Operation Chemosh: how encrypted chat groups exchanged emoji ‘stickers’ of child sexual abuse

11 December 2019
News Article
Press Release/News

This News/Press release is about Cybercrime

View all crime areas

A successful operation in encrypted chat groups has been carried out by Policia Nacional of Spain.  The investigation, begun in 2017 and led by the Central High Tech Crime Unit, has led to search and arrest actions in Spain, Italy and France.

In total there have been 33 investigations launched from Operation Chemosh with 26 of those begun in Spain. Notably the average age of those arrested in Spain is 22 due to many of those investigated being minors. Europol supported the investigation with analytical support, secure exchange of information and coordination between Spain and the target countries within Europe through the Joint Cybercrime Action Taskforce (JCAT). The Joint Cybercrime Action Taskforce (JCAT), at the European Cybercrime Centre (EC3) is a group of specialist international cyber investigators.  It is specially designed to assist in such investigations and played an important role in supporting the investigation.  

The case was brought to the attention of the Policia Nacional through a report from the public about children forming WhatsApp groups to create and exchange child abuse material.  That exchange included creating emoji ‘stickers’ of child sexual abuse and other extreme material that were subsequently widely distributed.  Breakoff groups from this one were formed and involved minors and adults with a sexual interest in children. The initial group exchanged messages mostly in Spanish and the intelligence gathering led to arrests in countries where Spanish is widely used with many being outside the EU.

Fernando Ruiz, Interim Head of EC3:  “This investigation is an excellent example of how contributions from the public can develop and ultimately lead to children being made safe as a result.  The work done by the Policia Nacional, infiltrating the chat groups and discovering how the network continued to developed is central to their success in this case.  It is very concerning that those involved at the outset were minors.  It makes clear that law enforcement must work hand-in-hand with parents and children to ensure that children act as responsibly in cyberspace as we expect them to in the real world.  The fact that all this activity took place through encrypted messaging reinforces the importance of law enforcement being able to have lawful access to such spaces and the communications in them.”