WELSH, Ms Mary-Jane, Detective Superintendent, Cybercrime Division, Crime Command, Victoria Police [by audio link]

CHAIR: I remind committee members and officers that the Senate has resolved that an officer of a department of the Commonwealth or of a state shall not be asked to give opinions on matters of policy and shall be given reasonable opportunity to refer questions asked of the officer to superior officers or to a minister. This resolution prohibits only questions asking for opinions on matters of policy and does not preclude questions asking for explanations of policies or factual questions about when and how policies were adopted.

Ms Welsh, I also remind you that it's a public hearing, so everything you say will be broadcast. If you would like to provide confidential evidence, you are quite welcome to; just give me a heads up so we can turn off the broadcast. We have a copy of your submission. Would you like to make an opening statement?

Ms Welsh : Thank you for the opportunity to speak before you today. I'm attending today from the lands of the Wurundjeri people, and I wish to acknowledge them as traditional owners. I would also like to pay my respects to elders past and present and Aboriginal elders of other communities who may be attending the hearing.

I am the detective superintendent in charge of the Cybercrime Division, Crime Command, of Victoria Police. The division includes the Joint Anti Child Exploitation Team, referred to as the JACET, which combines the Victoria Police and Australian Federal Police investigation and response to online child exploitation. The activities of the JACET include victim identification in child abuse material, which I will refer to as CAM going forward; identification and recovery or rescue of vulnerable children from further harm; the online monitoring and investigation of offenders; and liaising with interstate and international law enforcement agencies to facilitate a coordinated response to this offending.

The global scourge of online sexual exploitation of children is growing. It is enabled by technology, and these offenders are consistently developing new and innovative ways to access children and images of children, motivated primarily by the pursuit of sexual gratification. As the viewing of these images becomes normalised and sexual arousal is more difficult to achieve, offenders often search for more graphic depictions of depravity, involving sexualised violence and torture of children of all ages. As demand for new images grows, this increases risk to children as offenders seek to create new CAM, satisfying the demand. More recently, investigators have identified a growing trend in self-generated CAM. This can involve children producing CAM in response to being groomed by offenders they meet online and other situations where children are otherwise manipulated into generating CAM for the edification of an online offender who is threatening to expose the child to family, friends or the broader online community.

The online sexual exploitation of children is also enabled to some degree by the reticence of the community to discuss these crimes openly, as they would with other crimes that harm, such as drug crimes. This limits broad awareness and the ability to educate the community about risk and how best to support children to engage with technology in safe and productive ways. Ensuring the rights to privacy, free speech and anonymity online all impact on children's safety. The exercise of balancing human rights is consequential for children, as are the decisions society must make about how and when platform providers should be held accountable for the services they provide.

The world of child exploitation online is fast moving—as fast as the growth and sophistication of the technology that enables it. Technology is increasingly enabling offenders' anonymity, agility and ability to obfuscate. Technology is also very receptive to the innovation of the user to push and pull it to their advantage. Gaming platforms, social media platforms and other such communication enablers are perfect havens for offenders to prey on children. The recent COVID-19 pandemic only exacerbated risk to children online as they were driven indoors and in front of computer screens, with social media and various communication platforms the most popular method of engagement with friends and the outside world.

A systems approach, I submit, is required to reduce harm to children online. For example, we need to broaden community awareness about the extent of the problem so that the ever-increasing harm to children enabled by technology is high profile, much like the awareness campaigns for drugs, alcohol, seatbelts, speeding and the pandemic response. Services can be provided to enable offenders and possible offenders to seek help and support to avoid further or future offending. Highly capable, well-resourced and flexible law enforcement will complement these measures. Success in responding to online child exploitation is likely or may be evident through frequent, open conversations in the home about online risk. Assistance and support to those who self-report sexual feelings towards children and reduced vectors for offending for criminals are crucial. They may be achieved through greater regulation and oversight by platform providers and greater online police presence, both overt and covert.

Police measure our own success in various ways. Firstly, and perhaps foremost, the number of children removed from harm is often identified as the key measure of success in the first instance. This is stopping the harm one child at a time. When we talk about rescuing children, we mean removing children from the reach of contact offenders in the first instance. An increase in the number of offenders identified, charged and successfully prosecuted is also highly sought after in the reduction of instances of CAM offences and the creation of a hostile online environment for child sex offenders.

We need to wrestle with conflicting human rights which occupy a central position in the existence of online child sexual abuse decisions necessary to reduce harm. These include the rights of children and the right to free speech, most particularly anonymous speech. How does this ensure that all possible is done to understand what the right balance is and how to achieve it, and how do we know when it's achieved? It would be of assistance to have a clear position on the balance between these human rights, which articulates parameters for, but also proactively supports law enforcement interventions against, those who harm children.

The Victorian police submission in this inquiry identifies factors that, if addressed, might enable a more effective law enforcement response. These include a better understanding of offender motivations, which is critical in reducing harm, and this requires ongoing research. Police require sufficient resources to meet the challenges presented by modern technology, such as encryption, which enable offending, including contemporary information technology and hardware and software which allows covert access to offenders' computers and communication devices to more effectively collect and seize digital evidence identifying offenders and children at risk. Timely access to digital evidence is a vital component of effective law enforcement. We also need specialist capabilities to be more effective—for example, victim identify case experts and covert online operatives. Easier access to Commonwealth legislation which supports covert online investigations is also critical. Victim identification capabilities, which is a unique specialty area in the policing of this offending, support our primary measure of success, which is the removal of children from harm. Investigators in this area require specific training and skills, and the outcomes in this area are dependent on healthy and active global law enforcement collaboration.

Digital evidence is also a critical component of successful policing in this area. Access to digital evidence is crucial in the production of a strong policing response to online child exploitation. Access needs to span the big communication platforms through to single devices used by individual offenders. Access to digital evidence can be supported by strong government interventions—be they law, regulations or influence at a policy level; ongoing training for police investigators and specialists; and technology, both hardware and software, to support investigations. These investigations are also being supported by maintenance of quite complex covert IT networks which must be supported by specialists in that field.

Reducing waiting times for digital evidence for communication platforms is also critical. I note that the pending act has been raised in a number of submissions to the inquiry, showing all signs of a significant step forward in this area. We certainly look forward to realising the benefits that it promises if wait times are reduced in this particular area. Thank you for the opportunity to speak, and I most certainly welcome any questions. Thank you very much.

CHAIR: Thank you for the introduction. I'll take the first few questions to ask about some of the trends that you may or may not be seeing in your investigations to help the committee prioritise what to look through. You mentioned deep fake technology in your submission—how much are you seeing? Is it a small but growing trend; and how is it being utilised to deliver CAM?

Ms Welsh : In Victoria we are not seeing high instances of deep fake. What we're seeing more of are what's being described as capping, where offenders are accessing sexual video content from individual social media platforms or webcams.

CHAIR: Just explain that to us. People are recording it with their webcam and the material is being taken—a version of spyware?

Ms Welsh : No, it's the capture and recording of self-generated sexual video content from an individual social media platform. That can be accessed via different means—for example, from a Facebook platform. Some level of deception may be used to access a person's Facebook account and then the images are accessed, captured and redistributed elsewhere.

CHAIR: So people haven't been tricked into it; they produced the material and uploaded it but with the purpose of giving it only to their select group or select network, and people are trawling through those accounts to hoover it up?

Ms Welsh : That's right.

CHAIR: Is that kind of behaviour or that kind of offending in response to anything? They're just finding that an easier way of getting material than trying to produce it in third-party countries, or it's just a new way of offending?

Ms Welsh : It's mostly the latter. These offenders are constantly looking for new vectors to access this type of material. I think that this is just another way for them to access it. The instances of self-generated CAM are also something that is a raised concern. We're seeing a lot more of this from young people. This is also often a result of grooming. They are coerced into generating this material. Once that is generated they are then very easy to manipulate for the further generation of their own or accessing other children to generate further child abuse material.

CHAIR: They're blackmailed, essentially, into producing more material?

Ms Welsh : Very simply put, yes, they're threatened.

CHAIR: We might circle back to that, but on other trends you've seen: some of our other witnesses have raised an increase in the use of cryptocurrency. Are you seeing cryptocurrency being used more as payment to procure CSM? Does this method of payment present different challenges to what investigators are used to?

Ms Welsh : I understand that cryptocurrency is being seen more in the payment for child abuse material. It comes in many, many different forms. I'm quite sure the committee realises that the complexity is ever increasing. It may be the use of a cryptocurrency to access a child abuse forum in the first instance, or it may be the use of cryptocurrency to access the live abuse of children in a pay-per-view type situation, or it may be the use of cryptocurrency simply to buy CAM that that particular person wishes to add to their collection. They are some of the ways that cryptocurrency can be used. In response to your second question: yes, the use of cryptocurrency absolutely adds a layer of complexity for law enforcement.

CHAIR: Can you explain that to me a little bit more? In a situation where money is exchanged—it wouldn't actually be changing hands; it would be an electronic transfer—you'd be able to request from a bank as a law enforcement agency to get access to who owns that account, but the practicality is there isn't an institution to go to for bitcoin; it's traded privately?

Ms Welsh : Yes, it's traded privately, it's unregulated and it's a very easy way to transfer money and payment, particularly if it's not used with bitcoin, which has a public blockchain. Some of these other cryptocurrencies do not have a public blockchain.

CHAIR: There's talk at the moment of public institutions, even up to the RBA, regulating cryptocurrency and becoming involved. Do you think that will aid law enforcement if people are then keeping it in regular financial institutions, or offenders simply won't keep it in a bank in any case?

Ms Welsh : I think the regulation of cryptocurrencies will be helpful in many different areas not just for law enforcement. As long as cryptocurrency can be exchanged from peer to peer it will make it extremely difficult.

CHAIR: Have other jurisdictions tried to tackle that peer-to-peer transfer in relation to this issue, or it's just something where the technology is ahead of us at the moment?

Ms Welsh : The answer to your first question is that all jurisdictions are trying to tackle this, and we tend to stand at each other's shoulders as often as we can so we're not duplicating effort. This is being worked on across the country and across the globe, quite frankly, about how we deal with these sorts of exchanges peer to peer.

CHAIR: Okay. Can I ask you about something else in the committee's terms of reference: the use of remote access Trojans. You were talking about people trawling others' Facebook accounts before. Are you seeing many instances of people installing spyware and using that to access other people's private photos and materials or turning on a webcam and producing CAM that way?

Ms Welsh : Not so much through the JACET. I think those sorts of activities by offenders are seen in the family violence space. But here in Victoria we are not seeing that as commonly, in the context of CAM.

CHAIR: That's good. I will ask you specifically about some of the points in your submission. The first is your point about needing AFP buy-in to access Commonwealth powers—obviously I'll ask this of the AFP as well—and reasons why they might not be willing to do that in all cases, whether it be resourcing priorities or—I think this was the other thing that your submission mentioned—because they carry some risk within the operation. Is there a way to fix that legislatively so that, with their approval but without resources, you can then access Commonwealth powers and just have any Commonwealth offences you uncover referred back to them, or is it less about legislation and more about the practicalities of working together as two organisations?

Ms Welsh : I think it's a bit of both, unsurprisingly. This particular type of crime does not stop at state borders, and it is extremely fast moving, particularly if we have reports that come in and we need to action them immediately. It becomes very difficult to instantly stand up these teams across both law enforcement agencies. So that's one challenge. The other is, I think, that it can be assisted just by way of very slight legislative reform that either minimises some of the friction in the access to the Commonwealth legislation or, in relation to the state based legislation, allows us, in certain circumstances, to operate outside Victorian borders. Many times, when we're working that way, we may not have the information that we need to fulfil the requirements of the state based legislation. So I think that legislative reform would be extremely helpful in both those areas.

CHAIR: I don't expect you to produce it now, but do you think you could take that on notice and point the committee in the right direction on that legislation and what kind of changes would be required in a practical sense?

Ms Welsh : Of course, yes.

CHAIR: Thank you. I'm interested in your experience with Facebook and other tech companies, particularly as opposed to the AFP, because the feedback we get from the AFP and the eSafety Commissioner is that they tend to find companies, particularly the big tech companies, relatively responsive, but in your submission you've given us examples of where it's taken a lot longer. I think you said it was anywhere between four months and two years. So do you think that level of cooperation from big tech just isn't floating down to individual jurisdictions?

Ms Welsh : I do think so, yes, and I think that we are well past the point where we can rely on individual relationships between investigators and people in these tech companies. I think there needs to be broader attention to this so that the companies are more responsive at a state and territory level as well.

CHAIR: When you talk to your counterparts in other states, are they experiencing similar response times?

Ms Welsh : Yes.

CHAIR: Is it possible for you to give the committee—again, please take this on notice—a couple of examples of longer wait times or inappropriate responses? Obviously, that just helps us when we confront this issue with the tech companies, who usually tell us that they're fixing everything very quickly.

Ms Welsh : Yes, I can.

CHAIR: That would be great. Do you work closely with the eSafety Commissioner to try and lean on these tech companies as part of your investigation?

Ms Welsh : At the investigative level, that's not where the pressure comes. The investigators at the level of a jacket, for example, are very busy doing the practical work. I think this leaning, with absolutely all due respect, needs to be happening above the level of the individual jacket unit. I can most certainly provide the information and identify pain points. But that influence and persuasion need to come from a much higher level than that.

CHAIR: Okay. It would also be helpful—again, reading through your submission—if you wouldn't mind providing more detail about some of those delays with Commonwealth agencies as well. You've mentioned it broadly, but, if you're able to give us some specific examples, that would be something that the committee could recommend—that they were far more responsive to you, regardless of whether the AFP has buy-in on the investigation or not.

Ms Welsh : Thank you.

CHAIR: The other trend that we are looking at, beyond tech companies, is whether there is enough legislative and regulatory focus on cloud providers—on cloud hosting as a way for offenders to store large amounts of CEM and then delete it just as quickly, as investigators are walking through the door. Is there a greater response that we need to recommend, whether it be encouraging cloud providers to do proactive searches or engage more with law enforcement? What's your experience there?

Ms Welsh : This is an increasing problem for law enforcement, and that's access to the cloud—that's a law that supports our timely access to data on the cloud and also the responsibilities of the service providers to step into that space as well.

CHAIR: So it is an ongoing challenge. How is dealing with the Googles and Apples of the world, versus Facebook and social media companies?

Ms Welsh : I'm not in a position to compare and contrast on that one, but I can certainly get back to you with that.

CHAIR: Okay. No, that's quite alright. It's another area that the committee's very interested in. Finally, I have one last line of questioning before I hand over to the deputy chair. We've heard from a number of witnesses today about the potential for harm minimisation programs. They've likened it to harm minimisation for drug offenders. The committee has some significant concerns around that, about destigmatising this significant offending and the like. Do you have a view on whether there is merit in programs that try and get people to do, anonymously, some form of harm minimisation program before their offending escalates?

Ms Welsh : I think there is merit in exploring the possibility that it may be helpful. I know that sounds somewhat obtuse. But I don't think that we should leave any stone unturned, and I think that there should be efforts to find out whether it is possible for us to explore harm minimisation that way.

CHAIR: Is your experience with offenders that their escalation can be prevented, or is escalation not inevitable but part and parcel of it?

Ms Welsh : I just don't think I'm in a position to answer that one.

CHAIR: That's quite alright. You're well within your rights to say so. I've got a few more questions, but I'll hand over to the deputy chair now. We can always circle back if time permits.

Dr ALY: Thank you, Chair. I won't take too much of the questioning time, considering the detective superintendent gave quite a comprehensive submission and opening statement—and, in the interests of time, to give others an opportunity. As we've had different witnesses today, what has stood out for me is the different aspects to this offending. You have grooming, viewing material, accessing material and producing material, and you also mentioned self-generated CAM by children who have been groomed or blackmailed. There are so many different aspects to offending. It's not just a simple matter of viewing or accessing material; there are a whole range of other ones. Do you consider that the current legislation under which you operate is broad enough to capture all of those aspects of offending?

Ms Welsh : No, it's not broad enough to capture all aspects. The second component of my response to this question, and it's difficult, is that, because of the complexity of the offending and the increasing complexity of the offending—we spoke very briefly earlier about deep fakes, which are different again, technology that's on the horizon and technology that we have not yet anticipated—I think it will be of growing concern. How do we craft legislation that deals with such a rapidly evolving and complex crime type? I think that calls upon us all to think about how we might do this in a different way, perhaps.

Dr ALY: Do you think that a suite of standalone legislation specifically about CAM would improve the situation? Currently, we have a suite of standalone legislation for terrorism offences, for example, that range from everything from accessing and producing material, to publishing material and right through to travelling overseas. Do you think that we lack a comprehensive or cohesive framework of standalone legislation to deal with CAM and offending?

Ms Welsh : We do lack that. We lack something that's consistent and coherent and that stretches across the country. Federation also makes things very, very tricky when law enforcement is trying to deal with offending that crosses borders, nationally and internationally. A particularly challenging problem for law enforcement is the lack of definitions. Getting consistent definitions is also difficult. What you're suggesting may go some way to traversing that tough ground.

Dr ALY: Is the lack of definitions domestic as well as international? We know that internationally, for example, in relation to the definition of a child, some jurisdictions don't consider viewing as an offence. Is the lack of definitions also a problem within Australia?

Ms Welsh : I can get back to you on this, but I don't think we have consistent definitions across Australia either. I'm less certain about the degree of divergence across jurisdictions, but I can get back to you about that.

Dr ALY: Thank you so much. Thank you, Chair. I think I'll allow other people to ask some questions now.

CHAIR: Thanks, Deputy Chair. I'll hand over to Pat Conaghan.

Mr CONAGHAN: Thanks, Chair, and thank you, Detective Superintendent. I'll just follow on from what the deputy chair was talking about, and that's the consistency of language in legislation. I can't find exactly where it was in your report, but you see that as a major issue between the states and territories—is that correct?

Ms Welsh : It's an issue in so far as we consider it important to move away from language that talks about 'child pornography', and a lot of that is to do with messaging to community and also ensuring that this is always understood to be sexual offending against children. It's not pornography.

Mr CONAGHAN: Alright. I understand that, and I think the community as a whole is moving towards that and using the term 'child exploitation' rather than 'pornography'. When I say 'consistency of language', with the exception of child exploitation, I'm talking about within legislation—let's say cross-border operations or cross-border offending. Have you come across any situations where the language, description or definition within legislation has been such that a prosecution may fail because of the differences in the language or definitions in the legislation?

Ms Welsh : I can't answer that immediately, but I can certainly get you some information to respond to that question.

Mr CONAGHAN: Thank you. There was another thing that jumped out at me—and this is coming from an ex-police officer, so it's coming from the right place. At the bottom of page 5, under the heading 'Ensuring offences are prosecutable and holding offenders to account', it says, 'It's also important … that offenders are held to account through appropriate sentencing'. Is that a very nice way of saying you are not of the view that, generally, offenders are being given appropriate sentences, in Victoria or across the nation?

Ms Welsh : No. In that submission there, it's an assertion that, when offenders are held to account via the court, appropriate sentences are being administered—not that they are not being administered.

Mr CONAGHAN: Over the past decade, with the proliferation of this type of material, have you seen a reduction in the sentences people are receiving?

Ms Welsh : Are you asking whether sentences are less than they have been in the past?

Mr CONAGHAN: Yes. That's a better way of putting it; thank you.

Ms Welsh : No, I haven't made that observation, but I think that would be a really simple one to identify, simply by way of some data.

Mr CONAGHAN: Thank you, Detective.

CHAIR: The other two members on the line, Senator McLachlan and Senator Antic, have indicated they don't have any further questions. Well done, Ms Welsh. Thank you for burning through them. I might take the opportunity, with the extra time that we have, to ask for a little bit more detail about where you've struggled with Commonwealth agencies to access information in a timely manner. Can you talk us through what your process would be there and where you think it's falling down?

Ms Welsh : The process at the moment is quite convoluted. We have to go through the Attorney-General to get evidence that will be deemed admissible evidence before the court. We can access it, law enforcement to law enforcement. But if we wish to use that evidence in court as admissible evidence it needs to follow a particular course—the mutual assistance request, for example. The process is convoluted and it's in a very small pipe—that's probably the easiest way to put it. It's competing with many other requests in relation to many other areas of law enforcement. So it is incredibly cumbersome and time consuming, and it's not unheard of for us to have a person before the court and have the matter finalised and then, shortly after, for us to receive information back via a mutual assistance request.

CHAIR: Do you think it's a resourcing issue within—who are you writing to? Did you say it was the Attorney-General's Department, or do you write directly to the Commonwealth agency responsible?

Ms Welsh : Now we're going through to the Commonwealth agency. I don't think it is about resourcing. I think the CLOUD Act will do a lot to circumvent the challenges that we've had in many regards, but I'm not so sure if it is a resourcing thing. Throwing more people at it might not be the answer. I think that might be finding a more streamlined process and dedicating resources to it, as opposed to throwing more in that direction.

CHAIR: Sorry to jump around between topics. It's just the way with these things. I want to take you back to the conversation that we were having before about the prevalence of what you call capping—in particular, where kids are encouraged to produce their own material, perhaps not realising what they're producing. The deputy chair, quite rightly, was raising it before with other witnesses. Are you seeing this—Discord and the like amongst those chat groups—happening more in gaming discussions, in terms of grooming?

Ms Welsh : No, we're not seeing it more on the gaming platforms. We're not seeing it specifically, but the investigators are most certainly seeing more instances of self-produced child abuse material in and amongst the investigations that they're dealing with across the board.

CHAIR: What I'm getting at is: if it's not gaming, how are they engaging with these kids? Is it just via Facebook Messenger? Are they friending them and then jumping onto their direct chats?

Ms Welsh : Quite often, yes.

CHAIR: We've heard from other witnesses today. We heard from a couple of witnesses from academia, and they spoke about their desire to do more research and to get more information. Do you have any thoughts on how we might improve the connection and flow of information on this topic between law enforcement, NGOs and academics?

Ms Welsh : I think it needs to be a priority for law enforcement agencies and the areas within which these sorts of crimes are being investigated. Victoria Police does very well in this regard. We are in the midst of a very large research project with universities at the moment. This is an area that is really critically important. I see that the committee understands that already. It needs to be embraced by the agency so that when academics approach us and ask us for access to data and so on and so forth, be that qualitative or quantitative, the agency's law enforcement is receptive to that, because it's an incredibly important tool in relation to us understanding how best to deploy our resources towards this offending.

CHAIR: Perhaps the way to go about it is for the Commonwealth and other law enforcement jurisdictions to lead the way in terms of opening up information for this kind of work. I agree it is critically important. Thank you very much. You've been very forthcoming. That answers my questions. Deputy Chair, before we allow the witness to depart, have you got one more?

Dr ALY: Yes, Chair. I want to ask very quickly about the SLAID bill and whether that's had any flow-on impact on VicPol being able to identify and prosecute offenders?

Ms Welsh : The SLAID legislation is relatively new and I anticipate that it will have a significant impact, not just in this area but on the investigation of crimes much more broadly—for example, serious and organised crime.

Dr ALY: But you haven't seen the flow-on yet?

Ms Welsh : Not yet.

Dr ALY: Thank you.

CHAIR: Thank you very much, Detective Superintendent. We really appreciate your time today in giving us the value of the experiences of Vicpol. Again, thank you so much for persevering with the technical difficulties—we apologise for that.

Ms Welsh : It's my great pleasure. Thank you all very much.

CHAIR: Thank you for your help.
.