listed on archived versions of the site carried a simple, two-word description: “Real rape."

A deepening concern

Bruen, a father of two, has degrees in criminal justice, public policy and software engineering and is an elected user representative to an ICANN advisory board. He runs a small security-research firm called KnujOn.com — “no junk” spelled backward — out of a Tudor-style house shaded by maples in suburban Boston.

KnujOn, which grew out of work Bruen did in a previous job as an IT manager for a state agency, investigates sources of spam, those solicitations that jam e-mail inboxes worldwide with offers of easy money or discounts on drugs such as Viagra.

During one investigation, Bruen came across hundreds of sites — featuring pirated software, unlicensed pharmaceuticals and get-rich schemes — registered to a name, Henry Nguyen Gong, with an address and phone number supposedly based in France. Both the Web address and the privacy protection service came from a domain registrar, Bizcn.com, headquartered in the coastal Chinese city of Xiamen.

As Bruen searched for other sites registered to the same person, he was startled to find Rapetube.org. The images and descriptions Bruen found there only deepened his concern, prompting him to complain to ICANN and raise questions about the site in an e-mail to the organization’s chief executive, Fadi Chehade. Bruen eventually would file more than 1,400 complaints against Bizcn.com about flawed information on sites registered to Henry Nguyen Gong. They were among more than 8,000 complaints Bruen filed to ICANN about faulty contact information in one four-month period last year.

Chehade replied warmly, at one point saying in an e-mail to Bruen, “I appreciate your dedication and commitment to the ICANN community.” But ICANN’s compliance staff rejected 11 percent of his 8,000 complaints, mostly on the grounds that the filings “lacked sufficient detail;” for the other 89 percent, Bruen received no response at all, he said.

When Bruen requested a review of the cases from ICANN’s in-house ombudsman, the ombudsman wrote in a report, “There is no substance to the complaints” and ruled the contractual requirement that sites provide “accurate and reliable contact details” did not mean that the information had to be “verifiable.”

Bruen was more angry than surprised at the outcome. ICANN has repeatedly voiced support for transparency and required domain registrars — the companies such as GoDaddy and Enom that sell Web addresses — to collect contact information on site operators. Their contracts give ICANN authority to suspend registrars that failed to do so, but enforcement has been lax for years, according to experts and studies.

Investigators from the Government Accountability Office in 2005 submitted error reports to ICANN about 45 randomly selected Web sites that had “patently false” contact information, including phone numbers listed as “(999) 999-9999” and postal codes as “XXXXX.” After 30 days, the errors remained for 33 of the sites, nearly three-quarters of those checked.

“ICANN has not enforced these rules. Enforcing these rules is hard. . . . It would be a lot easier to ignore the problem,” said Benjamin G. Edelman, a Harvard Business School professor and former ICANN employee, who once testified to Congress that the Whois database was “substantially fiction.”

Those seeking to falsify contact information once favored fanciful names, such as Mickey Mouse and Donald Duck. Now they increasingly rely on “privacy protection services” that typically are offered, for a small fee, by the same domain registrars that sell Web addresses. These services are supposed to furnish contact information upon request, but in practice, they rarely do, according to Bruen and other critics.

The ICANN report in September found that the use of such services was “very high” or “extremely high” for sites featuring pornography, financial scams and unlicensed pharmaceuticals. For legal pharmacies, law firms and executive search consultants, the use of “privacy protection services” was much less common.

Suddenly, it’s not there

The FBI and other law enforcement agencies around the world have lobbied ICANN to create a more accurate, accessible Whois database to assist their investigations. Even the domain registrar’s industry group, the Domain Name Association, has endorsed the idea of a more accurate database, at least in concept. The association also has argued that more rigorous record keeping would add to the costs for registrars if they have to verify identities through passports or other official documents. Buying a new Web address now typically costs less than $15 a year.

“You’ve got to make the process transparent. You’ve got to make sure it’s policed. And we think it’s ICANN’s role to do so,” said Adrian Kinderis, chairman of the Domain Name Association.

Efforts by The Washington Post to reach the operator of Rapetube.org, based on the information on file in the Whois database, were no more successful than Bruen’s. Calls were not answered. E-mails were returned as undeliverable. Efforts to mail a letter failed because the listed address in Nimes, a city in southern France, is on a street that does not appear to exist.

The domain operator, Bizcn.com, had no additional information on Gong and was not aware of having been contacted by ICANN about problems with sites registered in his name, said Wu Weiqiang, a product manager for the company. “We are just the domain registrar, and it’s hard for us to tell who is behind a Web site.”

For months, Bruen continued to periodically check the Whois database to see whether the contact information for Rapetube.org had been corrected. It never was. But after Bruen expressed his frustration publicly, in a post on his personal blog in September, Rapetube.org suddenly went dark. Instead of images of naked women with gags in their mouths or shackles on their bodies, error messages appeared.

He wasn’t sure why, although he guessed that some Internet providers had quietly blacklisted the site, making it impossible for users to access it.

A few days later, with Rapetube.org still offline, Bruen decided to see how many similar sites were still online by running a search for Web addresses with the word “rape” in their names. He quickly found more than 40.

“There’s really a commercial interest in promoting this material,” Bruen said, “and it’s much, much bigger than I thought.”

The sites carried links to one another, allowing customers to have access to several for a single payment, but they also appeared to compete. One site bragged: “This is, without a doubt, the sickest and most depraved rape fantasy content I have EVER seen. . . . Even if you are a seasoned fan, like me, you may STILL come away shocked.”

Again, the contact information was of little use, with most sites listing only a “privacy protection service” run by their domain registrars. Nearly a year after discovering this extreme pornographic niche, Bruen was little closer to learning who operated the sites.

Julie Tate, Michael Birnbaum in Berlin and Guo Chen in Beijing contributed to this report.

Follow The Post’s new tech blog, The Switch, where technology and policy connect.

Craig Timberg is a national technology reporter for The Post.
SECTION: {section=business, subsection=technology}!!!
INITIAL commentConfig: {includereply=true, canvas_permalink_id=washpost.com/8bvh5zpd9k, allow_comments=true, commentmaxlength=2000, includeshare=true, display_comments=true, canvas_permalink_app_instance=bg52e9xhqr, display_more=true, moderationrequired=false, includefeaturenotification=true, comments_period=14, defaultsort=reverseChronological, canvas_allcomments_id=washpost.com/km4ey0dajm, includevoteofftopic=false, allow_videos=false, includesorts=true, markerdisplay=post_commenter:Post Commenter|staff:Post Writer|top_commenter:Post Forum|top_local:Washingtologist|top_sports:SuperFan|fact_checker:Fact Checker|post_recommended:Post Recommended|world_watcher:World Watcher|cultuer_connoisseur:Culture Connoisseur|weather_watcher:Capital Weather Watcher|post_contributor:Post Contributor, childrenitemsperpage=3, includeheader=true, includeverifiedcommenters=true, defaulttab=all, includerecommend=true, includereport=true, maxitemstop=3, source=washpost.com, allow_photos=false, maxitems=15, display_ugc_photos=false, includepause=true, canvas_allcomments_app_instance=6634zxcgfd, includepermalink=false}!!!

UGC FROM ARTICLE: {allow_comments=true, allow_photos=false, allow_videos=false, comments_period=14, comments_source=washpost.com, default_sort=, default_tab=, display_comments=true, is_ugc_gallery=false, max_items_to_display=15, max_items_to_display_top=3, moderation_required=false, stream_id=}!!!

FINAL commentConfig: {includereply=true, canvas_permalink_id=washpost.com/8bvh5zpd9k, allow_comments=true, commentmaxlength=2000, includeshare=true, display_comments=true, canvas_permalink_app_instance=bg52e9xhqr, display_more=true, moderationrequired=false, includefeaturenotification=true, comments_period=14, defaultsort=reverseChronological, canvas_allcomments_id=washpost.com/km4ey0dajm, includevoteofftopic=false, allow_videos=false, includesorts=true, markerdisplay=post_commenter:Post Commenter|staff:Post Writer|top_commenter:Post Forum|top_local:Washingtologist|top_sports:SuperFan|fact_checker:Fact Checker|post_recommended:Post Recommended|world_watcher:World Watcher|cultuer_connoisseur:Culture Connoisseur|weather_watcher:Capital Weather Watcher|post_contributor:Post Contributor, childrenitemsperpage=3, includeheader=true, includeverifiedcommenters=true, defaulttab=all, includerecommend=true, includereport=true, maxitemstop=3, source=washpost.com, allow_photos=false, maxitems=15, display_ugc_photos=false, includepause=true, canvas_allcomments_app_instance=6634zxcgfd, includepermalink=false}!!
Comments
SECTION: {section=business, subsection=technology}!!!
INITIAL commentConfig: {includereply=true, canvas_permalink_id=washpost.com/8bvh5zpd9k, allow_comments=true, commentmaxlength=2000, includeshare=true, display_comments=true, canvas_permalink_app_instance=bg52e9xhqr, display_more=true, moderationrequired=false, includefeaturenotification=true, comments_period=14, defaultsort=reverseChronological, canvas_allcomments_id=washpost.com/km4ey0dajm, includevoteofftopic=false, allow_videos=false, includesorts=true, markerdisplay=post_commenter:Post Commenter|staff:Post Writer|top_commenter:Post Forum|top_local:Washingtologist|top_sports:SuperFan|fact_checker:Fact Checker|post_recommended:Post Recommended|world_watcher:World Watcher|cultuer_connoisseur:Culture Connoisseur|weather_watcher:Capital Weather Watcher|post_contributor:Post Contributor, childrenitemsperpage=3, includeheader=true, includeverifiedcommenters=true, defaulttab=all, includerecommend=true, includereport=true, maxitemstop=3, source=washpost.com, allow_photos=false, maxitems=15, display_ugc_photos=false, includepause=true, canvas_allcomments_app_instance=6634zxcgfd, includepermalink=false}!!!

UGC FROM ARTICLE: {allow_comments=true, allow_photos=false, allow_videos=false, comments_period=14, comments_source=washpost.com, default_sort=, default_tab=, display_comments=true, is_ugc_gallery=false, max_items_to_display=15, max_items_to_display_top=3, moderation_required=false, stream_id=}!!!

FINAL commentConfig: {includereply=true, canvas_permalink_id=washpost.com/8bvh5zpd9k, allow_comments=true, commentmaxlength=2000, includeshare=true, display_comments=true, canvas_permalink_app_instance=bg52e9xhqr, display_more=true, moderationrequired=false, includefeaturenotification=true, comments_period=14, defaultsort=reverseChronological, canvas_allcomments_id=washpost.com/km4ey0dajm, includevoteofftopic=false, allow_videos=false, includesorts=true, markerdisplay=post_commenter:Post Commenter|staff:Post Writer|top_commenter:Post Forum|top_local:Washingtologist|top_sports:SuperFan|fact_checker:Fact Checker|post_recommended:Post Recommended|world_watcher:World Watcher|cultuer_connoisseur:Culture Connoisseur|weather_watcher:Capital Weather Watcher|post_contributor:Post Contributor, childrenitemsperpage=3, includeheader=true, includeverifiedcommenters=true, defaulttab=all, includerecommend=true, includereport=true, maxitemstop=3, source=washpost.com, allow_photos=false, maxitems=15, display_ugc_photos=false, includepause=true, canvas_allcomments_app_instance=6634zxcgfd, includepermalink=false}!!
Show Comments
Most Read Business