Lantern to the Underworld - Following User Actions Using Bing URL Parameters When Child Exploitation Terms Are Suggested by the Search Engine

Abstract

During a 2016 criminal investigation overseen by the authors, a discovery was made that the Bing search engine was suggesting search terms known to be associated with child exploitation materials. This was in response to a non-contraband search by a subject, leading to increasingly explicit suggestions. This information led to the discovery that, with a user's browser history files, the specific actions taken by a user could be isolated and tracked using Bing's own unique URL parameters. While the suggestion of contraband terms by the Bing search engine has since ceased, there has been little to no research conducted on analyzing a user's browser activity in order to determine their specific actions behind the keyboard through the use of these unique URL parameters. The purpose of this paper is to document Bing's URL parameters related to image searches (specifically the FORM parameter) in order to detail how a user's actions during searching may be determined by an analyst. The authors also provide a new tool for creating a timeline of Bing image search events when an analyst possesses a user's browser history files.Disclaimer: Some portions of this article discuss words or language that are considered profane, vulgar, or offensive. This article is neither a legal interpretation nor a statement of [agency redacted during review] policy. Reference to any specific product or entity does not constitute an endorsement or recommendation by the [agency redacted during review]. Views and opinions expressed by the authors are those of the authors and do not necessarily reflect the view of the [agency redacted during review] or any of its officials.