From 2 to 4 July 2025, the CyberSEE joint project of the European Union and the Council of Europe, in cooperation with the International Centre for Missing and Exploited Children (ICMEC), organised an Advanced Regional Training on investigating Online Child Sexual Exploitation and Abuse (OCSEA) in Bucharest, Romania, as a follow-up to the Regional workshop on OCSEA held in Rome, in November 2024.
Some 31 investigators and digital forensics specialists from South-East Europe and Türkiye joined forces with peers from several GLACY-e project countries and experts from the Romanian Police for enhancing their skills in detecting and investigating OCSEA within peer-to peer (P2P) networks.
The three-day training event blended theoretical notions with hands-on exercises to strengthen participants' capabilities in detecting, analysing, and investigating online child sexual exploitation offenses. The sessions focused on the operation of platforms like BitTorrent, the use of forensic tools such as RoundUp Torrential Downpour and its Receptor counterpart, and the application of investigative protocols for digital evidence collection and analysis. Case reviews using ICACCOPS data provided practical exposure to real-world investigations.
By the end of the course, participants will have developed solid understanding of child sexual and abuse materials (CSAM) distribution mechanisms, along with technical competencies in IP tracking, port forwarding, file hashing, and the use of netstat. They gained familiarity with the structure and function of torrent files, trackers, info hashes, and the sharing process, including the significance of file pieces and seeding. The training also offered hands-on experience with µTorrent and the ability to identify digital trace evidence such as search terms and shared files on suspect systems.
Furthermore, participants increased knowledge on how to operate specialised tools like RoundUp Torrential Downpour, understanding their capabilities, investigative protocols, and integration with T.I.P.S. (Torrents In Plain Sight) for data collection. They also explored how info hashes are generated and used in law enforcement to identify new torrent files. Through case reviews and tool-based investigations of BitTorrent and eMule, they enhanced their ability to assess P2P activity and are now equipped to launch new investigations into CSAM distribution within their own jurisdictions.
This activity directly supports the effective implementation of the Convention on Cybercrime (Budapest Convention) and its Second Additional Protocol by enhancing the ability of criminal justice authorities to investigate and prosecute online child sexual exploitation and abuse cases.
The Cybercrime Programme Office remains committed to supporting criminal justice authorities in building regional cooperation, enhancing investigative capabilities, and strengthening their capacity to address online child exploitation.
Cybercrime Programme Office (C-PROC)